As the digital attack surface continues to evolve, it’s crucial to stay ahead of the curve in terms of cybersecurity. That’s why we are excited to share with you the advancements we’ve made to our platform to better protect our customers from cyber threats. In this blog series, we will continuously highlight the newest features and updates that make the smarterSec Security Platform even more powerful for safeguarding your digital assets. From enhanced threat detection to improved user experience, our improvements will help our customers to stay one step ahead of potential security breaches. Whether you’re a current user or just interested in learning more about smarterSec, this blog series is for you. Your feedback is more than welcome. So, join us as we take a closer look at the latest innovations for the smarterSec Security Platform.
If you want to dive deeper into the functionalities of the smarterSec Security Platform, you can find more information here: smarterSec Security Platform
With release 5.3 we are putting data protection and individual risk assessment at the center. Confidential data within Testcase results are now pseudonymized, authorization and SOD severities can be aligned with your own risk model, and scan schedules keep themselves up to date via Testcase scenarios. On top of that, email delivery has become more robust.
New features & improvements
Main features
Pseudonymization of confidential data
Security findings rarely come without personal context. Usernames, user groups, role assignments. Especially in authorization-related checks, results quickly contain data that not everyone in the organization should see in clear text.
With release 5.3, confidential Testcase fields and value lists can now be pseudonymized. Clear-text data is only shown to users with the matching permissions. Everyone else works with pseudonymized values. The findings, their severity and their context remain fully usable for analysis and remediation.
Why does this matter? A security platform needs deep insight into your SAP systems. But not everyone working with the platform needs to know who is behind a finding. Pseudonymization brings the need-to-know principle into the platform itself. And it is a measure the GDPR explicitly names as an appropriate technical safeguard (Art. 32). That makes the conversation with your data protection officer and works council a lot easier.
Exceptions where you need them
Some values should stay readable, for example technical users. These values can be excluded from pseudonymization via a new standard value list.
Screenshot: Result view with pseudonymized values.
Screenshot: Same Result view with clear-text view for authorized users.
Screenshot: Value list for exclusions from pseudonymization. User DDIC in value list.
Screenshot: Value list for exclusions from pseudonymization. User DDIC now in clear text in result view.
Individual severities for authorization and SoD checks
Not every authorization / authorization combination (SOD) is equally critical in every organization. With release 5.3, you can now set an individual severity for each check within the authorization check framework (TC-18) and for each Segregation of Duties check (TC-21).
The configured severity is carried through consistently: reports, exports, delta notifications and dashboard charts all show your own risk assessment.
Scan schedules based on Testcase scenarios
Scan schedules can now be created based on Testcase scenarios. Instead of maintaining Testcases in every single schedule, you simply link the schedule to a scenario.
The best part: When you add new Testcases to a scenario, the related scan schedules are adjusted automatically. No manual follow-up, no forgotten “legacy” schedules.
Email delivery via Microsoft Graph with SMTP fallback
Email delivery now supports multiple mail backends in a set order: Microsoft Graph first, with SMTP as fallback. If one route fails, your notifications still reach their recipients.
In addition, large or blocked email attachments are now replaced with download links for all mail backends. Reports no longer get lost in size limits or attachment filters.
Improvements & Fixes
- Central Mail Configuration
– SMTP settings are no longer stored in the tenant configuration. Mail settings are now managed centrally through environment variables. - Extended Testcase Documentation
– The Testcase documentation now includes the descriptions of authorization actions and Segregation of Duties checks. - Fix – Action Filter in the Authorization Check Framework
– An issue where the action filter in the authorization check framework did not work properly has been resolved.
Content
As always, we have updated all Testcases to check for the latest releases of components, kernels, and security patches for all available target types.
SAP NetWeaver AS ABAP
For this target type, we have added 3 new checks to the authorization check framework:
- Unrestricted Access to ICF Services
- Maintain roles and authorizations
- Create User & grant Authorizations
Additionally, we have improved 2 Testcases:
- TC-116: Updated TLS recommendations, including TLS 1.3 guidance and SAP security references
- TC-313: Improved result signatures
We will update you on our new platform features regularly here in this blog – stay tuned and give us a follow on LinkedIn to not miss any further updates!
Related topics: Managed Security Service for the smarterSec Security Platform // smarterSec Security