Sitnl 2012 erp security
0 likes578 views
The document discusses SAP security, highlighting common myths and the significant risks associated with inadequate security measures, as well as the reasons for prioritizing security, such as business integrity and customer confidence. It advocates for a holistic approach to address SAP infrastructure security, emphasizing the need for regular patching, user training, and ongoing risk assessments. Additionally, it promotes the goals of Bizec, which include raising awareness and providing resources for analyzing and improving ERP security.
Sitnl 2012 erp security
- 1. sitNL 2012 Ciber, Eindhoven, December 8, 2012
- 2. Agenda o Introduction o SAP Security in the news o So how about SAP and Security, Some myths... o SAP Security, the problem... o Why bother? o Show me the money!!! o How to be safe instead of sorry o Bizec © 2012 ERP Security 2
- 3. Introduction Who am I SAP Technology specialist for profit and fun SAP Security researcher for fun (not for profit) Reported over 30 vulnerabilities to SAP Security team Co-founder ERP Security http://scn.sap.com/docs/DOC-8218 © 2012 ERP Security 3
- 4. We’ve all seen these... © 2012 ERP Security 4
- 5. But this is rather new... © 2012 ERP Security 5
- 6. So how about SAP and Security Some myths.... Technical Risks in SAP are basically the same as for other IT systems Except the value of the data stored in SAP is often much higher. Yet SAP Security is still mainly related to Segregation of Duties. Why? Some myths • SAP platforms are only accessible internally • SAP is expensive, so it must be secure • SAP Security = Segregation of Duties • SAP systems are not targeted by hackers • SAP Security is SAP’s problem • We are compliant, so we are secure © 2012 ERP Security 6
- 7. SAP Security The problem... The Problem Number of released SAP Security Notes 1 2 • Lack of awareness with customers 1000 • Lack of Time with customers 800 • High Complexity 600 400 • Lack of Budget 200 • Lack of good Figures 0 2001 2002 2003 2004 2005 2006 • Too much focus on SoD 2007 2008 2009 2010 2011 2012 • Build on code-base back from the 80’s / 90’s. Note1: value for 2012 is linearly extrapolated from 01.10.2012 • Often more than 6-12 months behind with patches Note2: December 2010 is excluded due to a one-time release of 500+ notes • By default many Security features are switched OFF • ... © 2012 ERP Security 7
- 8. Why bother? The Obvious... Why bother about SAP Security? •To prevent losing business!!! •To prevent bad PR •To prevent losing customer confidence •To prevent Legal prosecution •To be in control •To prevent costs of incident handling Why bother about SAP Platform Security? •Because SoD can be easily bypassed •Often leaving no traces on SAP level © 2012 ERP Security 8
- 9. Show me the money!!! Some more examples of what might happen when you don’t secure your systems enough: • Executing of OS commands • Creating admin users • ... © 2012 ERP Security 9
- 10. How to be safe instead of sorry SAP Infrastructure security needs to be addressed holistically: • Remember there is no silver bullet • SAP Infrastructure security is complex and involves many disciplines, so first take a step back, analyze your current state of the landscape, do risk assessments, make a plan and execute and keep on working on it. • Get all parties involved, think about responsible people from Business, Risk management, Security Officers, DB team, OS team, Network team, SAP Basis team, SoD team, etc. • Teach / train users and administrators, work on general security awareness • Control the process, stay up-to-date, evaluate periodically. • Security is a process, not a state*! Embed it in the organization. * Bruce Schneier © 2012 ERP Security 10
- 11. How to be safe instead of sorry II Some key takeaways: • Patch regularly (duh...). Do this for Gui components, DB, OS, SAP and network • Use e.g. the System Recommendations for SAP Security notes • Take a look at the SAP Security guides that are relevant for you • Read the security whitepapers • At least close down some high risk components like the gateway, unnecessary SICF services, etc. (See the guide) • Check RSUSR003 and get rid of DEFAULT passwords • Regularly review your landscape, don’t forget the open source tools * Bruce Schneier © 2012 ERP Security 11
- 12. Bizec Bizec. The main goals of BIZEC are: Raising awareness, demonstrating that ERP security must be analyzed holistically. Analyze current and future threats affecting these systems. Serve as a unique central point of knowledge and reference in this subject. Provide experienced feedback to global organizations, helping them to increase the security of their business-critical information. Organize events with the community to share and exchange information. Join & contribute! www.bizec.org © 2012 ERP Security 12
- 13. Questions? © 2012 ERP Security 13
- 14. Need more info? Contact us... More information See http://www.erp-sec.com Contact me on • jvdvis@erp-sec.com • @jvis © 2012 ERP Security 14
- 15. Disclaimer SAP, R/3, ABAP, SAP GUI, SAP NetWeaver and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. The authors assume no responsibility for errors or omissions in this document. The authors do not warrant the accuracy or completeness of the information, text, graphics, links, or other items contained within this material. This document is provided without a warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability, fitness for a particular purpose, or non-infringement. The authors shall have no liability for damages of any kind including without limitation direct, special, indirect, or consequential damages that may result from the use of this document. SAP AG is neither the author nor the publisher of this publication and is not responsible for its content, and SAP Group shall not be liable for errors or omissions with respect to the materials. No part of this document may be reproduced without the prior written permission of ERP Security BV. © 2012 ERP Security BV. © 2012 ERP Security 15