SAP UCON Implementation – Reducing the Attack Surface in Production
SAP Unified Connectivity (UCON) helps reduce the attack surface by controlling access to Remote-Enabled Function Modules (RFMs). Recognising the security benefits, the customer decided to fast-track the implementation of UCON directly in the production environment.
s4access was selected as a partner to design and deliver the rollout in a controlled, step-by-step manner, fully aligned with SAP best practices.
The Situation
The customer recognized the need to reduce their SAP attack surface but wanted to ensure that business operations remained unaffected. The project required a highly controlled rollout in the production environment, following a data-driven approach rather than assumptions to ensure business continuity.
Our Approach
The implementation followed a phased and risk-controlled approach, starting with RFC logging, followed by detailed evaluation and culminating in controlled activation in production using communication assemblies.
The setup was designed to capture a comprehensive view of all RFMs called within the system over an extended monitoring period. Key steps included:
- Detailed UCON concept design aligned with SAP best practices
- Phased RFC logging to capture real usage data
- Evaluation of all RFMs called within the system
- Selection of business-critical RFMs for whitelisting
- Controlled activation in production using communication assemblies
- Continuous monitoring to ensure zero disruption to integrations
Results & Benefits
s4access successfully deployed UCON in the customer’s production environment, delivering immediate and measurable improvements to the security posture of the SAP landscape without disrupting existing integrations or business processes.
- Over 47,000 RFC-enabled function modules (RFMs) were identified and logged using UCON.
- Only 1,500 RFMs were confirmed as business-critical and whitelisted.
- Less than 5% of the originally logged RFMs remained enabled for operational use.
- Achieved a significantly reduced attack surface with strict access limited to essential RFCs.
Customer Feedback
“The customer appreciated that UCON was implemented with zero disruptions to ongoing operations. From day one, the solution was supported by clear processes and continuous monitoring, ensuring a stable and sustainable setup in production.”