{"id":497,"date":"2018-04-23T08:00:21","date_gmt":"2018-04-23T06:00:21","guid":{"rendered":"http:\/\/akquinet-security-en.blog\/?p=497"},"modified":"2020-07-24T10:10:16","modified_gmt":"2020-07-24T08:10:16","slug":"audit-or-penetration-testing","status":"publish","type":"post","link":"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/","title":{"rendered":"Audit or Penetration testing? Find your vulnerabilities before you get hurt!"},"content":{"rendered":"

\"SAST-Blog_Audit-vs-Pentest_Abb_1804\"To answer the question of which Security & Compliance check is right for you, we must first remember that the term \u201cvulnerabilities\u201d can refer to very different levels of your system landscape and thus refer to a number of attack vectors.<\/p>\n

This ranges from system-side levels (e.g. operating system and network security) to the underlying database including the current parameterization of your SAP systems down to the authorizations required for operations and applications, including any SoD conflicts.<\/p>\n

So, the first question is \u2013 how sure are you that you know where your vulnerabilities are?<\/p>\n

Security & Compliance audit:<\/strong>
\n The perfect way to take stock of your SAP system security.<\/strong><\/p>\n

Our audits are designed to help you determine your SAP landscape\u2019s actual risk exposure and pinpoint areas that are open to potential attacks. They include everything from your infrastructure and SAP system parameters to individual component configurations and authorizations. In addition to analyzing conflicts in the segregation of duties (SoD), we check whether third parties are logging into your systems without user IDs and whether users with low-level authorizations can potentially gain further privileges without attracting attention.<\/p>\n

If your company\u2019s migration to SAP HANA or S\/4HANA is right around the corner, an audit offers an ideal solution for security guarding your systems and taking all the necessary security measures before you start your transition.<\/p>\n

Based on the results of this \u201cpassive\u201d review of the underlying SAP systems, we can then easily draw up a catalog of actions and recommendations for you that will result in concrete actions for hardening your system.<\/p>\n

Our Security & Compliance audits<\/a> at a glance:
\n<\/strong>–\u00a0 Full transparency regarding the actual risks your systems face
\n–\u00a0 Checks based on SAP’s security guidelines, recommendations from BSI, and the DIN ISO 27001 standard
\n–\u00a0 Coverage for every level of your SAP landscape and evaluation of your authorization, emergency user, and operational concepts
\n–\u00a0 Concepts you can reuse in future implementations
\n–\u00a0 Systematic analyses facilitated by our certified GRC software, SAST Suite
\n–\u00a0 Final presentation of results, including the degree to which your systems deviate from the ideal situation<\/p>\n

Penetration tests:<\/strong>
\n The toughest stress test for your SAP landscape<\/strong><\/p>\n

From external attacks to manipulations by internal entities, our experts can simulate various incursions to mimic common attack patterns and methods, force their way into your SAP systems, and reveal their last remaining vulnerabilities.<\/p>\n

These \u201cactive\u201d attack scenarios permit key assertions to be made about the current security level of your SAP system. Our approach and results mean that you also get a report with concrete recommendations for eliminating any risks uncovered during system penetration tests.<\/p>\n

Our penetration testing<\/a> at a glance:
\n<\/strong>–\u00a0 Full transparency regarding how vulnerable your systems are to attacks
\n–\u00a0 Reveal the vulnerabilities in your SAP systems and authorizations
\n–\u00a0 Realistic attack patterns simulate external hacks and internal manipulation (black- and white-box testing)
\n–\u00a0 Simulated incursions based on the latest BSI recommendations and our proven best-practice scenarios
\n–\u00a0 A final presentation that includes documentation of our assessment methods, the results of our simulated attacks, and tailored recommendations for your company
\n–\u00a0 Follow-up workshop where we present the vulnerabilities we’ve found and explain the specific risks your company faces<\/p>\n

Conclusion: Security & Compliance audit vs. pen test<\/strong><\/p>\n

By contrast to a pen test, a Security & Compliance audit goes much deeper. Based on our passive analysis and with the support of the SAST Suite, an audit provides a noticeably broader foundation for the analysis.<\/p>\n

However, if the actual and provable exploitation of concrete security loopholes is the focus \u2013 in the view of the potential attacker \u2013 then a pen test will be the better option for you.<\/p>\n

Or do you only need to take stock of the most acute security flaws in one of your SAP systems?<\/strong>
\nThen we recommend our Security Quick Audit. This service includes a review of the relevant security levels at hand, an assessment of the 10 most critical findings in your system and its authorizations, and a final presentation by our experts.
\nIdeal for companies who are taking a closer look at the subject of SAP security and compliance for the first time and thus need help setting priorities for the tasks in the queue.<\/p>\n

Whether you count yourself among the beginners or the professionals, we’d love to help you find the perfect path to truly secure SAP systems.<\/p>\n

\"Axel
\nAxel Giese
\nHead of Security Consulting at AKQUINET<\/h6>\n

Even as threat profiles evolve and new security-relevant factors emerge, our SAST SUITE<\/a> and SAST MANAGED SERVICES<\/a> will provide your systems with comprehensive long-term protection following a pen test or audit. Get in touch with us: knowhow@akquinet.de<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

To answer the question of which Security and Compliance check is right for you, we must first remember that the term \u201cvulnerability\u201d can refer to very different levels of your system landscape and thus refer to a number of attack vectors.
\nSo, the first question is \u2013 how sure are you that you know where your vulnerabilities are?<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[25,156,52,68,114,117],"class_list":["post-497","post","type-post","status-publish","format-standard","hentry","category-sap-threat-detection","tag-cyber-attack","tag-cyber-security","tag-penetration-testing","tag-sap-authorizations","tag-threat-detection","tag-vulnerability-assessment"],"yoast_head":"\nAudit or Penetration testing? Find your vulnerabilities before you get hurt!<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Audit or Penetration testing? Find your vulnerabilities before you get hurt!\" \/>\n<meta property=\"og:description\" content=\"To answer the question of which Security and Compliance check is right for you, we must first remember that the term \u201cvulnerability\u201d can refer to very different levels of your system landscape and thus refer to a number of attack vectors. So, the first question is \u2013 how sure are you that you know where your vulnerabilities are?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/\" \/>\n<meta property=\"og:site_name\" content=\"SAST BLOG\" \/>\n<meta property=\"article:published_time\" content=\"2018-04-23T06:00:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-07-24T08:10:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sast-blog.akquinet.com\/wp-content\/uploads\/2018\/04\/sast-blog_audit-vs-pentest_abb_1804-e1523976433515.png\" \/>\n<meta name=\"author\" content=\"securityblog\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"securityblog\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2018\\\/04\\\/23\\\/audit-or-penetration-testing\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2018\\\/04\\\/23\\\/audit-or-penetration-testing\\\/\"},\"author\":{\"name\":\"securityblog\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#\\\/schema\\\/person\\\/cd70e3749cca136a7e8a37dc1d3cfc26\"},\"headline\":\"Audit or Penetration testing? Find your vulnerabilities before you get hurt!\",\"datePublished\":\"2018-04-23T06:00:21+00:00\",\"dateModified\":\"2020-07-24T08:10:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2018\\\/04\\\/23\\\/audit-or-penetration-testing\\\/\"},\"wordCount\":787,\"publisher\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2018\\\/04\\\/23\\\/audit-or-penetration-testing\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sast-blog.akquinet.com\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/sast-blog_audit-vs-pentest_abb_1804-e1523976433515.png\",\"keywords\":[\"Cyber Attack\",\"Cyber Security\",\"Penetration Testing\",\"SAP Authorizations\",\"Threat Detection\",\"Vulnerability Assessment\"],\"articleSection\":[\"SAP Threat Detection\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2018\\\/04\\\/23\\\/audit-or-penetration-testing\\\/\",\"url\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2018\\\/04\\\/23\\\/audit-or-penetration-testing\\\/\",\"name\":\"Audit or Penetration testing? Find your vulnerabilities before you get hurt!\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2018\\\/04\\\/23\\\/audit-or-penetration-testing\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2018\\\/04\\\/23\\\/audit-or-penetration-testing\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sast-blog.akquinet.com\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/sast-blog_audit-vs-pentest_abb_1804-e1523976433515.png\",\"datePublished\":\"2018-04-23T06:00:21+00:00\",\"dateModified\":\"2020-07-24T08:10:16+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2018\\\/04\\\/23\\\/audit-or-penetration-testing\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2018\\\/04\\\/23\\\/audit-or-penetration-testing\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2018\\\/04\\\/23\\\/audit-or-penetration-testing\\\/#primaryimage\",\"url\":\"https:\\\/\\\/sast-blog.akquinet.com\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/sast-blog_audit-vs-pentest_abb_1804-e1523976433515.png\",\"contentUrl\":\"https:\\\/\\\/sast-blog.akquinet.com\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/sast-blog_audit-vs-pentest_abb_1804-e1523976433515.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2018\\\/04\\\/23\\\/audit-or-penetration-testing\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Audit or Penetration testing? Find your vulnerabilities before you get hurt!\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#website\",\"url\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/\",\"name\":\"SAST BLOG\",\"description\":\"SAP Security & Compliance\",\"publisher\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#organization\",\"name\":\"SAST BLOG\",\"url\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/sast-solutions-logo.png\",\"contentUrl\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/sast-solutions-logo.png\",\"width\":358,\"height\":155,\"caption\":\"SAST BLOG\"},\"image\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#\\\/schema\\\/person\\\/cd70e3749cca136a7e8a37dc1d3cfc26\",\"name\":\"securityblog\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Audit or Penetration testing? Find your vulnerabilities before you get hurt!","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/","og_locale":"en_US","og_type":"article","og_title":"Audit or Penetration testing? Find your vulnerabilities before you get hurt!","og_description":"To answer the question of which Security and Compliance check is right for you, we must first remember that the term \u201cvulnerability\u201d can refer to very different levels of your system landscape and thus refer to a number of attack vectors. So, the first question is \u2013 how sure are you that you know where your vulnerabilities are?","og_url":"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/","og_site_name":"SAST BLOG","article_published_time":"2018-04-23T06:00:21+00:00","article_modified_time":"2020-07-24T08:10:16+00:00","og_image":[{"url":"https:\/\/sast-blog.akquinet.com\/wp-content\/uploads\/2018\/04\/sast-blog_audit-vs-pentest_abb_1804-e1523976433515.png","type":"","width":"","height":""}],"author":"securityblog","twitter_card":"summary_large_image","twitter_misc":{"Written by":"securityblog","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/#article","isPartOf":{"@id":"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/"},"author":{"name":"securityblog","@id":"https:\/\/sast-solutions.com\/blog-en\/#\/schema\/person\/cd70e3749cca136a7e8a37dc1d3cfc26"},"headline":"Audit or Penetration testing? Find your vulnerabilities before you get hurt!","datePublished":"2018-04-23T06:00:21+00:00","dateModified":"2020-07-24T08:10:16+00:00","mainEntityOfPage":{"@id":"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/"},"wordCount":787,"publisher":{"@id":"https:\/\/sast-solutions.com\/blog-en\/#organization"},"image":{"@id":"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/#primaryimage"},"thumbnailUrl":"https:\/\/sast-blog.akquinet.com\/wp-content\/uploads\/2018\/04\/sast-blog_audit-vs-pentest_abb_1804-e1523976433515.png","keywords":["Cyber Attack","Cyber Security","Penetration Testing","SAP Authorizations","Threat Detection","Vulnerability Assessment"],"articleSection":["SAP Threat Detection"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/","url":"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/","name":"Audit or Penetration testing? Find your vulnerabilities before you get hurt!","isPartOf":{"@id":"https:\/\/sast-solutions.com\/blog-en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/#primaryimage"},"image":{"@id":"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/#primaryimage"},"thumbnailUrl":"https:\/\/sast-blog.akquinet.com\/wp-content\/uploads\/2018\/04\/sast-blog_audit-vs-pentest_abb_1804-e1523976433515.png","datePublished":"2018-04-23T06:00:21+00:00","dateModified":"2020-07-24T08:10:16+00:00","breadcrumb":{"@id":"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/#primaryimage","url":"https:\/\/sast-blog.akquinet.com\/wp-content\/uploads\/2018\/04\/sast-blog_audit-vs-pentest_abb_1804-e1523976433515.png","contentUrl":"https:\/\/sast-blog.akquinet.com\/wp-content\/uploads\/2018\/04\/sast-blog_audit-vs-pentest_abb_1804-e1523976433515.png"},{"@type":"BreadcrumbList","@id":"https:\/\/sast-solutions.com\/blog-en\/2018\/04\/23\/audit-or-penetration-testing\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/sast-solutions.com\/blog-en\/"},{"@type":"ListItem","position":2,"name":"Audit or Penetration testing? Find your vulnerabilities before you get hurt!"}]},{"@type":"WebSite","@id":"https:\/\/sast-solutions.com\/blog-en\/#website","url":"https:\/\/sast-solutions.com\/blog-en\/","name":"SAST BLOG","description":"SAP Security & Compliance","publisher":{"@id":"https:\/\/sast-solutions.com\/blog-en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sast-solutions.com\/blog-en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/sast-solutions.com\/blog-en\/#organization","name":"SAST BLOG","url":"https:\/\/sast-solutions.com\/blog-en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sast-solutions.com\/blog-en\/#\/schema\/logo\/image\/","url":"https:\/\/sast-solutions.com\/blog-en\/wp-content\/uploads\/2021\/03\/sast-solutions-logo.png","contentUrl":"https:\/\/sast-solutions.com\/blog-en\/wp-content\/uploads\/2021\/03\/sast-solutions-logo.png","width":358,"height":155,"caption":"SAST BLOG"},"image":{"@id":"https:\/\/sast-solutions.com\/blog-en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/sast-solutions.com\/blog-en\/#\/schema\/person\/cd70e3749cca136a7e8a37dc1d3cfc26","name":"securityblog"}]}},"_links":{"self":[{"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/posts\/497","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/comments?post=497"}],"version-history":[{"count":4,"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/posts\/497\/revisions"}],"predecessor-version":[{"id":1301,"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/posts\/497\/revisions\/1301"}],"wp:attachment":[{"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/media?parent=497"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/categories?post=497"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/tags?post=497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}