SAP (in)security - IT-SeCX - FH St. Pölten

75 Pages·2011·3.06 MB·English

SAP (in)security
Chris John Riley
Raiffeisen Informatik GmbH
world$whoami
Chris John Riley

 English (That was obvious really)
 Network and Web-App Penetration Tester
 Working for Raiffeisen Informatik Security Competence Center
in Zwettl

 13+ years working in IT (unlucky 13 ?)
 A bit of everything really… „Jack of all trades“
 Still learning something new everyday
 As we all should!
 Blogger and Twitterer (is that even a word ?)
 Bloger (http://blog.c22.cc)
 Twitterer (@ChrisJohnRiley)
 Podcaster (Eurotrash Security Podcast - NSFW)
„The wisest man is he who knows that he knows nothing"
SAP (in)security – FH St.Pölten Chris John Riley, Raiffeisen Informatik GmbH | 17.10.2011 | 2
What we’ll cover today
SAP Basics
SAP Architecture
SAP Components
SAP Threats / Attacks
SAP Conclusions
SAP (in)security – FH St.Pölten Chris John Riley, Raiffeisen Informatik GmbH | 17.10.2011 | 3
1. SAP BASICS
2. SAP Architecture
3. SAP Components
4. SAP Threats / Attacks
5. SAP Conclusions
SAP (in)security – FH St.Pölten Chris John Riley, Raiffeisen Informatik GmbH | 17.10.2011 | 4
SAP (in)security – FH St.Pölten Chris John Riley, Raiffeisen Informatik GmbH | 17.10.2011 | 5
What is SAP?
“…the world's leading provider of
business software, SAP (which stands
for "Systems, Applications, and
Products in Data Processing") delivers
products and services that help
accelerate business innovation for our
customers.”

source: sap.com
SAP (in)security – FH St.Pölten Chris John Riley, Raiffeisen Informatik GmbH | 17.10.2011 | 6
What is SAP?
 SAP Offerings
 ERP
(Enterprise Resource Planning)
 CRM
(Customer Relationship Management)
 SCM
(Supply Chain Management)
 PLM
(Product Life-cycle Management)
 SRM
(Supplier Relationship Management)
 GRC
(Governance, Risk and Compliance)
SAP (in)security – FH St.Pölten Chris John Riley, Raiffeisen Informatik GmbH | 17.10.2011 | 7
What is SAP?
 Customers in 120 countries
 More than 100,000 clients worldwide
 More than 40,000 employees
 More than 140,000 SAP implementations
 Covering every possibly industry
 From Automotive
 To Wholesale Distribution
SAP (in)security – FH St.Pölten Chris John Riley, Raiffeisen Informatik GmbH | 17.10.2011 | 8
source: sap.com
SAP (in)security – FH St.Pölten Chris John Riley, Raiffeisen Informatik GmbH | 17.10.2011 | 9
What is SAP?
 Growing target, despite it’s complexity
 Holds the keys to the kingdom
 Financial data
 Personal data
 Client data
 Business workflows
 …
 Surely such an important system must be secured!

RIGHT?

SAP (in)security – FH St.Pölten Chris John Riley, Raiffeisen Informatik GmbH | 17.10.2011 | 10