SAP Hybris solutions are all about providing a connected front office. But the customer experience can easily get damaged if the data from your business partners or end customers is not secure. With the new EU General Data Protection Regulation (GDPR) coming into effect in May 2018, the need to protect your customers’ data is essential for your business. Learn how to reduce cost by integrating security into your implementation process to be ahead of the curve for future cyberattacks.

1. PUBLIC
. Run Secure.
Andreas Gloege,SAP
October2017
Protect Your Customers’ Data from Cyberattacks

2. 2PUBLIC© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ
Existing network and perimeter based security is insufficient
1 2 3 4 5 6 7 8
Backend
Systems
84% of breaches exploit vulnerabilities in the application layer
Yet [the ratio of spending between perimeter security and application security is 23-to-1]
- Gartner Maverick Research:Stop Protecting Your Apps;It’s Time forApps to ProtectThemselves (2014)

3. 3PUBLIC© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ
Security failures create big problems
http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
20042017
92% of companies have experienced
commercial consequences as a
result of a data breach
Source: Gemalto Breach Level Index, The Reality of Data
Breaches in 2016
“

4. 4PUBLIC© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ
Your software is everywhere
How can you be sure your highly accessible applications are also highly secure?
Grown over the years
Complex
Built on changing requirements
Created based on different development paradigms
Optimized for performance
Extended, but not reinvented
You software has a history

5. 5PUBLIC© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ
It pays to discover issues prior to release
Identifying the critical bugs earlier in the lifecycle reduced costs by $2.3M USD*
*Source: OWASP, Application Security Guide for CISOs, November 2013
Today’s approach is expensive and reactive

6. 6PUBLIC© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ
It pays to discover issues prior to release
Identifying the critical bugs earlier in the lifecycle reduced costs by $2.3M USD*
*Source: OWASP, Application Security Guide for CISOs, November 2013
The right approach is systematic and proactive

7. 7PUBLIC© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ
SAP is in the business of securing our customers’ business
Over 300,000 customers depend on SAP. From
an attacker’s standpoint, SAP is one of the most
valuable applications to gain access to.
Since the start of the Application Security Initiative, SAP
had performed static analysis on approximately 178 million
lines of code using SAP Fortify by HPE.
Hybris is using SAP Fortify by HPE to scan the standard
code SAP delivers to our customers.
SAP Product Development is using SAP CVA to scan more
than 500 million lines of code for the standard products
which are delivered to our customers.
Justin Somaini, SAP Chief Security Officer
SAP on-premise
software development
systems
~8,500
SAP internal business
systems ~40
SAP cloud development
systems ~500

8. Technological advancement is outpacing security. If our digital
economy is to thrive, our commitment to cybersecurity must
match our commitment to innovation.
Source: Commission on Enhancing National Cybersecurity, Report on Securing and Growing the Digital Economy
“

9. 9PUBLIC© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ
End-to-end application security solution for SAP Hybris
Dynamic application security testing Static application security testing
Find vulnerabilities in the running application
Manual application penetration testing
Automated application vulnerability scanning
Find vulnerabilities analyzing the sources
Automated source code analysis
Manual source code review
SAP Fortify by HPE
SAP NetWeaver Application Server, add-on for code vulnerability analysis (CVA)
Back-End
ABAP system
Finding security issues at design time instead of in production is easier and less expensive!
Management platform for governance, reporting, auditing, analysis
SAP
Fortify
integrates
with CVA

10. 10PUBLIC© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ
Build secure Hybris solutions from the start
Stay Safe with
Application Security
Testing
SAP Fortify by HPE
and SAP Code
Vulnerability Analyzer
• Comprehensive:Full SDLC coverage, including SAST,
DAST, IAST, and RASP. One of the strongest and most
innovative SDLC integrations, with DevInspect and
Security Assistant.
• Proven:With over a decade of successful deployments,
and backed by the largest security research team.
• Leader:Since 2009, it has been a leader in Gartner’s
Magic Quadrant for Application Security Testing (AST).
• Watch the video
Why SAP Fortify by HPE is the best choice to
manage risk across your enterprise:
• Leverage tools that are already integrated into the
standard SAP ABAP development infrastructure for easy
consumption – no additional installations required.
• Provide developers with extensive documentation
to support speedy security fixes.
• Meet the compliance and automation requirements
of your software quality assurance teams.
• Watch the video
Why SAP Code Vulnerability Analyzer is the best
choice to manage risk across your ABAP applications:
Sources
1. “Cyber Risk Report2013”, HP
Security Research,February2014.
2. “2014 Gartner Magic Quadrant for
Application Security Testing.”
Gartner, July 1, 2014.
56% 75% 84%
of weaknesses reveal information about
applications, implementations, or users.3
of mobile applications fail
basic security tests.2
of breaches occur
at the application layer.1
Fortify and CVA
Integration

11. Thank you.
Contact information:
Andreas Gloege
Director, Quality and Security Assurance
SAP America, Inc.
Andreas.Gloege@sap.com
Deeper Dive Session in Focus Area: Technology
Session ID 53267
Thursday, October19, 2017 11:15 AM-12:15PM CC7.06 [474458]
Thursday, October19, 2017 3:00 PM-4:00 PM CC7.05 [474456]
Build secure codefrom within – securing yourcode againstcyberattacks
Abstract:A deeperdive of the Micro Theater session“ProtectYour Customers’Data
from Cyberattacks”.More than 80 percentof successfulbreaches target
vulnerabilities in the application layer, and here you will see demonstrations on how
you can keep your code from being a statistic.
. Run Secure.

12. 13PUBLIC© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ
Today’s approach is expensive and reactive
Somebody builds bad software
In-house Outsourced Commercial Open source
IT deploys the
bad software
1
2
Breach or pen test
proves our code is bad
3
We convince and pay
developers to fix it
4
Customization to SAP Hybris

13. 14PUBLIC© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ
Today’s approach is expensive and reactive
It pays to discover issues prior to release
Cost of fixing vulnerabilities EARLY Cost of fixing vulnerabilities LATER
Stage
Critical bugs
identified
Cost of fixing
one bug
Cost of fixing
all bugs
Requirements $139
Design $455
Coding 200 $977 $195,400
Testing $7,136
Production $14,102
Total 200 $195,400
Stage
Critical bugs
identified
Cost of fixing
one bug
Cost of fixing
all bugs
Requirements $139
Design $455
Coding $977
Testing 50 $7,136 $356,800
Production 150 $14,102 $2,115,300
Total 200 $2,472,100
Identifying the critical bugs earlier in the lifecycle reduced costs by US$2.3 million
Source: OWASP, Application Security Guide for CISOs, November 2013

14. 15PUBLIC© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ
It pays to discover issues prior to release
Identifying the critical bugs earlier in the lifecycle reduced costs by $2.3M USD
Source: OWASP, Application Security Guide for CISOs, November 2013

15. 16PUBLIC© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ
The right approach is systematic and proactive
People – Process - Technology
Leverage security gate
to validate resiliency of
internal or external code
before production
Protect
software running
in production through
continuous validation
2 3
This is application security and quality
Improve SoftwareDevelopmentLife Cycle policies
Embed security into system development
lifecycle (SDLC) process
In-house Outsourced Commercial Open source
1