Risk
Custom applications can introduce vulnerabilities and bypass standard protection.
ABAP
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| ABAP Practice | Code review and CVA | Manual quality gate and automated scanning Detects issues before deployment. |
| ABAP Practice | Segregation of responsibilities | Development, transport management and QA Provides independent change control. |
| ABAP Practice | Custom code lifecycle | Design, maintenance, deployment and retirement Remove unnecessary code and maintain required extensions. |
How to verify
- Maintain an inventory of extensions.
- Establish a secure development standard.
- Perform code reviews and scans before transport.
- Include security maintenance after deployment.