Monitoring SAP system settings centrally – how LINDE keeps an eye on all its SAP systems simultaneously

SAST Blog: Monitoring SAP system settings centrally – how LINDE keeps an eye on all its SAP systems simultaneouslyIncorrect parameter settings in the SAP system, operating system, or database often result in serious security deficiencies. Numerous companies using a central auditing policy developed as a document are up against the same challenges. Typically, parameter values are compared manually with the target requirements, which of course is time consuming. This a lot of effort even just for one single system. As you might imagine, making the comparisons on system-landscape level is that much more complicated. By centralizing monitoring with an automated solution, you can use resources more efficiently while boosting your IT security.

Continue reading

Hacker attack on Düsseldorf University Hospital – cyber criminals got in through the VPN interface

SAST Blog: Hacker attack on Düsseldorf University Hospital – cyber criminals got in through the VPN interfaceIn September 2020, the attack made headlines:

  • Hackers responsible for IT disruption at Düsseldorf University Hospital.
  • Hackers under investigation: Woman dead after attack on University Hospital.
  • Hacker attack on Düsseldorf University Hospital: Investigation into involuntary homicide opened.

A hacker attack can be fatal. Data, goods and assets aren’t the only things to consider: Human lives are at stake where public spaces, in particular public health, is concerned.

Continue reading

SAP home goes rogue – preventable attack vectors through the SAP GUI

SAST Blog: SAP Home Goes Rogue – Preventable Attack Vectors Through the SAP GUIIn most cases, enterprise networks are infected as a result of human error. Employees click on spoofed links, accidentally reveal their passwords to third parties, or open a file that contains unexpected malware. In attack vectors involving the SAP GUI, employees are often not to blame, because an incorrectly configured SAP system is enough to enable damage to the IT landscape.

Continue reading

SAP authorization management put to the test at Berliner Wasserbetriebe

SAP Authorization Management put to the test (©Berliner Wasserbetriebe)Berliner Wasserbetriebe, Berlin’s water supply and wastewater disposal company, is a public institution and is therefore subject to special legal requirements. High security standards apply to both business processes and its IT operations. As a consequence, setting up transparent SAP authorization management company-wide to meet all of these requirements was one of the water company’s most critical tasks.

Continue reading

SAP Security: five ways to make sure you’ll be hacked

Hacker attacks threaten SAP security: All alarmist nonsense?(A guide of the less serious sort.)
Let’s be honest right off the bat: There’s a lot of hype in the media about IT security in general and SAP security in special these days. But is there really anything behind it? Those headlines about millions of data records going missing always affect someone else – whether it’s Equifax across the pond or the big tech companies that have been infiltrated by organized groups of Chinese hackers. It’s all alarmist nonsense!

Continue reading

SAP Security and Hosting: Hacking 40 SAP Systems in One Fell Swoop

SAP Security and HostingIn spite of the hype surrounding the cloud, the on-premise model in which customers run their own SAP software is still the norm. However, that doesn’t rule out a service provider handling part of the operations; indeed, hosting is a widely used model, particularly among SMEs. While the roles at hand are usually clearly assigned in a hosting model like this, the same unfortunately doesn’t always apply to SAP system security.

Continue reading

10KBlaze and SAP Security II: Hype & Scaremongering

10KBlaze & SAP Security: Serpenteq(Partner blog post of SERPENTEQ GmbH)
On April 19, 2019, at the OPCDE Cyber Security conference in Dubai, security researchers Dmitry Chastuhin and Mathieu Geli gave a presentation called “SAP gateway to Heaven”. They re-visited two configuration issues (related to SAP Gateway and SAP Message Server) that have been known for many years and for which detailed security guidelines have been available for years. Now the researchers applied some admirably creative thinking to combine them.

Continue reading