Free Newsletters for the Channel
Register for Your Free Newsletter Now
SAP systems are a prominent attack vector for bad actors.
April 7, 2021
SAP systems running outdated or misconfigured software are exposed to increased risks of malicious attacks.
That’s according to a new alert by the Cybersecurity and Infrastructure Security Agency (CISA). On Tuesday, security researchers from Onapsis, in coordination with SAP, released an alert detailing threat actor activity they observed. They also pointed to techniques that could lead to full control of unsecured SAP applications.
SAP applications help organizations manage critical business processes. Those include enterprise resource planning, product life cycle management, customer relationship management and supply chain management.
Organizations impacted by threat activity could experience theft of sensitive data; financial fraud; disruption of mission-critical business processes; ransomware; and even a complete halt of operations.
CISA recommends operators of SAP systems review Onapsis’ alert for more information and apply necessary updates and mitigations.
Tim McKnight is SAP’s CSO.
SAP’s Tim McKnight
“This proactive research effort is the latest example of our commitment to ensure our global customers remain protected,” he said. “We’re releasing the research Onapsis has shared with SAP as part of our commitment to help our customers ensure their mission-critical applications are protected.”
That includes applying available patches, reviewing the security configuration of their SAP environments and assessing them for signs of compromise.
Kevin Dunne is president of Pathlock. He said SAP systems are a prominent attack vector for bad actors.
Pathlock’s Kevin Dunne
“Most federal agencies are running on SAP, as it has become the industry standard for government entities,” he said. “However, these SAP implementations are often on-premises, and managed by the government entities themselves due to security concerns. These systems then become increasingly vulnerable when updates and patches are not applied in a timely fashion, leaving them wide open for interested hackers.”
Applying security patches in a timely fashion is mission-critical in closing major, known SAP vulnerabilities, Dunne said. However, patching only remedies issues in the rearview.
“For a comprehensive, forward-looking approach to SAP security, organizations need to implement a comprehensive solution to monitor user activities within the system, including interactions with sensitive data,” he said.
Setu Kulkarni is vice president of strategy at WhiteHat Security. He said ISVs and technology companies have an inordinately high window of exposure. That’s because they lack security rigor. They may pass security responsibilities to the companies that use the ISV to build products for their customers.
WhiteHat Security’s Setu Kulkarni
“In this case, SAP customers are accountable for securing their customers,” Kulkarni said. “Customers who implement SAP cannot completely depend on SAP to guarantee security nor can SAP provide assurance of a customer’s implementation.”
Organizations that implement large packaged applications should be cautious of this blind spot, he said.
Connected systems are an underlying condition for a supply chain type of attack, Kulkarni said.
Read more about:VARs/SIs
You May Also Like
Zero Trust World: ThreatLocker Providing an Action Plan for Preventing AttacksFeb 26, 2024
The Gately Report: Trellix Partners Shielding SMBs from RansomwareFeb 26, 2024
Cloud Computing News: AWS Loses Another Key Exec to Azure; Canalys, Vega Cloud, Hyve NewsFeb 23, 2024
Channel Futures Reveals 2024 Circle of Excellence InducteesFeb 23, 2024