ABAP Security Checks in SAP Cloud Platform, ABAP Environment
“SAP Code Vulnerability Analyzer” is an on-premise product that carries out static analysis of ABAP source code and reports possible security risks. SAP Code Vulnerability Analyzer is integrated in the ABAP Test Cockpit (ATC), the central infrastructure for functional, performance and security code checks.
“SAP Cloud Platform, ABAP Environment” is SAP’s Platform as a Service (PaaS) offering for ABAP development which enables developers to make use of their traditional on-premise ABAP know-how to develop and run ABAP applications in the SAP Cloud Platform, either as extensions to SAP software or as standalone applications.
SAP Cloud Platform, ABAP Environment helps customers to:
- Develop and run ABAP extensions and applications on a PaaS
- Migrate their existing custom code to the cloud
- Use the newest version of the ABAP programming model (RAP)
- Consume the latest HANA database features
- Reuse the newest SAP Cloud Platform services
- Delegate the operation of the ABAP systems to the PaaS provider
Making sure your custom code is secure is one of the most important topics in cloud environments. ABAP coding in SAP Cloud Platform, ABAP Environment is also vulnerable to cyber-attacks, so it also makes sense to use ABAP security checks to check this custom code.This is why SAP provides ABAP security checks in SAP Cloud Platform, ABAP Environment at no additional cost. The ABAP security checks have the same feature scope as CVA, the on-premise product that we have been offering for years.
To execute security checks on your ABAP code in the cloud you use ADT, the Eclipse-Based ABAP Development Tools.
Fig 1 Launching Security Checks with the variant SLIN_SEC
Fig 2 Showing the ATC results with the security findings