November 10, 2015 By Douglas Bonderud 2 min read

The SAP HANA platform has seen marked success over the past few years and counts companies like T-Mobile, Palo Alto Networks and Airbus as customers. But according to CSO Online, there’s a problem: 21 vulnerabilities have now been found by security firm Onapsis, many of them serious. Eight are ranked as critical and several can be remotely exploited, leaving companies open to a data breach or worse. With SAP problems shaking HANA’s tree, how do companies using the product make sure they’re protected?

Big Attack Surface Equals Big Data Breach Risk

Part of the problem with HANA stems from its large attack surface. As noted by ZDNet, more than 10,000 businesses use the platform — both on-premises and in the cloud — to power everything from ERP to CRM to supply chain or business intelligence applications. In February 2015, Onapsis started reporting found flaws to SAP in hopes of prompting a fix. Several patches have since been released, which address some of the problems uncovered.

Others remain unresolved, and Onapsis CEO Mariano Nunez told CSO Online, “The kind of vulnerabilities we discovered would enable any attacker without any user ID or password to remotely have full control of any SAP HANA-based system.” For example, the company found a remote code execution flaw that allowed cybercriminals to control business-relevant information or processes. And according to Dark Reading, attackers plan to demonstrate a way to use SAP ERP as a stepping stone to sabotage oil and gas industry networks at the upcoming Black Hat Europe conference.

Bottom line? Big problems.

Putting Down Roots

How can companies running HANA stay safe? While two of the eight critical vulnerabilities could be addressed with software patches, the other six are hard-coded and require system configuration changes to eliminate.

One such flaw concerns the SAP TCP/IP-based communications protocol TREXNet. Experts recommended that companies ensure all TREXNet exchanges are isolated from end users and employ transport-level authentication. Across the enterprise network at large, meanwhile, it’s a good idea to monitor both HTTP and SQL traffic for any strange activity.

While it’s easy to point the finger at SAP, it has made efforts to make good on the flaws uncovered and — given the scope of its product offering and the size of enterprise networks using the services — it’s no surprise that multiple data breach vulnerabilities exist. Regular patches are one way to stay safe, and companies should make the effort to encrypt TREXNet communication in addition to monitoring network traffic.

There’s also a fail-safe option: Make backups of all critical data and store them apart from HANA-based solutions. That way, even if attackers leverage uncorrected flaws and network monitoring lets malicious code slip through, businesses still have the ability to fall back on stored data.

SAP flaws are shaking HANA’s tree. Put down roots and weather the storm by keeping HANA up to date, monitoring for unusual activity and investing in regular, off-site backups.

More from

ONCD releases 2024 Report on the Cybersecurity Posture of the U.S.

4 min read - On May 7, the Office of the National Cyber Director (ONCD) released the 2024 Report on the Cybersecurity Posture of the United States. This new document is a report card on how well cyber policy followed the guidelines set by the National Cybersecurity Strategy, introduced in March 2023. Here’s what you need to know about the newly released report. Fundamental shifts in cyber roles Over the past year, the U.S. national cybersecurity posture was driven by the 2023 National Cybersecurity…

CISA wants private industry to publicly commit to Secure by Design

4 min read - The tech industry has the power to protect the world from nation-state threat attacks, cyber crime and those wanting to compromise data and manipulate critical infrastructure. But with this power comes great responsibility, which, to be honest, the tech industry has not been that interested in holding. But at the RSA Conference (RSAC) in San Francisco, the cybersecurity and tech communities took steps to exert some power and take responsibility. They took the Secure by Design pledge, a promise to…

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today