Volume XV: SAP® Security In-Depth: Preventing Cyberattacks Against SAP Solution Manager

Highlighted in a recent IDC survey of 430 IT decision makers, 64% of organizations have experienced a breach of their ERP systems, either SAP or Oracle E-Business Suite. Why?

  • Attackers are specifically targeting the crown jewels of the organization, supported by their ERP systems
  • More ERP systems are exposed to the internet than ever before 
  • Traditional perimeter-focused security approaches are not effective at protecting business-critical applications
  • Software vulnerabilities, if left unpatched, create risk and opportunities for attackers 

With this in mind, the Onapsis Research Labs works very closely with both SAP and Oracle to help identify and fix vulnerabilities. When we find a vulnerability, it is our mission to help keep organizations protected. We provide a solution, The Onapsis Platform, and best practices and advice.

Dating back to 2019, SAP has issued three HotNews Security Notes for Solution Manager (SolMan). The most recent in March 2020 addresses a critical vulnerability. An exploit of this vulnerability can be unauthenticated, needing no user credentials, leading to access of any SAP system to potentially cause fraud, theft and disruption. 

As a result, the Onapsis Research Labs, who found this SolMan vulnerability, has issued an updated SAP Security In-Depth (SSID) report providing best practices for preventing cyberattacks against SAP SolMan. We highly encourage you to apply this latest SAP patch and also follow our guide for keeping SolMan and your SAP landscape secure.

For more information, check out our blog post analysis of the March 2020 SAP Patch Day 

Critical SAP RECON Vulnerability: Who is at Risk & How to Protect Your Business

Duration: 60 minutes
Available On Demand

This session will discuss how the Onapsis Research Labs and SAP Security Response Team collaborated to patch the critical RECON vulnerability in record time. You will also learn the details of the RECON vulnerability, who is at risk, what SAP systems are affected, what the business impact could be if exploited and how to protect your organization.

BigDebIT Vulnerabilities in Oracle EBS - Impact & Remediation Deep Dive

Duration: 45 minutes
Available On Demand

This session will cover the recent Onapsis Threat Report highlighting a serious example of what a potential attack on Oracle General Ledger would mean to an organization’s financials—presenting a deficiency in IT general controls for Sarbanes-Oxley (SOX) compliance for publicly-traded companies.  

How to protect your SAP landscape against hackers

Duration: 39 minutes
Available On Demand

Live Date: April 17, 2020

See how an attacker can infiltrate your SAP system by abusing well-known misconfigurations, Understand the most common attack vectors towards your SAP landscape, Learn how you can protect yourself by using SAP security automation and alerting.