TIL: Virus scan functionality when uploading files via a Fiori app

[ajmaradiaga]

In this short blog post, I'll be writing about computer virus scanning and not the other virus that is around :-). The question I'm trying to answer is..... Is there a virus scan functionality that scans files uploaded via a Fiori app?

Computer being attacked by a malicious virus

TLDR; Yes!

There are two scenarios that I'm interested in, when the Fiori app is deployed on-premise and when the Fiori app is deployed to SAP BTP.

On-premise

The virus scanning component in a Fiori FES (front-end server) is optional. Rules need to be defined in a scan profile so that the documents that are not compliant with the rules are rejected. More information about the virus scan interfaces can be found here.

Fiori FES Help documentation: https://help.sap.com/viewer/93d677d2f3cd4719aa2f0feaed8a914d/FES6.0/en-US/c623f0522bc80175e10000000a...

SAP BTP

This can be found in the security section of the SAP Trust Center (https://www.sap.com/about/trust-center/security.html), under Cloud Services: Reference Guide.

SAP uses a malware management process designed to keep the cloud service free of viruses, spam, spyware, and other malicious software. It consists of an anti-malware agent deployment, regular scanning, and malware reporting subprocesses. Anti-
malware software o equivalent is installed on servers in the SAP cloud landscape during the system setup process for data processing systems.

To protect servers against malware uploads, the anti-malware management service is automatically configured to scan files where is applicable, based on the anti-malware engine, when files are uploaded to the application.

In short, yes... all SAP Cloud servers contains software that protects its systems from viruses. You can find more information in the Feature Scope Description for SAP BTP, Cloud
Foundry, ABAP, and Kyma Environments https://help.sap.com/doc/5e8107bf49684962b897217040398007/Cloud/en-US/SAP_BTP_FSD.pdf

SAP Malware Scanning Service

Also, you can use the SAP Malware Scanning Service to scan documents uploaded by your custom-developed apps for malware. The app that you develop can call the SAP Malware Scanning service to check for viruses or other malware. Check out the SAP Malware Scanning Service APIs in the SAP API Business Hub - https://api.sap.com/api/MalwareScanAPI/overview.

Note: Thanks to oscar.herrera.sap and sissy0510 for their contribution on this topic.

[RBETRICH]

Hi Antonio,

thanks for sharing.

I`ve tried to get some more information on that, but struggled a little bit. Hopefully you can answer my questions:

• the only source I`ve found for some tests is api.sap.com, right?
• according to api.sap.com the rest api is in status beta, while the SAP BTP What's new viewer shows an statement that's general available starting in the mid of December. Link
• according to the documentation the service could be consumed via an entitlement / service instance that needs to be created in an Subaccount, right?
• so the question for me is right now, which commercial model is required to get my hands dirty. ( for example SAP BTP Trial is obviously currently not supported ).

BTW: It's also not listed in the SAP BTP Discovery Center.

Thanks for your time and your answers.

Kind regards,

Rainer

[former_member10870]

Hi Rainer,

to get your hands dirty you should start with a BTP PayasyouGo. With that contract in place you`ll be able to use "free tier" service. No investment would be needed to use free tier services.

To sign a Pay as you Go: https://storefront.s1.store.net.sap/dcp/en/product/display-9999951781_live_v1/SAP%20Business%20Techn...

Overview of "Free tier" services, able to use with "Pay as you Go": https://discovery-center.cloud.sap/index.html#/serviceCatalog?provider=all&regions=all&category=free...

"Malware Scanning Service" is already available within a Subaccount which has "beta" enabled. It will be soon available for all landscapes. There was an issue to display it.

best regards. Sissy

[RBETRICH]

Hi Sissy,

thanks for that update.

As we only have some partner based commercial models ( Subscription and PAYG) in place I think we have to wait. Do you have an idea / timeline when "Malware scanning Service" will be available for the "non commercial services"?

All the best,

Rainer

[kammaje_cis]

I am a little confused. You say

In short, yes… all SAP Cloud servers contains software that protects its systems from viruses

What cases do we need 'SAP Malware Scanning Service'?