Why Organizations Need DevSecOps for SAP Now More Than Ever
June 23, 2020

Shane MacDonald
Onapsis

Setting DevSecOps goals are a critical component when aligning mission-critical application functionality with businesses' needs. In an ideal world, this would allow organizations to increase operational speed, automate manual tasks, provide continuous delivery to the company, and keep what matters most protected.

However, these goals create challenges for IT, operations and information security teams to best support SAP mission-critical applications. With multiple technologies, architectures, and a lack of unified development sets, SAP application developers have to handle changes through a manual coding and change process. Errors in custom code can create quality, security, and compliance issues that impact application integrity, hamper availability, and open the door for additional threats in production SAP systems.

Why SAP Shops Need DevSecOps ASAP

A typical SAP environment contains, on average, two million lines of custom code, not to mention a company's most sensitive customer, financial, sales, intellectual and partner data.

As a very initial stage to DevSecOPs, an analysis to find mistakes in SAP custom code should be mandatory, but that's not always the case. Secure custom code is seldom taught, and pre-production analysis is a rarity. This type of automated code analysis during development, or at least integration into the development environment, is only used by a small set of SAP customers.

So, just how many vulnerabilities, compliance issues and quality errors are companies missing? Research shows there is more than one critical security and/or compliance issue per 1,000 lines of custom ABAP code, with a typical SAP environment averaging 2,150 issues. Additionally, you will typically find tens of thousands of quality errors that cause downtime and performance issues on production systems.

For decades, security, compliance and quality risks have often been overlooked due to the manual nature of changes, leading to hidden vulnerabilities and errors in the custom code, transports, and systems. The primary resource today to fix this problem is a lengthy and costly investigation, followed by another transport to correct the issue potentially.

That is, until now.

Developing a Robust DevSecOps Program for SAP

The DevSecOps process is core to continuous improvement for any mission-critical applications and is something every SAP-based organization needs to consider.

Today, businesses need to move beyond traditional tactics and look toward automated application testing and protection software that can help identify security, compliance and quality errors during the coding process – almost like spell-check.

These solutions insert security in the DevOps process as far left as possible, with capabilities to analyze code development, assist with code build and testing, inspect SAP changes, enforce configurations, assess for vulnerabilities and misconfiguration, and continuously monitor user behavior and threats. They even work on third-party integrations.

Functionality at this level helps businesses ensure application availability, avoid costly repairs, eliminate downtime in production, and establish a security baseline to help measure improvements.

Since many errors can be hidden in SAP custom code and transports and can be costly in the long run, addressing potential issues and ensuring they are not implemented into production can save time and money. In fact, the increased assurance of code quality helps businesses address significant security vulnerabilities and potential compliance issues more efficiently and effectively. It can also help accelerate critical projects, such as S/4HANA transformation and cloud migrations by being better prepared.


When Shifting Left, Don't Forget the Right

After custom SAP code is pushed into production, it's imperative organizations continue to analyze and monitor systems for vulnerabilities and misconfigurations. Only applying these principles to the development side would be like only locking half of your house – the process would be incomplete.

Understanding and identifying what's happening before, during, and after production is part of the continuous application improvement cycle. Information technology and security teams need to have the proper procedures in place to protect configurations, apply patches, and review threats to SAP applications continuously.

With the amount of sensitive information on the line and breaches on the rise, IT, operations and infosec teams need DevSecOps now more than ever. By implementing these processes today, businesses can ensure stability, security and compliance of their SAP mission-critical application tomorrow.

Shane MacDonald is Global VP of Sales Engineering at Onapsis
Share this

Industry News

January 26, 2023

Ubuntu Pro, Canonical’s comprehensive subscription for secure open source and compliance, is now generally available.

January 26, 2023

Mirantis, freeing developers to create their most valuable code, today announced that it has acquired the Santa Clara, California-based Shipa to add automated application discovery, operations, security, and observability to the Lens Kubernetes Platform.

January 25, 2023

SmartBear has integrated the powerful contract testing capabilities of PactFlow with SwaggerHub.

January 25, 2023

Venafi introduced TLS Protect for Kubernetes.

January 25, 2023

Tricentis announced the general availability of Tricentis Test Automation, a cloud-based test automation solution that simplifies test creation, orchestration, and scalable test execution for easier collaboration among QA teams and their business stakeholders and faster, higher-quality, and more durable releases of web-based applications and business processes.

January 24, 2023

Harness announced the acquisition of Propelo.

January 23, 2023

Couchbase announced its Couchbase Capella Database-as-a-Service (DBaaS) offering on Azure.

January 23, 2023

Mendix and Software Improvement Group (SIG) have announced the release of Mendix Quality & Security Management (QSM), a new cybersecurity solution that provides continuous deep-dive insights into security and code quality to immediately address risks and vulnerabilities.

January 23, 2023

Trunk announces the public launch of CI Analytics.

January 23, 2023

Panaya announced a new Partnership Program in response to ongoing growth within its partner network over the past year.

January 23, 2023

Cloudian closed $60 million in new funding, bringing the company’s total funding to $233 million.

January 19, 2023

Progress announced the R1 2023 release of Progress Telerik and Progress Kendo UI.

January 19, 2023

Wallarm announced the early release of the Wallarm API Leak Management solution, an enhanced API security technology designed to help organizations identify and remediate attacks exploiting leaked API keys and secrets, while providing on-going protection against hacks in the event of a leak.

January 19, 2023

ThreatModeler launched Threat Model Marketplace, a cybersecurity asset marketplace offering pre-built, field-tested threat models to be downloaded — free for a limited time — and incorporated into new and ongoing threat modeling initiatives.

January 18, 2023

Software AG has launched new updates to its webMethods platform that will simplify the process by which developers can find, work on and deploy new APIs and integration tools or capabilities.