Top Cyber Attack Vectors For Critical SAP Systems 65
An anonymous reader writes: Despite housing an organization's most valuable and sensitive information, SAP systems are not protected from cyber threats by traditional security approaches. Based on assessments of hundreds of SAP implementations, the Onapsis Research Labs study found that over 95 percent of SAP systems were exposed to vulnerabilities that could lead to full compromise of the company's business data and processes. Most companies are also exposed to protracted patching windows averaging 18 months or more. In 2014 alone, 391 security patches were released by SAP, averaging more than 30 per month. Almost 50 percent of them were ranked as "high priority" by SAP.
Why bother to use the word "traditional"? (Score:2)
That implies that there is some sort of protection while leaving out the word "traditional" implies the more correct situation where they are not protected at all.
That not necessarily a bad thing so long as the practice is to secure their stuff with third party approaches afterwards (eg. need to get on a secured VPN before you can communicate with the software).
Re: (Score:3)
That implies that there is some sort of protection while leaving out the word "traditional" implies the more correct situation where they are not protected at all.
That not necessarily a bad thing so long as the practice is to secure their stuff with third party approaches afterwards (eg. need to get on a secured VPN before you can communicate with the software).
Onapsis' bread and butter is a non-traditional security product meant specifically to secure...wait for it...SAP. So, that gives you an idea what the anonymous OP is up to.
wha? (Score:2, Insightful)
Re: (Score:1)
And what in the fucking bloody cunt hell's name does "H*" mean?
Re: wha? (Score:3)
Re: (Score:2)
I've always heard it as "Shitty Ass Program".
Re: (Score:2)
I figured it was "Sucks All Profit".
Re: (Score:1)
Outsourced, overpriced enterprisey bullshit software. Also with really shitty security, given that they averaged over 30 security patches a month in 2014, with nearly half marked "high priority".
Re: (Score:2)
Odd, all of the PRs for my software are functionality patches...as are my changes. Almost as if it's not an issue of "haters gonna hate," and that 40 vulnerabilities in that period of time is insanely unacceptable.
Then again it's corporate IT, and a ridiculous amount of that "community" are still running highly vulnerable IIS servers, so par for the course I suppose.
Re:wha? (Score:5, Insightful)
Re: (Score:2)
Re: (Score:3, Informative)
You'd think that [i]somewhere[/i] in the article they'd least ONCE explain that short acronym. But no. Short acronyms are difficult to google.
I think they're talking about this? [wikipedia.org]
Re: (Score:2)
I manage like 100 servers running SAP, and I have no idea what it stands for. Probably something German.
Re: (Score:1)
Re: (Score:3)
Yes, please define fricken TLAs.
Fricken what?
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:3, Interesting)
SAP is the third largest software company in the world (source [wikipedia.org]). What rock do you live under?
Re:wha? (Score:5, Informative)
Systeme, Anwendungen und Produkte (Systems, Applications, and Products).
www.sap.com
Basically it's one of the two the largest Enterprise Resource Planning software companies in the world. Oracle is the other one. And since most SAP systems are run inside a highly protected corporate network, the self-promoting hysteria from this article is so much bullcrap.
Re: (Score:2)
Re: (Score:2)
Do those really exist?
Re: (Score:2)
SAP is the equivalent of a parasitic wasp. It lays eggs on the host, which then hatch and devour it from within. Except it's software and the host is a company. But otherwise exactly like that.
Consider the source... (Score:1)
Hm.. So the research lab of a company that secures SAP for a living has found that nearly all SAP systems in the world are insecure.
Just sayin'..
Re: (Score:3, Interesting)
Re:Consider the source... (Score:4, Interesting)
I do not disagree at all that SAP sucks. I work for a large retailer and sit right next to the SAP guys. I've never seen such a miserable lot. Daily banging their heads against one stupid SAP issue after another and always complaining about SAP support being completely useless.
I'm just not sure I buy the 95% of installs are horribly insecure claims coming from a company that's only product is securing SAP.
Re: (Score:2)
I do not disagree at all that SAP sucks. I work for a large retailer and sit right next to the SAP guys. I've never seen such a miserable lot. Daily banging their heads against one stupid SAP issue after another and always complaining about SAP support being completely useless.
I'm just not sure I buy the 95% of installs are horribly insecure claims coming from a company that's only product is securing SAP.
You might get a laugh out of this then, one of the SAP guys came to me yesterday asking if one of the ECC servers can receive email. I asked him why the ECC server needs to read email, and he just said it was on this checklist he had and would have to see what the reason was. I don't think he even realized how preposterous his question was.
Re: (Score:2)
SAP can send and receive email. Your guys should know that. It's a sucky 1990's email system, but it works.
Disclaimer... I'm one of those 'SAP Guys' and have been doing it for a decade and a half.
Re: (Score:1)
Can and should are two different things. The point of the comment was that the SAP guy is blindly following some checklist but has no idea why he needs the thing he is asking for.
Sort of thing that makes it not that hard to believe that so many SAP systems are insecure....
Re: (Score:1)
You just described our SAP group. Blindly following checklists and SAP recommendations. Anytime an issue occurs you can actually watch the SAP guys travel in a pack to point blame. VMware -> Windows -> Networking -> Storage.. The Database guys are on the same team as the SAP guys otherwise I'm sure they would be in the mix as well. Never is the issue SAP itself.
Definition of SAP (Score:1)
For everyone who is wondering what SAP is:
http://yourfinancebook.com/what-is-sap [yourfinancebook.com]
Golf (Score:2)
When will the PHBs realise that the golf course is not a 'reputable source' for software?
Re: (Score:2)
When they have to start paying their own greens fees and club dues.
Article author has no idea what SAP security is (Score:1)
As a SAP architect for over 15 years, I can tell you definitively that this article is one big troll. Responsible architecture never exposes SAP systems to the outside world without a dedicated hardened third-party product in between. As far as the article’s points:
1) Portals: The portal product runs behind Apache and a J2EE product. Like 50% of the web, these products are very safe. I don’t understand the argument about “backdoor” users. Do they mean “system accounts
Re: Article author has no idea what SAP security i (Score:2)
I think you mean GLOBAL for all.
Re: (Score:2)
You are describing idealized setups. In most cases, the people on the floor don't give a shit about what the architect has said.
The third party firewall is too expensive, I mean we already laid out millions of dollars on SAP licensing, contractors and architects, let's cut it because the Windows box it is running on has a firewall too.
Why does the portal need it's own box? We pay $100k per CPU for SAP and Windows Server licenses cost $10,000 per CPU as well, let's run it on the same box.
That thing keeps loc
Shit article (Score:2)
What a useless article. The only content is that evil hackers leverage vulnerabilities to gain access to companies' SAP systems. Well, no shit sherlock. SAP is a mess and barely works under normal conditions, so anybody VP-level and above freaks out at the mere mention of touching anything on them. Of course they're going to have patching windows > 18 months.
In fairness to SAP (Score:2)
the vulnerabilities are most likely in the operating systems/database/web servers etc. SAP, of course, runs on top of all that. The SAP software itself is not insecure but there are a lot of moving parts :-)
Is this surprising? (Score:1)
"over 95 percent of SAP systems" are admined and operated by complete chuckleheads.