topic Re: NetWeaver 2004 WAS Patchlevel 15 secure? in Application Development and Automation Discussions

NetWeaver 2004 WAS Patchlevel 15 secure?

Former Member — Thu, 30 Nov 2006 10:20:58 GMT

i want to publish on the internet an Enterprise Portal (EP 6) on a NetWeaver 2004 Patchlevel 15 application server.

I am searching the SAP site for information if this is secure or that there known bugs. I have looked at the security notes and the release notes of higher service packs but i dont see any security issues.

Still i want to be certain, so i am wondering if someone here knows if this release has known security issues in EP 6 or WAS on patchlevel 15

Regards Alexander

Re: NetWeaver 2004 WAS Patchlevel 15 secure?

desiree_matas — Thu, 30 Nov 2006 10:30:31 GMT

Hello Alexander

Please, review SAP note 962904 which may be relevant for you, as it affects your support package level. The best solution to be safe will be to upgrade to SP19.

I hope this helps.

Regards, Désiré

Re: NetWeaver 2004 WAS Patchlevel 15 secure?

koehntopp — Thu, 30 Nov 2006 11:11:05 GMT

Hi Alexander,

there is no such thing as security per default. Security depends on the mode of operation.

To make a portal secure, there is a security guide that needs to be followed.

Everything else needs extra consideration:

- system architecture - how do you secure connections (firewall, encryption)

- switch off services that are not required for external users (admin etc.)

- apply all security patches

- same for operating system and other applications in the DMZ

- you may want to consider a web application firewall and/or reverse proxies

- how do you manage users?

There are lots more details to this, but this would be a bit too much to discuss here. Before you open up your portal to internet users, you definitely should do a security audit on your plan and its execution.

Let me know if you need any more help.

Kind regards,

Frank.

Re: NetWeaver 2004 WAS Patchlevel 15 secure?

Former Member — Thu, 30 Nov 2006 14:53:42 GMT

Thanks both,

Fank, if you only concentrate on the patches part (we got the other parts covered) where or from who can i get information about what known security issues exist for that sp level ?

Regards Alexander