Abstract: A method, an apparatus, and a storage medium for detecting vulnerabilities in software to protect a computer system from security and compliance breaches are provided. The method includes providing a ruleset code declaring programming interfaces of a target framework and including rules that define an admissible execution context when invoking the programming interfaces, providing a source code to be scanned for vulnerabilities; compiling the source code into a first execution code having additional instructions inserted to facilitate tracking of an actual execution context of the source code, compiling the ruleset code into a second execution code that can be executed together with the first execution code, executing the first execution code within an virtual machine and passing calls of the programming interfaces to the second execution code, and detecting a software vulnerability when the actual execution context disagrees with the admissible execution context.

Abstract: A method, an apparatus, and a storage medium for detecting vulnerabilities in software to protect a computer system from security and compliance breaches are provided. The method includes providing a ruleset code declaring programming interfaces of a target framework and including rules that define an admissible execution context when invoking the programming interfaces, providing a source code to be scanned for vulnerabilities; compiling the source code into a first execution code having additional instructions inserted to facilitate tracking of an actual execution context of the source code, compiling the ruleset code into a second execution code that can be executed together with the first execution code, executing the first execution code within an virtual machine and passing calls of the programming interfaces to the second execution code, and detecting a software vulnerability when the actual execution context disagrees with the admissible execution context.

Abstract: A method, an apparatus, and a storage medium for detecting vulnerabilities in software to protect a computer system from security and compliance breaches are provided. The method includes providing a ruleset code declaring programming interfaces of a target framework and including rules that define an admissible execution context when invoking the programming interfaces, providing a source code to be scanned for vulnerabilities; compiling the source code into a first execution code having additional instructions inserted to facilitate tracking of an actual execution context of the source code, compiling the ruleset code into a second execution code that can be executed together with the first execution code, executing the first execution code within an virtual machine and passing calls of the programming interfaces to the second execution code, and detecting a software vulnerability when the actual execution context disagrees with the admissible execution context.

Abstract: The present invention refers to a system, a method and product for automatically identifying quality defects in configuration parameters of a database system and for automatically correcting them according to predefined quality procedures. The method is executed on a central server (12) and on several satellite systems (10) as well. The method may be integral part of an enterprise resource planning system.

Abstract: The present invention refers to a system, a method and product for automatically identifying quality defects in configuration parameters of a database system and for automatically correcting them according to predefined quality procedures. The method is executed on a central server (12) and on several satellite systems (10) as well. The method may be integral part of an enterprise resource planning system.

Abstract: Comprehensive techniques identify data leaks in software applications using Asset Flow Analysis (AFA) to determine whether critical data leaves a system through an exit point such that the data is no longer protected by mechanisms of the system. A novel data extrusion mechanism makes use of a relevant subset of all the possible data paths detected by AFA using a knowledge base of critical business functions and critical database content. The system checks if any code performs read access to critical business data and subsequently transfers this data beyond the control limits of the target system. The knowledge base can be extended by configuring which database content is to be regarded as critical in any given organization. The approach is particularly valuable in protecting systems that manipulate, distribute, or store sensitive information associated with financial, business, or personal data, including SAP® ABAP™ software applications.

Abstract: A static code analysis (SCA) tool, apparatus and method detects, prioritizes and fixes security defects and compliance violations in SAP® ABAP™ code. The code, meta information and computer system configuration settings are transformed into an interchangeable format, and parsed into an execution model. A rules engine is applied to the execution model to identify security and compliance violations. The rules engine may include information about critical database tables and critical SAP standard functions, and the step of applying the rules engine to the execution model may include the calculation of specific business risks or whether a technical defect has a business-relevant impact. In particular, an asset flow analysis may be used to determine whether critical business data is no longer protected by the computer system. Such critical business data may include credit or debit card numbers, financial data or personal data.