May 11, 2015 By Douglas Bonderud 2 min read

According to security research firm Onapsis, any enterprise running back-end SAP systems has a problem. New data suggests that over 95 percent of SAP installations studied had been exposed to “vulnerabilities that could lead to the full compromise of an organization’s business data and processes.” With more than 250,000 customers worldwide — including 87 Global 2000 companies — these systems are ubiquitous. The result? These new SAP vulnerabilities have created a sticky situation for IT security.

The Bigger They Are, the Broader the Threat

Onapsis identified three unique ways that attackers are trying to breach SAP systems, starting with pivot attacks. Here, hackers move quickly between multiple back-end systems of varying integrity levels, hoping to glean bits and pieces of customer information, including credit card data. The second attack vector uses customer and supplier portal attacks, which are possible thanks to the creation of backdoor users in the SAP J2EE User Management Engine. The third threat comes from direct attacks through SAP protocols using the SAP RFC gateway to obtain and modify stored data. Together, these three methods give malicious actors a wealth of choices.

These aren’t the only SAP vulnerabilities brought to light in recent months. In February, for example, vulnerabilities were discovered in BusinessObjects, which allowed hackers to obtain unauthenticated access and remotely retrieve, alter and delete business data without being detected, Dark Reading reported. In addition, a cross-site scripting flaw in SAP’s HANA database platform made it possible for hackers to potentially grab authentication data from any user on the system.

The sheer scope of SAP deployments makes some vulnerabilities inevitable, but Onapsis’ data suggests a more widespread issue. What’s really behind the steady flow of new flaws?

Operations Gaps Lead to SAP Vulnerabilities

According to IT World Canada, part of the problem stems from a gap between CISOs, their security teams and SAP operations teams, which may result from a lack of knowledge about SAP. “SAP systems are inherently complex by nature as they are the backbone of business systems and the processes that run the enterprise,” Onapsis’ CTO and Head of Research Juan Pablo Perez-Etchegoyen explained to Dark Reading. Cybersecurity measures are typically aimed at processes, people and infrastructure, while SAP is left out of the loop. As a result, it’s the perfect way in for attackers. What’s more, these back-end systems are often so complex that CISOs and their teams may not even know they’re under attack until it’s too late.

The SAP gap also stems from problems with patches. While the average patch window at most companies is 18 months or longer, SAP releases up to 30 patches per month, with more than half labeled as “high priority.” But Onapsis CEO Mariano Nunez said “the truth is that most patches applied are not security-related, are late or introduce further operational risk.” In other words, just being late to the party isn’t enough since some patches do nothing to increase security, while others may make the problem worse.

C-suites need to identify key information security baselines and design SAP security plans that don’t compromise safety for the benefit of speed or uptime. Applying security patches on a regular basis is also critical, but above all, enterprises need better visibility into their SAP deployments. Even small security holes make a difference, and if there are too many, the IT tree comes crashing down.

More from

ONCD releases 2024 Report on the Cybersecurity Posture of the U.S.

4 min read - On May 7, the Office of the National Cyber Director (ONCD) released the 2024 Report on the Cybersecurity Posture of the United States. This new document is a report card on how well cyber policy followed the guidelines set by the National Cybersecurity Strategy, introduced in March 2023. Here’s what you need to know about the newly released report. Fundamental shifts in cyber roles Over the past year, the U.S. national cybersecurity posture was driven by the 2023 National Cybersecurity…

CISA wants private industry to publicly commit to Secure by Design

4 min read - The tech industry has the power to protect the world from nation-state threat attacks, cyber crime and those wanting to compromise data and manipulate critical infrastructure. But with this power comes great responsibility, which, to be honest, the tech industry has not been that interested in holding. But at the RSA Conference (RSAC) in San Francisco, the cybersecurity and tech communities took steps to exert some power and take responsibility. They took the Secure by Design pledge, a promise to…

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today