Search

Ponemon Report: Cybersecurity Risks to Oracle E-Business Suite of Applications

/in /by

Ponemon Report

How are organizations truly managing cybersecurity risks in their Oracle E-Business Suite ecosystem? Ponemon Institute’s latest study of almost 600 global IT and IT security practitioners reveals senior level perceptions about Oracle E-Business Suite, its security challenges, and the risk of data breaches and cyberattacks. By downloading this report, you will learn:

  • Senior leadership’s perception about security risks facing Oracle E-Business Suite
  • How critical Oracle E-Business Suite is to the revenue of an organization
  • The average cost of a data breach if Oracle E-Business Suite is taken offline
  • Where the division of responsibility is perceived to lie for securing Oracle E-Business Suite
  • Perceived confidence in being able to detect a security breach in Oracle E-Business Suite

Protecting the Crown Jewels in the Pivot to Digital Transformation

/in /by

For many organizations, digital transformation is not just buzzwords but a detailed outline of business and operational plans to integrate, prioritize and fully utilize the latest digital technologies available. While this plan has significant cost and productivity benefits to the organization, security is often a second priority or not in the scope of these projects. Beyond that, many organizations have not identified a plan for how they will migrate their most critical SAP and Oracle applications and workloads in a secure way, putting their crown jewels at risk.

Download this comprehensive white paper to outline key security challenges in migrating complex business-critical applications during digital transformation strategies. Also, learn key methods to ensure the business crown jewels are protected each step of the way.

The State of Enterprise Resource Planning Security in the Cloud

/in /by

With ERP vendors reporting double-digit growth in cloud revenue year over year, many organizations are faced with the challenging task of planning a cloud migration of their most critical assets. Because these systems are typically more complex, and also house the organization’s critical data and processes, special precautions must be taken when building a migration plan.

The Cloud Security Alliance (CSA) ERP Security Working Group has pulled together industry experts to study this topic and offer organizations a baseline in their new white paper, “The State of Enterprise Resource Planning Security in the Cloud.” This document aims to help organizations develop best practices to secure their ERP (and other business-critical applications) when undergoing complex cloud migrations.

Volume XIV: Setup Trusted RFC in SAP GRC

/in /by

In February 2017, SAP released Security Note 2413716 regarding configuration changes to secure Trusted RFC for GRC Access Control (AC) Emergency Access Management (EAM), which was a High Priority note.

The EAM module provides SAP GRC AC with the ability to determine how access can be granted in case of an emergency, however, you must set up Trusted RFC in order to do this.
In this white paper the Onapsis Research Labs will detail:

  • Key concepts of SAP GRC and Trusted RFC
  • Key risks of not configuring this in your organization
  • Steps to securely configure this High Priority note

MercadoLibre

/in /by
Industry – Large enterprise, E-Commerce Marketplace
Company Size – 40k+ employees >$13B revenue

Challenge

MercadoLibre’s top executive management had always had a highly proactive approach to protecting their sensitive information from cyberattacks. In light of the increased threats to SAP® environments, Diego Cabrera Canay, Director of Financial Planning, Analysis & Control at Mercadolibre, was faced with the challenge of securing the Company’s business-critical SAP platform. 

Diego evaluated the situation together with two colleagues: Jorge O’Higgins, Sr. Manager Information Security, and Sebastian Monaco, Sr. SAP security analyst. “We realized we needed to know where we were standing regarding SAP application security risks, beyond user access controls,” explained Sebastian. 

They soon came to the conclusion that they needed to define a process to manage the implementation of SAP Security Notes and protect their systems against known vulnerabilities. “SAP Security Notes are applied by our BASIS teams. However, we did not have the capabilities to understand which ones we were missing and the ones we needed to implement quickly,” mentioned Diego. “We could also not easily verify if they had actually been implemented.”

“While we had processes and products in place to assess the security of our Web applications, operating systems, and databases, none of them could help us review our SAP applications in depth. Onapsis filled this gap perfectly.”

Solution

MercadoLibre selected Onapsis, the first and only SAP-certified solution for automated application security assessments of SAP platforms. “Onapsis was the only product in the market that could provide us with these capabilities,” highlighted Jorge.

Onapsis  empowers Compliance, Information Security and SAP professionals to go beyond Segregation of Duties controls. The product closely inspects the SAP application layer (NetWeaver/BASIS) for vulnerabilities and unsafe configurations of technical parameters, missing SAP security patches, insecure interfaces between SAP components and users with risky technical authorizations (for both ABAP and Java-based SAP systems.) The product, which provides continuous monitoring capabilities, eliminates the SAP security gap many organizations suffer from by reporting precisely about existing threats affecting their SAP platform and providing actionable remediation information.

“As a publicly-traded company, we have to be SOX compliant. We knew we needed to stay current regarding modern requirements affecting our SAP environment, and Onapsis was the only product that was able to help us to detect and mitigate gaps in the SAP application security layer.”

Results

As a publicly-traded company, we have to be SOX compliant. We knew we needed to stay current regarding modern requirements affecting our SAP environment, and Onapsis  was the only product that was able to help us to detect and mitigate gaps in the SAP application security layer.  Onapsis helped us to streamline the process of implementing SAP Security Notes. We can now automatically identify which ones really affect our platform in a prioritized way, also helping us verify their correct implementation. 

Before Onapsis  MercadoLibre was only prepared to perform ad-hoc reviews in the case of incidents. Today, its security posture is much more robust: “We have a proactive and efficient solution to run our SAP systems securely, minimizing the probability of successful attacks to our business-critical systems,” commented Diego. 

Volume XIII: SAP HANA System Security Review - Part 2

/in /by

SAP HANA is being pushed by SAP as the absolute in-memory database for its products and more recently, as a standalone platform. The vast majority of companies who have already adopted it are leveraging its capabilities to support business-critical applications. Due to its nature, SAP HANA stores an organization’s most important assets, thus requiring large efforts to secure that data.

This publication is the second in our SAP HANA Security In-Depth publications, and follows SAP HANA System Security Review Part 1.

SAP HANA System Security Review Part 2 analyzes SAP HANA Internal Communication Channels detailing associated risk, and identifies how to properly audit an SAP HANA System. In addition, this publication describes how to update the platform, noting new improvements in the Support Package.

Blueprint for CIS Control Application: Securing the SAP Landscape

/in /by

A SANS Whitepaper | Written by Barbara Filkins

Any data breach can be expensive, but the potential cost rises with the value orexploitability of the data targeted in an attack.

Serious attacks aimed directly at large-scale ERP systems rather than more peripheral systems may generate extraordinary costs, whether they are simple denial-of-service attacks or sophisticated efforts to compromise data that is confidential or strategically important. A 2014 IDC study on the cost of system downtime among the Fortune 1,000 found that the average cost for the failure of a critical application is between $500,000 and $1 million per hour.

Direct attacks on ERP systems have been relatively rare, or at least very rarely disclosed publicly. Since 2012, groups including hacktivist collective Anonymous have claimed to have successfully attacked government organizations using zero-day exploits affecting SAP systems.2 The only clear and public example of compromise, however, was in May 2015, when Nextgov.com, a site that focuses on news about federal IT, broke the story that an SAP installation may have been the initial attack vector in a breach that netted files containing tens of millions of highly detailed and personal data points.3 The attack in question was the notorious U.S. Office of Personnel Management (OPM) breach.

According to Nextgov.com, an internal investigation had uncovered evidence that attackers had broken into United States Investigations Services Inc. (USIS), a contractor that conducts background checks for most federal agencies, by exploiting a flaw in an SAP system.

©2024 Onapsis | All rights reserved