Sitnl 2012 erp security


Published on

Security? For sure I'll break SAP. Oh and I will also tell how to fix it again...
Joris van de Vis

Published in: Business
1 Like
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Sitnl 2012 erp security

  1. 1. sitNL 2012Ciber, Eindhoven, December 8, 2012
  2. 2. Agendao Introductiono SAP Security in the newso So how about SAP and Security, Some myths...o SAP Security, the problem...o Why bother?o Show me the money!!!o How to be safe instead of sorryo Bizec© 2012 ERP Security 2
  3. 3. IntroductionWho am I SAP Technology specialist for profit and fun SAP Security researcher for fun (not for profit) Reported over 30 vulnerabilities to SAP Security team Co-founder ERP Security© 2012 ERP Security 3
  4. 4. We’ve all seen these...© 2012 ERP Security 4
  5. 5. But this is rather new...© 2012 ERP Security 5
  6. 6. So how about SAP and Security Some myths....Technical Risks in SAP are basically the same as for other IT systemsExcept the value of the data stored in SAP is often much higher. Yet SAP Security is still mainlyrelated to Segregation of Duties.Why? Some myths• SAP platforms are only accessible internally• SAP is expensive, so it must be secure• SAP Security = Segregation of Duties• SAP systems are not targeted by hackers• SAP Security is SAP’s problem• We are compliant, so we are secure © 2012 ERP Security 6
  7. 7. SAP Security The problem...The Problem Number of released SAP Security Notes 1 2• Lack of awareness with customers 1000• Lack of Time with customers 800• High Complexity 600 400• Lack of Budget 200• Lack of good Figures 0 2001 2002 2003 2004 2005 2006• Too much focus on SoD 2007 2008 2009 2010 2011 2012• Build on code-base back from the 80’s / 90’s. Note1: value for 2012 is linearly extrapolated from 01.10.2012• Often more than 6-12 months behind with patches Note2: December 2010 is excluded due to a one-time release of 500+ notes• By default many Security features are switched OFF• ... © 2012 ERP Security 7
  8. 8. Why bother? The Obvious...Why bother about SAP Security? •To prevent losing business!!! •To prevent bad PR •To prevent losing customer confidence •To prevent Legal prosecution •To be in control •To prevent costs of incident handlingWhy bother about SAP Platform Security? •Because SoD can be easily bypassed •Often leaving no traces on SAP level © 2012 ERP Security 8
  9. 9. Show me the money!!!Some more examples of what might happen when you don’t secure your systems enough:• Executing of OS commands• Creating admin users• ... © 2012 ERP Security 9
  10. 10. How to be safe instead of sorrySAP Infrastructure security needs to be addressed holistically:• Remember there is no silver bullet• SAP Infrastructure security is complex and involves many disciplines, so first take a step back, analyze your current state of the landscape, do risk assessments, make a plan and execute and keep on working on it.• Get all parties involved, think about responsible people from Business, Risk management, Security Officers, DB team, OS team, Network team, SAP Basis team, SoD team, etc.• Teach / train users and administrators, work on general security awareness• Control the process, stay up-to-date, evaluate periodically.• Security is a process, not a state*! Embed it in the organization. * Bruce Schneier © 2012 ERP Security 10
  11. 11. How to be safe instead of sorry IISome key takeaways:• Patch regularly (duh...). Do this for Gui components, DB, OS, SAP and network• Use e.g. the System Recommendations for SAP Security notes• Take a look at the SAP Security guides that are relevant for you• Read the security whitepapers • At least close down some high risk components like the gateway, unnecessary SICF services, etc. (See the guide)• Check RSUSR003 and get rid of DEFAULT passwords• Regularly review your landscape, don’t forget the open source tools * Bruce Schneier © 2012 ERP Security 11
  12. 12. BizecBizec.The main goals of BIZEC are: Raising awareness, demonstrating that ERP security must be analyzed holistically. Analyze current and future threats affecting these systems. Serve as a unique central point of knowledge and reference in this subject. Provide experienced feedback to global organizations, helping them to increase the security of their business-critical information. Organize events with the community to share and exchange information.Join & contribute!© 2012 ERP Security 12
  13. 13. Questions?© 2012 ERP Security 13
  14. 14. Need more info? Contact us...More information See http://www.erp-sec.comContact me on•• @jvis © 2012 ERP Security 14
  15. 15. DisclaimerSAP, R/3, ABAP, SAP GUI, SAP NetWeaver and other SAP products and services mentioned herein as wellas their respective logos are trademarks or registered trademarks of SAP AG in Germany and othercountries.All other product and service names mentioned are the trademarks of their respective companies. Datacontained in this document serves informational purposes only.The authors assume no responsibility for errors or omissions in this document. The authors do not warrantthe accuracy or completeness of the information, text, graphics, links, or other items contained within thismaterial. This document is provided without a warranty of any kind, either express or implied, including butnot limited to the implied warranties of merchantability, fitness for a particular purpose, or non-infringement.The authors shall have no liability for damages of any kind including without limitation direct, special, indirect,or consequential damages that may result from the use of this document.SAP AG is neither the author nor the publisher of this publication and is not responsible for its content, andSAP Group shall not be liable for errors or omissions with respect to the materials.No part of this document may be reproduced without the prior written permission of ERP Security BV.© 2012 ERP Security BV.© 2012 ERP Security 15