Why Organizations Need DevSecOps for SAP Now More Than Ever
June 23, 2020

Shane MacDonald
Onapsis

Setting DevSecOps goals are a critical component when aligning mission-critical application functionality with businesses' needs. In an ideal world, this would allow organizations to increase operational speed, automate manual tasks, provide continuous delivery to the company, and keep what matters most protected.

However, these goals create challenges for IT, operations and information security teams to best support SAP mission-critical applications. With multiple technologies, architectures, and a lack of unified development sets, SAP application developers have to handle changes through a manual coding and change process. Errors in custom code can create quality, security, and compliance issues that impact application integrity, hamper availability, and open the door for additional threats in production SAP systems.

Why SAP Shops Need DevSecOps ASAP

A typical SAP environment contains, on average, two million lines of custom code, not to mention a company's most sensitive customer, financial, sales, intellectual and partner data.

As a very initial stage to DevSecOPs, an analysis to find mistakes in SAP custom code should be mandatory, but that's not always the case. Secure custom code is seldom taught, and pre-production analysis is a rarity. This type of automated code analysis during development, or at least integration into the development environment, is only used by a small set of SAP customers.

So, just how many vulnerabilities, compliance issues and quality errors are companies missing? Research shows there is more than one critical security and/or compliance issue per 1,000 lines of custom ABAP code, with a typical SAP environment averaging 2,150 issues. Additionally, you will typically find tens of thousands of quality errors that cause downtime and performance issues on production systems.

For decades, security, compliance and quality risks have often been overlooked due to the manual nature of changes, leading to hidden vulnerabilities and errors in the custom code, transports, and systems. The primary resource today to fix this problem is a lengthy and costly investigation, followed by another transport to correct the issue potentially.

That is, until now.

Developing a Robust DevSecOps Program for SAP

The DevSecOps process is core to continuous improvement for any mission-critical applications and is something every SAP-based organization needs to consider.

Today, businesses need to move beyond traditional tactics and look toward automated application testing and protection software that can help identify security, compliance and quality errors during the coding process – almost like spell-check.

These solutions insert security in the DevOps process as far left as possible, with capabilities to analyze code development, assist with code build and testing, inspect SAP changes, enforce configurations, assess for vulnerabilities and misconfiguration, and continuously monitor user behavior and threats. They even work on third-party integrations.

Functionality at this level helps businesses ensure application availability, avoid costly repairs, eliminate downtime in production, and establish a security baseline to help measure improvements.

Since many errors can be hidden in SAP custom code and transports and can be costly in the long run, addressing potential issues and ensuring they are not implemented into production can save time and money. In fact, the increased assurance of code quality helps businesses address significant security vulnerabilities and potential compliance issues more efficiently and effectively. It can also help accelerate critical projects, such as S/4HANA transformation and cloud migrations by being better prepared.


When Shifting Left, Don't Forget the Right

After custom SAP code is pushed into production, it's imperative organizations continue to analyze and monitor systems for vulnerabilities and misconfigurations. Only applying these principles to the development side would be like only locking half of your house – the process would be incomplete.

Understanding and identifying what's happening before, during, and after production is part of the continuous application improvement cycle. Information technology and security teams need to have the proper procedures in place to protect configurations, apply patches, and review threats to SAP applications continuously.

With the amount of sensitive information on the line and breaches on the rise, IT, operations and infosec teams need DevSecOps now more than ever. By implementing these processes today, businesses can ensure stability, security and compliance of their SAP mission-critical application tomorrow.

Shane MacDonald is Global VP of Sales Engineering at Onapsis
Share this

Industry News

September 23, 2021

Shortcut, the collaborative home for modern software teams, announced new Team-to-Workflow functionality.

September 23, 2021

Portainer announced the launch of its Portainer Business Charmed Operator, allowing for seamless integration with Canonical’s Charmed Kubernetes distribution.

September 22, 2021

Parasoft announced the launch and extension of its static application security testing (SAST) and API testing platform with penetration testing, shifting security testing into developer workflows.

September 22, 2021

Synopsys announced a new partnership with The Chertoff Group, a global advisory services firm that applies security expertise, technology insights, and policy intelligence to help clients build resilient organizations, gain competitive advantage, and accelerate growth.

September 21, 2021

ShiftLeft announced that its unified code security platform, ShiftLeft CORE, is now available on the AWS Marketplace.

September 21, 2021

JFrog announced its JFrog Artifactory and JFrog Xray solutions are now accredited in Iron Bank and available via Platform One.

September 21, 2021

GitKraken acquired BigBrassBand and its popular Git Integration for Jira.

September 20, 2021

D2iQ announced version 2.0 of the D2iQ Kubernetes Platform (DKP).

September 20, 2021

Platform9 joined Intel's Open Retail Initiative (ORI) and launched a new software-defined store solution.

September 20, 2021

FireMon has acquired DisruptOps.

September 16, 2021

SnapLogic released the latest version of its new SnapLogic Flows solution.

September 16, 2021

Postman launched a new version of its API Management platform.

September 16, 2021

Progress announced its R3 2021 release of Progress Telerik and Progress Kendo UI.

September 15, 2021

Progress announced the availability of Progress Sitefinity DX 14.0.

September 15, 2021

Launchable, the intelligence platform layer for all software testing, announced their latest addition to the platform, Flaky Tests Insights (beta).