eLearning Course Backlog

Fundamentals of On Premise Network Security Designs

Learn practical approaches to network security when designing your on-premise SAP network.

Read More

Network security is a foundation of SAP application security. Various risks are current without proper compartmentalization, least privilege, secure name resolution, and network access control. Attackers can bypass security mechanisms on the application level or create a denial of service; bottlenecks can impact availability. You'll learn how to identify fundamental mistakes of a network security design for typical SAP usage scenarios and determine their risk.

Security Overview of Hybrid Integration Scenarios for SAP

Learn how to protect your data and environment in SAP cloud to on-premise integration scenarios.

Read More

With the increasing business demand for cloud services for a platform (PaaS) and software use (SaaS) requiring end-to-end integration with SAP core systems in a managed or on-premise environment, these scenarios' security becomes challenging. The number of gateways and the complexity of the landscape increases while perimeter security erodes. You'll get an overview of common hybrid integration scenarios available in the SAP product offering and how you can gauge their security impact in your environment.

Fundamentals of Network intrusion detection for SAP

Learn to identify attacks on your SAP via network intrusion detection.

Read More

A mix of standardized and proprietary application and management protocols and gateway systems in an SAP system landscape creates difficulties for intrusion detection on the network level what you can do to detect living off the land approaches and protocol-specific attacks in an SAP network.

Fundamentals of SAP Process Interaction Model

Learn how SAP application clusters work and how to protect the cluster management from compromisation.

Read More

An SAP system, mostly operated as an application cluster, orchestrates various processes. These processes communicate on the host level and in the cluster. To identify flaws and improper configuration, you'll learn how the process interaction model works and what protocols and privileges are required to run the system properly.

Fundamentals of SAP Specific Operating System Hardening

Learn to harden your SAP's operating system sufficiently.

Read More

Sufficiently hardened operating systems are fundamental to an SAP system's security. Attackers with access to the host level can otherwise create severe damage to the SAP system and pivot their attack into other environments like industrial control systems. You'll learn how the SAP application interacts with the host's operating system and the prevalent threats; how you can identify if application-specific operating system hardening measures have been carried out sufficiently.

Fundamentals of Security Incident Network Containment

Learn what options you have to contain and respond to the attacker's movements in your SAP environment

Read More

The capability to detect attacks is of limited value when there is no competency in responding to the attack appropriately. The criticality of the SAP services' availability and integrity can easily yield more severe damage than the actual attack when the response is insufficient. You'll learn what you should consider when responding to an attack in an SAP landscape to contain the attack and minimize unintended side-effects as fundamental concepts of your response playbook.

Principals of RFC Gateway & Message Server hardening

Learn how to secure and harden the SAP RFC Gateway and Message Server components.

Read More

The RFC Gateway and Message Server issue essential services to make its components work and to interact with the system remotely. They provide capabilities also to support various legacy integrations and operating scenarios. Some of them are not compatible with nowadays security requirements. You'll learn how to harden these system components to mitigate the inherent risk of some SAP proprietary protocols' design flaws.

Best Practices of RFC Security Monitoring

Learn how you can monitor and inventory interfaces of the RFC protocol.

Read More

The remote function call protocol (RFC) is the protocol of choice for many system-to-system communication scenarios. Managing the complexity of RFC interfaces and the various sub-protocols is of high importance in protecting an SAP landscape. You'll learn best practices to set up a monitoring and inventory of the actual RFC communication and how you can retire obsolete interfaces.

Best Practices of RFC communication hardening

Learn how to increase the protection level of the RFC protocol.

Read More

The remote function call protocol (RFC) is the protocol of choice for many system-to-system communication scenarios. Hardening RFC communication requires knowledge about different encryption and authentication constraints and protection capabilities on different protocol levels. You'll learn best practices to harden RFC-based communication using proper encryption for integrity, confidentiality, different authentication scenarios, whitelisting, and trust relations.

Introduction into SAP user management & authentication

Learn the basics of managing access and verifying SAP user identities.

Read More

Understanding user management and identifying the different user- and service-based authentication setups to verify identities is elementary. Determining if the management of the different kinds and types of users, their authentication security policies and mechanisms are sufficiently set up and carried out is crucial to identify access control risks. You'll understand how to investigate the according system's setup and determine the risks.

Fundamental Attack Vectors to the SAP Standard

Learn what the commonly used attack vectors to SAP systems are.

Read More

To protect against opponents, you need to understand how they think and act. You'll learn what are the fundamental attack vectors of cybercriminals when attacking SAP systems. You'll understand what tactics are used to spoof user identities, tampering the system or data, disclose information, create a denial of service, or elevate privileges. These tactics work by exploiting common weaknesses and flaws of the architecture, design, and misconfiguration of an SAP environment. You'll get a fundamental understanding of the tactics and the pre-requisites of an attacker to succeed.

Fundamental Attack Vectors to the SAP Application Lifecycle and Change Management

Learn what the commonly used software lifecycle attack vectors to SAP are.

Read More

To protect against opponents, you need to understand how they think and act. You'll learn the fundamental attack vectors of cybercriminals when attacking SAP software via the application lifecycle and the change management. You'll know what threats can be realized by an opponent via software and customizing deployments, the opponent's prerequisites to be successful, and how you can detect these kinds of attacks.

Fundamental Attacks Vectors to the SAP Proprietary Clients

Understand how adversaries can attack your environment via commonly used SAP proprietary client software.

Read More

SAP provides some proprietary clients for their software solutions for different purposes, from the end-user, data analyst to the system administrator, and developer. These clients come with different capabilities to interact with the user's personal computer operating system and have various security traits. You'll learn how and by what prerequisites attackers can use these proprietary clients to get a foothold into a corporate network or impersonate a user in an SAP system. You'll understand as a result what are the security specifics of SAP GUI, SAP Business Client, ABAP Development, and HANA Tools  compared to a web browser

Overview of Advanced SAP data Security Features

Get an overview of the more advanced data protection concepts possible in SAP.

Read More

Protecting the access and integrity of data processed and provided by SAP systems is one of the most critical security challenges. You'll get an overview of advanced security features on top of user access and authorizations in different SAP technologies you can use to protect the information, including encryption on different data processing scenarios but also masking and anonymization capabilities

Fundamentals of SAP Interface and Configuration Monitoring

Learn how you can detect security events by monitoring SAP interfaces and configuration.

Read More

Monitoring security-related events on interfaces and unintentional changes to an SAP system's configuration is fundamental to detect malicious activities. In this course, you'll learn what approaches and standard tools and event sources are available to detect critical events on a system's configuration and interfaces and what their limitations are.

Introduction to Cryptography for SAP S4/HANA

Learn about the cryptographic features of S/4HANA.

Read More

Protecting the access, integrity, and authenticity of data processed and provided by SAP systems is one of the most critical security challenges. In this course, you'll know about different encryption features different and layers like SSF (Secure Store and Forward) and key and secrets management (e.g., PSEs, Credv2, ABAP Secure Storage, HANA Secure User Store), and the protection of communications.

Introduction to the SAP Authorisation Concept

Understand how the concept of user authorisation works in SAP systems.

Read More

The user authorization concept in SAP is often different from other software. To determine security flaws in an SAP authorization concept, you'll need to understand the general approach of SAP user access control. You'll learn the SAP concept of roles, profiles, and authorization objects, the tools to manage access and authorization definitions, and the assignment to users.

Fundamentals of Interface & Start Authorisations

Learn how to identify too excessive user permissions on interfaces and programs.

Read More

Authorization to restrict users to start programs or remote enabled interfaces are the first line of the inner defense in an SAP system. You'll learn the fundamental approaches to identify the too excessive start and remote execution privileges and how to determine their attack surface.

Fundamentals of Organizational & Structural Authorisations

Learn how to identify authorisation flaws in separating access between organisations in an SAP system.

Read More

Dividing access to assets in ownership of different parts of an organization or legally separated entities is are security and compliance challenges. Many regulations like HIPA, GDPR, and SOX require such organizational measures and their technical enforcement. To identify flaws in the implementation of such requirements, you'll learn the fundamental concepts of structural authorizations in SAP and how to analyze a setup.

Introduction into SAP Authorisation Security Flaws

Learn about common user authorisation flaws in SAP systems.

Read More

Security flaws by permissive authorizations can pose severe threats. They are a ubiquitous security challenge for SAP customers. To identify authorization security flaws, you'll learn how to determine the criticality of assigned authorizations and how to use the standard analytical tools to detect authorization flaws.

Access & Authorization Tracing

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.

Read More

Elevating privileges by assigning critical authorizations and impersonating legitimate users are common approaches by adversaries. You'll learn which logs and traces for user access and authorization changes are available in an SAP system and how you can access them to identify relevant events.

Best Practices to Minimize Attack Surface on Start Authorisations

Learn what features you can use to minimise SAP user start-authorisation to the needful.

Read More

Restricting the assignment of start authorization to users is the first line of the inner defense in an SAP system. To minimize this attack surface, you'll learn the best practices to revoke too widely given start authorization by considering business continuity impacts and set up a monitoring and continuous improvement process.

Best Practices to Minimize Attack Surface on Remote Access Authorisations

Learn what features you can use to minimise SAP user remote access authorisation to the needful.

Read More

Restricting the assignment of remote execution authorization on a user level is essential to implement the least privilege principle. To minimize this attack surface, you'll learn the best practices to revoke too widely given remote execution authorization by considering business continuity impacts and set up a monitoring and continuous improvement process.

Fundamentals of Common Code Security Design Flaws

Learn to avoid the most common code security design flaws in ABAP.

Read More

Mistakes in the design of SAP software applications can yield severe security flaws. Instead of actual implementation flaws in code, security design flaws usually can't be detected by code scanners or pure code reviews. You'll learn how to identify common design flaws in the ABAP programming language by examples and how a design sufficiently complies with security requirements.

Stored Procedures Injection Vulnerabilities

Learn to identify and prevent Stored Prceude injection vulnerabilities in ABAP
Read more

Read More

Like with all programming languages, ABAP based applications can contain security flaws. Because of different programming paradigms, frameworks, and runtimes for ABAP, the exploitability of a flaw and security code measures can vary. You'll learn to identify HANA stored procedure vulnerabilities in their different ABAP code variations and what threats they can pose to the SAP system.

Trap- / Backdoors

Learn to identify trap- and backdoors in ABAP

Read more

Read More

Like with all programming languages, ABAP based applications can contain security flaws. Because of different programming paradigms, frameworks, and runtimes for ABAP, the exploitability of a flaw and security code measures can vary. You'll learn to identify common trap- and backdoor patterns and what threats they can pose to the SAP system.

Privilege Escalation Vulnerabilties

Learn to identify and prevent privilege escalation vulnerabilities in ABAP
Read more

Read More

Like with all programming languages, ABAP based applications can contain security flaws. Because of different programming paradigms, frameworks, and runtimes for ABAP, the exploitability of a flaw and security code measures can vary. You'll learn to identify code flaws due to missing or erroneous control flow that can allow privilege escalation and what threats they can pose to the SAP system.

Cross Site Request Forgery Vulnerabilities (XSRF)

Learn to identify and prevent cross-site request forgery vulnerabilities in ABAP
Read more

Cross Site Scripting & Click Jacking Vulnerabilities (XSS)

Learn to identify and prevent cross-site scripting and click-jacking vulnerabilities in ABAP
Read more

Forceful Browsing Vulnerabilities

Learn to identify and prevent forceful browsing vulnerabilities in ABAP
Read more

Server Side Request Forgery Vulnerabilities (SSRF)

Learn to identify and prevent server-side request forgery vulnerabilities in ABAP
Read more

Proprietary Client Attack Vulnerabilties

Learn to identify and prevent ABAP vulnerabilities allowing the attack of proprietary clients.
Read more

Best Practices for Application Security Concepts

Best Practices for application security concepts

Read more

Fundamentals of Application Security Requirements Engineering

Learn to determine the security requirements of your business applications like an engineer.
Read more

Best Practices for Custom Interface Logging

Learn how to implement audit and tracing requirements in your ABAP application correctly.
Read more

Fundamentals of Cryptography in Business Systems

Get an overview of cryptography in SAP solutions.

Read more

Introduction to Cryptography for SAP HANA

Learn about the cryptographic protection capabilities of HANA
Read more

Overview of Identity Management and SSO

Learn about the central identity management and single-sign-on options for S/4HANA.
Read more

Overview of SAP Solution Manager Security Capabilities

Get an overview of how the SAP Solution Manager can help you to automate SAP security operations.
Read more

Fundamental Aspects of Code Security for ABAP Applications

Understand the security traits of ABAP applications.
Read more

Fundamental Threats to PaaS Cloud Applications

Know your PaaS security threats for the SAP Business Technology Platform
Read more

Overview of Protective Capabilities in SAP Cloud Foundry

Get an overview how SAP cloud foundry can help to secure your applications
Read more

Fundamentals of Node.JS code Security Flaws

Understand typical security flaws when you use Node.JS on the SAP Business Technology platform.
Read more

Fundamental Aspects of Code Security for Node.JS Applications

Learn how you can implemenat a more secure Node.JS app.
Read more

Best Practices of SAP Threat Modelling

Master SAP threat modelling

Read more

Common Attacks to the Software Supply Chain

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Fundamentals of Managing and Troubleshooting S/4HANA User Authorization

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Fundamental Threats to PaaS Cloud Applications

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Overview of Protective Capabilities in SAP Cloud Foundry

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Fundamentals of Node.JS Code Security Flaws

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Best Practices to Apply Code Analysis Within Change and Release Management

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Fundamentals of Assessing Cryptographic Systems

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Fundamentals of Hardening Cryptographic Setups in Business Software

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Fundamentals of SAP Authentication Protocols

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Overview of SAP BTP Authentication and Authorisation Protocols

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Introduction to Hybrid Environment Authentication Scenarios in SAP BTP

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Introduction to SAP BTP Identity Authentication Service

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Introduction to the SAP BTP Identity & Authentication Provider Integration Options

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Fundamentals of Managing Federated Identities

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Overview of the SAP BTP Authorisation Concept

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Introduction of managing SAP BTP Authorisations

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Fundamentals of Testing SAP BTP Authorisations

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Fundamentals of Cyber-Attack Kill Chains

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Fundamentals of Security Operations Methods and Approaches

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Fundamentals of Network Traffic Analysis

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Overview of Security Event Analysis Concepts and Terms

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Fundamentals of Security Event Analysis

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Fundamentals of Network Intrusion Detection for SAP

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more

Fundamentals of Security Incident Network Containment

Our training is designed to provide the skills in a practical approach. Our students' success is our best asset in showing the quality of our training.
Read more