Top 10 SAP audit and security risks

SAP is a secure platform—but countless options for • Interfaces: Particularly transactional-related data
customization, access levels and permissions, alongside • Operating system: Pay close attention to typical
increasing cybersecurity threats—mean vulnerabilities can concerns related to patches, antivirus, malware, trusting,
appear if the organization fails to implement a thorough port vulnerabilities, etc.
process for managing them. Thus, companies must be aware of
potential risks to ensure the system is secure and functioning
• Network: Closely evaluate port management processes
efficiently. The focus of most businesses using SAP has 2. Insecure configuration
securing the system in accordance with regulations such as
the Sarbanes-Oxley Act of 2002 (SOX) and other regulatory Many of the default security settings are not configured
compliance requirements, like the Health Information Portability properly during the installation of SAP systems, leaving
and Accountability Act (HIPAA). However, new external them insecure and highly vulnerable to both internal and
threats to SAP have begun to emerge: Over the last few years, external attack. Organizations should therefore keep in mind
criminals have sought to exploit ERP systems in order to access that configuration is separate from patch management and
confidential information, from trade secrets to employee thus must ensure that the SAP systems are implemented
information. The following list discusses 10 common risks that with correct security settings and configuration of the SAP
can create vulnerabilities in a SAP system and compromise NetWeaver stack at the beginning, which will help avoid costly
important data. production server downtime later.

1. Infrastructure security vulnerabilities Few examples of areas where insecure configuration can
compromise the security of the SAP applications include
Infrastructure issues have typically been overlooked in the parameters related to configuration used by RFC connections
past, as they were not a key concern. However, as cybercrimes and gateway and message servers.
broaden in scope and severity, infrastructure vulnerabilities
must take greater precedence. Many issues that most people 3. Lack of patch management
are unaware of or disregard can have a huge impact, as the
greatest application-level security in the world can be largely Patch management is critical to supporting the stability and
undermined by vulnerabilities lower in the stack. security of your SAP systems through fixing functionality or
patching vulnerabilities identified in previous releases. As many
For example, a layer of SAP configures how different hosts organizations migrate their SAP environments to the cloud,
within the SAP infrastructure talk to each other; a normal patch management has become a more complex process
configuration will have production, quality assurance and wherein companies are struggling to identify, assess and
test servers. The SAP system trusts those servers, so implement patches on a timely basis.
misconfiguration or lax access controls around system
administrator commands could introduce vulnerabilities. Some of the challenges that organizations running SAP face
Remote function calls (RFCs) enable middle-layer while keeping their SAP systems up to date include:
communication within SAP; if someone can exploit those RFCs,
they can gain control of an entire system. • System administrators who are unaware of existing
vulnerabilities and relevant patches required to keep the
Other areas of particular concern include: system stable and secure

• Database security: Particularly system administrator • The absence of a patch management strategy required
to assess patches based on criticality and applicability
accounts such as “sa” and “sysadmin,” as well as
settings for trusted authentication and default • Testing patches prior to deployment to mitigate
application accounts unexpected system behavior and downtime
4. Unencrypted interface communications 7. System ID security
Communication protocols used by SAP application servers are System and communication IDs often have elevated access
not encrypted between client/server networks. In addition to the system, are not applicable to password configuration
to encryption, missing mutual authentication mechanisms settings and may have powerful profiles assigned, such as SAP_
could lead to network traffic being intercepted by a “man in the ALL. Thus, there is a greater risk that a hacker could obtain
middle” attack. credentials and utilize the ID to exploit the system.

Organizations must therefore consider using security measures System and communication accounts are typically not evaluated
such as Secure Network Communications (SNC) in order to during a standard SOX information technology general controls
encrypt communication between SAP GUI and SAP application audit, so in addition to a normal audit, a company must take a
servers, as well as RFC communications between SAP servers. deeper dive into systems and communication accounts and
Strong authentication mechanisms, including Single Sign-On, interfaces to ensure everything is appropriately protected so
also protect communication channels between systems of that the system is not vulnerable to additional risks.
higher security classification (e.g., production systems) and
lower classification systems (e.g., test/development systems). 8. Custom code security

5. Access control and segregation of duties Custom objects that frequently drive key business
functionalities, such as forms and interfaces, can have
Poorly executed SAP application security role design results in security backdoors that create major vulnerabilities. During
unauthorized access, increased potential for fraud in the form implementation, companies must include strong security and
of Segregation of Duties (SoD), inefficient access provisioning change management controls around these objects. Test them
for end users and increased audit findings/issues. Configuring appropriately during development and follow SAP-specific
access controls and roles in SAP applications prevents methodology to document what they do as well as specific
employees from having access to more data than needed for security measures that are being implemented.
their job duties and protects against insider threats and the
possibility of SoD-related fraud. When customizing SAP, many companies are concerned
about getting the system up and running, but forget about
Maintenance of the SAP application security role design and security—organizations must have program authorization
its governance, including adequate oversight of the change checks and implement a specific security plan that accounts for
management process, ensures that the role design remains customizations.
free of SoDs over a period of time, and thus less vulnerable to
internal breaches. A final precautionary control is to maintain a comprehensive,
updated RICEFW inventory, documenting all custom objects,
Companies should implement an organization-level segregation of forms, reports and interfaces. Security audits also make people
duties (SoD) matrix for an enterprise-wide assessment of sensitive aware of custom transactions and functionality by providing an
functions and incompatible duties. An SoD check during user account of what they do. In addition, vulnerability assessments
provisioning is also a best practice as a preventive control. However, can communicate the risks around any customizations.
SAP is such a complex system that a manual SoD check is difficult,
inefficient and not 100% accurate. An automated tool is therefore 9. Broad administrative user privileges/Excessive
necessary to perform the assessment; SAP has a GRC module emergency access
that handles the task effectively; other similar tools are available.
If a company chooses not to utilize a tool internally, we highly Many organizations provide elevated access to administrators
recommend that they have their auditors run their automated tool and/or the IT support team during the time of implementation
to assess hidden SoD risks. or during temporary maintenance/troubleshooting of the
production systems. Attackers have the possibility of exploiting
6. Monitoring security events and configuration weaknesses in privileged access security through the use of
ransomware attacks or data theft. Loss of privileged access has
Monitoring of privileged user accounts, application a high business impact, thus requiring additional measures to
configuration, data and databases, and use of logging to ensure its security.
evaluate the security events of the organization all help
address the risk of vulnerabilities within the SAP system. This It is recommended that organizations implement multi-factor
also enables the organization to address risks associated authentication mechanisms to limit the chances of these
with broken access controls while a review of the roles and privileged accounts being compromised by internal threats or
privileges across the SAP system is performed. external hackers. Monitoring, logging and review of user activity
is another way to ensure privileged access is used responsibly
Organizations must establish a security plan and security and that any anomalous activity is identified as an indicator of
configuration baseline, prioritize risk management and potential cybercrimes.
develop processes to address known vulnerabilities (through
patching or configuration changes) and mitigate threats to the
SAP environment.
2
10. User admin controls The status of users and the system of record are also major
concerns when managing system access. In some cases,
A major risk with many SAP systems is ineffective provisioning managers do not communicate rehired contractors, temporary
or changes of accounts/de-provisioning user access controls. employees or leaves of absence, while some contractors
As aforementioned, in many cases, approvers may not be are not in the HR system altogether. Pay close attention to
knowledgeable about what access they are granting—and contractors who may be set to expire, as well as potential users
access is not necessarily role-based, which could result in with more than one ID and multiple levels of access. Other
excessive access. potential control issues include transfers retaining access,
users being cloned and given excessive access, users named
In addition, some of the technology that has been introduced incorrectly and access not being role-based. Problems can
to automate provisioning and de-provisioning may complicate also arise with super-users when access is not approved or
matters and result in security holes that go undetected. informally given out or when super-users leave.
Depending on the environment, an identity and access
management solution or batch process tied to Active Directory Operating an ERP system comes with some inherent risks, and
may help remove and add access. Organizations that rely on SAP is no different. You must pay close attention in order to
automated Active Directory or HR-based removal introduce understand several common threats as well as be mindful not
the potential for the process to miss users based on poor to create additional vulnerabilities. Evaluating and successfully
communication between the different technologies and reuse managing these 10 audit and security risks can go a long way in
of accounts. Similarly, any technology changes made under lax ensuring that your SAP platform and critical data remain secure
administrator practice can render controls ineffective. Many and continue to function at peak efficiency.
organizations are automating processes to control access,
which is good.

However, it is critical for companies to be cognizant of the

data sources they use and how changes to access are made.
Multiple vulnerabilities can arise from how the company
configures the SAP system, administers access, makes changes
to infrastructure or performs identity management, alongside
how the platform is communicating. Just because processes
are automated does not make them foolproof.

+1 800 274 3978

rsmus.com

This document contains general information, may be based on authorities that are subject to change,
and is not a substitute for professional advice or services. This document does not constitute audit, tax,
consulting, business, financial, investment, legal or other professional advice, and you should consult a
qualified professional advisor before taking any action based on the information herein. RSM US LLP, its
affiliates and related entities are not responsible for any loss resulting from or relating to reliance on this
document by any person. Internal Revenue Service rules require us to inform you that this communication
may be deemed a solicitation to provide tax services. This communication is being sent to individuals who
have subscribed to receive it or who we believe would have an interest in the topics discussed.

RSM US LLP is a limited liability partnership and the U.S. member firm of RSM International, a global network
of independent audit, tax and consulting firms. The member firms of RSM International collaborate to
provide services to global clients, but are separate and distinct legal entities that cannot obligate each
other. Each member firm is responsible only for its own acts and omissions, and not those of any other
party. Visit rsmus.com/aboutus for more information regarding RSM US LLP and RSM International.

RSM, the RSM logo and the power of being understood are registered trademarks of RSM International
Association.

© 2021 RSM US LLP. All Rights Reserved. WP-NT-RAS-ALL-0221