SAP VSI introduces three abstraction layers:

1. Virus Scan Provider: describes the access to a virus scanner
   • Virus Scan Adapter: extends the SAP kernel functionality and enables the SAP kernel to access the malware scanner directly. The virus scan adapter is loaded as a dynamic library (DLL on Woindows). It is executed within the address space of the the J2EE or ABAP engine and is, therefore, the variant offering the highest performance.
   • Virus Scan Server: defines a (logical or physical) server that gets scan-objects via SAP RFC. This variant delivers significantly lower scan throughput and might fail when scanning large files. Its use is discouraged.

2. Virus Scan Group: A Virus Scan Group may contain several Virus Scan Providers with identical configurations

3. Virus Scan Profile: allows administrators to combine the unique functionalities of multiple Virus Scan Groups and combine them using logical AND/OR relationships. Creating configurations where files will be checked by multiple virus scan engines is possible. Also, Virus Scan Profiles may be created to maintain granular, application-specific scanning configurations.

Once installed, the bowbridge Anti-Virus basic configuration is performed entirely from the SAP customization tools. Additional options, such as activating debug tracing, specifying
alternative update sources or fine-tuning of active-content types, can be achieved via configuration files in an on-premises deployment or via the bowbridge customer portal in Hybrid- and Cloud-deployments.

Setting up virus protection for ABAP-based SAP applications requires the following major steps:

1. Definition of Virus Scanner Groups

2. Definition of Virus Scan Providers

3. Definition and activation of Virus Scan Profiles

4. On SAP gateway systems, activation of Virus Scanning at the SAP gateway.

A scanner group combines multiple virus scanners of the same type. As users will select the Virus Scan Provider using the scanner group when maintaining the virus scan profile, they must assign each Virus Scan Provider to at least one scanner group.

We recommend setting up multiple scanner groups in order to maintain multiple scan configurations on the system.

To set up and maintain Scanner Groups, access transaction VSCANGROUP. A list of key-value pairs may be specified as Configuration Parameters for every group.
Upon completing the OS-level installation, the bowbridge-installation-summary.txt file contains the required parameters and their values.

NOTE:

Not all parameters displayed in the parameter selection are valid in Virus Scanner Groups. Only the INIT*-parameters are relevant. And of those, only the ones below are required/supported by bowbridge Anti-Virus 4.

The options supported by bowbridge Anti-Virus 4 are:

Because the initialization parameters defined in the Virus Scanner Group will apply to all hosts and are usually transported to all systems of a system line, one should use paths that exist on all affected instances. If  SID-specific paths have to be used,  using environment variables, such as $SAPSYSTEMNAME or $HOSTNAME is supported for path and file names. The values will be expanded/resolved to respective values on each system.

To set up and maintain Scanner Groups, access transaction VSCANGROUP.

NOTE:

SAP VSI supports two types of Virus Scan Providers:

• Virus Scan Adapter
• Virus Scan Server

While both options are fully supported with Anti-Virus bowbridge and SAP recommend using the Virus Scan Adapter configuration whenever possible because it is more stable, delivers much better performance, and overcomes other limitations of the Virus Scan Server deployment mode. See SAP Note 782963 for details.

If you have to deploy bowbridge Anti-Virus in the Virus Scan Server model, please contact bowbridge technical support for additional documentation on implementing that configuration. We also encourage looking at the “Scan-Server” deployment model of bowbridge Anti-Virus 4. It combines the advantages of a central scanning server with those of not using RFC to transfer files to be scanned.

Upon creating/maintaining a Virus Scan Provider, the following parameters must be provided:

Virus Scan Profiles are a set of parameters specifying how a scan will be performed. Their names reference ABAP function modules in which the Virus Scan Profile name is hard-coded. During the execution of such function modules, scans are automatically performed with the profile settings if the respective virus scan profile is marked as “active”. Each profile defines one or more “Steps,” invoking a virus scan provider from a Virus Scanner Group or referencing another Virus Scan Profile.

Since SAP BASIS 757 inactive virus scan profile will result in warning messages (event type “FU0)  in the SAP Security Audit Log.

For example, if the SCET/GUI_UPLOAD profile is active, then any file upload via SAP GUI will be scanned with the settings of the SCET/GUI_UPLOAD profile. This is fully transparent to the application using the function module and works without any application changes.

SAP delivers several virus scan profiles, which are mostly empty. In their default configuration, they reference the so-called “Default Profile.”

There are, therefore, two ways to manage Virus Scan Profiles effectively:

• Maintain the Scan Settings in each relevant profile individually. This approach makes sense for maintaining specific scan settings that vary by function module; for example, if GUI uploads need to be scanned with settings other than HTTP uploads.
  In this case, uncheck the “Use Reference” checkbox in the Virus Scan Profile and maintain steps, MIME-types, and profile configuration parameters in the Virus Scan Profile
• Create one or a few “reference profiles” with common scan settings and use those as references in the other profiles that need to be activated.
  For this approach, create new profiles in the Z or Y namespace and maintain the required parameters. For example, administrators could create a Z_BASIC profile for pure virus scanning and a Z_ADVANCED profile containing more advanced filtering, like MIME-type filters and active content detection.
  If, additionally, one of the reference profiles is marked as “Default,” it would be sufficient to activate any other SAP-delivered profile for it to reference the Default Profile and perform scans with the settings of the Default Profile

In either case, the profiles contain the following parameters:

Step Configuration Parameters apply only to the selected step of the Virus Scan Profile.

Profile Configuration Parameters apply to any step of the profile.

When file transfers are embedded in ODATA, AS ABAP can scan these at the gateway level.

Access transaction /n/IWFND/VIRUS_SCAN to maintain virus scan at the gateway level:

To enable virus scanning at the gateway, ensure the “Disable Virus Scanning” checkbox is not checked.

In the Virus Scan Profile field, specify a Virus Scan Profile explicitly or leave the field empty (remove any “-” that may be there by default), then execute the transaction.

Once installed, the bowbridge Anti-Virus basic configuration is performed entirely in NetWeaver Administrator (NWA).  Additional options, such as activating debug tracing and
alternative update sources or granular deactivation of active-content types can be configured via configuration files in an on-premises deployment or via the bowbridge customer portal in Hybrid- and Cloud-deployments.

Setting up virus protection for Java-based SAP applications requires the following major steps:

1. Definition of Virus Scanner Groups

2. Definition of Virus Scan Providers

3. Definition and activation of Virus Scan Profiles

Virus Scan Providers with identical configurations are grouped in a Virus Scanner Group. However, even with only one Virus Scan Provider, a Scanner Group containing just this element must be created.

Virus Scanner Groups are maintained from the Virus Scan Provider section in the Netweaver Administrator’s Configuration Tab.

In the Group Tab of the Virus Scan Provider management, Edit, then add/change a Virus Scan Group.
When creating a new group, administrators may decide to mark it as the default group.
Specifying INIT Parameters, as with an ABAP stack, is not required on a Java Stack.

Virus Scan Adapters are the preferred option to set up a Virus Scan Provider on SAP AS JAVA. The Virus Scan Server option is also supported, but its use is discouraged.

Virus Scan Adapters are configured in the “Adapters” Tab of the Virus Scan Provider setup.

All Virus Scan Adapter Names must be prefixed with VSA_

Virus Scan Adapter parameter details:

Virus Scan Profiles are a set of parameters specifying how a scan will be performed. Their names reference Java methods in which the Virus Scan Profile name is hard-coded. During the execution of such methods, scans are automatically performed with the profile settings if the profile is marked as active. The profile defines one or more “Steps,” invoking a virus scan provider from a Virus Scanner Group or referencing another Virus Scan Profile.

For example, if the htmlb_FileUpload profile is active, then any file upload via HTTP will be scanned with the settings of the htmlb_FileUploadprofile profile. This is fully transparent to the application using the function module and works without any application changes.

SAP delivers several virus scan profiles, which are mostly empty. In their default configuration, they reference the so-called “Default Profile.”

There are, therefore, two ways to manage Virus Scan Profiles effectively:

• Maintain the Scan Settings in each relevant profile individually. This approach makes sense if you maintain specific scan settings that vary by function module. For example, if you want HTTP uploads to be scanned with different settings than pi_Messaging uploads.
  In this case, uncheck the “Use Reference” checkbox in the virus scan profile and maintain steps, MIME-types, and profile configuration parameters in the virus scan profile
• Create one or few “reference profiles” with common scan settings and use those as references in the other profiles you need to activate.
  For this approach, create new profiles in the Z or Y namespace and maintain the required parameters. For example, administrators could create a Z_BASIC profile for pure virus scanning and a Z_ADVANCED profile containing more advanced filtering, like MIME-type filters and active content detection.
  If, additionally, one of the reference profiles is marked as “Default,” it would be sufficient to activate any other SAP-delivered profile for it to reference the Default profile and perform scans with the settings of the Default Profile

In either case, the profiles contain the following parameters:

Use the Parameters tab to fine-tune the scan settings of the virus scan profile:

INIT parameters are defined in the Virus Scan Group.
These parameters are used to initialize the VSA. Hence, for changes to any INIT parameter to go into effect, the virus scan adapter must be re-initialized.

This may happen automatically, if a Re-Init Interval is defined, or it can be triggered manually by clicking the “Load” button in transaction VSCAN (on ABAP-stacks only)

Scan parameters are passed to the VSA with every scan request. They are typically set in the virus scan profile, allowing for fine-tuning of scanning policies by file transfer vector.

bowbridge Anti-Virus adds numerous “overlay” parameters that can enrich the limited configuration options provided by the virus scan profiles. These parameters may be configured at the realm-level or at the SID level.

In Virus Scan Profiles, SAP only implemented a generic on/off switch for active content detection with the Profile Configuration Parameter CUST_CHECK_ACTIVECONTENT. However, in order to maintain a good security posture and not disrupt business processes, a more granular configuration of what exactly needs to be blocked as active content is required. The following parameters provide this granularity. They may be implemented at the realm level or for individual SIDs.