Exploring the Evolving Landscape of ERP Digital Transformation and Strategies to Mitigate Security Risks
ON DEMAND
As global organizations fully embrace cloud and digital transformation projects in the enterprise, under-resourced teams frequently focus on agility and velocity over security. This webinar will discuss the current trends shaping ERP digital transformation and the broader challenges in securing these business-critical systems. This session will draw from Onapsis’ experiences in securing the world’s leading brands over the past 10+ years to discuss major security challenges and threats brought on by digital transformation, leveraging insights and real-world examples to illustrate the topic.
For industrial chemical companies, the impact of a successful cyber attack on their critical ERP, production and supply chain, or customer portals could be devastating.
Cyberattacks targeting the systems that support critical operations such as R&D, financials, and manufacturing are growing in number and severity with the primary goal being industrial espionage. Further, these attacks create business disruptions that potentially cripple operations due to interconnectivity of critical systems. As a result, most nations have designated the chemicals industry to be critical infrastructure. Under this growing threat of targeted cyber attacks, the chemical industry is challenged to protect these critical systems and ensure the quality and delivery of their products in the face of regulatory oversight and the threat of compliance audits.
$4.47M the average cost of a data breach for the chemical industry
1
25% of chemical industry data breaches caused by Ransomware
2
74% of breaches involved privileged account access
3
Key Risk Factors
Increasing ERP System Attacks
Cyber attacks targeting chemical companies are on the rise. Successful attacks on critical ERP systems can be particularly devastating with wide-ranging and significant business impact due to greater interconnectivity up and down the value chain.
Digitization and Interconnectivity
The focus on streamlining operations and creating more efficient processes is transforming supply chains into more localized, digitized, and interconnected systems. This makes chemical companies more agile and able to respond to supply and demand changes. However, this deeper interconnection greatly increases potential unmonitored risks.
Critical Infrastructure Regulations
Chemical companies, designated as critical infrastructure, are classified as high-risk and subject to strict governmental regulations. Failing to comply with audit regulations can result in significant financial impacts to the organization including fines as well as suspension of production.
Key Challenges
Limited Visibility for Security
Chemical companies have ERP applications and assets distributed across a complex and interconnected landscape (IT and OT). This means full visibility of the attack surface is difficult as is mitigating risk to the systems that support connected supply chains, production, and externally exposed applications.
Secure Digital Transformation
Digitization projects streamline operations and increase efficiencies, but they can favor expediency over security. Monitoring critical systems and ensuring that SAP code is developed securely when architecting new applications that affect the supply-chain is critical.
Security Controls for Compliance
Regulatory compliance generally requires a large number of time-consuming, manual, and repetitive tasks to collect data. Identifying unmonitored or vulnerable ERP assets and automating these processes greatly accelerates audit preparation and helps avoid violations.
Solution
Onapsis Provides a Better Approach to ERP Security
Fortunately, securing your complex ERP landscape doesn’t have to be complicated, even with all the advanced threats and attacks out in the wild.
That’s where Onapsis comes in.
As the undisputed experts in business application security with the most prolific threat research team for SAP and Oracle, Onapsis has been on the frontlines securing the world’s leading heavy and discrete manufacturers for over a decade now.
With Onapsis, you get complete 360 degree security for your critical ERP applications, helping you:
Automate security tasks for a faster, less resource intensive, process for compliance audits
Manage risk with specific threat research, analysis, and monitoring so your team can effectively take action
Integrate with existing security resources so familiar ticketing systems and SIEMs can bring ERP security into SOC playbooks
A global chemical company relies on SAP with several business units developing custom code for these business-critical applications. However, the organization struggled to maintain their development cycles at a pace that aligned with the speed of their business, finding it difficult to implement changes without impacting existing system performance or introducing security or compliance issues.
Solution
By using Onapsis Control, this company universally automated their code scanning, gated and analyzed all transports, and reduced their development costs and time investments, automatically scanning hundreds of thousands of lines of codes in minutes. Deep visibility into custom code and transports prevented bad code from entering critical production environments and adversely impacting system performance and security.
25% Less time spent on code reviews
65%Less costs spent on remediation activities
75% Reduction in security and quality errors imported into production
Learn more about how Onapsis helps chemical companies protect the systems and data supporting their supply chain, customer portals, production, and other business-critical operations at onapsis.com/fb-manufacturing
Reference
1 IBM Security Cost of a Data Breach Report 2022 2 IBM Security Cost of a Data Breach Report 2023 3 Centrify
Enterprise resource planning (ERP) systems, like SAP and Oracle E-Business Suite (EBS), are the operational engine of many organizations—running business-critical applications and holding the sensitive data needed for businesses to function.
ERP Systems Are Complex, but ERP Security Doesn’t Have to be Complicated
ON DEMAND
Businesses use enterprise resource planning (ERP) systems, like SAP, to keep their critical business assets, data and IP in one place. While ERP systems unify platforms and departments, centralizing large enterprise data presents an attractive target for malicious actors. An interconnected system combined with inadequate ERP security increases the risk of attacks and makes ERP systems a prime target for adversaries.
To shed light on the state of ERP security in 2023, we have analyzed and observed threats and attacks targeting ERP applications. Learn about the state of ERP Security, strategies to maintain compliance, and how to better mitigate risk across your SAP landscape.
This session covers:
The power and importance of business applications and why they are a target
Active and elevated SAP exploitation activity identified by Onapsis Research Labs
Fundamental concepts for SAP business-critical application cybersecurity & compliance
Key strategies to maintain compliance and better mitigate risk across your SAP landscape
Cyber attacks are targeting ERP applications within the oil and gas industry. These attacks can have financial and reputational impact and result in outages causing great human costs. They can disrupt oil and gas production, refinement, transportation, and delivery and put customer personally identifiable information (PII) at risk. Oil and gas companies need to protect against these attacks while modernizing their systems and complying with an ever increasing number of government regulations.
$4.7M average cost of energy industry breach 1
94% of energy industry breaches impacted personal data
2
33% of energy industry data breaches espionage driven
3
Solution
Onapsis Provides a Better Approach to ERP Security
Fortunately, securing your complex ERP landscape doesn’t have to be complicated, even with all the advanced threats and attacks out in the wild.
That’s where Onapsis comes in.
As the undisputed experts in business application security with the most prolific threat research team for SAP and Oracle, Onapsis has been on the frontlines securing the world’s leading heavy and discrete manufacturers for over a decade now. We’re proud to be an Oracle partner and the only application security platform in the SAP Endorsed Apps program
With Onapsis, you get complete 360 degree security for your critical ERP applications, helping you:
Automate your ERP security helping you reduce time and resource costs for compliance audits
Gain research-driven analysis and focused threat intel from industry experts, so even teams new to ERP security can quickly and effectively comprehend and act on risk
Integrate with ticketing systems and SIEMs to bring ERP security into existing processes and SOC playbooks
Case Study
F1000 Gas Company Builds SAP Vulnerability Management Program, Reduces Remediation Time by 80%
Challenge
The company heavily relies on SAP applications for their business-critical processes, but the company had zero visibility into the actual security posture of these applications. They had a long, complicated patching process, and their existing vulnerability management solution and SAP tools didn’t give them what they needed to effectively protect their value chain
Solution
Onapsis provided comprehensive, focused vulnerability management designed for SAP applications. Automated assessments, detailed solutions, and descriptions of business impact enabled the organization to easily identify and prioritize their risk, leading to a greater understanding of how to best respond while streamlining their patching process and reducing their overall time and costs while preparing for FERC compliance audits
80% Reduction in mean time to remediate (MTTR)
90% Less time spent on patching
60% Reduction in investigation time
Learn more about how Onapsis helps oil and gas companies protect the systems and data supporting their ERP and other business-critical operations from SAP and Oracle at onapsis.com/oil-and-gas
Reference
1 IBM Security Cost of a Data Breach Report 2022 2 Verizon 2021 Data Breach Investigations Report 3 Verizon 2021 Data Breach Investigations Report
Onapsis sat down with SAPinsider to discuss SAP security 101 as it applies to how security leads and ensure they are protecting their strategic operations and business processes.
Watch the virtual roundtable to learn:
How and why you should include SAP security in your overall cybersecurity strategy
Fundamental concepts for SAP business-critical application cybersecurity & compliance
Strategies for measuring and mitigating risk throughout your SAP landscape
For pharmaceutical companies, the impact of a successful cyber attack on their critical ERP, production and supply chain, or patient portals could be devastating.
Cyberattacks targeting the systems that support critical operations such as R&D, clinical trials, and manufacturing are growing in number and severity with the primary goal being theft of intellectual property of key research, formulas, and therapies. As a side effect, these attacks create business disruptions that potentially cause integrity or safety issues in products designed for human consumption. Under the growing threat of targeted cyber attacks, pharmaceutical companies are challenged to protect their critical systems and ensure the safety of their products in the face of regulatory oversight and the threat of compliance audits.
$5M the average cost of a data breach for the pharmaceutical industry
1
58% of F500 pharma executives have had their data exposed
2
$2M the average yearly cost of fines and penalties due to non-compliance
3
Key Risk Factors
Direct ERP Attacks on the Rise
Cyber attacks targeting pharmaceutical companies are on the rise. Successful attacks on ERP systems can be particularly devastating, with the potential to disrupt R&D, manufacturing supply chains, and clinical trials; interfere with product safety and delivery; and result in theft of company IP or patient data.
Digital Transformation Timelines
Investment in digitized R&D and supply chain projects is growing with the goal of better collaboration and agility. However, these digital transformation projects bring accelerated timelines where security is frequently an afterthought. The result is increased cyber risk across interconnected systems including remote trial data and patient portals.
Strict Audit Requirements
Pharmaceutical companies are subject to strict compliance regulations for drug development and the protection of patient and customer data. Failure to comply with laws and regulations can result in significant financial impacts including fines, revenue loss, and reputation damage.
There are multiple ERP application owners in pharmaceutical companies, and data lives within a complex, interconnected landscape. This lack of visibility, makes it harder to manage the attack surface and cyber risk for business-critical operations.
Digitization projects streamline operations and increase efficiencies, but they can favor expediency over security. Building in security, particularly during custom code development, and enabling continuous monitoring of critical ERP systems with vital research and patient data, is paramount.
Security Controls for Compliance
Regulatory and GxP compliance generally requires a large number of time-consuming, manual, and repetitive tasks to collect data. Identifying unmonitored or vulnerable ERP assets and automating these processes greatly accelerates audit preparation and helps avoid violations.
Solution
Onapsis Provides a Better Approach to ERP Security
Fortunately, securing your complex ERP landscape doesn’t have to be complicated.
That’s where Onapsis comes in.
Onapsis has been on the frontlines securing the world’s leading pharmaceutical companies for over a decade. We are the foremost experts in business application security with the most prolific ERP threat research team. We’re proud to be an Oracle partner and the only application security platform in the SAP Endorsed Apps program.
With Onapsis, you get complete 360 degree security for your critical ERP applications, helping you:
Automate security tasks for a faster, less resource intensive, process for compliance audits
Manage risk with specific threat research, analysis, and monitoring so your team can effectively take action
Integrate with existing security resources so familiar ticketing systems and SIEMs can bring ERP security into SOC playbooks
F250 Biopharma Company Case Study
F250 Biopharma Company Builds SAP Cybersecurity Program, Reduces Mean Time to Remediate (MTTR) by 83%
Challenge
Dependent upon SAP for their supply chain, manufacturing, and other business-critical operations, the company understood that a “threat to SAP is a threat to the patients that rely on their products.” They needed to harden their applications against internal and external threats and better understand and manage their SAP attack surface.
Solution
Onapsis was able to automate vulnerability scans and provide actionable visibility to mitigate risk to their SAP systems. The organization also leveraged Onapsis continuous threat monitoring of their SAP systems as an early warning system for potential cyberattacks.
83% Reduction in mean time to remediate (MTTR)
96%Reduction in time to remediate emergency issues
75% Improved incident response times
Learn more about how Onapsis helps pharmaceutical companies protect the systems and data supporting ERP, R&D, digital supply chains, clinical trials, and other business-critical operations at onapsis.com/pharma
Reference
1 IBM Security Cost of a Data Breach Report 2022 2 Data Breaches Targeting Pharma Companies are Rampant, Drug and Discovery 2022 3 Tech Republic
For personal care manufacturers, the impact of a successful cyber attack on their critical ERP, supply chain, or e-commerce applications could be devastating. Delays in digitization projects, interrupted business continuity, and loss of consumer personally identifiable information (PII) or the theft of proprietary formulas could have extensive financial and reputational consequences. Plus, considering the end products are designed for human body use or consumption, human safety is a large concern as well. With the growing threat of direct cyber attacks targeting the personal care industry, manufacturers are challenged to protect their critical systems and ensure the safety of their products while meeting accelerated demand for digitization and increasing privacy regulations.
39% of manufacturers experienced a breach in last 12 months
1
$4.5M = average cost of data breach for manufacturing industry
2
34% of manufacturers say theft of intellectual property is their top cyber threat
1
Key Risk Factors
Direct ERP Attacks on the Rise
Cyber attacks targeting the personal care industry are on the rise. Successful attacks on ERP systems can be particularly devastating, with the potential to disrupt supply chains, interfere with product safety and delivery, interrupt e-commerce, and result in loss of consumer PII or company IP (e.g., product formulas.)
More Digitization and Interconnectivity
COVID-19-induced supply chain instability and shifting consumer expectations are driving a need for more digitization and interconnectivity between business processes and systems, so organizations can be more resilient and respond more quickly to changing supply and demand.
Expanded E-Commerce and Digital Sales
As more personal care manufacturers go direct-to-consumer or enhance their e-commerce experiences to address evolving market demand, protecting consumer PII must be top of mind. Failure to do so could result in significant financial loss due to reputation damage or compliance violation (e.g., GDPR, CCPA.)
Key Challenges to ERP Security
Security Is Often an Afterthought in Digital Transformation
The need for supply chain digitization and innovative, integrated e-commerce solutions is driving digital transformation at unprecedented speed, often at the sake of security. The tendency has been to bolt on security after the fact, which can lead to unaddressed risk, project delays, and cost overruns.
Under-Resourced Teams
Workforce shortages, particularly in cybersecurity, mean teams must balance high priority digitization initiatives with ensuring resiliency and integrity of ERP, e-commerce, and supply chain systems and data. This can be particularly challenging since many security teams lack experience with these systems.
Limited Visibility for Security Teams
Limited or restricted visibility into ERP applications and assets across complex and interconnected landscapes results in the inability to effectively protect systems supporting digital supply chains, e-commerce, and other business-critical operations, as well as the data contained within.
Solution
Onapsis Provides a Better Approach to ERP Security
Fortunately, securing your complex ERP landscape doesn’t have to be complicated, even with all the advanced threats and attacks out in the wild.
That’s where Onapsis comes in.
As the undisputed experts in business application security with the most prolific threat research team for SAP and Oracle, Onapsis has been on the frontlines securing the world’s leading personal care manufacturers for over a decade now. We’re proud to be an Oracle partner and the only application security platform in the SAP Endorsed Apps program.
With Onapsis, you get complete 360 degree security for your critical ERP applications, helping you:
Automate security, so you can avoid delays and audit findings and focus on core transformation tasks, while ensuring your critical systems and data stay protected
Gain research-driven analysis and focused threat intel from industry experts, so even teams new to ERP can quickly and effectively understand and act on risk
Integrate with ticketing systems and SIEMs, so ERP can be brought into existing processes and SOC playbooks
F250 Case Study
F250, $17B Consumer Products Manufacturer Gains Visibility into SAP Attack Surface, Automates GDPR Audit Processes to Reduce Risk to Critical Systems
Challenge
There was a board-level initiative to secure SAP with a key focus around mitigating risk related to GDPR requirements and compliance. The CISO knew their security operations team didn’t have the visibility or tools they needed to secure SAP, and their existing manual audit processes were too time-consuming and left too much room for human error to effectively manage GDPR risk.
Solution
With Onapsis, comprehensive vulnerability scans provided much-needed visibility into the broader attack surface across the complex SAP landscape, allowing the security operations team to better comprehend, prioritize, and quickly respond to threats. Onapsis helped the manufacturer automate the majority of their efforts around testing IT controls and collecting evidence for GDPR audits, saving significant time and enabling them to find issues ahead of third-party audits.
81% Reduction In mean-time-to-remediate (MTTR) for SAP vulnerabilities
97% decrease in time spent preparing for compliance audits
40 hours/week saved by eliminating manual data extraction and collaboration
Learn more about how Onapsis helps personal care manufacturers protect the systems and data supporting their ERP, digital supply chains, e-commerce, and other business-critical operations at onapsis.com/personal-care
Reference
1 Cyber Risk in Advanced Manufacturing, Deloitte 2 Cost of a Data Breach Report 2022, IBM Security
For food and beverage manufacturers, the impact of a successful cyber attack on their critical ERP, supply chain, or e-commerce applications could be devastating.
Delays in digitization projects, interrupted business continuity, and loss of consumer personally identifiable information (PII) or theft of proprietary recipes have the potential for extensive financial and reputational consequences. Plus, given the consumable nature of the end products, human safety could also be at risk. With cyber attacks targeting the food and beverage industry on the rise, manufacturers are challenged to protect their critical systems and ensure the safety of their products while meeting accelerated demand for digitization and increasing privacy regulations.
$4.5M = average cost of data breach for manufacturing industry
1
39% of manufacturers experienced a breach in last 12 months
2
34% of manufacturers say theft of intellectual property is their top cyber threat
2
Key Risk Factors
Direct ERP Attacks on the Rise Cyber attacks targeting the food and beverage industry are on the rise. Successful attacks on ERP systems can be particularly devastating, with the potential to disrupt supply chains, interfere with product safety and delivery, interrupt e-commerce, and result in loss of consumer PII or intellectual property (e.g., product recipes.)
More Digitization and Interconnectivity COVID-19-induced supply chain instability and shifting consumer expectations are driving a need for more digitization and interconnectivity between business processes and systems, so organizations can be more resilient and respond more quickly to changing supply and demand.
Expanded E-Commerce and Digital Sales As more food and beverage manufacturers go direct-to-consumer or enhance their e-commerce experiences to address evolving market demand, protecting consumer PII must be top of mind. Failure to do so could result in significant financial loss due to reputation damage or compliance violation (e.g., GDPR, CCPA.)
ERP Security
Security Is Often an Afterthought in Digital Transformation The need for supply chain digitization and innovative, integrated e-commerce solutions is driving digital transformation at unprecedented speed, often at the sake of security. The tendency has been to “bolt on” security after the fact, which can lead to unaddressed risk, project delays, and cost overruns.
Under-Resourced Teams Workforce shortages, particularly in cybersecurity, force teams to work harder to balance high-priority digital initiatives with ensuring resiliency and integrity of ERP, e-commerce, and supply chain systems and data. This can be particularly challenging since many security teams lack experience with these systems.
Limited Visibility for Security Teams Limited or restricted visibility into ERP applications and assets across complex and interconnected landscapes results in unaddressed risk to the systems supporting digital supply chains, e-commerce, and other business-critical operations, as well as limited protection of the data within these systems.
Solution
Onapsis Provides a Better Approach to ERP Security
Fortunately, securing your complex ERP landscape doesn’t have to be complicated, even with all the advanced threats and attacks out in the wild. That’s where Onapsis comes in. As the undisputed experts in business application security with the most prolific threat research team for SAP and Oracle, Onapsis has been on the frontlines securing the world’s leading food and beverage manufacturers for over a decade now. We’re proud to be an Oracle partner and the only application security platform in the SAP Endorsed Apps program. With Onapsis, you get complete 360 degree security for your critical ERP applications, helping you:
Automate security, so you can avoid delays and audit findings and focus on core transformation tasks, while ensuring your critical systems and data stay protected
Gain research-driven analysis and focused threat intel from industry experts, so even teams new to ERP can quickly and effectively understand and act on risk
Integrate with ticketing systems and SIEMs, so ERP can be brought into existing processes and SOC playbooks
Case Study
$10.6B Beverage Manufacturer Builds SAP Vulnerability Management Program, Eliminates Majority of Manual Patching Efforts and Reduces MTTR
Challenge
Manual patching processes and competing priorities resulted in a backlog of SAP Security Notes, leaving critical SAP systems exposed. Internal teams also lacked the visibility and SAP security knowledge to understand and manage their full attack surface.
Solution
With Onapsis, time-saving vulnerability scans eliminated much of the manual work around identifying missing patches and validating they were applied correctly, and provided much-needed visibility into the broader attack surface across complex landscapes. The beverage manufacturer gained a much more accurate understanding of risk within their critical SAP systems, permitting them to make more informed decisions on where and how to respond, resulting in reduced investigation and remediation times and greater risk reduction with much less effort.
85% Lower Mean-time-to remediate (MTTR) for SAP vulnerabilities
93% Less time spent validating SAP Notes were applied correctly
300+ Hours/month saved on SAP vulnerability management efforts
Learn more about how Onapsis helps food & beverage manufacturers protect the systems and data supporting their ERP, digital supply chains, product innovation, and other business-critical operations at onapsis.com/fb-manufacturing
Reference
1 Cyber Risk in Advanced Manufacturing, Deloitte 2 Cost of a Data Breach Report 2022, IBM Security
