Slashdot Mirror
Top Cyber Attack Vectors For Critical SAP Systems
An anonymous reader writes: Despite housing an organization's most valuable and sensitive information, SAP systems are not protected from cyber threats by traditional security approaches. Based on assessments of hundreds of SAP implementations, the Onapsis Research Labs study found that over 95 percent of SAP systems were exposed to vulnerabilities that could lead to full compromise of the company's business data and processes. Most companies are also exposed to protracted patching windows averaging 18 months or more. In 2014 alone, 391 security patches were released by SAP, averaging more than 30 per month. Almost 50 percent of them were ranked as "high priority" by SAP.
That implies that there is some sort of protection while leaving out the word "traditional" implies the more correct situation where they are not protected at all.
That not necessarily a bad thing so long as the practice is to secure their stuff with third party approaches afterwards (eg. need to get on a secured VPN before you can communicate with the software).
What the H* is a SAP system?
Hm.. So the research lab of a company that secures SAP for a living has found that nearly all SAP systems in the world are insecure.
Just sayin'..
For everyone who is wondering what SAP is:
http://yourfinancebook.com/what-is-sap
When will the PHBs realise that the golf course is not a 'reputable source' for software?
As a SAP architect for over 15 years, I can tell you definitively that this article is one big troll. Responsible architecture never exposes SAP systems to the outside world without a dedicated hardened third-party product in between. As far as the article’s points:
1) Portals: The portal product runs behind Apache and a J2EE product. Like 50% of the web, these products are very safe. I don’t understand the argument about “backdoor” users. Do they mean “system accounts”, accounts that can never have a dialog login session? If they do, then they should have done enough homework to know that all accounts on SAP systems have lockout protocols on par with industry security standards. This whole argument about portals is bogus.
2) Proprietary protocols: Yes, SAP systems do have proprietary protocols, such as RFC, ALE, SOA, etc. Though, these are never exposed to the outside world. Then, from even the inside, these are usually protected by STRUST, a certificate based trust service, and then secondarily by password. Again, you cannot get to it if it is behind a VPN and even if you could, you don’t have the certificate and would lockout any accounts trying.
3) Pivoting between sap systems: So the argument is that if you can hack and gain access to a low priority box that you now have unfettered access to an ERP? No, not going to happen. Security between systems is always sandboxed to minimize access. For example, gaining access to a SAP Business Objects server will gain you the ability to call BAPIs which still require certificates and passwords on the ERP/BW box. Portals are setup the same way. In short, even if you could defeat apache, account management, and other 3rd party barriers, you have absolutely nothing because the level of trust setup system to system is not enough to even login.
Alright net-security.org, do your homework next time.
What a useless article. The only content is that evil hackers leverage vulnerabilities to gain access to companies' SAP systems. Well, no shit sherlock. SAP is a mess and barely works under normal conditions, so anybody VP-level and above freaks out at the mere mention of touching anything on them. Of course they're going to have patching windows > 18 months.
the vulnerabilities are most likely in the operating systems/database/web servers etc. SAP, of course, runs on top of all that. The SAP software itself is not insecure but there are a lot of moving parts :-)
I think you mean GLOBAL for all.