In this document, I have listed some of the most common risks and the recommended controls for each of those risks. Although this would be applicable for any ERP, it is particularly well suited for SAP.

Access controls and other areas traditionally focused upon by security professionals are no longer the only major risks to SAP systems. Today, SAP is confronted with a growing landscape of threats that include injection attacks, cross site scripting, session hijacking and denial of service. For the most part, business owners and security professionals are unaware of profound vulnerabilities laying in the technical components of SAP. Many of these vulnerabilities can be exploited by remote, external attackers without requiring a user account. These risks have arisen from the gradual shift towards open source languages, protocols, standards and Web-enabled services, as well as the increasing size and complexity of SAP. When combined with inherent weaknesses in existing network controls and the sophistication of attacks targeted at corporate applications and data, such a rare combination of circumstances should be viewed as a sinister perfect storm. Vulnerabilities in critical SAP components and services could be exploited by external attackers to interrupt SAP services, implement malicious changes to programs and files, intercept and alter data in transit, and corrupt or modify data directly in databases. If left unattended, these vulnerabilities raise serious concerns over the ability of companies to comply with SOX, PCI and other standards. This white paper discusses some of the methods used by hackers to attack and compromise SAP systems. It also addresses some lesser known risks to raise awareness within the community and improve the overall posture of SAP security.

The revised and expanded second edition of this best-selling book describes all requirements, basic principles and best practices of security for an SAP system.