Why Organizations Need DevSecOps for SAP Now More Than Ever
June 23, 2020

Shane MacDonald
Onapsis

Setting DevSecOps goals are a critical component when aligning mission-critical application functionality with businesses' needs. In an ideal world, this would allow organizations to increase operational speed, automate manual tasks, provide continuous delivery to the company, and keep what matters most protected.

However, these goals create challenges for IT, operations and information security teams to best support SAP mission-critical applications. With multiple technologies, architectures, and a lack of unified development sets, SAP application developers have to handle changes through a manual coding and change process. Errors in custom code can create quality, security, and compliance issues that impact application integrity, hamper availability, and open the door for additional threats in production SAP systems.

Why SAP Shops Need DevSecOps ASAP

A typical SAP environment contains, on average, two million lines of custom code, not to mention a company's most sensitive customer, financial, sales, intellectual and partner data.

As a very initial stage to DevSecOPs, an analysis to find mistakes in SAP custom code should be mandatory, but that's not always the case. Secure custom code is seldom taught, and pre-production analysis is a rarity. This type of automated code analysis during development, or at least integration into the development environment, is only used by a small set of SAP customers.

So, just how many vulnerabilities, compliance issues and quality errors are companies missing? Research shows there is more than one critical security and/or compliance issue per 1,000 lines of custom ABAP code, with a typical SAP environment averaging 2,150 issues. Additionally, you will typically find tens of thousands of quality errors that cause downtime and performance issues on production systems.

For decades, security, compliance and quality risks have often been overlooked due to the manual nature of changes, leading to hidden vulnerabilities and errors in the custom code, transports, and systems. The primary resource today to fix this problem is a lengthy and costly investigation, followed by another transport to correct the issue potentially.

That is, until now.

Developing a Robust DevSecOps Program for SAP

The DevSecOps process is core to continuous improvement for any mission-critical applications and is something every SAP-based organization needs to consider.

Today, businesses need to move beyond traditional tactics and look toward automated application testing and protection software that can help identify security, compliance and quality errors during the coding process – almost like spell-check.

These solutions insert security in the DevOps process as far left as possible, with capabilities to analyze code development, assist with code build and testing, inspect SAP changes, enforce configurations, assess for vulnerabilities and misconfiguration, and continuously monitor user behavior and threats. They even work on third-party integrations.

Functionality at this level helps businesses ensure application availability, avoid costly repairs, eliminate downtime in production, and establish a security baseline to help measure improvements.

Since many errors can be hidden in SAP custom code and transports and can be costly in the long run, addressing potential issues and ensuring they are not implemented into production can save time and money. In fact, the increased assurance of code quality helps businesses address significant security vulnerabilities and potential compliance issues more efficiently and effectively. It can also help accelerate critical projects, such as S/4HANA transformation and cloud migrations by being better prepared.


When Shifting Left, Don't Forget the Right

After custom SAP code is pushed into production, it's imperative organizations continue to analyze and monitor systems for vulnerabilities and misconfigurations. Only applying these principles to the development side would be like only locking half of your house – the process would be incomplete.

Understanding and identifying what's happening before, during, and after production is part of the continuous application improvement cycle. Information technology and security teams need to have the proper procedures in place to protect configurations, apply patches, and review threats to SAP applications continuously.

With the amount of sensitive information on the line and breaches on the rise, IT, operations and infosec teams need DevSecOps now more than ever. By implementing these processes today, businesses can ensure stability, security and compliance of their SAP mission-critical application tomorrow.

Shane MacDonald is Global VP of Sales Engineering at Onapsis
Share this

Industry News

July 13, 2020

Docker announced a collaboration with Amazon Web Services (AWS) to simplify the lives of developers by allowing them to focus on application development, streamlining the process of deploying and managing containers in AWS from their local development environment.

July 13, 2020

Perforce Software announced the release of a combined JRebel and XRebel plugin for the Eclipse IDE.

July 13, 2020

Spectro Cloud announced that its first product—Spectro Cloud—is now generally available.

July 09, 2020

ShiftLeft released a new version of NextGen Static Analysis (NG SAST), including new workflows, purpose-built for developers that significantly improve security, while enhancing productivity.

July 09, 2020

RunSafe Security announced a partnership with JFrog that will enable RunSafe to supercharge binary protections via a simple plugin that JFrog users can deploy within their Artifactory repositories and instantly protect binaries and containers.

July 09, 2020

LeanIX closed $80 million in Series D funding led by new investor Goldman Sachs Growth.

July 08, 2020

Afi.ai introduced Afi Data Platform, a cloud-based replication and resiliency service that helps to monitor, predict downtime and recover K8s applications.

July 08, 2020

D2iQ announced the release of Conductor, a new interactive learning platform that enables enterprises to access hands-on cloud native courses and training.

July 08, 2020

SUSE entered into a definitive agreement to acquire Rancher Labs.

July 07, 2020

Micro Focus announced AI-powered enhancements to the intelligent testing capabilities of the UFT Family, a unified set of solutions designed to reduce the overall complexity of automating the functional testing processes.

July 07, 2020

Push Technology announced the launch of a new Service API capability for Diffusion Cloud, Push’s Real-Time API Management Cloud Platform.

July 07, 2020

Lightrun exited stealth and announced $4M in seed funding for the first complete continuous debugging and observability platform for production applications.

July 01, 2020

JFrog announced the launch of ChartCenter, a free, security-focused central repository of Helm charts for the community.

July 01, 2020

Kong announced a significant upgrade to open source Kuma, Kuma 0.6, available today.

July 01, 2020

Compuware Corporation, a BMC company, announced new capabilities that further automate and integrate test data and test case execution, empowering IT teams to achieve high-performance application development quality, velocity and efficiency.