The SAP HANA platform has seen marked success over the past few years and counts companies like T-Mobile, Palo Alto Networks and Airbus as customers. But according to CSO Online, there’s a problem: 21 vulnerabilities have now been found by security firm Onapsis, many of them serious. Eight are ranked as critical and several can be remotely exploited, leaving companies open to a data breach or worse. With SAP problems shaking HANA’s tree, how do companies using the product make sure they’re protected?
Big Attack Surface Equals Big Data Breach Risk
Part of the problem with HANA stems from its large attack surface. As noted by ZDNet, more than 10,000 businesses use the platform — both on-premises and in the cloud — to power everything from ERP to CRM to supply chain or business intelligence applications. In February 2015, Onapsis started reporting found flaws to SAP in hopes of prompting a fix. Several patches have since been released, which address some of the problems uncovered.
Others remain unresolved, and Onapsis CEO Mariano Nunez told CSO Online, “The kind of vulnerabilities we discovered would enable any attacker without any user ID or password to remotely have full control of any SAP HANA-based system.” For example, the company found a remote code execution flaw that allowed cybercriminals to control business-relevant information or processes. And according to Dark Reading, attackers plan to demonstrate a way to use SAP ERP as a stepping stone to sabotage oil and gas industry networks at the upcoming Black Hat Europe conference.
Bottom line? Big problems.
Putting Down Roots
How can companies running HANA stay safe? While two of the eight critical vulnerabilities could be addressed with software patches, the other six are hard-coded and require system configuration changes to eliminate.
One such flaw concerns the SAP TCP/IP-based communications protocol TREXNet. Experts recommended that companies ensure all TREXNet exchanges are isolated from end users and employ transport-level authentication. Across the enterprise network at large, meanwhile, it’s a good idea to monitor both HTTP and SQL traffic for any strange activity.
While it’s easy to point the finger at SAP, it has made efforts to make good on the flaws uncovered and — given the scope of its product offering and the size of enterprise networks using the services — it’s no surprise that multiple data breach vulnerabilities exist. Regular patches are one way to stay safe, and companies should make the effort to encrypt TREXNet communication in addition to monitoring network traffic.
There’s also a fail-safe option: Make backups of all critical data and store them apart from HANA-based solutions. That way, even if attackers leverage uncorrected flaws and network monitoring lets malicious code slip through, businesses still have the ability to fall back on stored data.
SAP flaws are shaking HANA’s tree. Put down roots and weather the storm by keeping HANA up to date, monitoring for unusual activity and investing in regular, off-site backups.