June 15, 2016 By Vikalp Paliwal 2 min read

The latest reports about SAP HANA vulnerabilities reveal some critical vulnerabilities related to authentication, authorizations, patches and misconfigurations, which could make SAP HANA systems a high risk for customers. If any of these known vulnerabilities are exploited, it could result in significant business loss to customers running SAP HANA in applications. Other consequences related to an exploit or data breach include failed compliance, brand reputation impact and declining customer trust resulting in churn.

More About SAP HANA

SAP HANA often runs an enterprise’s most mission-critical applications. However, these enterprises may not completely understand the risk that weakened security for SAP HANA can present.

SAP HANA manages various enterprise resource planning, customer relationship management, supply chain, analytics and business intelligence systems. It stores most critical business, personal and financial data, which requires managing regulatory and compliance requirements such as PCI, PII, HIPAA, Sarbox and GDPR.

Research from the Ponemon Institute, titled “Trends in SAP Cybersecurity,” revealed a few key points about the systems:

  • There is no single function in the enterprise that owns SAP security.
  • There is no one role in the organization accountable in case of a SAP data breach.
  • The SAP platform is likely to contain at least one malware instance.
  • There is often a significant delay in discovering a data breach on a SAP system.

Because of the speed with which customers are deploying SAP HANA in hybrid deployment models, security is often neglected by database administrators (DBAs) and IT. But these customers need to understand the cost of the data stored in SAP HANA: Any misconfigurations or known vulnerabilities can cost millions of dollars in failed compliance if exploited by attackers or rogue insiders.

The Trouble With Vulnerabilities

There are many known vulnerabilities related to configurations changes, system-level privileges and missing patches that are known to cybercriminals, who are trying to exploit them. We need an automated tool that can scan all SAP HANA instances, identify critical and sensitive data, and provide a comprehensive listing of all vulnerabilities such as missing patches, use of default configurations, inadequate password policies, subpar file permissions, poor file ownership and more.

Security teams can then look at these results and understand the impact. There should be a way to provide details about how these vulnerabilities can be remediated. Remediation is the key; often, security teams and even DBAs do not know what should be done to remediate critical vulnerabilities.

Though identification of vulnerabilities is just one piece of a big problem, detailed remediation recommendations are key to helping teams learn how to harden their SAP HANA databases and subsequently lock down the system from future exploits of known vulnerabilities.

Download the Guardium Vulnerability Assessment Data Sheet

More from Data Protection

Why safeguarding sensitive data is so crucial

4 min read - A data breach at virtual medical provider Confidant Health lays bare the vast difference between personally identifiable information (PII) on the one hand and sensitive data on the other.The story began when security researcher Jeremiah Fowler discovered an unsecured database containing 5.3 terabytes of exposed data linked to Confidant Health. The company provides addiction recovery help and mental health treatment in Connecticut, Florida, Texas and other states.The breach, first reported by WIRED, involved PII, such as patient names and addresses,…

Addressing growing concerns about cybersecurity in manufacturing

4 min read - Manufacturing has become increasingly reliant on modern technology, including industrial control systems (ICS), Internet of Things (IoT) devices and operational technology (OT). While these innovations boost productivity and streamline operations, they’ve vastly expanded the cyberattack surface.According to the 2024 IBM Cost of a Data Breach report, the average total cost of a data breach in the industrial sector was $5.56 million. This reflects an 18% increase for the sector compared to 2023.Apparently, the data being stored in industrial control systems is…

3 proven use cases for AI in preventative cybersecurity

3 min read - IBM’s Cost of a Data Breach Report 2024 highlights a ground-breaking finding: The application of AI-powered automation in prevention has saved organizations an average of $2.2 million.Enterprises have been using AI for years in detection, investigation and response. However, as attack surfaces expand, security leaders must adopt a more proactive stance.Here are three ways how AI is helping to make that possible:1. Attack surface management: Proactive defense with AIIncreased complexity and interconnectedness are a growing headache for security teams, and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today