Latest / Onapsis Podcast / Hacking & Defending SAP Applications Live: Clean Core, Dark Shadows

Transcript

Hacking & Defending SAP Applications Live: Clean Core, Dark Shadows · Onapsis Podcast

• 0:00
  Speaker 1: Good morning and welcome to part two of our Hacking & Defending SAP Applications webinar series, Clean Chord Dark Shadows attacks on BTP and ABAP custom
• 0:11
  Speaker 0: code.
• 0:12
  Speaker 1: My name is Leah And before I hand things over First, I want to point out the questions module within the On-Twenty-Four platform.
• 0:22
  Speaker 1: If you have questions please enter them at any point during this presentation and if time allows we will answer whatever question that can be asked in the end of our discussion.
• 0:31
  Speaker 1: You can always adjust the size of your media player on your own to make it bigger or smaller depending upon preference.
• 0:38
  Speaker 1: There is a video component for this webinar so you'll need to ensure the media players are large enough.
• 0:44
  Speaker 1: And finally, please note that this webinar is being recorded and the link will be sent to you.
• 0:50
  Speaker 1: With us today is JP Perez at Jagoyen on NAPSIS CTO.
• 0:55
  Speaker 1: JP will present two high-stakes threat scenarios in how to prevent them based on real world incidents.
• 1:02
  Speaker 1: with that.
• 1:02
  Speaker 1: JP can we start off?
• 1:06
  Speaker 0: Awesome.
• 1:06
  Speaker 0: thanks Leah.
• 1:07
  Speaker 0: thank everyone for joining really excited hacking and defending SAP applications.
• 1:16
  Speaker 0: We have a lot of content, not a lot time so I'll try to be as concrete that's possible.
• 1:24
  Speaker 0: we start navigating through the slides So in terms agenda will do.
• 1:29
  Speaker 0: quick intro on the docu-series on the third landscape Will talk about challenges extending todays SAP landscapes.
• 1:40
  Speaker 0: Then we'll go through live attack demos, real attacks scenarios and will navigate what to do.
• 1:49
  Speaker 0: We talk about protections remediation defense with close Q&A And hopefully that would give you a good perspective of the potential threats that custom applications face today.
• 2:05
  Speaker 0: All right So Why are we doing this?
• 2:10
  Speaker 0: Hacking and defending SAP applications, we're episode two now.
• 2:15
  Speaker 0: We started to do these because it's very important to start bridging.
• 2:21
  Speaker 0: the theory on practical defenses of SAP systems.
• 2:26
  Speaker 0: nowadays is even more the overall IT security community, SAP Security Community is not separated or isolated from that.
• 2:44
  Speaker 0: And it's important for defenders to be really empowered to defend at the speed of AI right?
• 2:52
  Speaker 0: So that's why It's important to see in real life what these type of threats look like and they should be doing In terms of securing their SAP applications.
• 3:03
  Speaker 0: Of course These docuseries are powered by the UNASIS Research Labs, which is this team of professionals with extensive experience on understanding threats risks vulnerabilities affecting ERP applications.
• 3:21
  Speaker 0: We have been reporting hundreds over a thousand already vulnerabilities to ERP vendors and yeah these unparalleled experiences a core aspect of these docuseries.
• 3:39
  Speaker 0: So the objectives is really to empower the defenders, uh...to be able to respond to this type of threats on time and with the right speed that it's required in todays completely new world Right?
• 3:57
  Speaker 0: This AI World is shifting the timelines significantly.
• 4:07
  Speaker 0: Before jumping into content, a word or two on Apsis Research Labs this team of professionals that is continuously monitoring on one side potential vulnerabilities, potential threats to SAP applications and other sites monitoring what threat actors do really bringing all of their knowledge to the Onapsis platform, two of our customers so they can timely respond to vulnerabilities and threats affecting SAP application.
• 4:41
  Speaker 0: If you think about some of them most critical vulnerabilities affecting SAP in the history of SAP applications Most have been reported undiscovered by the onapsis research labs which actually makes me very proud because this team is actively contributing to making SAP applications more secure, one vulnerability at a time.
• 5:07
  Speaker 0: So think about the contribution that we have been doing over time and that's why I'm very proud has being significant right?
• 5:18
  Speaker 0: And of course too our customers giving them the ability to detect and manage these risks even ahead a key to our customer base.
• 5:30
  Speaker 0: All right, let's go into todays topic the challenge of extending Today's SAP landscape and that is why they titled Right Clean Core Dark Clouds The ADA.
• 5:45
  Speaker 0: There Is A Strategy Pushed By SAP To Clean Core Which Is Good One.
• 5:54
  Speaker 0: We Upload All Of Them the initiatives that SAP is taking, historically SAP has been embracing secure by default.
• 6:07
  Speaker 0: The cloud and many other initiatives are a step forward in terms of security.
• 6:15
  Speaker 0: There's still a lot risk if customers think that by navigating through and embracing all of their latest technology they're going to get rid of the vulnerability and risks, that's not a reality.
• 6:32
  Speaker 0: The reality is customers still need to customize their applications.
• 6:38
  Speaker 0: That why many organizations are in rise on private cloud version as for with the ability to customize or extend.
• 6:52
  Speaker 0: And still, organizations need to be able to match their business processes through the technology they use.
• 6:58
  Speaker 0: That's true extensions on BTP, extensions on ABAP.
• 7:03
  Speaker 0: so there are realities that today it is much more broad than a number of options customers have to extend and customize.
• 7:13
  Speaker 0: So thats why its important understand.
• 7:16
  Speaker 0: this is something we need to address right?
• 7:20
  Speaker 0: Thinkor is good Let's say the objective of getting there is good.
• 7:28
  Speaker 0: The reality that organizations still have a lot of customizations from their history, will continue to introduce customization and extensions because they need to extend and customize the core standard delivered by SAP as customers need to be able to properly secure that.
• 7:56
  Speaker 0: So a little bit of history here, if you have been running SAP for several years?
• 8:04
  Speaker 0: You're probably familiar with this.
• 8:07
  Speaker 0: extending or customizing SAP applications especially on-prem or even in private clouds has been something like these.
• 8:18
  Speaker 0: Of course there are some flavors but is really SD-ThirtyA, SEAD Eclipse ADT CDS creating workbench requests or transport requests.
• 8:33
  Speaker 0: Transporting from development to QA testing doing the proper testing and then moving into production.
• 8:42
  Speaker 0: so that's been a history of extending and customizing SAP applications with the majority of it being custom ABAP code delivered on top of standard SAP code.
• 9:03
  Speaker 0: Now, today extending SAP can be all what we saw which actually is still a lot of that customization extensions extending through Custom Code and ABAP on top of the standard, but then we have many other options as well.
• 9:25
  Speaker 0: We can extend on BTP the functionality that is provided for example in our S-FORHANA and we had different options with Fiori elements, Cap backends right?
• 9:39
  Speaker 0: On NodeJS Java Cloud Foundry supporting custom applications are integrated ABAP-based core.
• 9:51
  Speaker 0: We have many other alternatives to create and maintain custom code that version the code, those development pipelines.
• 10:05
  Speaker 0: so all of their new way of developing has been introduced in through SAP capabilities for extensions on BTP some also extending on ABAP, like ABAP Git and other capabilities.
• 10:22
  Speaker 0: But the reality is that now extending applications is much more than just a custom code right?
• 10:29
  Speaker 0: So you have some examples here of what it looks like still with classic abap our Z code that everyone is so familiar or custom namespaces that you may have in your organization.
• 10:47
  Speaker 0: But yeah, this is how it's growing and evolving.
• 10:52
  Speaker 0: And we believe that also with AI its going to continue evolve into even more options, more alternatives, more capabilities provided by SAP.
• 11:05
  Speaker 0: A little bit of who are the key players here?
• 11:14
  Speaker 0: Who are their personas let say involved in extending or customizing SAP, these are just some of them.
• 11:24
  Speaker 0: We have the business users for Fiori in-app extensibility which may not have any knowledge on SAP technology but yes and how to extend through Fiorin app extensivity really with their right knowledge from that business function.
• 11:44
  Speaker 0: then we had a classic ABAP developers developer on ABAP in the cloud.
• 11:51
  Speaker 0: We have the CAP developers for VTP applications, Fiori as well for UI-V HTML five applications.
• 12:00
  Speaker 0: and then we also integration developers right?
• 12:03
  Speaker 0: For the Cloud Integration Suite where you have developers creating those integrations between on-prem cloud private clouds, SaaS solutions a little bit all over.
• 12:16
  Speaker 0: So these are just some examples of who the users behind extending and customizing SAP.
• 12:25
  Speaker 0: we're going to be focusing on some of this not all of them because time doesn't allow but at the examples that we have will be touching upon some of his personas Just to wrap up a little introduction.
• 12:43
  Speaker 0: The securing the business is tougher than ever, right?
• 12:47
  Speaker 0: So talk about AI.
• 12:50
  Speaker 0: Talk about the cloud really... The environments that we have today in SAP customers are a really hybrid environment with a little bit of everything.
• 13:04
  Speaker 0: BTP on-prem private Cloud public Cloud SaaS solutions all of it integrated, with special needs for customizations and extensions that are being deployed on BTP or custom code in different places.
• 13:22
  Speaker 0: So really been able to secure that is challenging.
• 13:29
  Speaker 0: It was challenging the past but its becoming more difficult as complexity of SAP technology evolves.
• 13:38
  Speaker 0: so let's go into live attack demos.
• 13:42
  Speaker 0: We set up two specific demos highlighting two very different scenarios, the first scenario that we're going to see is really purely on ABAB.
• 13:55
  Speaker 0: We are gonna talk about a potentially malicious developer who's introducing potentially malicious code in ABAb custom code and runs it in an S for HANA system and we'll see a little bit of how it works in terms off, how that is modified introduced.
• 14:18
  Speaker 0: How that's triggered?
• 14:20
  Speaker 0: The other scenario is more on the BTP side right.
• 14:23
  Speaker 0: so its a PTP application extending an integrating with S-for-HANA system on premise connected through Cloud Connector.
• 14:35
  Speaker 0: there is here a little bit of all data exposed.
• 14:40
  Speaker 0: There's a little javascript, NodeJS running on Cloud Foundry and expose through PTP integrated as I mentioned to specific destination going into the SAP Cloud Connector.
• 14:57
  Speaker 0: All right!
• 15:01
  Speaker 0: The first demo is portraying well-intended developer.
• 15:07
  Speaker 0: this well-intended developer is someone creating an app on BTP.
• 15:14
  Speaker 0: This developer has experience, creating code in on BPP, NodeJS, some UI five different elements of these.
• 15:28
  Speaker 0: but the developer doesn't have a lot of background and security.
• 15:34
  Speaker 0: so while he's well intended to serve the requirements that were provided him, of him or her.
• 15:44
  Speaker 0: The reality is that unknowingly this developer is introducing specific vulnerabilities that could expose the entire application and we'll see that these could also expose the backend applications as well right?
• 16:02
  Speaker 0: This is what it looks like.
• 16:04
  Speaker 0: The app itself is a fury, really the look and feel of other SAP applications that's using SAP libraries, SAP technology to serve their UI as well.
• 16:20
  Speaker 0: And this is what he looks like both the application on the attack demo we are going see.
• 16:26
  Speaker 0: so they're.
• 16:28
  Speaker 0: the application is on BTP in Cloud Foundry.
• 16:32
  Speaker 0: The attacker is going to log in into the application, he's gonna see that there are different vulnerabilities.
• 16:41
  Speaker 0: It's got to be able to see some of those weaknesses and potentially exploit those weaknesses ultimately connecting into their backend system.
• 16:51
  Speaker 0: for ease or simplicity we're connecting directly to a back-end system And now you could tell me okay but they original applications go through cloud connectors.
• 16:59
  Speaker 0: so thats true.
• 17:02
  Speaker 0: Potentially, it could be possible also to go through CloudConnector but it adds some complexity.
• 17:08
  Speaker 0: For the sake of simplicity we are doing this A, compromising the BTP application and then through that compromise navigating into the backend system which would be on-prem And these users should be sitting in a network place that allows for both connections.
• 17:30
  Speaker 0: So let's go with the demo and I'm gonna be explaining what you are seeing on your screen.
• 17:41
  Speaker 0: So the user is connecting to the PTP app, right?
• 17:48
  Speaker 0: This user is accessing this specific link.
• 17:52
  Speaker 0: authenticating into a system is Sean Brennan.
• 17:57
  Speaker 0: He has a user in his system navigating through different capabilities.
• 18:02
  Speaker 0: there's a directory as you may have in other places, an employee directory pulling data from the backend SAP showing you different colleagues of this person.
• 18:14
  Speaker 0: But there's also a profile here right?
• 18:18
  Speaker 0: So they user is looking at information that...of his own profile for example compensation and also employment data, the vial.
• 18:29
  Speaker 0: so now their users sees them.
• 18:32
  Speaker 0: hey if I modify this parameter, what's happening?
• 18:36
  Speaker 0: Okay.
• 18:37
  Speaker 0: So modifying the specific parameter provided by the application.
• 18:41
  Speaker 0: these user is now able to see compensation from other users which he absolutely should not.
• 18:48
  Speaker 0: for example they CEO compensation right in this case looking at his personal data as well.
• 18:56
  Speaker 0: that wasn't available through employee directory.
• 18:59
  Speaker 0: Now there are a possibility to modify the BIO if you are able to see their profile.
• 19:08
  Speaker 0: Now deploying specific payload on the BEO, specific bio they user can now change behavior of application because it's cross-site scripting right?
• 19:23
  Speaker 0: This information could be exfiltrated through this cross site script that is permanent and installed.
• 19:30
  Speaker 0: so anyone looking at profile so he could change for all of the different profiles and could compromise this specific session off those target users with a stored cross-site scripting.
• 19:48
  Speaker 0: Now, that's one attack that an attacker can perform.
• 19:52
  Speaker 0: This other attack here realized there is this export base leap.
• 19:59
  Speaker 0: So you could export the information of your salary, like the deductions and all that information.
• 20:07
  Speaker 0: So exporting that could yield some potential insights right?
• 20:16
  Speaker 0: The user is exporting his own payslip Sam Brennan.
• 20:21
  Speaker 0: he's actually looking at his pay slip okay this is a salary netpay but also realized that in the same functionality, he could introduce other characters.
• 20:37
  Speaker 0: That could yield another vulnerability and this is a common injection vulnerability.
• 20:43
  Speaker 0: The common injection could be abused to exfiltrate internal information of those BTP services And use that actually abuse one of their BTPs.
• 20:57
  Speaker 0: This is a client ID, Client Secret for specific service that is the destination service.
• 21:05
  Speaker 0: Now with that information this attacker could now exfit trade credentials that are stored on that destination service and he's actually has a Python script for doing that.
• 21:22
  Speaker 0: Voila!
• 21:23
  Speaker 0: So now the information of a specific destination is provided to this malicious attacker, right?
• 21:33
  Speaker 0: So now these information could be used to go back that backend system and connect it an access.
• 21:44
  Speaker 0: Information that can be available for specific user which a technical user use to bridge between the BTP on the backend systems.
• 21:56
  Speaker 0: in this case It really depends on the authorizations that are provided to this user, but we'll see.
• 22:04
  Speaker 0: once they use it is able to connect which.
• 22:08
  Speaker 0: The user was able to collect and he's providing those credentials of course a secure credential secured password configured there very strong.
• 22:20
  Speaker 0: But through their views off these service?
• 22:27
  Speaker 0: Now, the attacker is logging into a system.
• 22:31
  Speaker 0: And now it's all up to the credentials of that user right?
• 22:35
  Speaker 0: So now its accessing BP transaction but could be other transactions like SE-Sixteen to navigate business tables.
• 22:45
  Speaker 0: in this case we are just looking at users here too But these could potentially anyone on on the system, right?
• 22:55
  Speaker 0: Any table that is authorized to be seen.
• 22:59
  Speaker 0: And then let's continue with this session.
• 23:05
  Speaker 0: hopefully you can go back to slides.
• 23:08
  Speaker 0: so what happened here?
• 23:11
  Speaker 0: some renon junior security analyst.
• 23:14
  Speaker 0: this user was able to connect to a BTP and access their different functionalities legitimately available to this user, but then through different vulnerabilities.
• 23:27
  Speaker 0: This user was able to see compensation for other users information potentially for all.
• 23:35
  Speaker 0: the users attack through cross-site scripting and their profiles also export based.
• 23:44
  Speaker 0: his own base leap back through abusing of that he.
• 23:49
  Speaker 0: these use could common injection vulnerability, X-field trading information of the destination service and internal secrets of their BTP destination services.
• 24:06
  Speaker 0: X field trade those credentials and connect back to the backend system using the credentials.
• 24:13
  Speaker 0: so this is a hypothetical scenario that it's possible if there are vulnerabilities introduced and not really properly assessed in this BTP application.
• 24:30
  Speaker 0: Some examples of some of these vulnerabilities, I mentioned cross-site scripting.
• 24:35
  Speaker 0: there was also an anonymous access to an exposed API.
• 24:39
  Speaker 0: that is also possible depending on how the system is configured OS command injection.
• 24:44
  Speaker 0: so here you have a example of on axis control identifying the exact code and how it should be fixed.
• 24:57
  Speaker 0: So this is, the other part of these.
• 25:00
  Speaker 0: we'll see some demos on how to address these vulnerabilities but there are.
• 25:06
  Speaker 0: these examples highlight some of their vulnerabilities identified by Anapsis control.
• 25:13
  Speaker 0: Okay now a different perspective right?
• 25:16
  Speaker 0: On the first one was so completely legitimate developer that was well-intended, but introduced vulnerabilities on the system without unknowingly.
• 25:30
  Speaker 0: So this second scenario is a developer who has the malicious intent to compromise his system.
• 25:39
  Speaker 0: he had some level of privileges But these attackers want to ensure that potentially something malicious can happen or some elevated access could happen in production for example.
• 25:53
  Speaker 0: All right, this scenario is different.
• 25:57
  Speaker 0: we are now in the world of traditional ABAP code.
• 26:02
  Speaker 0: so this a report Z vendor master review completely valid reports requested by AP back office users who need to run it before month end.
• 26:18
  Speaker 0: analyzing potentially duplicated block vendors, missing tax IDs all coming from table LFA one.
• 26:28
  Speaker 0: The requirements for executing this report are valid.
• 26:31
  Speaker 0: you can execute it through transaction code GVMR or SE-ThirtyEight.
• 26:37
  Speaker 0: with the execution of the program name there is a specific role Only grants a very limited number of authorizations.
• 26:50
  Speaker 0: LFL, LFA-I GRP S program ST code.
• 26:54
  Speaker 0: nothing high privileged or really critical beyond what needs to be provided and this is the diagram right.
• 27:05
  Speaker 0: so The end user which we are going see uses these reports legitimately.
• 27:14
  Speaker 0: Nothing out of the ordinary But then we'll see how a developer modifies this report.
• 27:21
  Speaker 0: This reports ends up going all the way to production and potentially abused by the developer with access to it, will see what impact of that?
• 27:34
  Speaker 0: All right.
• 27:38
  Speaker 0: Demo two... Okay there you go We're back on track!
• 27:46
  Speaker 0: the scenario where we have ABAP code, someone is Mary Rogers.
• 27:57
  Speaker 0: It's an AP user who periodically runs this report.
• 28:03
  Speaker 0: it's a completely legit report that was requested to the ABAP development team with their rights specific requirements right?
• 28:14
  Speaker 0: So they're report fulfills all of those.
• 28:21
  Speaker 0: This report is pre-executed, everything normal nothing out of the ordinary.
• 28:25
  Speaker 0: But there's another user that is a developer that is connecting to their system and has privileges too.
• 28:35
  Speaker 0: develop right?
• 28:36
  Speaker 0: So in this case we have the developer that it not authorized.
• 28:43
  Speaker 0: do any like execute transaction BP or SCO one.
• 28:48
  Speaker 0: This developer has only developer rights in this system, which can modify code.
• 28:55
  Speaker 0: Ultimately these codes will end up going to production and we can see the Bendo Master Review.
• 29:03
  Speaker 0: it's like why was created.
• 29:08
  Speaker 0: what is doing?
• 29:09
  Speaker 0: there are authorization checks In their.
• 29:15
  Speaker 0: There is access to table LFA-one and doing some filtering presentation to the user.
• 29:25
  Speaker 0: It's a very simple report, but this developer has a very extensive knowledge of ABAP so he has specific code that can be added at the end of their reports completely altering the behavior.
• 29:48
  Speaker 0: So in this case, we see it's adding some OK codes.
• 29:55
  Speaker 0: Some specific processing depending on the OK code that were providing and
• 30:03
  Speaker 1: its
• 30:03
  Speaker 0: somehow working with USRBF-II.
• 30:09
  Speaker 0: That is basically a user buffer table right?
• 30:13
  Speaker 0: You don't need to understand exactly what it is but you you'll see the impact.
• 30:18
  Speaker 0: So this is basically tampering with a session of the user, so they develop or execute their code and when these new codes executing X access it's just name could be anything additional authorizations were added to use a buffer.
• 30:41
  Speaker 0: now This user that wasn't able to access SUC one is now able to access it.
• 30:50
  Speaker 0: But interestingly enough, if we look at his roles... We see that he has developer roles.
• 30:56
  Speaker 0: He had the role of executing this specific report but nothing else Shouldn't be able to use SCS-O-one or transaction BP for example.
• 31:09
  Speaker 0: All those things shouldn't be authorized.
• 31:12
  Speaker 0: and what you are seeing?
• 31:17
  Speaker 0: report RS-USR-COOC, which is part of SUIM.
• 31:22
  Speaker 0: What an auditor would use?
• 31:24
  Speaker 0: and if we look at the user profiles nothing out of the ordinary right?
• 31:31
  Speaker 0: So all of their authorizations that are granted through the roles this user legitimately has.
• 31:39
  Speaker 0: however We just saw he executed SCO one.
• 31:42
  Speaker 0: so there's something else.
• 31:44
  Speaker 0: they're on that.
• 31:44
  Speaker 0: something else because In the user buffer, he has all authorizations.
• 31:50
  Speaker 0: So now their user is accessing transaction BP for maintaining business partners.
• 31:57
  Speaker 0: so it's looking at existing business partner vendors in this case and what these users are going to do.
• 32:09
  Speaker 0: his gonna search for specific vendors navigating through them so that there is a certain pattern.
• 32:18
  Speaker 0: Okay, let's access this one and he's actually going to payment
• 32:26
  Speaker 0: transaction.".
• 32:27
  Speaker 0: So that said bank account then these vendor is actually being paid on?
• 32:34
  Speaker 0: Never modified other than when the vendor was created.
• 32:38
  Speaker 0: Now accessing that modifying the bank account, potentially the bank key or other details.
• 32:47
  Speaker 0: He's putting his own bank accounts and now if of course in history we see another change.
• 32:57
  Speaker 0: so this was actually modified into master records.
• 33:03
  Speaker 0: So every time that vendor is paid This user will get that payment.
• 33:13
  Speaker 0: Now, the last part is this user executed another OK code which cleaned their use of buffer from what was added before.
• 33:22
  Speaker 0: So now they used it doesn't have any more privileges to access SU-Zero one or BP?
• 33:30
  Speaker 0: Or any other transaction at that point right.
• 33:32
  Speaker 0: so when he shows us that for a small period time completely untraceably these users got high privileges.
• 33:43
  Speaker 0: So now going back to the slides, what happened was that this malicious developer got SAP.
• 33:53
  Speaker 0: all could access any business data.
• 33:55
  Speaker 0: As I mentioned too you logged into Sforhana run that specific modified reports or program and then accessed a specific OK code.
• 34:11
  Speaker 0: after that, anything could happen completely and traceably from a permissions perspective.
• 34:17
  Speaker 0: From an audit perspective the backdoor is really okay code calling specific code that is inserting into the user buffer.
• 34:31
  Speaker 0: so this it's very technical form on the A website but That was technically possible right?
• 34:40
  Speaker 0: The reality when you have access to modify ABAP code, anything can happen.
• 34:45
  Speaker 0: This is just one example.
• 34:47
  Speaker 0: this developer could have hidden the code in many different ways to avoid being detected as malicious right?
• 34:57
  Speaker 0: To the eyes of potentially a reviewer like Could be doing different applying different techniques to make it really not been detected.
• 35:07
  Speaker 0: that's why It's important to have automation at the detection level, so these type of things can be properly identified.
• 35:20
  Speaker 0: This is an example of control identifying some of the issues that this report had and if you think about it was just one report with many different vulnerabilities in it.
• 35:35
  Speaker 0: now If you extrapolate to potentially functionality, many reports made transactions.
• 35:46
  Speaker 0: Function modules, BAP is the different elements that you could be creating and maintaining over time.
• 35:54
  Speaker 0: That's a significantly large attack surface right?
• 36:00
  Speaker 0: All right so what should we go about it?
• 36:08
  Speaker 0: how can we address this all?
• 36:11
  Speaker 0: That's where we kick in, right?
• 36:16
  Speaker 0: There is many ways you could prevent this from happening.
• 36:20
  Speaker 0: You can automate security and compliance testing... ...you can correct errors while typing when this actually being created.. ..you can prevent vulnerabilities on development phase rather than on production.
• 36:37
  Speaker 0: once the code is in production You can train developers to secure develop, right?
• 36:43
  Speaker 0: To introduce a code.
• 36:45
  Speaker 0: It can ensure compliance with strict regulations and of course all this saving time money while improving quality and security.
• 36:58
  Speaker 0: How is our product on abscess control which performs all the things that are heads achieving All of these things I mentioned before?
• 37:08
  Speaker 0: integrate into your development processes into your development pipelines, also able to assess production code.
• 37:16
  Speaker 0: I have some demos for this.
• 37:21
  Speaker 0: very quickly too.
• 37:23
  Speaker 0: show you what it looks like in reality when you need to address securing custom code.
• 37:31
  Speaker 0: so In these case What we are seeing is basically the Bundable report, part of a specific transport request.
• 37:44
  Speaker 0: This was when they develop or created
• 37:45
  Speaker 1: this
• 37:46
  Speaker 0: and was transporting it to PA and ultimately transported into production.
• 37:52
  Speaker 0: what you are seeing?
• 37:53
  Speaker 0: that there is the transport being stopped by control saying no these has vulnerabilities or ill-intended developers from introducing vulnerabilities, which is not the majority of cases.
• 38:13
  Speaker 0: But we know that's possible and there are examples where that happened.
• 38:20
  Speaker 0: so preventing someone introducing a vulnerability on purpose through change management process with control being able to assist you.
• 38:33
  Speaker 0: then Now, the second demo that I wanted to highlight here is on the BTP side.
• 38:41
  Speaker 0: You may be using a business application studio.
• 38:45
  Speaker 0: you maybe creating different components, JavaScript, different elements of your BTP applications.
• 38:55
  Speaker 0: while doing that you can use control to identify specific vulnerabilities.
• 38:59
  Speaker 0: this is cross-site scripting vulnerability.
• 39:03
  Speaker 0: sorry that is introduced in one of the JavaScript elements, and you can see why your typing... The results are changing from one vulnerability to two vulnerabilities.
• 39:19
  Speaker 0: And then if you remove a comment out again, it becomes zero again.
• 39:28
  Speaker 0: That's how real-time these controls when you are using Business Application Studio or any development environment, control supports most of the widely used development environments to develop on BTP but also on ABAP code as well.
• 39:48
  Speaker 0: There we have information about the vulnerability how to solve it and all that is part of control right there at the hands.
• 40:00
  Speaker 0: The other element, and just to close the loop is how this integrates into the Anapsys platform as well.
• 40:11
  Speaker 0: I show you control product integrates in to transform management system at the hands of your developers when they are creating code.
• 40:21
  Speaker 0: You can also assess repositories, you can access productive environments, you could assess your entire code base with the on-appsys platform as well.
• 40:32
  Speaker 0: As part of those capabilities off their control product line, right?
• 40:38
  Speaker 0: So it could be a gig repository or an AVAP asset.
• 40:44
  Speaker 0: all that UI five and everything is possible through really integrating visibility in existing vulnerabilities to the on appsys platform.
• 40:58
  Speaker 0: so that was just really close the loop on, okay if I have the Nazis platform and control how do i look that uh all in the same place.
• 41:06
  Speaker 0: well.
• 41:07
  Speaker 0: That's one part of how you had their right level of visibility into your existing potential vulnerabilities in your call.
• 41:18
  Speaker 0: And this is the UI for have been using for the vulnerabilities in code kernel, configurations on integrations authorizations all of the other elements.
• 41:45
  Speaker 0: That's just a last demo that I had prepared for you Just going back to the slides and wrapping up because we are running out of time.
• 41:56
  Speaker 0: This is The objecting of control is really giving you the ability to make all of their developers able to develop secure code, right?
• 42:09
  Speaker 0: Develop a code that's basically compliant with your policies and blocking any type potentially vulnerable codes at quality gate, right?
• 42:27
  Speaker 0: In QA or even at the hands of your developers.
• 42:32
  Speaker 0: At the IDE in business application studio using Eclipse, using any type development environment you use and with that we have some time for questions.
• 42:47
  Speaker 0: so back to you Lea
• 42:50
  Speaker 1: Oh great thank you so much JP.
• 42:51
  Speaker 1: this is awesome.
• 42:52
  Speaker 1: I think people are really going Appreciate this, and the videos were really helpful just to see all of us in action.
• 43:01
  Speaker 1: So we did have a lot questions that came in but I think we're pretty close at time so i may ask you one of them.
• 43:09
  Speaker 1: here goes This is question.
• 43:12
  Speaker 1: The final question are they first?
• 43:14
  Speaker 1: and final question our SAP footprint Is twenty years old?
• 43:18
  Speaker 1: And give millions of lines of custom ABAP
• 43:21
  Speaker 0: code.
• 43:22
  Speaker 1: At rest If we run an automated scan of all that legacy code, we're terrified at getting hit with thousands and false positives.
• 43:30
  Speaker 1: We don't have the resources to fix.
• 43:33
  Speaker 1: how do we prioritize what actually matters?
• 43:38
  Speaker 0: That's a great question.
• 43:38
  Speaker 0: I'm not any easy problem to solve right.
• 43:42
  Speaker 0: so if you are sitting on it on a ton off potentially vulnerable custom code there is risk they'll write so that that custom called.
• 43:52
  Speaker 0: In the past, we have seen many incidents driven by situations like that.
• 43:58
  Speaker 0: Insecure reports, insecure code can be used from an issues perspective.
• 44:08
  Speaker 0: It's all about prioritizing.
• 44:10
  Speaker 0: First is being able to have a right level of visibility and being able prioritize those critical issues.
• 44:17
  Speaker 0: first and foremost that's right there a compliance violation for many of the major compliance mandates.
• 44:27
  Speaker 0: Then it is about stop the bleeding, so make sure you don't introduce additional vulnerabilities.
• 44:34
  Speaker 0: put these type of controls at the hands of your developers So you stopped any additional vulnerabilities to be introduced and then prioritizing.
• 44:45
  Speaker 0: what do we have with help for prioritizing that, right?
• 44:51
  Speaker 0: It's not the same if you have a missing authorization at specific code than if we had let us say common injection flow available to many users in a code that is available too many uses.
• 45:09
  Speaker 0: So there are some type of prioritization they need make and it's process, right security isn't one-and-one.
• 45:17
  Speaker 0: So you mitigate the introduction of additional risks.
• 45:23
  Speaker 0: You analyze the exposure, you have your prioritized demonstratical risk and then introduce potentially automated fix right?
• 45:34
  Speaker 0: There's other capabilities that allow to close some of those risks without they need to involve significant manual effort with a lot automation.
• 45:45
  Speaker 0: thats possible today.
• 45:46
  Speaker 0: so As you see, it looks like a simple question but has many, many caveats.
• 45:54
  Speaker 0: It's not an easy problem to solve and the good part is that there are solutions
• 46:02
  Speaker 1: for those elements right?
• 46:05
  Speaker 1: Great thank you so much JP for answering my questions.
• 46:09
  Speaker 1: we're slightly over time.
• 46:11
  Speaker 1: I'm just going to wrap things up here.
• 46:14
  Speaker 1: For any other questions in chat will be reaching out individually.
• 46:18
  Speaker 1: Just a brief reminder to everyone listening that this session has been recorded and the link for their recording will be emailed to you.
• 46:25
  Speaker 1: With that, thanks again to JP for providing valuable insights into how you can eliminate vulnerable and malicious code across the BTP and ABAP spectrum.
• 46:36
  Speaker 1: Thanks so much.
• 46:36
  Speaker 1: everybody have great day!