A vulnerability finding describes one SAP host and an attack path describes a pair of them, so no quantity of findings, however complete, answers the question the RedRays Security Platform builds a landscape map to answer: which other systems does a compromised system reach.
Most SAP security work is organised per system. A scan runs, findings are stored against a host, somebody works through them. That is the right way to reduce the chance of the first system falling. It says nothing about what the first system is worth once it has fallen, which is frequently the larger quantity.
Because a finding has no direction and a path has nothing else. "This host is missing a patch" is the same sentence read from either end. "This host holds a stored logon into production" is not: reverse it and it becomes a different fact, about a different machine, with a different owner and a different fix. A scan of the target system cannot see it either, because the evidence is not stored there. It is stored on the machine that does the reaching.
In each SAP system's own outbound connection configuration, which is what transaction SM59 maintains. One entry is one destination: a name somebody typed, a connection type, and the parameters for reaching the far system. The security-relevant part is whether the entry carries a saved password, whether it forwards the caller's own logon, or whether the far system has been told to trust this one without asking for a password at all.
A destination with a saved password is a permanent, unexpiring, unaudited logon from one system into another, held on the first system, usable by anybody who reaches it. It is not a defect in anything SAP wrote, it appears in no patch list, and no vendor Security Note will ever remove it.
Nothing about this evidence is secret and nothing about reading it is clever. Any Basis administrator can open SM59 and read a destination. The obstacles are of a different kind, and they are why the manual answer is one nobody produces twice.
| Obstacle | Why it bites |
|---|---|
| One at a time | The transaction is built for the person maintaining a destination, not for the person auditing all of them. It lists names, and the fields that decide the answer are a screen further in. |
| Per system, per client | The answer is the union of every system's configuration. One system's destinations say where that system can go and nothing about who can come to it. |
| A privileged read | Reading the configuration in bulk needs an authorisation on a production system that not everybody holds, and it has to be repeated everywhere. |
| It changes without notice | Creating a destination is an ordinary configuration task during any project or interface change, and nothing about it reaches a security team by default. |
| The working copy carries credentials | Anybody who pastes destination parameters into a spreadsheet to work through them has pasted the credential field with it, and the spreadsheet then lives wherever spreadsheets live. |
The deepest problem with the manual method is not accuracy. It is that a review by hand records what was found and never what was looked at. The next reader of that spreadsheet cannot tell a system that was checked and was clean from a system whose administrator was on holiday, and nothing in the document tells them they cannot.
Both errors are expensive and they are paid by different people.
A path reported that is not there costs an outage. The remediation is to delete a destination or to take the stored password out of it, and both are changes to a running interface on a production system. Somebody acts, the nightly job stops, and the cost arrives the next morning at a distance from the person who caused it.
A path that is there and is not reported costs the thing the analysis was bought to prevent, and it is the error nobody notices, because its evidence is an absence. A map is only as complete as the set of systems that were successfully read, which is why what the landscape map does not claim is a page rather than a footnote.
No. Segmentation decides which packets may travel. A stored credential is a logon that succeeds over traffic the firewall is configured to permit, usually because the interface it belongs to is meant to work. Reviewing firewall rules will not surface it.
Deliberate creation and safe configuration are different questions. The map does not object to a destination existing. It objects to a destination that turns access to one system into access to another with no second authentication, and grades that by the boundary it crosses. See system types and environment boundaries.
What one attack path says defines the unit precisely, and SAP threat modelling and attack paths is the overview of the capability.