Overview

Have you ever wondered whether your business-critical SAP implementation was secure? Do you know how to check it? Have you imagined which could be the impact of an attack to your core business platform? Do you know how to prevent it? This training is the answer to these questions.

For many years, SAP security has been a synonym of “segregation of duties” or “securing roles and profiles”. While this kind of security is mandatory and of absolute importance, there are many threats that have been so far overlooked and are even more dangerous, such as the possibility of taking remote control of the entire SAP landscape without having any user in any system.

This training will help you to fill this knowledge gap, allowing you to understand the involved threats and risks and how to mitigate them. You will review the whole picture, from the security of the Environment and the SAP application-level gateways (SAProuter, Webdispatcher), through the assessment and hardening of the Operating Systems and Databases and their interaction with the SAP systems up to the security of the SAP Application Layer: Authentication, User security, Password Policies, Authorization subsystem, Interface Security, Component Security, Auditing, Monitoring and more!

The training is organized with many hands-on exercises, which will help you grasp practical knowledge quickly. You will learn how to assess the security of an SAP implementation and then secure the critical security gaps you discovered. You will be able to learn how to use different SAP security tools, as well as the publicly- available SAP Penetration Testing Framework developed by the instructor.

The training also provides a quick introduction to basic SAP concepts, which allows non-SAP security professionals to follow the course smoothly.

Who Should Attend

- Information Security Managers, Consultants and Auditors.
- SAP Administrators, Project Leaders and Consultants.

Key Learning Objectives

- Understand the basic security concepts in SAP systems
- Learn which are the main risks that can affect the security of the platform.
- Learn how to perform technical security assessment of SAP systems.
- Understand how to protect the systems from detected vulnerabilities, decreasing fraud risk.
- Use specific software to evaluate the security of an SAP system.
- Grasp practical knowledge through hands-on exercises.

Class Equipment Requirements:

* Any modern laptop with a CD/DVD drive and network port
* Windows XP/Vista/7 (native or VMWare image)
* SSH client
* SAPGUI

Pre-requisite knowledge

The training provides a quick introduction to basic SAP concepts, which allows non-SAP security professionals to follow the course smoothly. General knowledge of networking and security concepts is recommended.

Agenda
Day 1:

* Introduction to SAP
* Threats
* Security of the Environment
o Secure Architecture
o SAP Application Level Gateways
* The SAProuter
* The SAP Web Dispatcher
* Security of the OS & DB
o Security of SAP on Windows environments
o Security of SAP on UNIX environments
o Security of SAP with MS SQL Server databases
o Security of SAP with Oracle databases

Day 2:

* Security of the SAP Application Layer
o Authentication Mechanisms
o User Security
o Password Policies
o Authorization Concept
o Interface Security
o Securing the System Landscape
o Component and Application Security
* SAP Internet Transaction Server (ITS)
* SAP Internet Communication Manager (ICM)
* SAP Secure Network Communications (SNC)
* Secure Sockets Layer (SSL)
* Monitoring and Auditing
* Conclusions

About Mariano

Mariano Nuñez Di Croce is the Director of Research and Development at ONAPSIS. Mariano has a long experience as a Senior Security Consultant, mainly involved in security assessments and vulnerability research. He has discovered critical vulnerabilities in SAP, Microsoft, Oracle and IBM applications.

Mariano leads the SAP Security Team at Onapsis, where he works hardening and assessing the security of critical SAP implementations in world-wide organizations. He is the author and developer of the first open-source SAP Penetration Testing Framework and has discovered more than 40 vulnerabilities in SAP applications. Mariano is also the lead author of the “SAP Security In-Depth” publication.

Mariano has been invited to hold presentations and trainings in many international security conferences such as Blackhat USA/EU, DeepSec, Sec-T, Hack.lu, Seacure.it, Ekoparty, CIBSI as well as to host private trainings for Fortune-100 companies and defense contractors. Mariano has a degree in Computer Science Engineering from the UTN.