--- title: Gestione delle vulnerabilità SAP description: "[Gestione delle vulnerabilità in SAP] Cosa fare? Quali sono e come attivarsi su questo argomento? 4 suggerimenti per partire! #AgleaSAPSecurity" image: https://www.aglea.com/hubfs/Aglea/Imported_Blog_Media/Prodotti%20SAP%20dalla%20A%20alla%20Z-Jun-14-2024-09-11-20-9923-AM.jpg --- [linkedin](https://www.linkedin.com/company/292350?trk=vsrp_companies_res_name&trkInfo=VSRPsearchId%3A3373431891426179412478%2CVSRPtargetId%3A292350%2CVSRPcmpt%3Aprimary) [YouTube](https://www.youtube.com/c/AgleaSAPSecurity?sub_confirmation=1) [Twitter](https://twitter.com/AgleaItaly?lang=it) [![Logo-Aglea-horsa-company](https://www.aglea.com/hubfs/Aglea/Aglea_November2018%20Theme/Images/Logo-Aglea-horsa-company.webp) ](https://www.aglea.com/) # Gestione delle vulnerabilità SAP # Gestione delle vulnerabilità SAP Posted by [Massimo Manara](https://www.aglea.com/blog/author/massimo-manara) on Dec 20, 2023 12:00:00 AM - [Tweet](https://twitter.com/share) Cosa significa gestire le vulnerabilità nei sistemi SAP? Cosa facciamo quando ci viene chiesto di farlo e come?   ![vulnerability SAP](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/vulnerability%20SAP-Jun-14-2024-09-11-21-5774-AM.jpg?width=527&height=351&name=vulnerability%20SAP-Jun-14-2024-09-11-21-5774-AM.jpg) Leggi l'articolo per approfondire quali sono i quattro suggerimenti per partire!   ## Vulnerabilità nei sistemi SAP Parto dal presupposto che conosci cosa siano le vulnerabilità e come queste vengono gestite nei sistemi diversi da SAP.   Chiaramente il processo non è molto distante rispetto a quello che avviene nei sistemi che magari stai già gestendo.   Spesso ci confrontiamo sulla tematica con i CISO aziendali e non sempre i sistemi SAP sono considerati nel proprio "radar" per diverse ragioni:   - solitamente in azienda è un gruppo IT specifico che si occupa di SAP (e quindi questi sistemi **non sempre sono presidiati da IT Security** come altri) - chi è abituato a gestire l'IT security spesso non conosce le logiche di questi sistemi - la SAP stessa sconsiglia in diversi casi l'utilizzo di strumenti di scanning generici in quanto, al momento, evidenziano molti falsi positivi. Vedi ad esempio il caso di Qualys ([2300088 - Qualys and SAP NetWeaver AS ABAP/Java](https://me.sap.com/notes/2300088/E))   > *The Qualys software is not a Certified SAP Partner product for NetWeaver Java, hence undesired effects may happen when using it directly in the AS Java, in the local network or bypassing a reverse proxy.*   - Sono anche altri i casi di penetration test o vulnerability assessment effettuati che evidenziano falsi positivi a seguito di confronto con la SAP o di vulnerabilità dovute a mancanza di aggiornamenti o di componenti non legati alla SAP - [2929868 - How to isolate Security Vulnerability issue from AS Java perspective](https://me.sap.com/notes/2929868) - [2191528 - Third-party report showing security vulnerabilities](https://me.sap.com/notes/2191528)   - In molti casi SAP (non come sistema, ma come eco-sistema) viene vista come una blackbox dove è difficile entrare e addirittura parlare con gli interlocutori che attualmente gestiscono in azienda quei sistemi.   ## Vulnerability Management in SAP come are? Quattro passaggi che ti aiutano a decidere e svolgere delle azioni concrete.   Il primo passaggio che ti suggeriamo è quello di recuperare in azienda la propria mappa dei sistemi SAP presenti ed utilizzati. *Sembra semplice, ma vedrai che potrebbe non esserlo.*   Devi infatti sapere anche che:   - Anche se il SAP ERP è il sistema al quale ci si riferisce maggiormente quando si pensa a SAP in realtà esistono molti altri sistemi della famiglia - SAP per la gestione dei clienti (CRM) oggi il sistema SAP C4C - SAP SRM per la gestione dei fornitori (SRM) oggi il sistema Ariba - SAP per la gestione dei rimborsi spesa es. Concur - SAP per la gestione delle risorse umane SAP Success Factors - e molti altri qui trovi una lista di tutti i possibili [sistemi dalla A alla Z](https://www.sap.com/italy/products/a-z.html) ![Prodotti SAP dalla A alla Z](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/Prodotti%20SAP%20dalla%20A%20alla%20Z-Jun-14-2024-09-11-20-9923-AM.jpg?width=365&height=197&name=Prodotti%20SAP%20dalla%20A%20alla%20Z-Jun-14-2024-09-11-20-9923-AM.jpg) - Ogni sistema **SAP può avere diversi ambienti** (ad esempio sviluppo, test e produzione) - Ogni sistema SAP può essere sviluppato con tecnologie diverse. Principalmente ci sono tre divisioni al momento - **Sistemi ABAP** (ovvero i sistemi che sono sviluppati con il linguaggio di programmazione SAP ABAP) - Sistemi JAVA (ovvero sistemi che sono stati sviluppati da SAP in linguaggio JAVA), ad oggi una minima parte del totale. - Questi sono quelli che statisticamente hanno le maggiori vulnerabilità. Guarda qui come scaricare tutti i componenti JAVA del sistema ([1757810 - How to get the complete list of software components on your NetWeaver Application Server Java](https://me.sap.com/notes/1757810)) - **Sistemi nativi [Cloud](https://www.aglea.com/sap-security-cloud)** - Esiste la possibilità che siano **più stack in un sistema** ad esempio ABAP più JAVA - Nel caso del SAP ERP devi sapere che la SAP ha pianificato un cambiamento importante entro il 2027. **Ovvero che il SAP ERP ECC (ERP Central Component) sta cambiando, ovvero sarà sostituito da un nuovo sistema, sempre ERP, ma chiamato SAP ERP S/4HANA** - Anche se lato tuo potrebbe essere considerato un rebranding in realtà sono diverse le cose che cambiano, ad esempio - il **database **potrà essere solo quello di SAP ovvero il database HANA (attenzione che [HANA ed S/4HANA](https://www.aglea.com/blog/5-suggerimenti-su-sap-s/4hana-security-lesson-learned) sono due cose diverse. Il primo è il database il secondo è la parte applicativa, spesso vengono usati come sinonimi). Quindi devi fare un [VA](https://www.aglea.com/blog/cosa-fare-dopo-un-audit-o-vulnerability-assessment-sap-security) su [HANA](https://www.aglea.com/blog/migrazione-sap-hana-security-sap-cosa-cambia) o S/4HANA? Chiaramente sarà una attività con un "target" diverso. - S/4HANA rispetto ad ECC ha introdotto diverse modifiche in ottica **Security by default,** ma al momento il passaggio non è ancora terminato (ed in qualsiasi fase dell'installazione o configurazione è possibile decidere se adottare o cambiare i settaggi di default, aprendo delle potenziali falle) - L'architettura di S/4HANA può essere diversa da quella ECC questo dipende dall'approccio dell'upgrade che è stato scelto - In generale come sai, **nessun sistema è sicuro.** Tantomeno SAP, quindi le false convinzioni di un sistema tedesco a prova di proiettile, così come qualsiasi altro sistema sono pura fantasia. Sicuramente la SAP è un fornitore molto attento a questi aspetti e fornisce supporto immediato in caso di bisogno; tuttavia, nessuno può essere sicuro di aver rilasciato un software privo di vulnerabilità.   Secondo passaggio. Identifica un caso di prova, su quale sistema ha senso concentrarci. Chiaramente in questo caso sono diversi i fattori da tenere in considerazione: 1. Quali sono i dati gestiti dal sistema stesso? 1. Sono dati rilevanti per l'azienda? 2. Sono dati dell'azienda rilevanti per il mercato? 3. Sono gestiti dati personali? In che volumi? 2. Si tratta di un sistema interno o esposto alla rete? 3. Si tratta di un sistema sviluppato con tecnologie più soggette a vulnerabilità? 4. È un sistema aggiornato di frequente o meno? Magari non è così semplice aggiornarlo? 5. È un sistema in dismissione? È un sistema oggetto di upgrade a breve?   Quelli sono solo alcuni dei driver per provare ad identificare un primo sistema "pilota" per avviare una indagine di questo tipo.   Terzo passaggio. Che controllo fare? Sono diversi i controlli che puoi svolgere, ovvero quale/i superficie di attacco vuoi considerare? Alcune sono applicabili al sistema scelto altre magari no o in parte. Ad esempio: - [Audit Applicativo](https://www.aglea.com/sap-audit) - SAP Security Vulnerability Assessment, ad esempio sono controllati questi aspetti: - Autorizzazioni IT critiche - Configurazione del sistema non corrette - Patch di sicurezza non applicate - Configurazioni del database (HANA) o sistema operativo non corrette - Gestione dei processi di autenticazione e crittografia dei dati non corretti ![Vulnerability Assessment SAP](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/Vulnerability%20Assessment%20SAP-Jun-14-2024-09-11-20-3022-AM.jpg?width=483&height=274&name=Vulnerability%20Assessment%20SAP-Jun-14-2024-09-11-20-3022-AM.jpg) - [Secure Code](https://www.aglea.com/blog/secure-coding-abap-le-10-regole-per-lo-sviluppo-sicuro-in-sap) scanning   Ognuna di queste aree mostra chiaramente determinati risultati, cosa vuoi fare e su cosa vuoi concentrarti, tutto o parte di questi?   Quarto passaggio. Come effettui il controllo. Ovvero, una volta identificato il sistema, che sia ABAP o JAVA o Cloud come controlli?   Come potrai immaginare ogni sistema ha un set esteso di controlli possibili. Certamente è possibile fare dei controlli manuali, ma significa lasciare l'accesso a terzi, e sicuramente non sarò possibile controllare il più possibile. Per questo motivo suggeriamo di utilizzare degli strumenti che permettano di automatizzare i controlli utilizzando la nostra esperienza per poi leggere e calibrare correttamente le analisi e soprattutto i risultati.   Voi provare a sentire cosa possiamo fare per te su questo argomento? Contattaci!         Topics: [sap vulnerability](https://www.aglea.com/blog/tag/sap-vulnerability), [vulnerability assessment](https://www.aglea.com/blog/tag/vulnerability-assessment), [code vulnerability analysis](https://www.aglea.com/blog/tag/code-vulnerability-analysis) ### Iscriviti qui! ### Blog Aglea, cosa puoi trovare? Ogni mercoledì pubblichiamo articoli, interviste e documenti relativi alla security SAP. Cosa puoi trovare: - Suggerimenti su come mettere in sicurezza i sistemi SAP - Come fare a … (How To) - Checklist - Gli errori comuni che spesso vengono fatti in ambito Security SAP - Interviste con esperti del settore - Chi è AGLEA quale è la nostra vision security SAP ### Post recenti ### Post By Topic - [SAP Security (32)](https://www.aglea.com/blog/tag/sap-security) - [SAP GRC (24)](https://www.aglea.com/blog/tag/sap-grc) - [audit sap (22)](https://www.aglea.com/blog/tag/audit-sap) - [fiori launchpad (20)](https://www.aglea.com/blog/tag/fiori-launchpad) - [pfcg (19)](https://www.aglea.com/blog/tag/pfcg) - [authorization concept (18)](https://www.aglea.com/blog/tag/authorization-concept) - [cyber security (18)](https://www.aglea.com/blog/tag/cyber-security) - [SAP audit (17)](https://www.aglea.com/blog/tag/sap-audit) - [audit (16)](https://www.aglea.com/blog/tag/audit) - [gdpr (16)](https://www.aglea.com/blog/tag/gdpr) - [sap cyber security (16)](https://www.aglea.com/blog/tag/sap-cyber-security) - [auditing (15)](https://www.aglea.com/blog/tag/auditing) - [sap security blog (14)](https://www.aglea.com/blog/tag/sap-security-blog) - [supporto sap ams (14)](https://www.aglea.com/blog/tag/supporto-sap-ams) - [PFCG SAP transaction (13)](https://www.aglea.com/blog/tag/pfcg-sap-transaction) - [SAP Cloud (13)](https://www.aglea.com/blog/tag/sap-cloud) - [sap FIORI (13)](https://www.aglea.com/blog/tag/sap-fiori) - [libro SAP (12)](https://www.aglea.com/blog/tag/libro-sap) - [sod (12)](https://www.aglea.com/blog/tag/sod) - [SAP GDPR (11)](https://www.aglea.com/blog/tag/sap-gdpr) - [sap password (11)](https://www.aglea.com/blog/tag/sap-password) - [sap vulnerability (11)](https://www.aglea.com/blog/tag/sap-vulnerability) - [SAP cloud identity services (10)](https://www.aglea.com/blog/tag/sap-cloud-identity-services) - [Segregation of duties (10)](https://www.aglea.com/blog/tag/segregation-of-duties) - [vulnerability assessment (10)](https://www.aglea.com/blog/tag/vulnerability-assessment) - [sap btp (9)](https://www.aglea.com/blog/tag/sap-btp) - [sap license auditing (9)](https://www.aglea.com/blog/tag/sap-license-auditing) - [SAP Cloud Security (8)](https://www.aglea.com/blog/tag/sap-cloud-security) - [SAP FIORI Security (8)](https://www.aglea.com/blog/tag/sap-fiori-security) - [SAP HR (8)](https://www.aglea.com/blog/tag/sap-hr) - [consulenza sap security (8)](https://www.aglea.com/blog/tag/consulenza-sap-security) - [idm (8)](https://www.aglea.com/blog/tag/idm) - [secure coding sap (8)](https://www.aglea.com/blog/tag/secure-coding-sap) - [security audit log (8)](https://www.aglea.com/blog/tag/security-audit-log) - [siem (8)](https://www.aglea.com/blog/tag/siem) - [threat detection (8)](https://www.aglea.com/blog/tag/threat-detection) - [upgrade (8)](https://www.aglea.com/blog/tag/upgrade) - [FIORI Security (7)](https://www.aglea.com/blog/tag/fiori-security) - [S/4HANA (7)](https://www.aglea.com/blog/tag/s-4hana) - [SAP IAG (7)](https://www.aglea.com/blog/tag/sap-iag) - [SAP LOG (7)](https://www.aglea.com/blog/tag/sap-log) - [User Access Management (7)](https://www.aglea.com/blog/tag/user-access-management) - [governance (7)](https://www.aglea.com/blog/tag/governance) - [internal audit (7)](https://www.aglea.com/blog/tag/internal-audit) - [sap consulenza security (7)](https://www.aglea.com/blog/tag/sap-consulenza-security) - [sap fiori space (7)](https://www.aglea.com/blog/tag/sap-fiori-space) - [sap grc 12 (7)](https://www.aglea.com/blog/tag/sap-grc-12) - [security ams (7)](https://www.aglea.com/blog/tag/security-ams) - [su53 (7)](https://www.aglea.com/blog/tag/su53) - [HANA Security (6)](https://www.aglea.com/blog/tag/hana-security) - [SAP ECC (6)](https://www.aglea.com/blog/tag/sap-ecc) - [autorizzazioni sap (6)](https://www.aglea.com/blog/tag/autorizzazioni-sap) - [identity management system (6)](https://www.aglea.com/blog/tag/identity-management-system) - [sap patch (6)](https://www.aglea.com/blog/tag/sap-patch) - [ISO (5)](https://www.aglea.com/blog/tag/iso) - [SAP Identity and Access Governance (5)](https://www.aglea.com/blog/tag/sap-identity-and-access-governance) - [SU01 sap (5)](https://www.aglea.com/blog/tag/su01-sap) - [access management (5)](https://www.aglea.com/blog/tag/access-management) - [authorization model (5)](https://www.aglea.com/blog/tag/authorization-model) - [controlli interni (5)](https://www.aglea.com/blog/tag/controlli-interni) - [cyber security culture (5)](https://www.aglea.com/blog/tag/cyber-security-culture) - [data loss prevention (5)](https://www.aglea.com/blog/tag/data-loss-prevention) - [documentazione sap security (5)](https://www.aglea.com/blog/tag/documentazione-sap-security) - [log sap (5)](https://www.aglea.com/blog/tag/log-sap) - [oggetti autorizzativi critici (5)](https://www.aglea.com/blog/tag/oggetti-autorizzativi-critici) - [rfc security (5)](https://www.aglea.com/blog/tag/rfc-security) - [ruoli (5)](https://www.aglea.com/blog/tag/ruoli) - [sap authorization review (5)](https://www.aglea.com/blog/tag/sap-authorization-review) - [sap fue (5)](https://www.aglea.com/blog/tag/sap-fue) - [sap_all (5)](https://www.aglea.com/blog/tag/sap_all) - [securitybridge (5)](https://www.aglea.com/blog/tag/securitybridge) - [sicurezza sap (5)](https://www.aglea.com/blog/tag/sicurezza-sap) - [sviluppo codice sicuro (5)](https://www.aglea.com/blog/tag/sviluppo-codice-sicuro) - [userid (5)](https://www.aglea.com/blog/tag/userid) - [IAG (4)](https://www.aglea.com/blog/tag/iag) - [RISE with SAP (4)](https://www.aglea.com/blog/tag/rise-with-sap) - [SAP IDM (4)](https://www.aglea.com/blog/tag/sap-idm) - [aglea (4)](https://www.aglea.com/blog/tag/aglea) - [code vulnerability analysis (4)](https://www.aglea.com/blog/tag/code-vulnerability-analysis) - [data privacy (4)](https://www.aglea.com/blog/tag/data-privacy) - [fraud management (4)](https://www.aglea.com/blog/tag/fraud-management) - [itgc (4)](https://www.aglea.com/blog/tag/itgc) - [microsoft (4)](https://www.aglea.com/blog/tag/microsoft) - [patch (4)](https://www.aglea.com/blog/tag/patch) - [sap data masking (4)](https://www.aglea.com/blog/tag/sap-data-masking) - [sap gui (4)](https://www.aglea.com/blog/tag/sap-gui) - [sap gui security (4)](https://www.aglea.com/blog/tag/sap-gui-security) - [sap hana (4)](https://www.aglea.com/blog/tag/sap-hana) - [sap logon (4)](https://www.aglea.com/blog/tag/sap-logon) - [sap super user (4)](https://www.aglea.com/blog/tag/sap-super-user) - [security awareness (4)](https://www.aglea.com/blog/tag/security-awareness) - [test system (4)](https://www.aglea.com/blog/tag/test-system) - [workflow security SAP (4)](https://www.aglea.com/blog/tag/workflow-security-sap) - [AI (3)](https://www.aglea.com/blog/tag/ai) - [HANA (3)](https://www.aglea.com/blog/tag/hana) - [RISE (3)](https://www.aglea.com/blog/tag/rise) - [Risk Management (3)](https://www.aglea.com/blog/tag/risk-management) - [SAP AUDIT LOG (3)](https://www.aglea.com/blog/tag/sap-audit-log) - [SAP NOW (3)](https://www.aglea.com/blog/tag/sap-now) - [Single Sing On (3)](https://www.aglea.com/blog/tag/single-sing-on) - [UCON (3)](https://www.aglea.com/blog/tag/ucon) - [UI logging (3)](https://www.aglea.com/blog/tag/ui-logging) - [amministratore di sistema (3)](https://www.aglea.com/blog/tag/amministratore-di-sistema) - [cloud platform (3)](https://www.aglea.com/blog/tag/cloud-platform) - [consulenti (3)](https://www.aglea.com/blog/tag/consulenti) - [consulenti sap security (3)](https://www.aglea.com/blog/tag/consulenti-sap-security) - [corsi sap (3)](https://www.aglea.com/blog/tag/corsi-sap) - [crittografia SAP (3)](https://www.aglea.com/blog/tag/crittografia-sap) - [e-learning (3)](https://www.aglea.com/blog/tag/e-learning) - [emergency users (3)](https://www.aglea.com/blog/tag/emergency-users) - [formazione sap (3)](https://www.aglea.com/blog/tag/formazione-sap) - [mail security sap (3)](https://www.aglea.com/blog/tag/mail-security-sap) - [manuali sap security (3)](https://www.aglea.com/blog/tag/manuali-sap-security) - [password policy (3)](https://www.aglea.com/blog/tag/password-policy) - [process control (3)](https://www.aglea.com/blog/tag/process-control) - [process mining (3)](https://www.aglea.com/blog/tag/process-mining) - [processi security (3)](https://www.aglea.com/blog/tag/processi-security) - [profili sap (3)](https://www.aglea.com/blog/tag/profili-sap) - [reporting (3)](https://www.aglea.com/blog/tag/reporting) - [rfc (3)](https://www.aglea.com/blog/tag/rfc) - [rpa sap security (3)](https://www.aglea.com/blog/tag/rpa-sap-security) - [sap compliance (3)](https://www.aglea.com/blog/tag/sap-compliance) - [sap custom (3)](https://www.aglea.com/blog/tag/sap-custom) - [sap data obfuscation (3)](https://www.aglea.com/blog/tag/sap-data-obfuscation) - [sap dati personali (3)](https://www.aglea.com/blog/tag/sap-dati-personali) - [sap ias (3)](https://www.aglea.com/blog/tag/sap-ias) - [sap mail (3)](https://www.aglea.com/blog/tag/sap-mail) - [sap siem (3)](https://www.aglea.com/blog/tag/sap-siem) - [sap sso (3)](https://www.aglea.com/blog/tag/sap-sso) - [sap training (3)](https://www.aglea.com/blog/tag/sap-training) - [se16 (3)](https://www.aglea.com/blog/tag/se16) - [sicurezza dei dati sap (3)](https://www.aglea.com/blog/tag/sicurezza-dei-dati-sap) - [su25 (3)](https://www.aglea.com/blog/tag/su25) - [suim (3)](https://www.aglea.com/blog/tag/suim) - [ticket management system (3)](https://www.aglea.com/blog/tag/ticket-management-system) - [training (3)](https://www.aglea.com/blog/tag/training) - [transazioni sap (3)](https://www.aglea.com/blog/tag/transazioni-sap) - [zero trust security (3)](https://www.aglea.com/blog/tag/zero-trust-security) - [27001 (2)](https://www.aglea.com/blog/tag/27001) - [NIS2 (2)](https://www.aglea.com/blog/tag/nis2) - [SAP GRC Process Control (2)](https://www.aglea.com/blog/tag/sap-grc-process-control) - [SAP Gateway security (2)](https://www.aglea.com/blog/tag/sap-gateway-security) - [Trace autorizzazioni SAP (2)](https://www.aglea.com/blog/tag/trace-autorizzazioni-sap) - [UI Masking (2)](https://www.aglea.com/blog/tag/ui-masking) - [agleasapsecurity (2)](https://www.aglea.com/blog/tag/agleasapsecurity) - [ams (2)](https://www.aglea.com/blog/tag/ams) - [corso (2)](https://www.aglea.com/blog/tag/corso) - [custom (2)](https://www.aglea.com/blog/tag/custom) - [cyber security exposure (2)](https://www.aglea.com/blog/tag/cyber-security-exposure) - [epi-use (2)](https://www.aglea.com/blog/tag/epi-use) - [eventi (2)](https://www.aglea.com/blog/tag/eventi) - [gxp (2)](https://www.aglea.com/blog/tag/gxp) - [intelligenza artificiale (2)](https://www.aglea.com/blog/tag/intelligenza-artificiale) - [joule (2)](https://www.aglea.com/blog/tag/joule) - [organizzazione (2)](https://www.aglea.com/blog/tag/organizzazione) - [profili (2)](https://www.aglea.com/blog/tag/profili) - [progetti sap security (2)](https://www.aglea.com/blog/tag/progetti-sap-security) - [programmazione sicura (2)](https://www.aglea.com/blog/tag/programmazione-sicura) - [quality (2)](https://www.aglea.com/blog/tag/quality) - [quotazione borsa (2)](https://www.aglea.com/blog/tag/quotazione-borsa) - [s_tabu_dis (2)](https://www.aglea.com/blog/tag/s_tabu_dis) - [sap business role (2)](https://www.aglea.com/blog/tag/sap-business-role) - [sap catalog (2)](https://www.aglea.com/blog/tag/sap-catalog) - [sap data protection (2)](https://www.aglea.com/blog/tag/sap-data-protection) - [sap developer (2)](https://www.aglea.com/blog/tag/sap-developer) - [sap enterprise threat detection (2)](https://www.aglea.com/blog/tag/sap-enterprise-threat-detection) - [sap etd (2)](https://www.aglea.com/blog/tag/sap-etd) - [sap gxp compliance (2)](https://www.aglea.com/blog/tag/sap-gxp-compliance) - [sap ilm (2)](https://www.aglea.com/blog/tag/sap-ilm) - [sap italia (2)](https://www.aglea.com/blog/tag/sap-italia) - [sap menu (2)](https://www.aglea.com/blog/tag/sap-menu) - [sap query (2)](https://www.aglea.com/blog/tag/sap-query) - [sap router security (2)](https://www.aglea.com/blog/tag/sap-router-security) - [sap security guidelines (2)](https://www.aglea.com/blog/tag/sap-security-guidelines) - [sap security note (2)](https://www.aglea.com/blog/tag/sap-security-note) - [sap security partner (2)](https://www.aglea.com/blog/tag/sap-security-partner) - [sap security patch day (2)](https://www.aglea.com/blog/tag/sap-security-patch-day) - [sap security tools (2)](https://www.aglea.com/blog/tag/sap-security-tools) - [sap security video (2)](https://www.aglea.com/blog/tag/sap-security-video) - [sap sos (2)](https://www.aglea.com/blog/tag/sap-sos) - [sap workflow (2)](https://www.aglea.com/blog/tag/sap-workflow) - [se16n (2)](https://www.aglea.com/blog/tag/se16n) - [secure operation map (2)](https://www.aglea.com/blog/tag/secure-operation-map) - [slaw (2)](https://www.aglea.com/blog/tag/slaw) - [smartworking (2)](https://www.aglea.com/blog/tag/smartworking) - [soar (2)](https://www.aglea.com/blog/tag/soar) - [social engineering (2)](https://www.aglea.com/blog/tag/social-engineering) - [solution manager (2)](https://www.aglea.com/blog/tag/solution-manager) - [success Factors (2)](https://www.aglea.com/blog/tag/success-factors) - [super utenti sap (2)](https://www.aglea.com/blog/tag/super-utenti-sap) - [system users (2)](https://www.aglea.com/blog/tag/system-users) - [tabelle (2)](https://www.aglea.com/blog/tag/tabelle) - [trasformazione digitale (2)](https://www.aglea.com/blog/tag/trasformazione-digitale) - [usmm (2)](https://www.aglea.com/blog/tag/usmm) - [youtube aglea (2)](https://www.aglea.com/blog/tag/youtube-aglea) - [youtube sap (2)](https://www.aglea.com/blog/tag/youtube-sap) - [10bklaze (1)](https://www.aglea.com/blog/tag/10bklaze) - [20000 (1)](https://www.aglea.com/blog/tag/20000) - [312 (1)](https://www.aglea.com/blog/tag/312) - [9001 (1)](https://www.aglea.com/blog/tag/9001) - [ABAP (1)](https://www.aglea.com/blog/tag/abap) - [Barcellona (1)](https://www.aglea.com/blog/tag/barcellona) - [CIAM (1)](https://www.aglea.com/blog/tag/ciam) - [CSR (1)](https://www.aglea.com/blog/tag/csr) - [CVA (1)](https://www.aglea.com/blog/tag/cva) - [CVE-2021-44228 (1)](https://www.aglea.com/blog/tag/cve-2021-44228) - [Cloud ALM (1)](https://www.aglea.com/blog/tag/cloud-alm) - [DPO (1)](https://www.aglea.com/blog/tag/dpo) - [ERM (1)](https://www.aglea.com/blog/tag/erm) - [Enterprise risk management (1)](https://www.aglea.com/blog/tag/enterprise-risk-management) - [GROW (1)](https://www.aglea.com/blog/tag/grow) - [Gestione del rischio aziendale (1)](https://www.aglea.com/blog/tag/gestione-del-rischio-aziendale) - [HANA Roles (1)](https://www.aglea.com/blog/tag/hana-roles) - [HR Data Reporting (1)](https://www.aglea.com/blog/tag/hr-data-reporting) - [IAS (1)](https://www.aglea.com/blog/tag/ias) - [IPS (1)](https://www.aglea.com/blog/tag/ips) - [Liste distribuzione SAP (1)](https://www.aglea.com/blog/tag/liste-distribuzione-sap) - [Log4Shell SAP (1)](https://www.aglea.com/blog/tag/log4shell-sap) - [Milano (1)](https://www.aglea.com/blog/tag/milano) - [OKR (1)](https://www.aglea.com/blog/tag/okr) - [Onboarding (1)](https://www.aglea.com/blog/tag/onboarding) - [P-user (1)](https://www.aglea.com/blog/tag/p-user) - [Portale SAP note (1)](https://www.aglea.com/blog/tag/portale-sap-note) - [Privilege Access Management (1)](https://www.aglea.com/blog/tag/privilege-access-management) - [S-user (1)](https://www.aglea.com/blog/tag/s-user) - [SAP ABAC (1)](https://www.aglea.com/blog/tag/sap-abac) - [SAP Assurance and Compliance Software (1)](https://www.aglea.com/blog/tag/sap-assurance-and-compliance-software) - [SAP C4C (1)](https://www.aglea.com/blog/tag/sap-c4c) - [SAP DAM (1)](https://www.aglea.com/blog/tag/sap-dam) - [SAP DLP (1)](https://www.aglea.com/blog/tag/sap-dlp) - [SAP DRM (1)](https://www.aglea.com/blog/tag/sap-drm) - [SAP ERP cloud private (1)](https://www.aglea.com/blog/tag/sap-erp-cloud-private) - [SAP FKOM (1)](https://www.aglea.com/blog/tag/sap-fkom) - [SAP Fraud Management (1)](https://www.aglea.com/blog/tag/sap-fraud-management) - [SAP RBAC (1)](https://www.aglea.com/blog/tag/sap-rbac) - [SAP RECON (1)](https://www.aglea.com/blog/tag/sap-recon) - [SAP Sales (1)](https://www.aglea.com/blog/tag/sap-sales) - [SAP Table (1)](https://www.aglea.com/blog/tag/sap-table) - [SECURITY PATTERN ANALYSIS (1)](https://www.aglea.com/blog/tag/security-pattern-analysis) - [SLA (1)](https://www.aglea.com/blog/tag/sla) - [SOX (1)](https://www.aglea.com/blog/tag/sox) - [SPOOL (1)](https://www.aglea.com/blog/tag/spool) - [ST01 (1)](https://www.aglea.com/blog/tag/st01) - [STAUTHTRACE (1)](https://www.aglea.com/blog/tag/stauthtrace) - [Statistiche security SAP (1)](https://www.aglea.com/blog/tag/statistiche-security-sap) - [admin (1)](https://www.aglea.com/blog/tag/admin) - [aglea tribe (1)](https://www.aglea.com/blog/tag/aglea-tribe) - [analisi dei rischi (1)](https://www.aglea.com/blog/tag/analisi-dei-rischi) - [azure (1)](https://www.aglea.com/blog/tag/azure) - [backup (1)](https://www.aglea.com/blog/tag/backup) - [biolock sap (1)](https://www.aglea.com/blog/tag/biolock-sap) - [biometria (1)](https://www.aglea.com/blog/tag/biometria) - [blacklist sap (1)](https://www.aglea.com/blog/tag/blacklist-sap) - [bot (1)](https://www.aglea.com/blog/tag/bot) - [brand (1)](https://www.aglea.com/blog/tag/brand) - [certificazioni sap (1)](https://www.aglea.com/blog/tag/certificazioni-sap) - [chatGPT (1)](https://www.aglea.com/blog/tag/chatgpt) - [ciso (1)](https://www.aglea.com/blog/tag/ciso) - [cloud connector (1)](https://www.aglea.com/blog/tag/cloud-connector) - [codice sicuro SAP (1)](https://www.aglea.com/blog/tag/codice-sicuro-sap) - [compatibility packs (1)](https://www.aglea.com/blog/tag/compatibility-packs) - [continuità del servizio (1)](https://www.aglea.com/blog/tag/continuità-del-servizio) - [customization sap (1)](https://www.aglea.com/blog/tag/customization-sap) - [cyber security deception (1)](https://www.aglea.com/blog/tag/cyber-security-deception) - [data access subject request (1)](https://www.aglea.com/blog/tag/data-access-subject-request) - [data subject request gdpr (1)](https://www.aglea.com/blog/tag/data-subject-request-gdpr) - [delete user (1)](https://www.aglea.com/blog/tag/delete-user) - [developer (1)](https://www.aglea.com/blog/tag/developer) - [documentazione SAP GRC (1)](https://www.aglea.com/blog/tag/documentazione-sap-grc) - [documentazione di progetto (1)](https://www.aglea.com/blog/tag/documentazione-di-progetto) - [dsr (1)](https://www.aglea.com/blog/tag/dsr) - [dynamic authorization management (1)](https://www.aglea.com/blog/tag/dynamic-authorization-management) - [esg (1)](https://www.aglea.com/blog/tag/esg) - [esterni (1)](https://www.aglea.com/blog/tag/esterni) - [exchange rates (1)](https://www.aglea.com/blog/tag/exchange-rates) - [external users management (1)](https://www.aglea.com/blog/tag/external-users-management) - [falsi positivi (1)](https://www.aglea.com/blog/tag/falsi-positivi) - [feedback (1)](https://www.aglea.com/blog/tag/feedback) - [firefighter (1)](https://www.aglea.com/blog/tag/firefighter) - [firefighter HANA (1)](https://www.aglea.com/blog/tag/firefighter-hana) - [flash (1)](https://www.aglea.com/blog/tag/flash) - [fornitori sap (1)](https://www.aglea.com/blog/tag/fornitori-sap) - [ftp (1)](https://www.aglea.com/blog/tag/ftp) - [go-live (1)](https://www.aglea.com/blog/tag/go-live) - [grc ram (1)](https://www.aglea.com/blog/tag/grc-ram) - [handover autorizzazioni (1)](https://www.aglea.com/blog/tag/handover-autorizzazioni) - [hardening (1)](https://www.aglea.com/blog/tag/hardening) - [horsa (1)](https://www.aglea.com/blog/tag/horsa) - [integrazioni sap (1)](https://www.aglea.com/blog/tag/integrazioni-sap) - [intune (1)](https://www.aglea.com/blog/tag/intune) - [lavoro agile (1)](https://www.aglea.com/blog/tag/lavoro-agile) - [libri (1)](https://www.aglea.com/blog/tag/libri) - [malware (1)](https://www.aglea.com/blog/tag/malware) - [mandanti (1)](https://www.aglea.com/blog/tag/mandanti) - [metodologia sap activate (1)](https://www.aglea.com/blog/tag/metodologia-sap-activate) - [microsoft planner (1)](https://www.aglea.com/blog/tag/microsoft-planner) - [microsoft stream (1)](https://www.aglea.com/blog/tag/microsoft-stream) - [multicompany sap security (1)](https://www.aglea.com/blog/tag/multicompany-sap-security) - [multiple logon (1)](https://www.aglea.com/blog/tag/multiple-logon) - [naming convention (1)](https://www.aglea.com/blog/tag/naming-convention) - [nist (1)](https://www.aglea.com/blog/tag/nist) - [nuovi assunti (1)](https://www.aglea.com/blog/tag/nuovi-assunti) - [ob08 (1)](https://www.aglea.com/blog/tag/ob08) - [pa20 (1)](https://www.aglea.com/blog/tag/pa20) - [parameter sap (1)](https://www.aglea.com/blog/tag/parameter-sap) - [partner sap (1)](https://www.aglea.com/blog/tag/partner-sap) - [pfud (1)](https://www.aglea.com/blog/tag/pfud) - [podcast sap security (1)](https://www.aglea.com/blog/tag/podcast-sap-security) - [postmand sap api (1)](https://www.aglea.com/blog/tag/postmand-sap-api) - [progetti security sap (1)](https://www.aglea.com/blog/tag/progetti-security-sap) - [quantum (1)](https://www.aglea.com/blog/tag/quantum) - [remediation (1)](https://www.aglea.com/blog/tag/remediation) - [remote access (1)](https://www.aglea.com/blog/tag/remote-access) - [rfc destination (1)](https://www.aglea.com/blog/tag/rfc-destination) - [risorse umane (1)](https://www.aglea.com/blog/tag/risorse-umane) - [role transport (1)](https://www.aglea.com/blog/tag/role-transport) - [s_tabu_nam (1)](https://www.aglea.com/blog/tag/s_tabu_nam) - [s_tabu_rfc (1)](https://www.aglea.com/blog/tag/s_tabu_rfc) - [sailpoint (1)](https://www.aglea.com/blog/tag/sailpoint) - [sap TechEd (1)](https://www.aglea.com/blog/tag/sap-teched) - [sap access control (1)](https://www.aglea.com/blog/tag/sap-access-control) - [sap acronimi (1)](https://www.aglea.com/blog/tag/sap-acronimi) - [sap activate (1)](https://www.aglea.com/blog/tag/sap-activate) - [sap add on (1)](https://www.aglea.com/blog/tag/sap-add-on) - [sap antivirus (1)](https://www.aglea.com/blog/tag/sap-antivirus) - [sap asap (1)](https://www.aglea.com/blog/tag/sap-asap) - [sap assure (1)](https://www.aglea.com/blog/tag/sap-assure) - [sap backup (1)](https://www.aglea.com/blog/tag/sap-backup) - [sap bis (1)](https://www.aglea.com/blog/tag/sap-bis) - [sap business continuity (1)](https://www.aglea.com/blog/tag/sap-business-continuity) - [sap business integrity screening (1)](https://www.aglea.com/blog/tag/sap-business-integrity-screening) - [sap business partner (1)](https://www.aglea.com/blog/tag/sap-business-partner) - [sap bw (1)](https://www.aglea.com/blog/tag/sap-bw) - [sap covid (1)](https://www.aglea.com/blog/tag/sap-covid) - [sap cua (1)](https://www.aglea.com/blog/tag/sap-cua) - [sap cva (1)](https://www.aglea.com/blog/tag/sap-cva) - [sap earlywatch (1)](https://www.aglea.com/blog/tag/sap-earlywatch) - [sap frodi (1)](https://www.aglea.com/blog/tag/sap-frodi) - [sap gamification (1)](https://www.aglea.com/blog/tag/sap-gamification) - [sap grc app (1)](https://www.aglea.com/blog/tag/sap-grc-app) - [sap grc fiori (1)](https://www.aglea.com/blog/tag/sap-grc-fiori) - [sap grc rm (1)](https://www.aglea.com/blog/tag/sap-grc-rm) - [sap grc tables (1)](https://www.aglea.com/blog/tag/sap-grc-tables) - [sap gui history (1)](https://www.aglea.com/blog/tag/sap-gui-history) - [sap ilm gdpr (1)](https://www.aglea.com/blog/tag/sap-ilm-gdpr) - [sap ips (1)](https://www.aglea.com/blog/tag/sap-ips) - [sap masking (1)](https://www.aglea.com/blog/tag/sap-masking) - [sap penetration test (1)](https://www.aglea.com/blog/tag/sap-penetration-test) - [sap personalization (1)](https://www.aglea.com/blog/tag/sap-personalization) - [sap roll out (1)](https://www.aglea.com/blog/tag/sap-roll-out) - [sap scp logon (1)](https://www.aglea.com/blog/tag/sap-scp-logon) - [sap security MEME (1)](https://www.aglea.com/blog/tag/sap-security-meme) - [sap security checklist (1)](https://www.aglea.com/blog/tag/sap-security-checklist) - [sap security integrator (1)](https://www.aglea.com/blog/tag/sap-security-integrator) - [sap security teal (1)](https://www.aglea.com/blog/tag/sap-security-teal) - [sap signavio (1)](https://www.aglea.com/blog/tag/sap-signavio) - [sap splunk (1)](https://www.aglea.com/blog/tag/sap-splunk) - [sap standard role (1)](https://www.aglea.com/blog/tag/sap-standard-role) - [sap support package (1)](https://www.aglea.com/blog/tag/sap-support-package) - [sap tabelle custom (1)](https://www.aglea.com/blog/tag/sap-tabelle-custom) - [sap tdms (1)](https://www.aglea.com/blog/tag/sap-tdms) - [sap tipo utente (1)](https://www.aglea.com/blog/tag/sap-tipo-utente) - [sap translate (1)](https://www.aglea.com/blog/tag/sap-translate) - [sap_all_only_view (1)](https://www.aglea.com/blog/tag/sap_all_only_view) - [sap_gui (1)](https://www.aglea.com/blog/tag/sap_gui) - [sap_new (1)](https://www.aglea.com/blog/tag/sap_new) - [scc4 (1)](https://www.aglea.com/blog/tag/scc4) - [scoodo log (1)](https://www.aglea.com/blog/tag/scoodo-log) - [scrambling (1)](https://www.aglea.com/blog/tag/scrambling) - [scrum sap (1)](https://www.aglea.com/blog/tag/scrum-sap) - [secpol (1)](https://www.aglea.com/blog/tag/secpol) - [security bridge (1)](https://www.aglea.com/blog/tag/security-bridge) - [security operation center (1)](https://www.aglea.com/blog/tag/security-operation-center) - [security template (1)](https://www.aglea.com/blog/tag/security-template) - [security tools (1)](https://www.aglea.com/blog/tag/security-tools) - [security weaver (1)](https://www.aglea.com/blog/tag/security-weaver) - [self service (1)](https://www.aglea.com/blog/tag/self-service) - [semplificare (1)](https://www.aglea.com/blog/tag/semplificare) - [sentinel (1)](https://www.aglea.com/blog/tag/sentinel) - [sicurezza codice ABAP (1)](https://www.aglea.com/blog/tag/sicurezza-codice-abap) - [sicurezza dati (1)](https://www.aglea.com/blog/tag/sicurezza-dati) - [sistema integrato (1)](https://www.aglea.com/blog/tag/sistema-integrato) - [sod ruleset (1)](https://www.aglea.com/blog/tag/sod-ruleset) - [sondaggi (1)](https://www.aglea.com/blog/tag/sondaggi) - [sost (1)](https://www.aglea.com/blog/tag/sost) - [sql (1)](https://www.aglea.com/blog/tag/sql) - [sticker (1)](https://www.aglea.com/blog/tag/sticker) - [su21 (1)](https://www.aglea.com/blog/tag/su21) - [system integrator (1)](https://www.aglea.com/blog/tag/system-integrator) - [tabelle SAP grc access control (1)](https://www.aglea.com/blog/tag/tabelle-sap-grc-access-control) - [tassi di cambio (1)](https://www.aglea.com/blog/tag/tassi-di-cambio) - [test autorizzazioni (1)](https://www.aglea.com/blog/tag/test-autorizzazioni) - [traduzione ruoli (1)](https://www.aglea.com/blog/tag/traduzione-ruoli) - [traduzione sap (1)](https://www.aglea.com/blog/tag/traduzione-sap) - [ust04 (1)](https://www.aglea.com/blog/tag/ust04) - [utenti sap (1)](https://www.aglea.com/blog/tag/utenti-sap) - [utenze di sistema (1)](https://www.aglea.com/blog/tag/utenze-di-sistema) - [virtual forge (1)](https://www.aglea.com/blog/tag/virtual-forge) - [vpn (1)](https://www.aglea.com/blog/tag/vpn) - [xiting (1)](https://www.aglea.com/blog/tag/xiting) [Visualizza tutti](https://www.aglea.com/blog/gestione-delle-vulnerabilit%C3%A0-sap#) ## [SAP Security Blog AGLEA RSS Feed](https://www.aglea.com/blog/rss.xml) Aglea s.r.l. - Soggetta alla direzione e coordinamento di Horsa S.p.A. - P. IVA: IT 03868780960 - 2026 | [Privacy Policy](https://www.aglea.com/privacy-policy/) - [Cookie Policy](https://www.aglea.com/cookie-policy) - [Whistleblowing](https://whistleblowing.horsa.it/) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Massimo Manara", "url" : "https://www.aglea.com/blog/author/massimo-manara" }, "dateModified" : "2024-06-14T09:13:55.623Z", "datePublished" : "2023-12-19T23:00:00.000Z", "headline" : "Gestione delle vulnerabilità SAP", "image" : [ "https://www.aglea.com/hubfs/Aglea/Imported_Blog_Media/Prodotti%20SAP%20dalla%20A%20alla%20Z-Jun-14-2024-09-11-20-9923-AM.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.aglea.com/blog/gestione-delle-vulnerabilità-sap", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject" }, "name" : "Horsa S.p.A." } } ```