10 tips to safeguard your critical business data in SAP systems
                     10 tips to 
safeguard your 
critical business 
data in SAP 
systems
Security and risk are becoming increasingly challenging as 
businesses become more connected. It requires data 
sharing between different systems, applications, and 
enterprises.
According to Forrester, companies will double their budgets 
for data strategy over the next five years and according to 
Gartner, transparency and traceability are among the Top 
Secure Ten Strategic Technology Trends for 2022. Smart spaces, 
they claim, will offer better business opportunities.
It was found in another recent report by Onapsis that 
your between 50,000 and 100,000 organizations use SAP systems that are vulnerable. An example that made the 
world aware of the importance of data security is the case 
Critical with the New Zealand government. An immense data breach in which firearms, addresses, and names of gun 
owners were exposed led SAP itself to apologize to the 
government. There was no hacking involved in the breach, 
Business but 66 dealers got access to sensitive information because of a change in user access given to dealers participating in 
the buyback scheme.
Data “Between 50,000 to 100,000 organizations use SAP systems that are vulnerable.”
Apparently, SAP is working on various solutions to increase 
the security of data. In addition, it reminds clients that 
security is a collaborative effort, and emphasizes the 
importance of proper system configuration.

Data breaches and ransomware attacks are on the 
rise, and the global pandemic presents new 
opportunities for cybercriminals. Many employees 
today access corporate resources through 
The virtual private networks (VPNs). The shift to remote work has resulted in a more permissive VPN policy, 
which compromises corporate networks in an 
importanc indirect way.There is a need for IT security teams to accomplish 
more with less budget or with the same budget. It is 
e of part of their job responsibility to manage day-to-day IT and security operations, find and retain skilled 
security talent, identify and address security 
security in capability gaps, and maximize the return on investment (ROI).
Almost seven out of ten organizations do not place a 
SAP high priority on securing their SAP systems. Considering the recent spike in cyber-attacks, it is 
essential to secure SAP systems. We have put 
together a list of 10 tips you can use immediately to 
secure your critical business data in SAP system.
When a security breach occurs, who is responsible? 
A recent survey by Onapsis found that half of the 
respondents believe SAP is to blame for security 
breaches – not anyone within their own 
1. Own it – organization. Another 30% believe that no one is responsible. A small percentage of people believe 
that the CIO or CISO is responsible for a security 
Don’t blame breach.50% blame SAP for security breaches
30% have no idea
20% say it is CIO/CISO’s responsibility
63% of C-Level executives underestimate the risks 
associated with insecure SAP applications
The dangers associated with insecure SAP 
applications are underestimated by 63% of C-level 
executives.
One of the most significant steps to staying secure 
is to keep your system up to date. Enhancement 
packages are delivered by SAP to deliver new 
innovations/functionality or “enhancements” to 
customers without disruption. Ensure you have the 
latest enhancement packs installed, and that you 
2. aren’t several versions behind. It is always risky to be a first adopter, but it is also imperative to avoid 
falling behind (n-1 is always recommended). 
Regularly Technology and computer security are constantly improving, so it is important to keep your system up 
to date with patches, fixes, updates, and 
enhancement packs.
update As part of its Support Package Stacks, SAP releases 
periodic security solutions. The Support Package 
Stacks are patches for a given product that should 
the EHP be applied together. It is recommended that these 
stacks be applied at least once a year, and SAP 
specifies the maintenance schedule on its website. 
& SPS In addition, ToggleNow can help you identify your system’s most critical SPSs.
As business processes rapidly evolve, employee roles and 
responsibilities are also changing. By establishing boundaries 
between roles assigned to an employee and conflicts of 
interest that may arise from the employee’s responsibilities, 
segregation of duties aims to reduce internal fraud risks. For 
example, one employee processes a PO while another verifies 
and approves it. This adds more control and prevents 
3. The payments to ‘fake’ vendors.It is becoming more common for mature organisations to look 
for ways to improve Segregation of Duties management while 
reducing costs. It is imperative for businesses to integrate an 
Right advanced, quick, and easy-to-install Access Management tool that fits with their systems. This will avoid conflicts after an 
employee’s role or tasks change.
SODs This can be achieved either by implementing the SAP GRC Access Control solution or ToggleNow’s SoD Analysis solution 
for SAP. The SAP Security Assessment services provided by 
ToggleNow will identify the right solutions for your organization. 
make a Additionally, if you have SAP GRC implemented, explore the 
various SAP GRC services that are offered by us.
With the help of our SMEs, you will be able to implement the 
differenc right separation of duties strategies and ensure that you comply with the various regulations and mandates.
e
SAP systems typically have over 30 percent proprietary code, 
depending on the industry. Statistics indicate that one critical 
security defect occurs for every 1,000 lines of ABAP code.
It is possible that SAP system performance will be adversely 
affected. It is estimated that the average SAP system 
contains 2,151 risks, and 70% of enterprises fail to audit 
their ABAP custom code for compliance and security.
It is possible to simplify the security process for your code. It 
4. Ensure is no longer necessary for organizations to invest time, money, and manpower in major security projects. An analysis 
of your code beforehand will enable you to identify and 
the prioritize any risks and issues before you begin an upgrade.To ensure security, performance, maintainability, robustness, 
and compliance with ABAP standards, integrate coding and 
quality assurance into a single activity.
quality of Finally, you should only keep the custom code you need. It introduces unnecessary risks and increases the amount of 
effort needed for unnecessary code corrections when 
your code redundant unused custom code is used.Wondering how to handle the situation? Here is a solution – 
SAP Solution Manager CCLM is a fantastic solution that 
addresses the majority of these requirements. Refer to this 
blog
We are often asked by clients what tools are available to check the security of SAP 
systems? Additionally, to Early Watch Alert (EWA), SAP Solution Manager (SOLMAN) 
has a Security Optimization Service (SOS) report that focuses on security.
Security Optimization Service for the SAP NetWeaver Application Server ABAP checks 
the security of your SAP system(s) and perform the following checks:
• Basis administration check
• User management check
• Super users check
5. Implement • Password check• Spool and printer authorization check
• Background authorization check
SAP Solution • Batch input authorization check• Transport control authorization check
• Role management authorization check
Manager – • Profile parameter check• SAP GUI Single Sign-On (SSO) check
• Certificate Single Sign-On (SSO) check
Security • External authentication checkYou’ll need the latest version of SOLMAN and the latest support pack to set this up. 
The managed system must also be configured and setup in SOLMAN without any 
Optimization errors and the instance is correctly defined in LMDB. (Status Green). Additionally, the OS collector must be running on your target instances and database.
It is important, however, to answer the following before setting up the SOS:
Service (SOS) • Does your organization have the capacity to manually review those reports and act on each recommendation?
• It is set correctly so that your team has ample time to review and act on the 
reports.
Read ToggleNow’s success story on this subject. We have implemented Solution 
Manager 7.2 for one of our clients who is a leading refractory company in India since 
1958.
Yes, you heard that right. Humans and systems alike 
benefit from regular health checks. Ponemon 
Institute reports that organizations lack visibility 
“into the security of SAP applications and lack the 
expertise to detect, prevent, and respond to 
cyberattacks quickly.”
6. Regular health Early detection is the key to staying healthy or 
secure. A frequent ERP system check helps you get a 
checks keep the comprehensive picture of your ERP landscape before 
making changes and identifying areas for 
system healthy improvement. This is just like healthy people need 
annual checkups and preventative medicine to stay 
healthy and detect problems early. Regular health 
checkups can identify security gaps. Additionally, 
EWA and SOS reports provide an in-depth analysis of 
the system. According to experts’ recommendations, 
SAP Solution Manager must be configured to support 
these modules.
How confident are you that the documents attached in 
SAP are virus-free? A vulnerable code might be included in 
a file your users use/attach in SAP, allowing hackers to 
gain access.
If you use SAP software, you should use a virus scanner to 
protect against computer viruses, and SAP recommends 
this. However, SAP does not investigate, recommend, or 
7. release antivirus software as part of its server product validation program.
Many anti-virus software packages protect your SAP 
Implement deployments using Deep Security, protecting critical 
information from threats such as malware, cross-site 
an scripting, and SQL injections.A Virus Scan Adapter (VSA) must be installed on the host 
before a Deep Security scan can be performed. SAP note 
Antivirus 2081108 explains how to set up and configure the VSA 
system and SAP note 1494278 provides a list of the AV 
products that are supported.
scan Additionally, SAP administrators can define the types of 
documents that are allowed based on various policies. 
After selecting the right AV product, this can be 
determined.
Reviews of dormant IDs and 
dormant roles make a great start. 
Regularly reviewing the user IDs 
8. and deactivating those that are no longer needed is always 
recommended. This will not only 
Implement increase the application’s security 
but also reduce licensing costs. If 
re- you already have an SOP in place and are still performing this activity 
manually, here is a solution for 
certificatio you. ToggleNow’s UserSentry 
automates both dormant ID review 
n and Role review by taking the appropriate action according to 
defined rules. Thus, you can 
processes comply with a critical audit 
requirement.
In addition, we recommend that additional 
security measures be implemented. Back 
then, experts used to advise setting up 
complex password policies like keeping 
password lengths between 8-12 characters 
and forcing users to change their passwords 
frequently. Keeping strong passwords alone 
9. is no longer sufficient considering technological advancements.
It is recommended to implement additional 
Implement security measures such as 2-factor 
authentication (2FA) or multifactor 
additional authentication (MFA), validating a user’s 
machine ID (aka mac ID) at log-in, and 
Security adding geofencing validations, verifying the availability of anti-virus software, checking 
the firewall status, etc. All these features are 
measures included in ToggleNow’s 
UserSentry application, which helps next-
generation enterprises implement them 
quickly.
The waterfall era has ended. Agility has won. By 
embracing digital transformation and getting fast 
and frequent feedback, organizations can 
respond quickly to critical security issues. By 
10. doing this, security issues aren’t ignored, and 
crises can be averted.
Transform If you are worried about the Subject matter 
expertise and resource availability, ToggleNow 
your can step in and take over this critical piece. The FourEdge Service offering is a great reliever for 
many organizations that are seeking to start 
business their GRC transformation journey. Remember to 
be in the race, or else your competitors will take 
with digital over.
These are the best tips to secure your critical 
technology business data in SAP systems. Talk to our SMEs today and leave rest on us for your business data 
security.
CONTACT US :
Level 2-4, 49, Shakthi Nilayam, 
Silicon Valley Society, Madhapur, 
Hyderabad 500084, India
Thank You