This advisory takes a long look at 2022 and offers a compelling list of the Common Vulnerabilities and Exposures (CVEs) that were most frequently and consistently exploited throughout last year. Unsurprisingly, for those that have been paying attention to the Onapsis Research Labs for a while now, ERP software vulnerabilities (for Oracle and SAP) made the hot list of 42 observed, frequently exploited vulnerabilities. What might be surprising is that this is the first time that SAP and Oracle vulnerabilities have officially made this list.
SAP applications are widely deployed and used for critical operations worldwide by organizations in essential industries. Despite their importance, many organizations lack the proper preventative, detective, and corrective controls to secure their SAP systes, and have a reigning false sense of security provided by traditional security and compliance products.
A successful attack on unprotected SAP applications could have far-reaching consequences. The U.S. Department of Homeland Security has issued six alerts to date about cyber attacks targeting mission-critical enterprise systems, including SAP. Onapsis Research Labs’ threat intelligence cloud has found more than 300 confirmed exploitations of unprotected SAP applications, including more than 100 hands-on attacks on organizations in less than a year. Among the compromised data included sales, HR, customer, intellectual property, and financial information. Given their importance to business operations, SAP applications need to be secured with the proper tools, processes, and teams.
To learn more about SAP security, take a look at our blogs below. If you're ready to get started with an SAP security strategy, contact us.
Thumbnail
SAP Remote Function Call (RFC) Vulnerabilities in 2023
In 2007, Onapsis CEO & Co-founder Mariano Nuñez presented several vulnerabilities and attacks affecting the RFC Protocol at Black Hat Europe. That presentation became a call-to-action for the research community to dedicate time into improving the security of SAP applications and SAP Protocols.
Thumbnail
Using Generic Application Access Rules in SAP Custom Development
SAP applications often require the need to restrict access for certain entities to a subset of all instances. In most scenarios, SAP’s authorization concept is sufficient for this purpose. However, there are some disadvantages using SAP authorizations:
Thumbnail
How To Talk to Your Board About SAP Security: Three Tips From Former Google CISO
Gerhard Eschelbeck, former CISO of Google, shares how to talk to your board about the importance of ERP security.
Thumbnail
A Look Back at SAP Vulnerabilities in 2022
Onapsis Research Labs shares some of the top SAP security vulnerabilities organizations should be aware of from 2022.
Thumbnail
AppsMas: Onapsis Platform 2022 Highlights
Let's take a look at 2022 and see what key Onapsis Platform enhancements launched throughout 2022.
Thumbnail
The Risks of SAP RFC Callbacks and How to Avoid Them
This blog explains SAP RFC Callbacks and how to protect your SAP systems.
Thumbnail
Protect SAP Systems With Unified Connectivity Framework (UCON)
This blog post will explain the main aspects of Unified Connectivity Framework (UCON) and how it can be used to decrease the attack surface for malicious RFC calls by 95%.
Thumbnail
SAP Development System: A Critical Entry Point for Attacks
SAP development systems are an often underestimated entry point for attacks.
Thumbnail
What is SAP Security?
What is SAP security? This blog provides six things every leader should be doing to secure their SAP environment.
