--- title: "SAP security: who is responsible?" description: Managing SAP security is complex. It is a struggle to get one’s arms around its entirety. Very few, with hand on heart, can confidently say they have it sorted. image: https://www.legupsoftware.com/hubfs/image%20(3).jpg --- [![logo](https://www.legupsoftware.com/hs-fs/hubfs/Website,%20Dec%202022/Assets/logo.png?width=300&height=61&name=logo.png "logo")](https://www.legupsoftware.com) - [Home](https://www.legupsoftware.com) - [Solutions](https://www.legupsoftware.com/solutions) - [For SAP Adminstrators](https://www.legupsoftware.com/expert_insights/solutions#administrators2) - [For SAP Basis Teams](https://www.legupsoftware.com/expert_insights/solutions#basis-teams2) - [For SAP Developers](https://www.legupsoftware.com/expert_insights/solutions#developers2) - [For SAP Support Teams](https://www.legupsoftware.com/expert_insights/solutions#support-teams2) - [For SAP Security Teams](https://www.legupsoftware.com/expert_insights/solutions#security-teams2) - Products - [SAP Incident Ticketing](https://www.legupsoftware.com/product-itsm-connector) - [SAP System Copy](https://www.legupsoftware.com/product-libelle-systemcopy) - [Data Anonymisation](https://www.legupsoftware.com/product-libelle-datamasking) - [iDoc Management and Monitoring](https://www.legupsoftware.com/product-libelle-edimon) - [SAP Security Vulnerability Analysis and Monitoring](https://www.legupsoftware.com/product-smartersec) - [SAP License Management and Optimisation](https://www.legupsoftware.com/product-samq) - [SAP User Role and Authorisation Management](https://www.legupsoftware.com/product-soterion) - [About](https://www.legupsoftware.com/about) - [Events](https://www.legupsoftware.com/events) - [Expert Insights](https://www.legupsoftware.com/expert_insights) - [Resource Library](https://www.legupsoftware.com/resources) - [Partners](https://www.legupsoftware.com/partners) - [Contact](https://www.legupsoftware.com/contact) [Get in touch](https://www.legupsoftware.com/contact) [![logo](https://www.legupsoftware.com/hs-fs/hubfs/Website,%20Dec%202022/Assets/logo.png?width=300&height=61&name=logo.png "logo")](https://www.legupsoftware.com) [Get in touch](https://www.legupsoftware.com/contact) [![logo](https://www.legupsoftware.com/hs-fs/hubfs/Website,%20Dec%202022/Assets/logo.png?width=300&height=61&name=logo.png "logo")](https://www.legupsoftware.com) - [Home](https://www.legupsoftware.com) - [Solutions](https://www.legupsoftware.com/solutions) - [For SAP Adminstrators](https://www.legupsoftware.com/expert_insights/solutions#administrators2) - [For SAP Basis Teams](https://www.legupsoftware.com/expert_insights/solutions#basis-teams2) - [For SAP Developers](https://www.legupsoftware.com/expert_insights/solutions#developers2) - [For SAP Support Teams](https://www.legupsoftware.com/expert_insights/solutions#support-teams2) - [For SAP Security Teams](https://www.legupsoftware.com/expert_insights/solutions#security-teams2) - Products - [SAP Incident Ticketing](https://www.legupsoftware.com/product-itsm-connector) - [SAP System Copy](https://www.legupsoftware.com/product-libelle-systemcopy) - [Data Anonymisation](https://www.legupsoftware.com/product-libelle-datamasking) - [iDoc Management and Monitoring](https://www.legupsoftware.com/product-libelle-edimon) - [SAP Security Vulnerability Analysis and Monitoring](https://www.legupsoftware.com/product-smartersec) - [SAP License Management and Optimisation](https://www.legupsoftware.com/product-samq) - [SAP User Role and Authorisation Management](https://www.legupsoftware.com/product-soterion) - [About](https://www.legupsoftware.com/about) - [Events](https://www.legupsoftware.com/events) - [Expert Insights](https://www.legupsoftware.com/expert_insights) - [Resource Library](https://www.legupsoftware.com/resources) - [Partners](https://www.legupsoftware.com/partners) - [Contact](https://www.legupsoftware.com/contact) [Get in touch](https://www.legupsoftware.com/contact) [![logo](https://www.legupsoftware.com/hs-fs/hubfs/Website,%20Dec%202022/Assets/logo.png?width=300&height=61&name=logo.png "logo")](https://www.legupsoftware.com) [Get in touch](https://www.legupsoftware.com/contact) - [Home](https://www.legupsoftware.com) - [Solutions](https://www.legupsoftware.com/solutions) - [For SAP Adminstrators](https://www.legupsoftware.com/expert_insights/solutions#administrators2) - [For SAP Basis Teams](https://www.legupsoftware.com/expert_insights/solutions#basis-teams2) - [For SAP Developers](https://www.legupsoftware.com/expert_insights/solutions#developers2) - [For SAP Support Teams](https://www.legupsoftware.com/expert_insights/solutions#support-teams2) - [For SAP Security Teams](https://www.legupsoftware.com/expert_insights/solutions#security-teams2) - Products - [SAP Incident Ticketing](https://www.legupsoftware.com/product-itsm-connector) - [SAP System Copy](https://www.legupsoftware.com/product-libelle-systemcopy) - [Data Anonymisation](https://www.legupsoftware.com/product-libelle-datamasking) - [iDoc Management and Monitoring](https://www.legupsoftware.com/product-libelle-edimon) - [SAP Security Vulnerability Analysis and Monitoring](https://www.legupsoftware.com/product-smartersec) - [SAP License Management and Optimisation](https://www.legupsoftware.com/product-samq) - [SAP User Role and Authorisation Management](https://www.legupsoftware.com/product-soterion) - [About](https://www.legupsoftware.com/about) - [Events](https://www.legupsoftware.com/events) - [Expert Insights](https://www.legupsoftware.com/expert_insights) - [Resource Library](https://www.legupsoftware.com/resources) - [Partners](https://www.legupsoftware.com/partners) - [Contact](https://www.legupsoftware.com/contact) [Get in touch](https://www.legupsoftware.com/contact) [SAP](https://www.legupsoftware.com/expert_insights/tag/sap) [Security](https://www.legupsoftware.com/expert_insights/tag/security) [smartersec](https://www.legupsoftware.com/expert_insights/tag/smartersec) # SAP security: who is responsible? By [Rick Porter](https://www.legupsoftware.com/expert_insights/author/rick-porter) October 18, 2024 3 Minute Read **Managing SAP security is complex. It is a struggle to get one’s arms around its entirety. Very few, with hand on heart, can confidently say they have it sorted. Like other large ERP infrastructures, SAP systems have a wide range of inherent vulnerabilities. Some are well-known, others lesser known, and there is a steady stream of newly identified ones.** These vulnerabilities are spread across configuration, SAP basis, integrations and interfaces, and custom code, to name several areas.. Although team members may be well-informed about the potential vulnerabilities within each area, many are not. New vulnerabilities can be introduced at any time, and past remediated vulnerabilities can be overwritten or re-introduced. Any of these can expose the SAP systems to exploitation by internal or external attack. SAP security is a moving target. ## SAP security vulnerabilities Managing SAP vulnerabilities is time-consuming and resource-intensive, subject to human error, oversight, and omission. It is not an exact science, and today’s resource-strapped SAP teams are hard-pressed to keep up with it. As a result, most SAP systems are exposed to one degree or another. **Configuration** Inadequate system configurations may expose SAP systems. Misconfigurations may lead to unauthorized access, data leaks, or system downtime. SAP Basis teams often rely on manual configuration checks, which are time-consuming and prone to human error. Misconfigurations may go unnoticed for an extraordinarily long time until a security incident occurs. **Roles & Authorizations** Determining who has access to what within the SAP systems is a critical security issue. . Traditional methods involve manual audits and periodic reviews, which are resource-intensive and often result in oversights. Manually identifying and resolving authorization issues promptly is impossible in today’s complex SAP systems. **Interfaces and integrations** Interfaces and integrations bridge the internal and external systems of the SAP environments, creating potential exploitation opportunities if not properly secured. Interface teams rely on manual investigations or integration teams to identify and remediate interface vulnerabilities. However, these approaches are time-consuming and subject to error and can lead to delayed response times. **Patch-Management** Regular patch management in SAP system landscapes is crucial to mitigate recently identified vulnerabilities and those caused by outdated software versions. Unfortunately, many organizations struggle to implement patches regularly and face challenges in tracking, testing, and applying patches as soon as they are released. This often results in delayed responses to critical vulnerabilities that are publicly available and, therefore, easy to exploit. **Custom-code** With around 2 million lines of custom code per SAP system, developing custom code introduces unique vulnerabilities. A developer has to develop secure and compliant custom code and secure code is mostly their responsibility. However, manual code reviews are time-consuming and may miss subtle vulnerabilities. Traditional methods often struggle to keep pace with the rapid development and deployment of custom code. ## Who is responsible? So, who is responsible for overall SAP security? It can’t be SAP basis; their responsibility is limited to SAP basis activities. Neither can it be the integrations team; their scope doesn’t include SAP basis or development. It can’t be the development team, either, for similar reasons. What about the Cyber Security team? Often, SAP security falls under their remit, but how can they be responsible for areas they do not understand? Unfortunately, this presents IT management with an unsolvable issue. Disparate sources of risk, distributed responsibility, and no one point of contact. Individual team workloads, resource limitations, knowledge gaps, and constant changes mean IT management must, at best, keep its fingers crossed. ## Automated SAP vulnerability analysis and monitoring Fortunately, there is a solution: The [smarterSec](https://www.linkedin.com/company/smartersec-gmbh/) SAP security platform. Automated SAP vulnerability analysis software, such as [smarterSec](https://www.linkedin.com/company/smartersec-gmbh/), has the knowledge and scope of access to identify and consolidate SAP vulnerabilities from every corner of the infrastructure. Highlighting known, unknown, and newly identified vulnerabilities from configuration to connections and ABAP custom code, SAP IT management can be as sure as possible about the security state of their SAP infrastructure. Based on internal requirements and risk profiles, plans can be made to mitigate identified vulnerabilities to an acceptable level over time. Ongoing monitoring then ensures the systems stay secure, highlighting newly introduced vulnerabilities or overwritten previous remediation efforts for immediate action. SAP IT management can uncross their fingers. They know the state of their SAP system security, and plans can be made to secure critical vulnerabilities. ## About us. [Leg Up Software](https://www.linkedin.com/company/leg-up-software/) is an expert in SAP IT operational and infrastructure software automation solutions, including those that support SAP security. We know the SAP operations and infrastructure automation solutions landscape and have already done the legwork identifying the best available solutions. We have excellent relationships with many software vendors, including those providing automated SAP vulnerability analysis mentioned here, and can negotiate an evaluation process that best suits your circumstances and budget. Why not set up a time to start the conversation by putting something in our calendar? [Chat with Rick](https://meetings.hubspot.com/rick255/calendar) [![Rick Porter](https://www.legupsoftware.com/hubfs/Rick_ANZSAP.jpg)](https://www.legupsoftware.com/expert_insights/author/rick-porter) #### Rick Porter With over two decades of working within the SAP ecosystem, Rick has met and worked with SAP IT professionals from broad backgrounds and experiences. Rick knows the stresses and strains experienced by those managing SAP systems and enjoys bringing these insights and reflections into conversations. Author ## Recommended For You [![](https://www.legupsoftware.com/hubfs/MicrosoftTeams-image%20(5).png)](https://www.legupsoftware.com/expert_insights/sap-s/4-hana-brownfield-transformation-three-critical-custom-code-adaption-considerations) [SAP](https://www.legupsoftware.com/expert_insights/tag/sap) [Automation](https://www.legupsoftware.com/expert_insights/tag/automation) [S/4 HANA](https://www.legupsoftware.com/expert_insights/tag/s-4-hana) 2 Min Read ### [SAP S/4 HANA Brownfield Transformation: Three Critical Custom Code Adaption Considerations](https://www.legupsoftware.com/expert_insights/sap-s/4-hana-brownfield-transformation-three-critical-custom-code-adaption-considerations) Transforming from ECC to S/4 HANA Every organization’s SAP landscape is different, with a combination of ... [![Rick Porter](https://www.legupsoftware.com/hubfs/Rick_ANZSAP.jpg) Rick Porter November 24, 2023](https://www.legupsoftware.com/expert_insights/author/rick-porter) [![](https://www.legupsoftware.com/hubfs/image.jpg)](https://www.legupsoftware.com/expert_insights/sap-rise-private-cloud-edition-is-it-driveaway-no-more-to-pay) [Software](https://www.legupsoftware.com/expert_insights/tag/software) [SAP](https://www.legupsoftware.com/expert_insights/tag/sap) [Automation](https://www.legupsoftware.com/expert_insights/tag/automation) 3 Min Read ### [SAP RISE Private Cloud Edition– Is it driveaway, no more to pay?](https://www.legupsoftware.com/expert_insights/sap-rise-private-cloud-edition-is-it-driveaway-no-more-to-pay) With SAP customers moving off ECC onto S/4 HANA Cloud over the next few years decisions will be made about ... [![Rick Porter](https://www.legupsoftware.com/hubfs/Rick_ANZSAP.jpg) Rick Porter August 15, 2024](https://www.legupsoftware.com/expert_insights/author/rick-porter) [![](https://www.legupsoftware.com/hubfs/SAP%20IT%20Automation_CICD%2c%20DevOps%2c%20Agile%2c%20and%20Increasing%20System%20Refresh%20Frequency_2022_12_12-1.jpg)](https://www.legupsoftware.com/expert_insights/ci-cd-devops-agile-and-increasing-sap-system-refresh-frequency) [DevOps](https://www.legupsoftware.com/expert_insights/tag/devops) [Agile](https://www.legupsoftware.com/expert_insights/tag/agile) [SAP Basis](https://www.legupsoftware.com/expert_insights/tag/sap-basis) [Ci/CD](https://www.legupsoftware.com/expert_insights/tag/ci-cd) 2 Min Read ### [CI/CD, DevOps, Agile, and Increased SAP System Refresh](https://www.legupsoftware.com/expert_insights/ci-cd-devops-agile-and-increasing-sap-system-refresh-frequency) Until recently, annual SAP QAS data refresh cycles were the norm, but now the demand is for quarterly or even ... [![Rick Porter](https://www.legupsoftware.com/hubfs/Rick_ANZSAP.jpg) Rick Porter December 12, 2022](https://www.legupsoftware.com/expert_insights/author/rick-porter) ![logo-footer](https://www.legupsoftware.com/hubfs/Website,%20Dec%202022/Assets/logo-footer.png) Melbourne VIC 3001 AUSTRALIA Phone: +61 3 9000 0958 Email: [info@legupsoftware.com](mailto:info@legupsoftware.com)   [John 3:16](https://www.kingjamesbibleonline.org/John-3-16/) - [Solutions](https://www.legupsoftware.com/solutions) - [For SAP Administrators](https://www.legupsoftware.com/expert_insights/solutions#administrators2) - [For SAP Basis Teams](https://www.legupsoftware.com/expert_insights/solutions#basis-teams2) - [For SAP Developers](https://www.legupsoftware.com/expert_insights/solutions#developers2) - [For SAP Support Teams](https://www.legupsoftware.com/expert_insights/solutions#support-teams2) - [For SAP Security Teams](https://www.legupsoftware.com/expert_insights/solutions#security-teams2) - Products - [Libelle SystemCopy](https://www.legupsoftware.com/product-libelle-systemcopy) - [Libelle DataMasking](https://www.legupsoftware.com/product-libelle-datamasking) - [Libelle EDIMON](https://www.legupsoftware.com/product-libelle-edimon) - [STA ITSM](https://www.legupsoftware.com/product-itsm-connector) - [VOQUZ samQ](https://www.legupsoftware.com/product-samq) - [Arch Floe](https://www.legupsoftware.com/product-floe) - [Arch Stelo](https://www.legupsoftware.com/product-stelo) - [Leg Up Software](https://www.legupsoftware.com/about) - [About](https://www.legupsoftware.com/about) - [Events](https://www.legupsoftware.com/events) - [Expert Insights](https://www.legupsoftware.com/expert_insights) - [Resource Library](https://www.legupsoftware.com/resources) - [Partners](https://www.legupsoftware.com/partners) - [Contact](https://www.legupsoftware.com/contact) Copyright © 2023 LegUpSoftware  ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Rick Porter", "url" : "https://www.legupsoftware.com/expert_insights/author/rick-porter" }, "dateModified" : "2024-10-18T04:53:37.142Z", "datePublished" : "2024-10-18T04:42:14.000Z", "headline" : "SAP security: who is responsible?", "image" : [ "https://www.legupsoftware.com/hubfs/image%20(3).jpg" ], "mainEntityOfPage" : { "@id" : "https://www.legupsoftware.com/expert_insights/sap-security-who-is-responsible", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.legupsoftware.com/hubfs/Website,%20Dec%202022/Assets/logo.png" }, "name" : "Leg Up Software" } } ```