Latest / Onapsis Podcast / The Hidden Risks of AI-Generated SAP Custom Code

Transcript

The Hidden Risks of AI-Generated SAP Custom Code · Onapsis Podcast

• 0:01
  Speaker 1: Hello,
• 0:01
  Speaker 2: everyone.
• 0:02
  Speaker 2: And thanks for joining today's webinar.
• 0:04
  Speaker 2: The Hidden Risk of AI-Generated SAP Custom Code.
• 0:08
  Speaker 2: My name is Cecilia Deloy and I will be managing Today's session.
• 0:12
  Speaker 2: Before we get started i have some housekeeping notes.
• 0:15
  Speaker 2: First ,I want to point out the questions module within the On-Twenty-Four platform.
• 0:20
  Speaker 2: We welcome you to answer your question at any time during their presentation.
• 0:24
  Speaker 2: If time allows You'll answer whatever questions you can At end of this session.
• 0:30
  Speaker 2: Also, there is the option to request a meeting with our experts.
• 0:33
  Speaker 2: Feel free to fill out the form on your left hand side.
• 0:37
  Speaker 2: You can always address the size of the media player To make it bigger or smaller depending upon your preference.
• 0:44
  Speaker 2: Finally please note that this session has been recorded and we will share a link for this session after we wrap up today.
• 0:51
  Speaker 2: Now I'm going to pass it over to our presenter.
• 0:54
  Speaker 2: With us today We have Viva's career Associated Vice President Saiba Rizq Adiloy and Elke Bastian, Senior Product Marketing Manager for Control at Anastas.
• 1:06
  Speaker 2: They will be taking us to how organizations can safety harness AI innovation without compromising SAP security?
• 1:14
  Speaker 2: And with that I'm handing over it to our presenters.
• 1:19
  Speaker 0: Thank you, Cecil for the nice introduction and welcome to our participants.
• 1:26
  Speaker 0: So again my name is Elke Bastian.
• 1:29
  Speaker 0: I'm Senior Product Marketing Manager for Onapsis Control at Onapses And At the end of this session we will talk a little bit more about control but before We come to that in SAP custom code.
• 1:53
  Speaker 0: But before we start, I hand over to Vaibhav... ...to give him the possibility of introducing himself as well.
• 2:05
  Speaker 1: Thanks Alka!
• 2:06
  Speaker 1: Good morning and good evening everyone.
• 2:08
  Speaker 1: depending on where you are I'm a associate vice president at Deloitte, have more than eighteen years of experience in this area.
• 2:17
  Speaker 1: Primarily been focusing on securing SAP landscapes not only from role-based access control but actually securing it with nine different cyber domains .I also lead the SAP vulnerability management practice here and looking forward for sharing some with AI-generated custom codes today.
• 2:44
  Speaker 0: Thank you very much, so maybe let's start directly with some numbers?
• 2:51
  Speaker 0: Yeah looks like some random number is made.
• 2:54
  Speaker 0: do have an idea what they mean?
• 2:57
  Speaker 0: Maybe not.
• 2:58
  Speaker 0: So it's sixty two Two point seven four Three.
• 3:05
  Speaker 0: But yeah Let me solve this question about the numbers, of course they have something to do with AI generated code and risks that it can bring.
• 3:21
  Speaker 0: And there are several studies And I picked some of them and choose some numbers to introduce a topic for today, really raise the awareness of the importance on this topic.
• 3:40
  Speaker 0: So let's start with the sixty-two.
• 3:44
  Speaker 0: This comes from study that evaluated that forty one to sixty two percent of AI generated code contains security vulnerabilities.
• 3:55
  Speaker 0: It's quite a lot.
• 3:57
  Speaker 0: So it is probably more than half of the code that can have vulnerabilities.
• 4:05
  Speaker 0: and let us look at next number, two point seven four.
• 4:10
  Speaker 0: so what could this mean?
• 4:12
  Speaker 1: This
• 4:14
  Speaker 0: comes from study compared to codes created by humans with code created by JI they found out especially for security issues the probability can be up to two point seven four times higher for risks than in human code or code created by humans.
• 4:40
  Speaker 0: In average, it's one point seven times higher overall issues that also cover logic and correctness, code quality maintainability and also performance.
• 4:56
  Speaker 0: In all areas, we can have higher probability for issues in AI-generated code.
• 5:05
  Speaker 0: Let's come to the final number of three.
• 5:07
  Speaker 1: This comes
• 5:08
  Speaker 0: from our own research named Theonepsis Threat Research and new unprotected applications provisioned in Cloud environments can be discovered and compromised in less than three hours.
• 5:27
  Speaker 0: This really highlights how fast hackers can compromise you nowadays, and how important it is to secure a specialty application that are published on the cloud.
• 5:42
  Speaker 0: I will even come with some more numbers Because another study discovered that seventy one percent of organizations are already using AI models and source code.
• 5:57
  Speaker 0: And forty six percent of them doing this in a risky way.
• 6:02
  Speaker 0: so actually we know the problem, but you can gain a lot of productivity effects if you are using AI.
• 6:17
  Speaker 0: So what are you going to do?
• 6:20
  Speaker 0: This brings me to our first poll for today.
• 6:25
  Speaker 1: I'm
• 6:26
  Speaker 0: very curious, What about you?
• 6:28
  Speaker 0: Are you using AI for code generation already?
• 6:34
  Speaker 0: Yes frequently yes occasionally i am just starting or no?
• 6:44
  Speaker 0: I can see that some people already submitted and i hope we will be able to see the results in a minute.
• 7:24
  Speaker 0: Let's wait for more seconds, now let us look at our result.
• 7:35
  Speaker 0: Oh this is actually quite balanced.
• 7:39
  Speaker 0: Fabav did you
• 7:40
  Speaker 1: expect it?
• 7:42
  Speaker 1: No, yes, like frequently, twenty three percent.
• 7:45
  Speaker 1: That was good!
• 7:49
  Speaker 0: Yeah okay but only seven percent answered no or almost eight percent answered no, and the rest is relatively balanced.
• 7:57
  Speaker 0: Okay that's interesting.
• 8:01
  Speaker 0: I have another poll for you.
• 8:05
  Speaker 0: do we think you are doing this in a secure way?
• 8:10
  Speaker 0: Absolutely i hope so.
• 8:13
  Speaker 0: probably not don't know?
• 8:18
  Speaker 0: yeah let's wait a while.
• 8:19
  Speaker 0: vibe up to you.
• 8:21
  Speaker 0: Do You Want To Make A Guess?
• 8:26
  Speaker 1: Probably Between B or C is what I would expect.
• 8:32
  Speaker 1: There could be a few people who will do absolutely and doing it the right way, but yeah majority of them say B or c?
• 8:40
  Speaker 1: Yeah
• 8:43
  Speaker 0: i think so too because its really complex topic and i think its difficult to say.
• 8:50
  Speaker 0: if you are really secure let me check that we can already get answers.
• 8:59
  Speaker 0: yes a relatively high percentage answer don't know.
• 9:07
  Speaker 0: Yeah, interesting
• 9:08
  Speaker 1: and
• 9:09
  Speaker 0: very low percent percentage is absolutely sure.
• 9:14
  Speaker 0: okay this really interesting.
• 9:17
  Speaker 0: thank you for your participation and answers.
• 9:21
  Speaker 0: so maybe let's now have look at what risks and challenges can come with AI generated Code.
• 9:34
  Speaker 0: Yeah, you can see five pillars here how we summarized it.
• 9:39
  Speaker 0: so the first one can be missing business contacts.
• 9:44
  Speaker 0: text like Missing Authority checks Can be a risk.
• 9:48
  Speaker 0: then We have replicating legacy flaws AI hallucinations and ghost dependencies which is clear.
• 9:59
  Speaker 0: I mean, everybody who uses AI knows that the answers are not always completely correct.
• 10:06
  Speaker 0: and then we have the regulatory compliance risk here.
• 10:12
  Speaker 0: The challenge is that AI is not always complete up to date with a newest regulation And probably just don't know the newest requirements.
• 10:23
  Speaker 0: and the right pillar concentrates on the pure volume of AI generated
• 10:29
  Speaker 1: code.
• 10:31
  Speaker 0: If AI writes code a hundred times faster than humans, it creates quite a lot of code.
• 10:37
  Speaker 0: so that will be really difficult to review everything manually which is an additional challenge.
• 10:50
  Speaker 0: Vaibhav, now I have the first question for you.
• 10:54
  Speaker 0: If it's clear that a lure of AI augmented software development is undeniable and the idea creating prompts in generating code at lightning speed promises significant productivity gains.
• 11:09
  Speaker 0: but as we saw before or see here this acceleration can come with some risks.
• 11:18
  Speaker 0: from your perspective what's the gap between the promise and reality when it comes to custom code security?
• 11:29
  Speaker 1: That is a great question, Elka.
• 11:31
  Speaker 1: I will answer that in slightly different way.
• 11:38
  Speaker 1: Let us be clear.
• 11:40
  Speaker 1: AI is real.
• 11:41
  Speaker 1: everybody all of first may using AI one-way or other like for example maybe in our work, maybe on a personal.
• 11:51
  Speaker 1: It's like a peer who is always there with us.
• 11:53
  Speaker 1: you ask the question.
• 11:55
  Speaker 1: I mean it will give you answer sometimes correct.
• 12:00
  Speaker 1: some times You may not like the answers but yes they'll be.
• 12:03
  Speaker 1: that so similarly for any developers right?
• 12:08
  Speaker 1: Use AI productivity tools for SAP ABAP or B to P extensions I mean, so it is kind of becoming the thing that they will do more and more in future.
• 12:24
  Speaker 1: But what's happening here?
• 12:26
  Speaker 1: We have to understand how these LLMs are created or how SAP has been created.
• 12:32
  Speaker 1: LLM was primarily created from vast majority public information whereas SAP system... this is highly customized tailored to a company product, right?
• 12:47
  Speaker 1: For example every company.
• 12:49
  Speaker 1: Is different in terms of their business processes are different there.
• 12:54
  Speaker 1: security policies are different they're namespaces are different that the security configurations are different.
• 13:02
  Speaker 1: so there's so many customize things that I still unknown.
• 13:07
  Speaker 1: two LLM Hence, when you use an LLM there will be a gap.
• 13:14
  Speaker 1: It may not give you the desired result.
• 13:16
  Speaker 1: Consider this as a junior developer who has just joined the organization and maybe does not know but sooner or later that these LLMs get better.
• 13:25
  Speaker 1: they'll able to provide you with the desired results.
• 13:28
  Speaker 1: But now it is a gap which we have to fill and supplement.
• 13:35
  Speaker 1: otherwise You will have codes with authorization issues, you'll have code with vulnerabilities.
• 13:44
  Speaker 1: Even Elka will show you a vulnerability where simple prompt... I mean these agents create a code.
• 13:58
  Speaker 1: that will not.
• 13:59
  Speaker 1: That would be free of vulnerabilities, but they will create.
• 14:01
  Speaker 1: so you will see that in subsequent slides.
• 14:07
  Speaker 1: But the second thing is it's a myth.
• 14:11
  Speaker 1: I have seen A lot people think developers are no longer doing the code.
• 14:19
  Speaker 1: So their focus is more on delivering a secure code Quality.
• 14:27
  Speaker 1: but in reality, you know what is happening?
• 14:30
  Speaker 1: Is Developers are their shift.
• 14:33
  Speaker 1: It's focusing from writing the code to validating the court.
• 14:37
  Speaker 0: The
• 14:37
  Speaker 1: projects are shortening I mean because with AI everybody wants to deliver it much faster and the volume of code is also generated In a much faster phase.
• 14:49
  Speaker 1: so So essentially What is happening is that developers us still busy reviewing, hence the bottleneck shifted from writing the code to validating.
• 15:03
  Speaker 1: So essentially I mean what comes last in their mind is security and that's why even over reliance on AI right now may lead to some vulnerabilities And what developers need Is basically Some kind of assistance In this area That can help them review those vulnerabilities, security flaws quickly so that they can keep up with the pain.
• 15:32
  Speaker 1: That's one.
• 15:33
  Speaker 1: The last thing I would say here is compliance framework to work just like any other code.
• 15:44
  Speaker 1: if a code is AI generated will the compliance framework work in same way?
• 15:49
  Speaker 1: More or less yes but you know All of these compliance frameworks, they assume human authorship.
• 15:59
  Speaker 1: They assume that you will have multiple people doing and making decisions.
• 16:05
  Speaker 1: but what I feel is to implement AI in a secure way supplemented with another trustworthy framework if your organization has it implemented.
• 16:19
  Speaker 1: otherwise.
• 16:22
  Speaker 1: That is a paramount to supplement the current framework with your AI security framework.
• 16:32
  Speaker 0: Okay, thanks great answers and yeah what you said that developers concentrate more on validating code but I can imagine this huge volume in this huge speed.
• 16:48
  Speaker 0: Developers need also huge knowledge to be able validate all these codes and you talked about assistance, but we will come to this later.
• 17:01
  Speaker 0: A little bit later for now.
• 17:05
  Speaker 0: to come back again to the point that AI accelerates custom code creation customers risk surface is expanding rapidly.
• 17:22
  Speaker 0: From Deloitte's perspective, what governance frameworks or guardrails must organizations put in place today to safely harness AI without compromising their compliance?
• 17:38
  Speaker 0: Do we have something?
• 17:40
  Speaker 1: Yeah absolutely I mean We.
• 17:43
  Speaker 1: we do have our trustworthy AI framework and I can show you in a bed if yeah, so I mean as As Our clients are using more and more AI with Joule and creating their own agent having a framework like this is Is really important.
• 18:04
  Speaker 1: It has seven pillars And You know all these seven pillars helps you address AI specific risk Okay.
• 18:13
  Speaker 1: For example, safe and secure is one of the important pillar which talks about.
• 18:20
  Speaker 1: how do I make sure that I protect my company from any cyber risk associated with AI?
• 18:29
  Speaker 1: How to protect with legal regulatory requirements?
• 18:33
  Speaker 1: so all this comes into this pillar.
• 18:36
  Speaker 1: right.
• 18:37
  Speaker 1: prompt injection model thefts.
• 18:40
  Speaker 1: you need Take care of that, private.
• 18:44
  Speaker 1: That's another important pillar because data privacy and protection is number one concern when it comes to our clients right?
• 18:58
  Speaker 1: And SAP Clients?
• 18:59
  Speaker 1: Because SAP system hosts a lot of PIO sensitive information related customers HR sales even sensitive finance information All these clients, they want to make sure that their data is not being used for training the model or more importantly because some of these regulations have agreed upon usage of PII like EU.
• 19:26
  Speaker 1: They would like you need a consent form asking users permission collecting a personal information and you need to strictly abide with that.
• 19:39
  Speaker 1: Now, if we are using it for training It may lead some clear violation And nobody wants to do that right?
• 19:46
  Speaker 1: So That's another thing.
• 19:50
  Speaker 1: Transparency and explainability is one of the most important factor.
• 19:54
  Speaker 1: as your implementing AI It basically tells you As the AI makes decision or gives an output Why did I?
• 20:04
  Speaker 1: why did it actually gives you certain output?
• 20:07
  Speaker 1: I mean, what is the rationale behind that right?
• 20:11
  Speaker 1: a best example.
• 20:12
  Speaker 1: That You can see his in Google Gemini.
• 20:15
  Speaker 1: if you search something Right It gives you The source where it Is coming from.
• 20:20
  Speaker 1: it is trying to explain you Where exactly this data is Coming From and Why does making that decision.
• 20:29
  Speaker 1: similarly If your generating code Whenever you are generating a code using AI, it should tell you what is the business process document that it referred.
• 20:43
  Speaker 1: What is the requirement to refer?
• 20:48
  Speaker 1: That's why it has written certain piece of code and following strict guidelines in the business processes using AI in the custom code.
• 21:04
  Speaker 1: Now bias, fair and impartial I mean we all know publicly trained it may result into some kind of biased answers.
• 21:18
  Speaker 1: even SAP has its own orchestration layer, which actually removes all the vice opinions and whatnot.
• 21:25
  Speaker 1: If you're using it for your custom code, we can rely on that.
• 21:32
  Speaker 1: but essentially what are doing here is making sure they output as always consistent with their policies in terms of fairness and being impartial.
• 21:45
  Speaker 1: Responsible and accountable are two main features in this pillar.
• 21:49
  Speaker 1: Responsible deals with implementing technology, making sure that you're executing it correctly with the right set of guardrails your data or using it correctly.
• 22:04
  Speaker 1: It is very important.
• 22:06
  Speaker 1: responsibility deals with policies for using these.
• 22:09
  Speaker 1: so who's accountable?
• 22:12
  Speaker 1: who is, if there's something which isn't correct.
• 22:16
  Speaker 1: Who do I report to?
• 22:18
  Speaker 1: Things like that.
• 22:19
  Speaker 1: lastly robust and reliable.
• 22:22
  Speaker 1: We all want very highly accurate output from our AI whether we are generating code or not.
• 22:31
  Speaker 1: you want highly reliable.
• 22:33
  Speaker 1: basically You need implement certain characteristics on how much.
• 22:41
  Speaker 1: what is the confidence score when it comes to output of current.
• 22:47
  Speaker 1: Having such kind measures helps you get more confidence while using those AI-enabled custom code agents.
• 23:01
  Speaker 1: Now, all in all this framework to kind of use AI in a manner that you are much more comfortable.
• 23:10
  Speaker 1: Now, In terms of using June and using it for custom code I think so whenever you're using if have guardrails Have making sure your output is there are constraints in built in the agent itself.
• 23:30
  Speaker 1: So then It does not spit out a core which correct.
• 23:35
  Speaker 1: For example, if it is deleting data from a table right?
• 23:39
  Speaker 1: I mean you have to put certain constraints so that you know.
• 23:43
  Speaker 1: um If deleting in mass It kind of gives You uh it triggers human In the loop So that you Know A validator can do it before AI damages or corrupts The data in your system.
• 23:58
  Speaker 1: That's one Of the key things here.
• 24:00
  Speaker 1: using it in secure manner is far more paramount than just using AI.
• 24:20
  Speaker 0: Yeah, it's a great framework with lots of detailed guidelines and thank you for your great explanation.
• 24:36
  Speaker 0: I'd like to shift our focus a little bit towards rice and maybe the migration through the cloud.
• 24:47
  Speaker 0: Therefore, I have the next poll for you.
• 24:52
  Speaker 0: I would like know how familiar are with S&P's shared responsibility model?
• 25:00
  Speaker 0: Do we know it inside out or do understand core concepts?
• 25:06
  Speaker 0: Did you hear about it, but need a refresher?
• 25:11
  Speaker 0: Or did you even think that as I do have all the security when we go to the cloud.
• 25:22
  Speaker 0: Let's wait some seconds and there are still some answers incoming.
• 25:49
  Speaker 0: Okay let us have look!
• 25:56
  Speaker 0: It seems our next slide will be helpful for because more than the half would like to have a refresher.
• 26:09
  Speaker 0: Even thirty percent think that SAP handles all this security, so maybe let's look at our next slide where we discuss the shared responsibility model in the Cloud little bit.
• 26:27
  Speaker 0: as you can see there are two boxes for
• 26:33
  Speaker 1: everything
• 26:33
  Speaker 0: that SAP is responsible for.
• 26:37
  Speaker 0: In summary, it's the responsibility for the cloud and on the right side you see everything at a customer as responsible which SAP takes care of the physical security, hardware data center power network isolation and of course the SAP software itself.
• 27:06
  Speaker 0: But the customer still stays responsible for data governance encryption interface security authorizations role design and also custom code.
• 27:21
  Speaker 0: so It looks like that the customer is responsible for AI generated code.
• 27:34
  Speaker 0: In summary, we can say SAP secures a platform but the customers secures to code and data.
• 27:45
  Speaker 0: Let me come to my next question.
• 27:48
  Speaker 0: by both in rise environments where AI authored the vulnerability who owns the liability?
• 28:00
  Speaker 0: and does current shared responsibility model actually have a clear answer to that?
• 28:07
  Speaker 1: Yeah, sure.
• 28:08
  Speaker 1: So you could look into the polling questions as well right?
• 28:13
  Speaker 1: I mean, this responsibility model has always been very confusing.
• 28:18
  Speaker 1: I have had multiple discussions with my own clients or prospective clients whenever i go and talk about vulnerability management.
• 28:27
  Speaker 1: they think that you know in the rise model SAP is responsible for everything related to vulnerability.
• 28:33
  Speaker 1: while it is true to a certain extent like anything related to platform SAP will be responsible.
• 28:42
  Speaker 1: Customers are responsible because they're managing their configuring and an SAP doesn't know what but They have configured, right?
• 28:50
  Speaker 1: So that's one Right.
• 28:52
  Speaker 1: But think about this.
• 28:53
  Speaker 1: This model has always been binary in terms of SAP and customer, right.
• 29:00
  Speaker 1: And still it was confusing in me a lot of ambiguities when people not knowing What and just relying as over on only on SAP.
• 29:09
  Speaker 1: now with the With AI and LLM, there is a third party involved here.
• 29:15
  Speaker 1: Now this third if I talk just purely in terms of custom code and all now Third-party is not responsible.
• 29:23
  Speaker 1: their model behavior and training is responsible for the core that has been generated The output that you are getting?
• 29:32
  Speaker 1: No they are NOT liable or responsible For the code is being generated.
• 29:37
  Speaker 1: customers are still liable for any code that is generated.
• 29:42
  Speaker 1: So how can they actually mitigate the risk?
• 29:47
  Speaker 1: A, by making sure to thoroughly validate the code and like I said we will show you vulnerabilities do get generated via these AI-generated codes.
• 30:01
  Speaker 1: The second thing is validation against your policies or procedures really helps, right?
• 30:09
  Speaker 1: And making sure that you know.
• 30:11
  Speaker 1: You have a proper governance in place to make so that you can give I mean you can validate and makes someone accountable from your organization for those custom code that is being generated.
• 30:29
  Speaker 1: lastly i would say there should be a clear policy of how you are using AI within the organization, whether for custom code or just rating output.
• 30:46
  Speaker 1: You need to always have continuous testing in place because lot many times focus is on functionality and giving it but not so much focused on vulnerability.
• 31:04
  Speaker 1: these AI models are not only good in terms of giving the code, but they can all there.
• 31:11
  Speaker 1: I mean, so many new vulnerabilities have been found because with the frontier model it is equally important to kind do their testing so that you don't open up an unknown vulnerabilities in your system.
• 31:26
  Speaker 1: So this absolutely important short answer customer is liable But they get mitigate this.
• 31:36
  Speaker 2: Okay,
• 31:37
  Speaker 0: this is good to know and there's surely some need to take action if you are not prepared yet.
• 31:50
  Speaker 0: We talk about the shared responsibility model of Cloud and when we talked need to talk about clean core and about shifting left, these two strategic plus that are currently relevant for SAP customers.
• 32:15
  Speaker 0: And to keep the SAP Core Clean developers now increasingly pushing custom code and AI generated extensions through the edges using SAP BTP.
• 32:33
  Speaker 0: So when clients are building these BTP extensions, how critical is the shift left approach to catching vulnerabilities early in the life cycle?
• 32:46
  Speaker 0: But maybe before you answer let me quickly move to the next slide.
• 32:52
  Speaker 0: To also show the shift-left approach.
• 32:59
  Speaker 0: so what do
• 33:04
  Speaker 1: Before I talk about that, what does shift left means?
• 33:09
  Speaker 1: For some of you who are not aware of this shifting left means making sure your testing security and the quality measures that you take towards end-of-the-development.
• 33:23
  Speaker 1: You bring them early in game.
• 33:25
  Speaker 1: so I mean, you can resolve them early in the game rather than finding either in production or very late for your project.
• 33:39
  Speaker 1: Traditionally most of these testing were done post functionality has been tested and that's when we move to test security.
• 33:51
  Speaker 1: if there are new vulnerabilities identified I mean, it becomes too late.
• 33:55
  Speaker 1: You have to delay your projects to kind of identify or remediate those vulnerabilities now.
• 34:02
  Speaker 1: so that's one right?
• 34:04
  Speaker 1: Now you answer about clean core.
• 34:09
  Speaker 1: no shifting left So basically is absolutely very critical.
• 34:16
  Speaker 1: If you don't, if your shift left and do not... And especially in the newer B to P and clean core environment.
• 34:31
  Speaker 1: If you do not shift left it's a half measure.
• 34:34
  Speaker 1: why?
• 34:35
  Speaker 1: Because In S for HANA with the clean core concept You are moving all of your customization to B-to-P as a B-To-P extensions so that you do not keep your core clean, which helps with the upgrade and follow SAP standard practices.
• 34:57
  Speaker 1: Now what has happened is B-TO-P is a SaaS application.
• 35:02
  Speaker 1: if you move your custom code to B two P all of your customizations to B to P You Do Not Follow Shift Less Strategy.
• 35:11
  Speaker 1: What it is half major because you're not, earlier SAP system were within the four walls of your organization.
• 35:20
  Speaker 1: Now all of those customization are in B to P which is a SaaS application.
• 35:24
  Speaker 1: so there's new attack surface that has now their custom code now.
• 35:34
  Speaker 1: So they have greater risk and hence where extremely important for you to shift left, and anytime you create a code make sure you do scan.
• 35:50
  Speaker 1: Make sure actually remediate those issues early in the game rather than waiting till they end because if you move until then many of times your projects cannot wait or security scans.
• 36:04
  Speaker 1: so it will be post go live measure meaning there are vulnerabilities that air attacker can use it for gaining access to your data.
• 36:19
  Speaker 1: So that's really important, and once it moves into production is far more costly.
• 36:26
  Speaker 1: there are a lot of bottlenecks that come along with that.
• 36:29
  Speaker 1: so moving in left is not nice now but an important primary mechanism.
• 36:40
  Speaker 1: keep your data safe, keep your core clean as well.
• 36:48
  Speaker 0: Yeah and like we saw at the beginning it takes less than three hours for attackers to compromise your applications if you have vulnerabilities.
• 36:59
  Speaker 0: okay let's come to our final poll for today.
• 37:07
  Speaker 0: How mature is your organization's shift left strategy for code security?
• 37:16
  Speaker 0: Do you think you are highly mature, making progress?
• 37:21
  Speaker 0: just starting, shift what.
• 37:29
  Speaker 0: I'm curious about what do you think of your own strategy and your own DevSecOps.
• 37:39
  Speaker 0: Let us wait some more seconds to give everyone the chance.
• 37:45
  Speaker 0: To answer, okay so let me check.
• 38:13
  Speaker 0: oh
• 38:16
  Speaker 1: what
• 38:16
  Speaker 0: do you think about your answers?
• 38:20
  Speaker 1: I think it is consistent when we have about seven percent earlier who were using AI in a very secure manner and they are mature because if he was being highly mature is quite possible and all the others are consistent as well, making progress starting.
• 38:44
  Speaker 1: that it's consistent with what we have seen in previous polls.
• 38:50
  Speaker 0: Yeah okay thanks again for your participation and answers.
• 38:57
  Speaker 0: now that we had into a final segment of our webinar.
• 39:02
  Speaker 0: let us look at how to pull.
• 39:07
  Speaker 0: So what can be a solution?
• 39:10
  Speaker 0: ONAPSIS as an SAP endorsed security provider recommends using comprehensive and rigorous application-security testing solutions, like control.
• 39:23
  Speaker 0: But we will come to this in a minute.
• 39:30
  Speaker 0: from Deloitte's perspective or your when organizations are introducing this type of automated security testing, what key criteria or capabilities should they be looking for?
• 39:48
  Speaker 1: Yeah sure.
• 39:49
  Speaker 1: I mean i'll keep it short because we have a demo and as well in couple more slides As We Go And Talk To Our Clients.
• 40:00
  Speaker 1: One Of The Key Things That I mean, a lot of our clients start thinking about having a vulnerability management program for ERP SAP systems.
• 40:09
  Speaker 1: And that program is basically enables them to kind of start thinking how do we get the capability off?
• 40:18
  Speaker 1: What are the vulnerabilities in this system?
• 40:20
  Speaker 1: and also how do you get the ability to remediate it once they have done this right?
• 40:25
  Speaker 1: How did we do it on going basis Right.
• 40:28
  Speaker 1: so a lot talking to their cyber organization, making sure that you know they are following the vulnerability management program.
• 40:37
  Speaker 1: The way cyber follows in all other areas and follow same footsteps.
• 40:43
  Speaker 1: a couple of key things have come up based on discussions.
• 40:48
  Speaker 1: is what clients are expecting?
• 40:52
  Speaker 1: is SAP native coverage right?
• 40:57
  Speaker 1: There's lot of SAP products out there.
• 41:00
  Speaker 1: They are on ABAP, HANA database.
• 41:04
  Speaker 1: B to P. how do we make sure that there is a comprehensive coverage?
• 41:10
  Speaker 1: So there's the coverage aspect because what they want to do when this elected tool based on their landscape?
• 41:16
  Speaker 1: then they won't coverage.
• 41:18
  Speaker 1: That's why The second thing Is as they aren't talking to the cyber organizations to have an automated capability, detect these early and how you do that as soon a code is created or developed.
• 41:38
  Speaker 1: And it's ready to move right?
• 41:40
  Speaker 1: I mean they didn't want the automated capabilities.
• 41:44
  Speaker 1: so any vulnerabilities are scanned then before going into production because there was one aspect of doing at once time and ongoing protection.
• 41:56
  Speaker 1: They are not introducing vulnerability.
• 41:58
  Speaker 1: So they want a SAP native coverage, b-they also make sure that it is integrated with transport management system for ongoing and their automatic capabilities.
• 42:13
  Speaker 1: thirdly And this is companies which have large SAP footprint many SAP systems you know, a lot of these vulnerabilities are also tied to their ITGC.
• 42:28
  Speaker 1: So they want a single place where they can track all this IDGC controls, ID General Controls in a singleplace so that it can track whether I'm compliant or not compliant?
• 42:44
  Speaker 1: There is control aspect as well.
• 42:48
  Speaker 1: All-in-all there's three main things.
• 42:53
  Speaker 1: Okay,
• 42:59
  Speaker 0: thank you for your advice and your answers.
• 43:05
  Speaker 0: I have another slide for You.
• 43:08
  Speaker 0: um i promised at the beginning that we will also talk about nexus control At the end which is the onapsis solution?
• 43:18
  Speaker 0: For custom code security.
• 43:20
  Speaker 0: And Yeah onapses control Is designed in a way that we try to deliver the best coverage for modern software development.
• 43:35
  Speaker 0: We support SAP BTP, we have very powerful scan engine and more than six hundred test cases that are fueled by our own Anapsis Research Labs which is team of humans who research the markets every month and find the newest vulnerabilities.
• 44:02
  Speaker 0: And based on this, we always try to provide the newest test cases and tried to improve.
• 44:12
  Speaker 0: our test case is always further.
• 44:14
  Speaker 0: to provide best security We support a shift left approach by doing and recommending to scan custom code very early in the development process.
• 44:32
  Speaker 0: And every stage, like directly and developer IDEs and CI CD pipelines in Git repositories.
• 44:42
  Speaker 0: we support all common languages not only ABAP.
• 44:49
  Speaker 0: also UI five check transports and block-riskly transport so that vulnerabilities don't reach production.
• 45:05
  Speaker 0: We have a spellcheck like real time scanning in developer IDs, to show you how this works.
• 45:17
  Speaker 0: I want to show very short videos for an impression about the tool And to see it properly, I recommend to enlarge the video.
• 45:29
  Speaker 0: You can do it by hovering over the media player and using a small arrow.
• 45:37
  Speaker 0: so please check this that you can see everything good.
• 45:41
  Speaker 0: i will start now.
• 45:49
  Speaker 0: So what you see here is visual studio code.
• 45:54
  Speaker 0: there's already some code that has been created.
• 46:01
  Speaker 0: You can see on the right, we are using co-pilot to create some more codes and we're entering a prompt now.
• 46:13
  Speaker 0: please add a header to the render function.
• 46:20
  Speaker 0: let copilot analyze and create something.
• 46:24
  Speaker 0: Then you can see that there has been some code added, highlighted in the screen box.
• 46:32
  Speaker 0: You can also see that they are snippets underlined with a red squiggly line and yeah!
• 46:40
  Speaker 0: The tool found across site scripting vulnerability.
• 46:45
  Speaker 0: That is shown below.
• 46:47
  Speaker 0: You can click on this and then you get some more information about this vulnerability like a description, business risks solution.
• 46:58
  Speaker 0: And some guidelines.
• 47:00
  Speaker 0: how we can fix is so you can see
• 47:03
  Speaker 1: the moment
• 47:04
  Speaker 0: that code is generated or pasted from AI on.
• 47:08
  Speaker 0: the tool immediately detects the vulnerability and gives us necessary information to solve it.
• 47:18
  Speaker 0: Okay, with this we are now at the end of our presentation and I would like to invite you now for questions.
• 47:34
  Speaker 0: We will try provide some answers to your question.
• 47:40
  Speaker 0: Cecilia do already have any questions?
• 47:43
  Speaker 2: Yes perfect thank-you!
• 47:47
  Speaker 2: We actually have time now, and I can see that we got a lot of questions in.
• 47:51
  Speaker 2: So let's pick as long if you have time.
• 47:57
  Speaker 0: for the rest
• 47:58
  Speaker 2: please feel free to send them what tools are available to ensure a trusted and secure AI framework.
• 48:18
  Speaker 2: It would be good to understand, to apply these principles in practice ideally with
• 48:24
  Speaker 1: some real-world
• 48:25
  Speaker 2: practical experience.
• 48:30
  Speaker 0: Aibas will you take
• 48:31
  Speaker 1: it?
• 48:33
  Speaker 1: Yes absolutely so I think that's a great question.
• 48:38
  Speaker 1: now when we talk about Secure AI Framework how do we implement?
• 48:46
  Speaker 1: There are not a lot of good tools available as of now.
• 48:50
  Speaker 1: SAP is also working towards that, they also have responsible AI framework.
• 48:56
  Speaker 1: but in Qtree when there are releasing a bunch of agenting recently announced Sapphire it's expected to have capabilities.
• 49:07
  Speaker 1: so we're waiting.
• 49:10
  Speaker 1: if you ask them.
• 49:11
  Speaker 1: I mean most of these AI tools that you have, they are already inbuilt to have some guardrails built-in.
• 49:23
  Speaker 1: So we can define all those constraints... Some call it a constraint and some called as Guardrails or whatnot.
• 49:29
  Speaker 1: so whatever your using.. As long if you're following this principles You will use it securely.
• 49:39
  Speaker 1: I mean, there will be tools coming in to kind of assist you and play around.
• 49:44
  Speaker 1: But right now they're less on the market.
• 49:46
  Speaker 1: here's
• 49:51
  Speaker 2: all right.
• 49:51
  Speaker 0: then
• 49:53
  Speaker 2: The next one Why is it clean core strategy considered
• 49:58
  Speaker 0: only a
• 49:58
  Speaker 2: half measure if an organization does also embed a shift left security posture when building SAP BTP extension?
• 50:10
  Speaker 1: well Well It
• 50:12
  Speaker 0: Is.
• 50:13
  Speaker 1: It is considered half-measured primarily from two main reasons.
• 50:18
  Speaker 1: First, like I said in my previous question example as well right earlier SAP was within the four walls of your organization.
• 50:31
  Speaker 1: it was inside.
• 50:32
  Speaker 1: so all those customizations were inside that SAP only.
• 50:36
  Speaker 1: now you're moving into B to P but you're moving all of this custom code in a SaaS-based application.
• 50:49
  Speaker 1: So your attack surface has increased, right?
• 50:55
  Speaker 1: And like we said if any vulnerability comes then it doesn't take a lot time for attackers to start exploiting those into SAP.
• 51:07
  Speaker 1: and these days SAP systems are prime target for any company because earlier, these were internal facing.
• 51:20
  Speaker 1: These days it is more external facing right?
• 51:23
  Speaker 1: That's one.
• 51:24
  Speaker 1: the second thing is SAP is becoming prime target because all the sensitive data is stored at a single place so advantages for developer to do that.
• 51:39
  Speaker 1: So that's one of the reasons SAP is becoming prime target.
• 51:44
  Speaker 1: That's the reason it has half measure.
• 51:46
  Speaker 1: if you just do a clean core strategy, not securing your B to P and other codes?
• 51:57
  Speaker 1: It's a half-measure.
• 51:59
  Speaker 1: You'll not be able to keep your code clean because attacker can use it and cut up something
• 52:08
  Speaker 0: All
• 52:09
  Speaker 2: right.
• 52:10
  Speaker 2: then I will come through question before we wrap for today.
• 52:16
  Speaker 2: When implementing automated security testing to validate AI generated
• 52:21
  Speaker 0: code,
• 52:21
  Speaker 2: why is it essential to use a solution with SAP native coverage rather than relying on generic web vulnerability tools?
• 52:34
  Speaker 1: Well two things there.
• 52:37
  Speaker 1: lot of these generic tools that your cyber teams have been using those they are very good in terms web-based tools, which are Java based, HTML based.
• 52:52
  Speaker 1: They're very good in that they don't necessarily...they are not necessarily good and a bad code.
• 53:02
  Speaker 1: They do know what authority statement checks means.
• 53:07
  Speaker 1: so that's why SAP native coverage is important.
• 53:11
  Speaker 1: And again you now even SAP.
• 53:14
  Speaker 1: There are now B to P, there is HANA.
• 53:16
  Speaker 1: that it's about.
• 53:18
  Speaker 1: A lot of things coming in within SAP also.
• 53:22
  Speaker 1: so native coverage as important.
• 53:25
  Speaker 1: not everything your organization has a generic tool will be able support SAP because they won't capture the specific vulnerabilities.
• 53:43
  Speaker 2: I'm handing back to Elkin for your
• 53:46
  Speaker 0: wrap up?
• 53:51
  Speaker 0: Yes thank
• 53:52
  Speaker 1: you Cecil.
• 53:55
  Speaker 0: Yeah, thank you Weibuff.
• 53:57
  Speaker 0: It was a great conversation.
• 53:58
  Speaker 0: I enjoyed it a lot and i hope that our audience could get some great insights from You.
• 54:07
  Speaker 0: And what can still do for you For participants is give your recommendation of our hacking and defending series.
• 54:21
  Speaker 0: We already did some very interesting webinars.
• 54:26
  Speaker 0: You can watch them on demand and we will provide more episodes in the future, so if you have not heard about this series yet please keep your eyes and ears open for our invitations or check out a website.
• 54:47
  Speaker 1: I think
• 54:47
  Speaker 0: you will not keep the URL in mind, but you can go to our website and You can go through threat research.
• 54:56
  Speaker 0: And there you'll find
• 54:57
  Speaker 1: a box
• 54:58
  Speaker 0: where you are Directly guided to this hacking and defending learning page.
• 55:06
  Speaker 0: Where do you find?
• 55:07
  Speaker 0: The past webinars that you can watch on demand?
• 55:13
  Speaker 0: Yeah with this I'd like to say so thank you again for joining us on our webinar.
• 55:18
  Speaker 0: I hope we will see each other again in the future, and I wish you a nice rest of today!
• 55:28
  Speaker 0: Thank you and bye-bye!
• 55:30
  Speaker 1: Good bye everyone.
• 55:31
  Speaker 1: thank you so much for joining.
• 55:32
  Speaker 1: Thank
• 55:32
  Speaker 2: You Bye-Bye from Erika.
• 55:33
  Speaker 2: thanks to every one for joining.