Tuesday, August 30, 2016

Awareness Improving But Security Still Lags For SAP Implementations

By Ericka Chickowski "SAP ecosystem a huge Achilles heel for enterprise system security, report says. While SAP makes some of the most business-critical applications used by enterprises today, it has taken some time for the IT world to get serious about securing SAP infrastructure. In the wake of a several high-profile incidents involving SAP over the past year -- and an increasing focus by analysts on SAP defense issues -- SAP awareness is at an all-time high in 2016. But the statistics show that there's a lot of work to do in order to turn that awareness into meaningful protection for business-critical applications.

 So says a new report out this week by ERPScan, which takes an in-depth look at the state of threats and protections around the global SAP ecosystem. As the report notes, 90% of the Fortune 2000 uses SAP and last year there were vulnerabilities in almost every SAP module, with CRM carrying the bulk of reported vulnerabilities. The footprint for possible SAP system exposure continues to grow beyond the traditional triumvirate of customer resource planning (CRM), supplier relationship management (SRM), and enterprise resource management (ERP) the firm is known for as it expands into IoT connections and mobility through its SAP HANA and SAP Mobile apps. As an example, a recent issue in SAP Mobile affected over a million mobile devices in 2015. 

 The firm reports that there are three big factors that make it difficult for enterprises to get SAP security under control. The first is a lack of qualified specialists in the field of protecting SAP. These applications are typically run by SAP specialists who often operate with dotted-line reporting to IT, outside the typical control of IT security teams. These specialists have very little security experience, and at the same time "security officers hardly understand SAP threats, not to mention methods and approaches of preventing them," the report notes." Read more...