Why Organizations Need DevSecOps for SAP Now More Than Ever
June 23, 2020

Shane MacDonald
Onapsis

Setting DevSecOps goals are a critical component when aligning mission-critical application functionality with businesses' needs. In an ideal world, this would allow organizations to increase operational speed, automate manual tasks, provide continuous delivery to the company, and keep what matters most protected.

However, these goals create challenges for IT, operations and information security teams to best support SAP mission-critical applications. With multiple technologies, architectures, and a lack of unified development sets, SAP application developers have to handle changes through a manual coding and change process. Errors in custom code can create quality, security, and compliance issues that impact application integrity, hamper availability, and open the door for additional threats in production SAP systems.

Why SAP Shops Need DevSecOps ASAP

A typical SAP environment contains, on average, two million lines of custom code, not to mention a company's most sensitive customer, financial, sales, intellectual and partner data.

As a very initial stage to DevSecOPs, an analysis to find mistakes in SAP custom code should be mandatory, but that's not always the case. Secure custom code is seldom taught, and pre-production analysis is a rarity. This type of automated code analysis during development, or at least integration into the development environment, is only used by a small set of SAP customers.

So, just how many vulnerabilities, compliance issues and quality errors are companies missing? Research shows there is more than one critical security and/or compliance issue per 1,000 lines of custom ABAP code, with a typical SAP environment averaging 2,150 issues. Additionally, you will typically find tens of thousands of quality errors that cause downtime and performance issues on production systems.

For decades, security, compliance and quality risks have often been overlooked due to the manual nature of changes, leading to hidden vulnerabilities and errors in the custom code, transports, and systems. The primary resource today to fix this problem is a lengthy and costly investigation, followed by another transport to correct the issue potentially.

That is, until now.

Developing a Robust DevSecOps Program for SAP

The DevSecOps process is core to continuous improvement for any mission-critical applications and is something every SAP-based organization needs to consider.

Today, businesses need to move beyond traditional tactics and look toward automated application testing and protection software that can help identify security, compliance and quality errors during the coding process – almost like spell-check.

These solutions insert security in the DevOps process as far left as possible, with capabilities to analyze code development, assist with code build and testing, inspect SAP changes, enforce configurations, assess for vulnerabilities and misconfiguration, and continuously monitor user behavior and threats. They even work on third-party integrations.

Functionality at this level helps businesses ensure application availability, avoid costly repairs, eliminate downtime in production, and establish a security baseline to help measure improvements.

Since many errors can be hidden in SAP custom code and transports and can be costly in the long run, addressing potential issues and ensuring they are not implemented into production can save time and money. In fact, the increased assurance of code quality helps businesses address significant security vulnerabilities and potential compliance issues more efficiently and effectively. It can also help accelerate critical projects, such as S/4HANA transformation and cloud migrations by being better prepared.


When Shifting Left, Don't Forget the Right

After custom SAP code is pushed into production, it's imperative organizations continue to analyze and monitor systems for vulnerabilities and misconfigurations. Only applying these principles to the development side would be like only locking half of your house – the process would be incomplete.

Understanding and identifying what's happening before, during, and after production is part of the continuous application improvement cycle. Information technology and security teams need to have the proper procedures in place to protect configurations, apply patches, and review threats to SAP applications continuously.

With the amount of sensitive information on the line and breaches on the rise, IT, operations and infosec teams need DevSecOps now more than ever. By implementing these processes today, businesses can ensure stability, security and compliance of their SAP mission-critical application tomorrow.

Shane MacDonald is Global VP of Sales Engineering at Onapsis
Share this

Industry News

September 24, 2020

NetApp announced the availability of Elastigroup for Microsoft Azure Spot Virtual Machines (VMs).

September 24, 2020

CloudBees announced a robust new set of DevSecOps capabilities for CloudBees CI and CloudBees CD. The new capabilities enable customers to perform early and frequent security checks and ensure that security is an integral part of the whole software delivery pipeline workflow, without sacrificing speed or increasing risk.

September 24, 2020

Pulumi announced the release of a Pulumi-native provider for Microsoft Azure that provides 100% coverage of Azure Resource Manager (ARM), the deployment and management service for Azure that enables users to create, update and delete resources in their Azure accounts.

September 23, 2020

Puppet announced new Windows services, integrations and enhancements aimed at making it easier to automate and manage infrastructure using tools Windows admins rely on. The latest updates include services around Group Policy Migration and Chocolatey, as well as enhancements to the Puppet VS Code Extension, and a new Puppet PowerShell DSC Builder module.

September 23, 2020

Red Hat announced the release of Red Hat OpenShift Container Storage 4.5, delivering Kubernetes-based data services for modern, cloud-native applications across the open hybrid cloud.

September 23, 2020

Copado, a native DevOps platform for Salesforce, has acquired ClickDeploy.

September 22, 2020

CloudBees announced general availability of the first two modules of its Software Delivery Management solution.

September 22, 2020

Applause announced the availability of its Bring Your Own Testers (BYOT) feature that enables clients to manage their internal teams – employees, friends, family members and existing customers – and invite them to test cycles in the Applause Platform alongside Applause’s vetted and expert community of testers.

September 22, 2020

Kasten announced the integration of the K10 data management platform with VMware vSphere and Tanzu Kubernetes Grid Service.

September 21, 2020

PagerDuty entered into a definitive agreement to acquire Rundeck, a provider of DevOps automation for enterprise.

September 21, 2020

Grafana Labs announced the release of Grafana Metrics Enterprise, a modern Prometheus-as-a-Service solution designed for the scale, architecture, and security needs of enterprises as they expand their observability initiatives.

September 21, 2020

Portshift's Cloud Workload Protection platform is now available through the Red Hat Marketplace.

September 17, 2020

env0, a developer of Infrastructure-as-Code (IaC) management software, announced the availability of its new open source solution for Terraform users, Terratag.

September 17, 2020

Push Technology announced a partnership with Innova Solutions, an ACS Solutions company, specializing in global information technology services.

September 17, 2020

Alcide achieved the AWS Outposts Ready designation, part of the Amazon Web Services (AWS) Service Ready Program.