SAP Ariba SSPM Scanner — PhalanxCyber

01Overview

SAP Ariba SSPM Security Scanner is a zero-dependency, offline SaaS Security Posture Management (SSPM) tool that assesses the security configuration of SAP Ariba procurement environments. Instead of connecting to a live tenant, it ingests JSON/CSV configuration exports (users, groups, SSO, MFA, API clients, approval workflows, payment controls, supplier settings, audit config and more) and evaluates them for misconfigurations, access risk, compliance gaps and drift from a security baseline.

Modeled on commercial SSPM platforms such as AppOmni, Obsidian, Adaptive Shield and Nudge Security, the scanner covers the full SaaS security spectrum for procurement: identity security, authentication and SSO, API and integration risk, procurement and workflow controls (SoD, three-way match, auto-approve thresholds), data protection and PII classification, supplier/third-party risk, audit logging, network exposure, alerting and configuration drift. Each finding carries a severity, affected-item list, remediation guidance and framework references.

It is aimed at procurement security teams, SAP GRC and internal-audit functions, and cloud/SSPM assessors who need to review an Ariba tenant's posture without live API credentials or agents. Because it is pure Python 3.8+ standard library with no external packages, it runs in air-gapped and change-controlled environments and slots cleanly into audit workflows.

The scanner is notable for pairing procurement-specific risk logic (maverick spend, competitive-bidding controls, supplier bank-detail verification as a BEC/invoice-fraud vector, Segregation-of-Duties conflicts across the req-to-pay lifecycle) with a polished, self-contained interactive HTML dashboard that computes a weighted risk score and lets assessors filter and drill into every finding.

02Key Capabilities

Offline, credential-free assessment

Analyzes exported JSON/CSV configuration files with no live SAP Ariba API access, so it runs safely in air-gapped and change-controlled environments.

Zero third-party dependencies

Built entirely on the Python 3.8+ standard library, making it trivial to vet, deploy, and run inside restricted enterprise networks.

10 SSPM audit modules

Covers identity, authentication/SSO, API/integration, procurement controls, data protection, supplier security, audit, network, notification, and configuration drift.

Segregation-of-Duties detection

Flags users holding conflicting roles across the req-to-pay lifecycle (create+approve requisitions/POs, reconcile+pay invoices, manage suppliers+contracts).

Procurement fraud controls

Checks three-way match, duplicate-payment detection, auto-approve thresholds, competitive bidding, maverick spend, and supplier bank-detail verification against BEC fraud.

PII auto-classification

Scans custom field names for 13 PII patterns (SSN, Tax ID, IBAN, bank account, passport, DOB, etc.) and flags unclassified sensitive fields.

Configuration drift detection

Compares live config against a JSON security baseline and reports any critical settings that are disabled or have drifted from expected values.

Weighted risk scoring

Aggregates findings into a 0-100 severity-weighted risk score with Critical/High/Medium/Low banding shown on the report dashboard.

Interactive HTML report

Generates a self-contained dark-themed dashboard with a risk ring, severity cards, per-category bars, filtering, and collapsible finding detail plus remediation.

Flexible module and severity scoping

Run all modules or a targeted subset (e.g. iam auth procurement) and filter output by minimum severity for focused assessments.

Resilient data loader

Accepts alternate file names, tolerates BOM/whitespace, normalizes CSV headers, and gracefully reports which config files were found or missing.

Built-in sample data generator

Ships a generator that produces 23 demo config files seeded with deliberate misconfigurations for instant demonstration and testing.

03Architecture

A CLI orchestrator (ariba_scanner.py) loads all configuration exports through a single DataLoader, then dispatches to ten pluggable auditor classes that share a BaseAuditor contract. Each auditor emits structured findings (check_id, severity, affected items, remediation, references), which are aggregated, severity-filtered, and rendered into a self-contained interactive HTML dashboard.

CLI orchestrator (ariba_scanner.py)

Parses arguments, resolves the MODULE_MAP of ten auditors, runs selected modules, applies severity filtering, and triggers report generation.

Data loader (modules/base.py)

DataLoader resolves 25 config keys via a FILE_MAP with alias filenames, parses CSV/JSON (BOM-tolerant, header-normalized) into an in-memory dict consumed by all auditors.

BaseAuditor contract

Shared base class providing severity constants, the finding() factory (with affected counts, remediation, references, timestamp), and baseline config lookup.

Identity auditor (identity_access.py)

IdentityAccessAuditor implements the eight IAM checks including admin sprawl, dormant/terminated accounts, SoD conflict matrix, and privilege creep.

Core auditors (core_modules.py)

AuthenticationAuditor, ApiIntegrationAuditor, ProcurementControlsAuditor, and DataProtectionAuditor cover SSO/MFA, OAuth/webhooks, approval/payment controls, and PII/encryption.

Extended auditors (extended_modules.py)

SupplierSecurity, AuditCompliance, NetworkSecurity, Notification, and ConfigDrift auditors handle third-party risk, logging/SIEM, Ariba Network exposure, alerting, and baseline drift.

Report generator (report_generator.py)

ReportGenerator computes the weighted risk score and renders a dark-themed, dependency-free HTML dashboard with filtering, category bars, and collapsible findings; falls back to JSON if unavailable.

04Project Structure

ariba_scanner.pyMain CLI entry point wiring the module map, argument parsing, and scan pipeline.

generate_sample_data.pyGenerator that writes 23 demo config files seeded with deliberate security issues.

modules/base.pyDataLoader and BaseAuditor: file resolution, CSV/JSON parsing, and the finding factory.

modules/identity_access.pyIdentity & Access auditor with the 8 IAM checks and the SoD conflict matrix.

modules/core_modules.pyAuthentication/SSO, API/Integration, Procurement, and Data Protection auditors.

modules/extended_modules.pySupplier, Audit & Compliance, Network, Notification, and Configuration Drift auditors.

modules/report_generator.pyInteractive HTML dashboard generator with risk scoring and severity/category views.

sample_data/23 example JSON/CSV exports plus a prebuilt sample_report.html for demonstration.

docs/banner.svgProject banner asset used in the README.

README.mdOverview, module table, data-export guide, and quick-start usage.

CONTRIBUTING.mdContribution guidelines for the project.

LICENSEMIT license.

05Security Controls

Identity & Access (8 checks)

Dormant accounts (>90d), admin sprawl vs. max threshold, orphaned users, terminated-employee active access, SoD conflicts across req-to-pay, shared/generic accounts, privilege creep, and empty/unused group hygiene.

Authentication & SSO (8 checks)

SAML 2.0 SSO presence and enforcement, signed/encrypted assertions, IDP-initiated CSRF risk, MFA enablement/admin-MFA/bypass/SMS deprecation, password-policy baseline, session timeout >30m, IP restrictions, and X.509 certificate expiry.

API & Integration (7 checks)

Overly broad OAuth scopes (wildcard/admin/full), deprecated grant types (password/implicit), stale clients (>180d), API write access to sensitive entities, unauthenticated integrations, HTTP (non-HTTPS) webhooks, and missing rate limiting.

Procurement & Workflow (7 checks)

Missing approval requirements, auto-approval bypass of SoD, high auto-approve thresholds (>$10K), contract controls (expiry alerts/dual approval/competitive bidding), catalog change governance, payment three-way match and duplicate detection, and maverick spend.

Data Protection & Privacy (6 checks)

Overly broad external sharing (ALL/PUBLIC), field-level encryption at rest, data retention/purge policies, PII auto-classification across 13 patterns, bulk-export restrictions, and supplier-portal data isolation.

Supplier / Third-Party Risk (4 checks)

Onboarding approval and due diligence, supplier portal MFA, bank-detail-change verification as a BEC/invoice-fraud control, and continuous supplier risk monitoring.

Audit & Compliance (6 checks)

Audit logging enablement, coverage of 10 required event types, log retention >=365 days, SIEM/external forwarding, and compliance-framework mapping presence.

Network Security (3 checks)

Ariba Network public-profile exposure, minimum TLS version (flags TLS 1.0/1.1), and automatic document sharing with trading partners.

Notification & Alerting (2 checks)

Presence of security alert rules for events like mass login failures and admin changes, and configured notification channels.

Configuration Drift (2 checks)

Critical security settings baseline (SSO/MFA/audit/IP restrictions disabled) and per-setting drift comparison against a supplied JSON baseline.

06Technology Stack

Language: Python 3.8+
Dependencies: None — standard library only (argparse, json, csv, datetime, pathlib, html)
Input formats: JSON and CSV configuration exports
Reporting: Self-contained interactive HTML dashboard (inline CSS/JS), JSON fallback
Architecture: Pluggable BaseAuditor modules dispatched via a CLI module map
License: MIT

07Quick Start

$ git clone https://github.com/Krishcalin/SAP-Ariba-Security-Scanner.git && cd SAP-Ariba-Security-Scanner
$ python generate_sample_data.py   # create 23 demo config files with seeded issues
$ python ariba_scanner.py --data-dir ./sample_data --output report.html
$ python ariba_scanner.py --data-dir ./exports --modules iam auth procurement
$ python ariba_scanner.py --data-dir ./exports --severity HIGH
$ python ariba_scanner.py --data-dir ./exports --config baseline.json   # drift detection

08Compliance & Frameworks

SOX (incl. Section 404)

Procurement, payment, and audit-trail controls including SoD, three-way match, and log retention mapped to Sarbanes-Oxley IT controls.

GDPR

Data minimization, retention/purge policies, and PII classification referenced against GDPR Article 5.

ISO 27001

Referenced as a target framework for control mapping in the audit/compliance module.

SOC 2

Aligned to SaaS trust controls, referencing SAP Ariba's SOC 2 posture.

CIS Controls v8

Identity, access, and configuration hardening guidance referenced in the assessment.

NIST SP 800-53 / 800-52

Security control catalog and TLS configuration guidance (flags TLS 1.0/1.1 per SP 800-52 Rev 2).

09Integrations & Outputs

Explore SAP Ariba SSPM Scanner

Full source, documentation, and deployment guides live on GitHub.

View on GitHub Browse all tools