SAP systems contain a significant amount of information critical to the organisations that run them. The SAP standard provides for various mechanisms to protect this data. However, information critical to an organisation could still be accessed without permission through faulty in-house or custom ABAP development. Employees or attackers could thus transfer data into an environment that can no longer be controlled. Critical data can also be manipulated through the use of ABAP programs in bypassing the standard SAP security mechanisms.