Indus Community INDUS Defeat the Hackers, 29 Jul 2020

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: INDUS Defeat the Hacker SIG - Secure Software Development LiveCycle for custom code application

Description

In the July edition of their monthly webinar Defeat the Hackers, INDUS Security Special Interest group hosted Natascha Lalor, where she shared the importance of having Secure Software Development LiveCycle for custom code applications.

The session provided an overview of the various tools at SAP that can be used to secure custom code. In the session Natascha also explained the processes that should be in place to make sure your custom applications are secure. Best practices were also shared that will help to secure custom applications right from the start.

The session gave an overview on:
• Software security vulnerability situation today
• Application security testing solutions at SAP
• ABAP Test Cockpit
• SAP Code Vulnerability Analyzer
• Custom Code Management Tools
• Threat Modelling

#Security #ABAP #Code #ThreadModelling #CustomCode

A

Yeah um so welcome everyone uh good afternoon, so uh this is the sixth instance of our monthly webinar defeat the hackers, and today we have natasha who will be talking to us about um how we can secure our ab like custom above secure code and also how a secure life cycle process can be built around it, so that your whatever your custom writing is also secure and, just to add, we have a kuvente box which is available. uh Please feel free to ask any questions.

A

If you have in the middle also, we can use the chat box, we will be monitoring it uh today. We have uh let's participants so yeah in case whoever is listening to the recordings. Also, if you have any questions you can reach out to us me or mukesh, we will be sharing the email ideas at the end. Yeah with that, I will hand over to natasha over to natasha.

B

Thanks so much for the introduction, great and okay, let me just share my screen this one.

B

Great um yes, hello, everyone aside from myself, um so yes, I'm natasha, laura I'm from the cue security and governance here in dublin and ireland, um so I'm doing security for quite a long time, and it's getting of course, more and more important um for for customers to secure yeah, their crown jewels, their main business systems.

B

um One of the areas I'm working a lot with is basically the custom code security. So I know one of my colleagues. He had already done a very good session on the code, vulnerability analyzer. So this session is more about the processes around um the code, vulnerability, analyzer. So how do you use it? Where do you use it when and what other things to to keep in mind um when securing your custom codes? So the main title is crazy: the secure software development life cycle. So what are the processes around these um good?

B

So let me just this: uh can? Can you see all the screen exactly so thanks for the whole. So first of all is the question. um So have you heard the um previous session, or do you know already about this code, vulnerability, analyzer? Or is it a complete new topic to you, so it depends on how deep I have to um go through the initial slides from from peter parker, or is it already known see if you can answer the question in the poll.

C

I have one response, so I I think it will be better if everyone could actually respond to the poll so that the content then becomes more relevant.

C

B

C

Is a 50 50 uh natasha.

B

Okay, good good, so I will you see me fast going through going through this soon for that one person who who answered with this? Yes, they know this tool. Can you put up, maybe the second poll already just to see if they indeed using the static code, analyzer so or any static code, analyzer or the code vulnerability to analyze it so and for this participant to answer this? Yes, are you using a product like this or or equipment ability analyzer already or you can so yeah? If you can just answer that.

C

So the response is no.

B

Okay- okay, great good thanks, so much good okay! So then I know how uh or what to to look out for so. Yes,.

B

Then we start, um then, in general, with introduction. Of course, um the the core businesses said that you're using this your custom code. Of course it's growing and growing on complex stuff, but we're seeing the complexities is very, very large.

B

um This was one of the the problems to to keep your custom code secure and when you look at yeah, it also changes all the the complexity of these other and yes, usually, the main.

B

The main priority usually on custom code is, of course, the performance and, of course, the stability of of these. So security is always kind of afterthought in custom code, so but yeah, why do we need the securities there? Well, I think it's everything in in first we've seen a similar slides like that uh before um this was even with the hardening of systems, but also it's the same for the the custom code. So, of course you you if there are vulnerabilities that are getting misused in your custom code in the applications.

B

Of course, it's a whole thing of the negative publicity of the brand damage. So the reason why that was run somewhere attack on garmin. If you heard about that. Well, it's you use those sort of the trust in in the brand there's a lot of negative and publications now about garmin. Would he ever use garmin if it's so unreliable and getting attacked? God knows what what data may be leaked by this.

B

um So that would of course, will cause lost revenue because, maybe you think, or the customers think twice of buying your product. If and if you as a company, are not secure and maybe leaking data, or it's unreliable so um like arm and they were, they were basically shut down for about four or four days at least so. This is not a good thing, of course. So after an attack, you usually have to rebuild the system.

B

So this is not a good idea, so I know in a lot of countries that there are no legal consequences, so especially here in europe, wherever I'm living after gdpr, so we have legal consequences on data leaks of any information that may be leaked and even penalties. So the gdpr has like a high penalty to paid, if you're not adding to these rules, so I think any country has a similar kind of rules to present good um so yeah. What are these?

B

um These typical vulnerabilities that are found with the static code analysis or that we are trying to prevent in the custom code and one of these or most of these are kind of injection vulnerabilities.

B

So what does that mean? So injection is basically putting something into the code or into the sql or even the command prompt and put something malicious into that, so when the sql injection classically- and that would be something like yeah changing the whole world class or um by by entering something or injecting something like like a salary variable. For example, you have this this application, it's usually handling, for example, hr kind of data um and as well. It has somewhere to salary, but usually you can't change the salary. So it's no salary field.

B

However, if the attacker knows this variable salary that they can inject salary equals, I don't know 2000 or something, and then um this value will be can be used. So I think- and we have that but um typical example- I think peter parker showed it before already, and this is similar to the other code injection. So you could potentially inject malicious code into into the program because it's genomically created um operating system command injections, the same thing you could inject something like a talent command or something else malicious into it and many many more things.

B

So these are the things we'll be trying um to to fight on the application level or in the custom code.

B

So the other thing is, of course, the backdoors. um This is, of course, very malicious of some developer or some malicious developer, creating vectors that he or she could misuse afterwards.

B

Other things are missing, authorization, checks or basically authorization checks, been well ignored, so missing action. So we've seen that a lot of times that it's been done by mistake or being forgotten. What's what to do with that um based up exploits you have to wait for anything. That is another thing and, of course, no compliance to any of these regulations like the gdpr, for example.

B

So the problem that there is- and this is this- is a way um yeah very, very critical one, because, yes and first of all, you have to understand all these threats that I just mentioned so and how do they fit in with the infrastructure.

B

So it takes really only the one flaw in your application to yeah so to be misused.

B

So, but you must basically secure everything and that that just really the problem and it's not enough to just rely on the infrastructure or on the underlying kind of security controls you may have, because sometimes they may not work or it's maybe an internal attack. Even so it doesn't matter. Then, if you have the infrastructure secured good. um Just have this following little example here so normally- and this is basically the problem, usually when you're designing the application, you usually think it's been, or it's been designed that it's been used as intended right.

B

So so, when you see these typical um numbers, you would think okay, maybe then the following. The the continuation of these would be maybe something like that: the 12 14 16 or maybe other more adventurous ones, but usually we have some kind of integer value that they're just following these these lines. So that's what you expect when you create your application, yeah, the the end user of this application will automatically um enter the right value.

B

So the problem is that it doesn't work that way right. So, unfortunately, you have these attackers, even if it's an internal attack or external and they never enter something else to either break the application or, as you said, inserting something. So you see here, this r equals one one equals one. This is basically a typical sql injection.

B

What exactly is this does is. Basically, this statement is always true, so one is always equals one right. So if you and inject that into a word class, it's the output, the whole value of of your table. So again, this is not best as you intended, because you're only fetching, maybe one value or something, but you don't want to um output all the values, especially if it's maybe sensitive or confidential data.

B

So how can we intervene this? uh What can we do and to to prevent these? So the one thing is and of course, the cool vulnerability, analyzer and, of course, for for non-above is the supportified by microfocus, but let's focus on the above um first, so the code, one bit analyzer, is basically sasd or sast, so static um code testing.

B

So what that means regarding or in in the opposite, we have to do dynamic testing.

B

So, as you seen, you need all of these in these in this circle right, so so the sas or the static code analysis there's only this small little a quarter of of everything that you really need to cover so to do the full test coverage.

B

We actually need all of these here, so basically um a manual code review because again in the static code, analyzer like the code one and we can analyze it from sap, it's only testing yeah. The the typical um vulnerabilities that we just seen like scale. Injection authorization check missing a few of the back dosing, but it does not um replace a manual code review so for a principle of going through the code manually and certainly some things can't be caught by a static protest. You still need a dynamic code test, for example like logical errors.

B

So, of course, any static code check or even a manual code review would not detect any logical errors that may lead to to misuse or to vulnerabilities in your code. So of all. Basically, you have to keep in mind to use all of these mechanisms or controls to secure your custom code or to do meaningful testing.

B

So yes- and I think that was the slide- that you must be seen as well by my colleague peter barker- so that's quickly, one suit, of course, and it's one of the best practices because of course, sap is using um this product all the time.

B

um So what basically, is this also once again, these are the slides that we've seen from from peter, so this one person who's seen this you possibly remember, and if it's new to you, um unfortunately, we don't have that much time to cover this, but it's basically the cool 1d analyzer is part of the above test, cockpit, so which is very nice because you can use all the features that are coming with above test cockpit. So, for example, one of them um that I would now find is exemption handling.

B

So this would be the same as you would be used to from the above test cockpit, so you can rise. Exemptions have been approved or not um so that's the normal process. As per atc, um you can even control um your transport management, so that is one of the great features in in the other test, cockpit, um that you can say, okay, so for for this, um a bunch of security checks, um we like to stop our transports.

B

If you have a priority, one um checks failing on this so or if it finds any vulnerabilities of priority. One you'd like to stop your transports, for example. So this is all part of these um above test cockpit. So it's fully integrated into this just nice. Really, you don't need to to learn any new tools or or anything like that. It's just a new check variant, basically of your above plus comfort, um good, so the rules per se, so there we go already a little bit more into the um into these processes around it.

B

So, of course, you have the developer, who is developing on the above tests above workbench, um so in this case, then we have the some quality exporter quality management. Then, who runs these um checks yeah that that's where it comes already, then to our processors? So how often would you run these checks then? And this is basically the one point, I'm not sure if peter went into it, but this is basically more or less what um I want to discuss in this session. So what are the processes around this?

B

So usually we have a q gate. I guess something similar to that where you usually scan um all your code, so usually it's done for performance and syntax checks, and so on, so there where we would see also the security checks to be run. So usually you have also for for the cva checks should be also part of these normal quality gates that you scan it and, as I said, um you could actually see the check results that could be emailed to the responsible developer again.

B

The developer could then raise exceptions saying this is a false positive or this being taken care of already, I'm not sure, whatever exemption he may sing, or it's a false, positive, maybe or something um and then again as the atc. As I mentioned already, it's been quite tightly linked to the transport management, so it can then be decided.

B

Should we go ahead with the transport, or should we stop because there's a priority one, for example security, vulnerabilities present at the moment, so that's already talking a little bit about the process of when to use um and how to use it. It's also, as I said, integrated in your usual static tests um that you're running at the q gates before well before the transport um good. Yes, so that was actually the the person seen that already. Firstly, the the typical scale injection. So again you have a salary field here or variable.

B

um So what we expect um is basically just a speed change, for example. But um what is happening here is the sql injection saying salary is 1500, so this is here the scale injection that we're injecting here at the at the input level. So what the this program does is then, basically setting these values. So, yes, the street has been changed through x of nonsense, um but also the salary field.

B

So even it's not asking or doesn't have the user input for the salary field um it's here injected into the code, so that is a classic scale. Injection, um yes and the first it's been set in here, so the how this code analysis works, and so that is one of the big differences um between the code inspector and the code, vulnerability analyzer.

B

It's actually checking the whole flow of the program so where just as well, you come from so yes, there is this input field and that's where actually the attack happened. It doesn't happen directly at this, where clause, but it happened beforehand at the input field.

B

So and then, of course, it's that such expression here that made it possible to to set this salary variable in the end and, of course, that's the data flow here in between this input field and then in the end, that statement here right. So this is a nice thing that the code wanna reach analyzer is basically checking. Where is the source coming from where it's been? Where is that that value coming from actually and there's? We are always with security.

B

We shouldn't really trust anything right. We shouldn't trust the input field, so I say, except this way, one of the way first slides you shouldn't expect always that the end user is really using this input as intended.

B

You have to really think out of the box. What could happen so in this case, yes, there was a code injection entered um in this case, the salary fields good. So how? How do we fix this? So we fix it here at the set expression levels. So we do hear these input validation about this quotation, mark that caused this sql injection um to ignore this right, so so that was basically how to how to solve this in this case.

B

So this is the other nice thing in the codename analyzer you get um in the in the help text of these findings. You click basically on these findings. So in this case a scan injection- and it already comes up with a proposal of how to solve this so in this case, um use these puppy here um to do the input, validation with basically ignoring the the codes.

B

um Of course, we do need this for for integer variables um because yeah you it's only accepted into your, not a string, I'm just very quickly on the news and above test cockpit. This is more about this cockpit, rather than um the actual code, vulnerability analyzer, it's basically that you can now have well, I would say, from 752 onwards, you have now the availability of saying you can um use a centralized above test cockpit or could when we analyze it to scan remote systems.

B

So this is actually quite nice, so you don't have to configure the upper test cockpit and for each of your development system. You do that centrally on one system that is well higher than 751, I would say it's stable from 752 onwards, the 751. You still have a lot of um prerequisite notes um to enter.

B

So I would say seven five, two, seven five three is one of the better um choices, but yes, that's a relatively new thing and to to execute these checks, basically on in a centralized level and, of course, the above test, cockpit, um it ties in to the solution manager.

B

So one thing I really like to highlight is the code custom code, life cycle management. Here we will talk about this a little bit more um because what well? What I'd like to to discuss here is what I see a lot of times when we are scanning custom code, and so that is one of the servers that we are offering for max attention and active attention, customers that we scan the code we can yeah.

B

We are able to to enable this couponability analyzer license for the number of days and the services on so usually between two and ten days, depending on the customer needs. So what we can do. There is basically scanning these codes. Usually we scans the whole custom codenames namespace, but the problem is sometimes that is quite redundant code found.

B

So I would nearly say in some cases it's up to 50 of the vulnerabilities found overall are basically found in old, redundant goods, so especially, maybe back, then no one really paid much attention to security um or yeah. It was basically being forgotten, or the code was never wasn't, really looked at anymore, because it's an old application that nobody uses anymore.

B

Well. What is the problem with that? Well, the issue: is there still that even unused applications, they still um can be misused, so if they have vulnerabilities, of course, you can still misuse um these.

B

um So that's why life cycle management is very important in this case to basically highlight okay. What what of this code has not been used? Maybe for a year.

B

So usually you don't do a project like that with enabling things like the upl for well, we say at least a year or so um so, basically trying to get the quarter our years and kind of um yeah kind of mechanism, insults or anything that has to be run, maybe only once a year um and crazy. Look over there to see.

B

Okay, what applications are really use, what objects are really been used and anything that hasn't been used in a time frame to disable it, because that's everything about security right, you just disable everything unused, because again things can be still misused, but good. So that is the one project and that I like you to think about when thinking about custom code, that again would could could basically entail any anyone abilities that could be misused and, of course, um with spotify. You can extract the data as well from atc good.

B

Yes- and this is exactly what um what I was mentioning earlier on so when or if you have this project of securing your custom code then really think about it as well. The the quantity of your custom code so, basically, is there anything redundant is anything that that was maybe a really old application that hasn't hasn't been used for the last three four years.

B

We see that quite a lot that when we show the results of the scan to the customers that they said well hey, these are all really old applications, the developers and even with us anymore. This is really really old. um But, yes, it is still very vulnerable code. It is so critical to leave the code there, so either you have to fix it and, of course, it's more uh how you say more expensive or it takes more resources to fix these um this code.

B

Rather than retire it, so that is the point three here so again: use upl to to switch it on and it's not having too much footprint. Even so, it doesn't impact the performance of the system, so you can just run it on your on your productive system to see what has actually been used and yes, custom code. Lifecycle management can basically show um it can show also the delta. So once you run um the code one which analyzer you can have to delta between them to see.

B

Okay, these findings, um these vulnerabilities are not used or it's an unused program, so we're starting already to talk a little bit about what to do or how to um secure your code. So yes, that's! Actually the next poll or the last rule that I wanted to ask so how many of you are having a kind of a documentation or basically the any kind of development guidelines.

B

So if you can bring up the last folder full three, please.

B

See the pool, are you still there not that it's perfect? Yes, so yes, so so are you using any um kind of handbooks or guidelines already for your developers and would it use or does it have already some guidelines on security in there? So, for example, you shouldn't use, um or you always have to do- authorization check- you always have to check against authorization, something like that and prevent any sql injection where possible and do input validation.

B

Anything like that. Do you have that already in place.

B

um Let's get into the next, I think very much so indeed- and this is actually so- this is the use of a development life cycle um and what I think it's very important from this is to see. We have to really start quite early in the development to think about security, so this is actually very important.

B

So this is basically the secure software development, lifecycle or ssdl. That sap is using at the moment.

B

So it starts really um with the security awareness so with security training of the developers, because, as you've seen from the very first slide um that you've seen developers usually um or even the designer, uh the colleagues who are designing the application, they really assume always that the end users will use the program as intended or your application, and you have to think a little bit more out of the box or the developers or the designer of this application.

B

They have to sing out of the box. They have to think okay. Can we actually trust this input so with security? We do not trust anything right or when you think of even directory traversal.

B

Can we actually really trust that the end user will put in the right file name or the correct um pass, so these are direct to traversal, so you could potentially read in any file if you, if you try to exploit this and one ability or you even overwrite, something right, so this is actually really a really dangerous thing, so you have to always think. Can we trust these things?

B

Can we trust that user input or if you fetch things from rfc, can we actually trust us other source, or can we trust, maybe that the rfc is really secure because a lot of attacks happening yeah? Are we seen right? So this is always the thing, so this awareness has to be there so that that zero trust, I wouldn't really say- um and this has to be in mine in the mind of the developers or, of course or and the people who are designing this application.

B

The other thing that sap is doing- and we will talk about this in a minute- is the track model subject. Modeling was basically done already in this in this early start, where you prepare, or were you designing the application so while security testing well, this is again something you need to plan.

B

You need to know how to do security testing look for secure programming, so so how do we avoid these vulnerabilities in the first place, um so in sap we do have a full curriculum that the developer has to has to perform before even allowed to be developing so, and that means basically, they had done a course of secure programming. So, as I said, do the input, validation, input, validation of everything anywhere, where you have a user input um either for the sql or for for the file name or something like that.

B

You have to validate this input, so that would be the first rule, for example in secure programming. um But yes, they have to know what what how to do the authorization check properly, because we've seen that a lot of time that yes, there is an authorization check, but then no consequences to that. So in programming terms, no super c, uh if clause behind it. So so it's just saying authorization check for this object, but then nothing so nothing's happening.

B

That's happening a lot of times, and this is basically just lack of knowledge. I guess, or maybe yeah they weren't aware or it's again. This is they need awareness or there should be some kind of training to to um observe for for the developers.

B

The other thing well. This is more, I'm not sure how it is in india, as I said here in europe via very strict. This is um personal data or handling of personal data, so without dpr.

B

So if you're, if the application here is handling- or even in your case, if you have maybe um data subjects within europe, you also have to have to follow the gdpr right. So if you do any businesses with europe or any of your vendors customers also um would be residing in europe, and the data has been processed of these data subjects I would say so, then you need to have this data protection and privacy kind of knowledge, so that is then basically the risk assessment afterwards.

B

So that is the thing you need to then know this track modeling. So I ever go into that into detail, but chat. Modeling is just a really a great way to find the risk and to evaluate the risk of your application. um So, for example, you know you have a user input. So how that that's a risk. You know, because you do not trust this, as we said um so, then that goes into the next step into the planning. Then right.

B

So so, if you know you have to to you, have to somehow um validate this input, um you have basically these requirements, so you have to adapt to these requirements or certain controls that you need, because I think is, for example, with the snc um or yeah have snc with the rfc. Basically, if you can trust, maybe or you don't want to trust the normal unencrypted rfc connection, um you might need snc united method encryption, so that would be security control here.

B

So this that's why this risk assessment automatically um comes into the planning, so you know what the requirements would be in your application.

B

Another thing is, as I mentioned, the privacy if you're handling personal information of a european um data subject, you need to also do this. Private privacy impact assessment- and there are certain rules for this as well, but that's just more related to gdpr, um but from these, as I mentioned, if you have things like the snc or you maybe say okay well, we are uploading documents from the internet. He shouldn't trust us at all.

B

Of course you maybe need something like a virus checker or something so that would be control, but from there you know exactly what what to test right. So so you can do the testing on uh if, if these controls are really working, you know that means also. For example, if you say you have this input validation, the test would be okay, the dynamic test, okay, the tester should really check. Can I do these?

B

um Can I input like the sql injection, for example, or if I know um I need to do a viral check or I need to encrypt. So these are the things you can test for later on, so you can create basically, this test plan from the results of your of your um of your chat model.

B

So, that's why you think it's so important to start, first of all to learn what is a trap model and use it as a risk assessment and then from there you know what requirements and control your needs, but also in simple ways what to test for so of course, then this is secured development.

B

So against your programming, you should do a review so how often do tests so that does one question: am I always getting or how? How often should we scan if you have the code? Vulnerability analyzer, for example, yes uh scan?

B

Theoretically as soon as you write code, so even at the end of your of the working day of a developer, they should scan it, um but my very latest at the queue gate. But then there might be a mad rush um if there are vulnerabilities found and they have to be fixed because usually their deadlines as well right.

B

So it's maybe then already a bit too late, but um that's why it should start quite early in the development life cycle to to do the static tests as well, but they later set secure gate um before you, transport range.

B

So and then this of course also the dynamic testing, so you possibly do dynamic testing like the acceptance session, testing or regression testing, um but, yes, think of the security controls and as well just just also use um what you know what you learned from the trad model before so so. Can I test anything for any of the security controls that are indeed working as intended.

B

So a lot of customers, they do independent security assessment, which that means it's basically a penetration test from a third party and of course, you have to have some kind of response plan um in place, so that is already here during the planning, and you just put it into place. You just execute this once and the the um your application is released.

B

So what that means so so, for example, in sap we have a huge security response team. Of course, it's understandable we have them even in any time zone, so that so what that means is basically, if our customers suddenly report the security issues that we can deal with in in that time zone, so basically 24 hours more or less that we can cover any any incidences. That are rising, but I mean in a smaller scale.

B

It means basically that you have to have something in place like a ticketing system, um if you you possibly have that already, but also something somehow that that the end user um can report any security issues with such application. So we had that already a couple of times that the customers, our customers, would um tell us. Oh one of our employees, actually found one ability in our own custom code and if you can support fixing these or maybe have them to find more vulnerabilities that that may be in the coding.

B

So we do see that that customers are using this and um some end users should have the possibility or the ability to enter or to to report any security incidences for set application. And of course, you have to have some kind of plan in place of how to deal with that.

B

So that's the main area we wanted to talk about. I very quickly go into the chat model because I don't think um there's much known about what this is. So I will like briefly cover this um before we go to the q a session.

B

So, yes, what? What is that? So that's the sap definition. What is the track? Modeling is the systematic approach and to uncover security threats, design time- and this is the thing it's done during the design um time- to reach a secure design right. So that's why you use it quite early on um in the stage, so that's the just the the general definition of it. So what are you really doing in sap so track modeling? It's it's nothing that sap invented.

B

It's been there mainly actually by microsoft, and they have this really great module, because it's using all the three most powerful um track models um together to to um yeah, because it again we can have to miss use cases. I like that quite a lot for brainstorming. um I think it's also good. It's unknown a funny unknown or any best practices.

B

um I personally don't like attack trees, but I know that's been usually actually been been done in universities. So, if you're studying um cyber security, it's usually you you're doing that factories. I personally don't like them, but again views basically, all of it. That's called the stride module model. So that's what microsoft is using, and that is what sap is using as well.

B

So just as an example, but again um I would say like whatever you're most comfortable with, if you're studying cyber security in in university and you've done their tech trees and you like them of course, go ahead with duct trees, um if not do the brainstorming um or or mixture of everything, except what the city is doing, I'm but good. So what does strike mean? What does it stand for so spoofing? I'm just gonna put these up as well.

B

So, yes moving um of course it's impersonating someone, so that's busy part of the authentication, the tampering so modifying anything, um so basically that integrity, um information or refradiation is, of course, um claiming that you have performed any or not performed any action. Rather, um information disclosure, it supports the confidentiality and denial of service. Of course, it's like what you have um with any kind of web attacks, usually the dos attacks. Basically, so that would be the availability and elevation of privileges, that's the authorization, so someone gains more access than, and that possibly should have.

B

So yes, so coming back to these, so I think these are the really security basics, so the cia principle, so confidentiality, integrity, availability. So usually it's when talking to customers. They mainly are afraid of the integrity of the systems. Because yeah can you can you trust your system? Can you trust your data? So that is quite scary, so especially with the sql injection right. So so you can potentially change any data in your system or even this this, the directory traversal, you can overwrite files to immediately.

B

So can you actually trust the integrity of your system?

B

So with the gdpr, for example, saying the confidentiality, especially your personal information, is very important, but of course, if you have any confidential data on your system, any highly sensitive data, of course the confidentiality is the most thing. You're afraid of I actually say: availability is the less scariest one, because usually you have the higher availability kind of um systems right, so so you usually have failovers and so on so availability or s attacks, and you have load balancers that are usually protecting you and against these dui sub tags.

B

Maybe, if you're using sub 3 scripting that can be worried that that you could overload the system with something, but generally, I think availability is the least concerns of most customers. That I talk to, of course, as I said authentication, so is that really the right person on the system and then no republication, of course that's one of the um main concerns as well.

B

So, but how do we do the track modeling? So first, you have to ask yourself: okay, what are the assets of the particular system or of that application of the data that you're handling? So is it really highly confidential? Data is a very sensitive data, or is it just well no real um significant data at all.

B

So from there you have to sort of see what would be the risk, how how dang, how bad would that be if this data leaks, for example, or if this data gets somehow been manipulated, so that's what it means by assets. So what is basically what do you have on the system? What what is the processing, usually? Is it hr system, or is it your main erp system? So, in this case, it's of course assets are very important. Those are just some little internal sandbox. Maybe that doesn't have any data.

B

So who are the chat actors so who would be the trade actor so in the application who's it aimed for? Is it the end users? Is it the external users, or is it just maybe an internal tool for your basis, employees for the for the admins, maybe um so who, who are the actual actors, who are the actual user so who could using or misusing this application um and then, of course, the vectors?

B

So how? How is the extra being done um or how can the expert being done so? Is it either via a user interface? So that would be the actual attack vector. So you have to look at the application.

B

Are we relying on on the user input or on the rfc, for example? That would be basically the attack vector. So how is the application being misused? So with this you have to really single. As I said in the planning of your application, you have to ask yourself these questions here and from there you basically can judge the first of all the likelihood. So how difficult is that to attack? So, for example, we move again from your user interface.

B

um Well, you could mitigate it. That's the next thing then, and so the likelihood yeah you have to input user input. It's quite likely that you could um yeah misuse this and if the assets are being high, so the impact is quite high and the likelihood is quite high. You end up with a high risk on this right. So that's how how you use this so then you have to decide. Okay, do I mitigate it? So I said, as I said, for example, mitigation of user input, user interfaces. Of course input validation right.

B

So so you would basically no straight away. Okay. The security control that I need to implement in my application is any kind of input. Validation. um The other thing is, if you're saying okay well. Well, the chat actors are just internal, so we're not really that concerned about internal attacks. The assets there's not much on the system either that that just could be misused, or that could be interesting um in the vector while, okay, it ends up.

B

Maybe here still in the low um category or maybe in the medium here um you could maybe just accept the risk. So so it's good to know about the risk but yeah um we can also just go and say: okay, we accept these, so that was basically the very basic track model that I wanted to discuss.

B

So you see, we are nearly running out of time here and I want to, of course, um open for any question and answers on that or any questions and giving you answers of course. um Yes, so I would say I would end here um with my presentation. I hope you found it useful and yes, um let me know if you have any questions. Are there any questions in the chat? Maybe.

C

A

One question in the q a box, so the question is from anil kumar. Is there any security threat through sap gui.

B

uh Yes, good that you ask that indeed, so by the subguri itself, um it needs to be patched really as well. So I think you had my colleague, frank bugholz already also in one of your webinars. He talked about the patching or security patching. Of course there are security patches also for sub gui, because there are some vulnerabilities known already that that are um mitigated by by patching it. um The other thing is subquery scripting, so if you have it enabled it is quite a vulnerability because and usually use it for mass inputs.

B

I know a lot of customers are doing that and it helps of course, to to you know, enter like a bulk of data but, of course, the misuse. um It is risky, of course, and to to do this yeah indeed, so I guess that is the risk from that, um so any best practice tips for outsourcing about development. So yes, if you're outsourcing the development like a lot of customers and they do that, they don't have any more in-house developments.

B

That's why I was asking about the security guy uh kind of handbook, so you have to really um write in in your security guides or well, but usually you have some kind of development handbook for the developers, so that should be really clear that you also include the security in there so that you either say: okay. Well, please ensure you always have to have a authority check our authorization check in there and make sure that um you mitigate the risk of of uh input, validation and so on. So yes,.

C

Yeah this is here, so is there a sample handbook that you have that we use internally, which you can show at least the main headings of what that development handbook should contain.

B

And we don't, unfortunately, maybe have one of course, but unfortunately I can't um share that.

C

B

C

If you can just share, you know, what's what are some of the things that should be included in that handbook, so.

B

What I've seen from from customers who are using the quite well or doing this quite well as yes? um Basically, you have a list of when I go back at this slide. So so, basically, can I go back to the. Let me just see if I can go back to the previous slides of one of the earlier slides of the typical injections right that I wanted to show going back here.

B

These yeah all these injection things, so you can basically say um basically um avoid all the scale injection avoid all across such scripting ensure there's no up up injection possible and so on right. So you could do all these uh vulnerabilities as a as a negative or as a you know, ensures there's no scale. Injection ensures there's no cross-site scripting, um which leaves it and up to the developer to ensure that they use or if you have user input, use, input, validation and don't trust any any input.

B

If there is an external document being uploaded insured, it's checked for viruses and if it's sensitive data ensure encryption is used. um Well things things like that that you've basically mentioned any of these.

B

There is basically the secure development I think that is available somewhere, um so you can basically use all these forms in in the handbook of saying avoid all these uh typical exploits here or vulnerabilities here, I'll, be more clear and clearer and say um make sure that or ensure um any input is validated any and any user input is validated, ensure that, if um handling sensitive information, that encryption is used, things things like that that if you see in the handbook and ensure that you know you're doing the authorization check properly um yeah and then yeah react to that.

B

So so that's what you've seen so that this, as I said as authorization check, but then there's no handling of of this exception that there's no authorization, so the reaction isn't there or the authorization check is completely missing, so yeah ensure that they are authorization check and ensure there is a action or reaction to this as well, so that so basically use the negative form of these vulnerabilities. Here that you see most um most of these guides are handbooks.

A

Yeah yeah, um I think if you have time, I know that you have another meeting to get to. So, if you have time there is one more question from the chat um is code inspector available in sap, I'm not sure if it was already covered in the later presentation, it came like half an hour before.

B

And so code inspector put inspector is this part of of any sap system yeah, and I have to go to the next meeting here. Sorry.

A

Okay, so if uh anybody has any more questions, please reach out to us, I will be sharing the contacts later. Thank you natasha for the great presentation, um yeah, probably yeah. uh You can talk off and go to the next meeting.

C

You can also post your questions on the whatsapp chat uh and or email us when you receive the registration email. So thank you so much.

B

Thanks very much thanks for hosting thank.

A

B