CONTACT US
Search
CONTACT US

Ponemon Report: Cybersecurity Risks to Oracle E-Business Suite of Applications

/in /by

Ponemon Report

How are organizations truly managing cybersecurity risks in their Oracle E-Business Suite ecosystem? Ponemon Institute’s latest study of almost 600 global IT and IT security practitioners reveals senior level perceptions about Oracle E-Business Suite, its security challenges, and the risk of data breaches and cyberattacks. By downloading this report, you will learn:

  • Senior leadership’s perception about security risks facing Oracle E-Business Suite
  • How critical Oracle E-Business Suite is to the revenue of an organization
  • The average cost of a data breach if Oracle E-Business Suite is taken offline
  • Where the division of responsibility is perceived to lie for securing Oracle E-Business Suite
  • Perceived confidence in being able to detect a security breach in Oracle E-Business Suite

An Introduction to Oracle EBS Application Security

/in /by

Until recently, Oracle security was regarded as database security or application roles and profiles by the majority of the information security community. While both of these security methods are certainly necessary, many threats to-date have been overlooked by auditing and information security practices, despite the fact that these threats could lead to greater business risk. 

The technical components of business-critical applications introduce specific security concerns that, if not mitigated properly, can be subject to cyberattacks with severe impact to the business. If vulnerabilities against these systems are exploited, confidentiality, integrity and/or availability of critical business information processed and stored in these systems are at risk of being compromised from internal or external attackers. 

Download this publication and become informed with the latest information about current and future risks facing Oracle applications, allowing different actors (financial managers, information security managers, Oracle administrators, auditors, consultants and others) to better understand the techniques and tools available to assess and mitigate them.

SAP & GDPR: Keeping Your Organization Ahead of the Upcoming EU Law

/in /by

With the GDPR enforcement date of May 2018 and steep fines of up to 4% of profit or €20 million looming, organizations are still struggling to understand this complicated policy and how they will adhere to it. This guide aims to provide SAP customers an overview of GDPR, how it affects them and how they can begin a plan to become compliant.

By downloading this guide, you will learn:

  • Important details about GDPR
  • How to check if your organization manages EU citizen data
  • Which SAP systems handle citizen data
  • Methods to secure data housed in SAP systems
  • How to align your SAP security with GDPR compliance mandates

Protecting the Crown Jewels in the Pivot to Digital Transformation

/in /by

For many organizations, digital transformation is not just buzzwords but a detailed outline of business and operational plans to integrate, prioritize and fully utilize the latest digital technologies available. While this plan has significant cost and productivity benefits to the organization, security is often a second priority or not in the scope of these projects. Beyond that, many organizations have not identified a plan for how they will migrate their most critical SAP and Oracle applications and workloads in a secure way, putting their crown jewels at risk.

Download this comprehensive white paper to outline key security challenges in migrating complex business-critical applications during digital transformation strategies. Also, learn key methods to ensure the business crown jewels are protected each step of the way.

The State of Enterprise Resource Planning Security in the Cloud

/in /by

With ERP vendors reporting double-digit growth in cloud revenue year over year, many organizations are faced with the challenging task of planning a cloud migration of their most critical assets. Because these systems are typically more complex, and also house the organization’s critical data and processes, special precautions must be taken when building a migration plan.

The Cloud Security Alliance (CSA) ERP Security Working Group has pulled together industry experts to study this topic and offer organizations a baseline in their new white paper, “The State of Enterprise Resource Planning Security in the Cloud.” This document aims to help organizations develop best practices to secure their ERP (and other business-critical applications) when undergoing complex cloud migrations.

Volume XIV: Setup Trusted RFC in SAP GRC

/in /by

In February 2017, SAP released Security Note 2413716 regarding configuration changes to secure Trusted RFC for GRC Access Control (AC) Emergency Access Management (EAM), which was a High Priority note.

The EAM module provides SAP GRC AC with the ability to determine how access can be granted in case of an emergency, however, you must set up Trusted RFC in order to do this.
In this white paper the Onapsis Research Labs will detail:

  • Key concepts of SAP GRC and Trusted RFC
  • Key risks of not configuring this in your organization
  • Steps to securely configure this High Priority note

MercadoLibre

/in /by
Industry – Large enterprise, E-Commerce Marketplace
Company Size – 40k+ employees >$13B revenue

Challenge

MercadoLibre’s top executive management had always had a highly proactive approach to protecting their sensitive information from cyberattacks. In light of the increased threats to SAP® environments, Diego Cabrera Canay, Director of Financial Planning, Analysis & Control at Mercadolibre, was faced with the challenge of securing the Company’s business-critical SAP platform. 

Diego evaluated the situation together with two colleagues: Jorge O’Higgins, Sr. Manager Information Security, and Sebastian Monaco, Sr. SAP security analyst. “We realized we needed to know where we were standing regarding SAP application security risks, beyond user access controls,” explained Sebastian. 

They soon came to the conclusion that they needed to define a process to manage the implementation of SAP Security Notes and protect their systems against known vulnerabilities. “SAP Security Notes are applied by our BASIS teams. However, we did not have the capabilities to understand which ones we were missing and the ones we needed to implement quickly,” mentioned Diego. “We could also not easily verify if they had actually been implemented.”

“While we had processes and products in place to assess the security of our Web applications, operating systems, and databases, none of them could help us review our SAP applications in depth. Onapsis filled this gap perfectly.”

Solution

MercadoLibre selected Onapsis, the first and only SAP-certified solution for automated application security assessments of SAP platforms. “Onapsis was the only product in the market that could provide us with these capabilities,” highlighted Jorge.

Onapsis  empowers Compliance, Information Security and SAP professionals to go beyond Segregation of Duties controls. The product closely inspects the SAP application layer (NetWeaver/BASIS) for vulnerabilities and unsafe configurations of technical parameters, missing SAP security patches, insecure interfaces between SAP components and users with risky technical authorizations (for both ABAP and Java-based SAP systems.) The product, which provides continuous monitoring capabilities, eliminates the SAP security gap many organizations suffer from by reporting precisely about existing threats affecting their SAP platform and providing actionable remediation information.

“As a publicly-traded company, we have to be SOX compliant. We knew we needed to stay current regarding modern requirements affecting our SAP environment, and Onapsis was the only product that was able to help us to detect and mitigate gaps in the SAP application security layer.”

Results

As a publicly-traded company, we have to be SOX compliant. We knew we needed to stay current regarding modern requirements affecting our SAP environment, and Onapsis  was the only product that was able to help us to detect and mitigate gaps in the SAP application security layer.  Onapsis helped us to streamline the process of implementing SAP Security Notes. We can now automatically identify which ones really affect our platform in a prioritized way, also helping us verify their correct implementation. 

Before Onapsis  MercadoLibre was only prepared to perform ad-hoc reviews in the case of incidents. Today, its security posture is much more robust: “We have a proactive and efficient solution to run our SAP systems securely, minimizing the probability of successful attacks to our business-critical systems,” commented Diego. 

Volume XIII: SAP HANA System Security Review - Part 2

/in /by

SAP HANA is being pushed by SAP as the absolute in-memory database for its products and more recently, as a standalone platform. The vast majority of companies who have already adopted it are leveraging its capabilities to support business-critical applications. Due to its nature, SAP HANA stores an organization’s most important assets, thus requiring large efforts to secure that data.

This publication is the second in our SAP HANA Security In-Depth publications, and follows SAP HANA System Security Review Part 1.

SAP HANA System Security Review Part 2 analyzes SAP HANA Internal Communication Channels detailing associated risk, and identifies how to properly audit an SAP HANA System. In addition, this publication describes how to update the platform, noting new improvements in the Support Package.

Sitemap  | Terms of Use | Privacy Policy   |  Quality Policy  |  Disclosure Policy |  Security Vulnerability Reporting Guidelines |  ©2025 Onapsis  |  All rights reserved