According to security research firm Onapsis, any enterprise running back-end SAP systems has a problem. New data suggests that over 95 percent of SAP installations studied had been exposed to “vulnerabilities that could lead to the full compromise of an organization’s business data and processes.” With more than 250,000 customers worldwide — including 87 Global 2000 companies — these systems are ubiquitous. The result? These new SAP vulnerabilities have created a sticky situation for IT security.

The Bigger They Are, the Broader the Threat

Onapsis identified three unique ways that attackers are trying to breach SAP systems, starting with pivot attacks. Here, hackers move quickly between multiple back-end systems of varying integrity levels, hoping to glean bits and pieces of customer information, including credit card data. The second attack vector uses customer and supplier portal attacks, which are possible thanks to the creation of backdoor users in the SAP J2EE User Management Engine. The third threat comes from direct attacks through SAP protocols using the SAP RFC gateway to obtain and modify stored data. Together, these three methods give malicious actors a wealth of choices.

These aren’t the only SAP vulnerabilities brought to light in recent months. In February, for example, vulnerabilities were discovered in BusinessObjects, which allowed hackers to obtain unauthenticated access and remotely retrieve, alter and delete business data without being detected, Dark Reading reported. In addition, a cross-site scripting flaw in SAP’s HANA database platform made it possible for hackers to potentially grab authentication data from any user on the system.

The sheer scope of SAP deployments makes some vulnerabilities inevitable, but Onapsis’ data suggests a more widespread issue. What’s really behind the steady flow of new flaws?

Operations Gaps Lead to SAP Vulnerabilities

According to IT World Canada, part of the problem stems from a gap between CISOs, their security teams and SAP operations teams, which may result from a lack of knowledge about SAP. “SAP systems are inherently complex by nature as they are the backbone of business systems and the processes that run the enterprise,” Onapsis’ CTO and Head of Research Juan Pablo Perez-Etchegoyen explained to Dark Reading. Cybersecurity measures are typically aimed at processes, people and infrastructure, while SAP is left out of the loop. As a result, it’s the perfect way in for attackers. What’s more, these back-end systems are often so complex that CISOs and their teams may not even know they’re under attack until it’s too late.

The SAP gap also stems from problems with patches. While the average patch window at most companies is 18 months or longer, SAP releases up to 30 patches per month, with more than half labeled as “high priority.” But Onapsis CEO Mariano Nunez said “the truth is that most patches applied are not security-related, are late or introduce further operational risk.” In other words, just being late to the party isn’t enough since some patches do nothing to increase security, while others may make the problem worse.

C-suites need to identify key information security baselines and design SAP security plans that don’t compromise safety for the benefit of speed or uptime. Applying security patches on a regular basis is also critical, but above all, enterprises need better visibility into their SAP deployments. Even small security holes make a difference, and if there are too many, the IT tree comes crashing down.