BERRY9 IT Services, home

Security Testing SAP and Oracle ERP: Scope and Risks

Manufacturing, pharma and services companies in Hyderabad and across India run finance, stock and payroll on ERP packages such as SAP and Oracle. These systems hold the most valuable records the company has, and they are often left out of penetration tests because they are fragile and hard to scope. They deserve a test, with some extra care.

Request a scoping call Call +91 86868 92922

Network · By Thimmagurudu Bathini · Published · 3 min read

Why ERP Needs Its Own Scope

An ERP system is not one application. It is a network of services, a database, an application layer with its own users and roles, and thousands of custom reports and interfaces. A general web or network test touches only the surface. A useful test names the parts that matter, agrees what must not be touched, and uses a copy of production where it can.

What a Test Covers

Layers of an ERP security test
LayerWhat a tester checks
Network and servicesWhich ERP ports are reachable and from where: gateways, message servers, web interfaces and the database. These services are rarely meant for ordinary users' networks.
Accounts and passwordsDefault and standard accounts left with known passwords, shared accounts, weak password rules and password hashes that can be read.
AuthorizationWho holds powerful profiles such as SAP_ALL, who can run remote function calls, and combinations of rights that break the separation of duties.
InterfacesConnections between systems, stored credentials in them, and trust relationships that let one compromised system reach another.
Custom codeReports and extensions written in-house, which often lack the authorization checks the standard code has.
PatchingWhether the vendor's security notes and quarterly patches are applied.

A Worked Example

During an internal test, a scan of the ERP network finds the gateway service reachable from the office network. The tester checks whether the system lets an ordinary workstation register an external program, or call functions without a strict allow list. In a poorly configured system it does, and the tester can start from a user's laptop and read data from the application layer without any ERP account. The report states which setting allows it, such as a missing access control list on the gateway, and the fix: restrict who may connect, and allow only listed programs and hosts.

Safety Rules for ERP Tests

  • Test on a recent copy of production, or on a quality-assurance system, whenever possible.
  • If production must be tested, agree the hours, avoid bulk operations and never post, delete or change business records.
  • Do not run intrusive checks against the database during month-end or payroll runs.
  • Keep a named contact on the client's basis (administration) team during the test, with authority to stop it.

How to Check Your Own System

  • List the standard accounts in each client or tenant and check their passwords have been changed and the accounts locked where not needed.
  • Ask who holds the most powerful profiles, and whether each person still needs them.
  • Check which networks may reach the ERP services, and whether a firewall restricts them.
  • Check the date of the last security patch round against the vendor's schedule.
  • Review the stored credentials in interfaces between systems.

What the Fixes Look Like

Most of them are configuration: restrict network access, lock or change standard accounts, remove broad profiles, require strong passwords, apply the vendor's security notes and quarterly patches on a schedule, and add authorization checks to custom code. These are tasks for your ERP administrators and your vendor, and the report is written for them, with the setting or note number for each finding.

We scope ERP work with network Penetration Testing, and the internal side is covered in the internal network playbook.

To plan a test for your own systems, request a scoping call, or download the pre-test checklist and scoping questionnaire.

Sources

Links checked on 5 November 2026.

Next Step

To see what these checks find on your own network, see network Penetration Testing and Active Directory Penetration Testing. To get your scope ready first, use the pre-test checklist and scoping questionnaire.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan Your Next Security Test

Tell us what needs Penetration Testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp