Predict SAP Attacks – Assess SAP systems

Why do you need an automated SAP Scanning solution?

Timely prediction of cyberattacks is the key to Security. The reliability of protection mechanisms and the speed of responding to security incidents make a world of difference when it comes to protecting your system. The best way to secure your precious business-critical data is to continuously analyze existing vulnerabilities that can be used to break in.

Analysts from Gartner, IDC, KuppingerCole, Qoucirca, and other firms agree on the significance of ERP security as well as on the lack of this functionality (e.g., security scanners, SIEM, and breach detection mechanisms) in traditional solutions.

In-depth assessments of databases and applications, such as ERP systems (for example, SAP or Oracle), specially, are not widely supported in traditional VA solutions, which focus on devices. Gartner’s Market Guide for Vulnerability Assessment 2014.

The EAS-SEC SAP Cybersecurity framework distinguishes the following areas that have vital importance for predicting cyberattacks:

  • Asset Management
  • Vulnerability Management
  • Risk Management
  • Secure Development
  • Governance and Business Environment

Combining most of the listed areas, SAP Security Assessment plays the major part in predicting SAP attacks. Since these are complex systems to operate, and there is an array of different installation types, the need for security experts specialized in different areas is urgent. Even an application server may be based on either ABAP, J2EE, HANA or other platforms, not to mention that there are more than 50 particular applications and modules, which turns the manual process into a real challenge. Such an in-depth assessment of an SAP landscape is a laborious and time-consuming process as there may be 10,000+ vulnerabilities and misconfigurations of user access control in a single system.

What will you get from Prediction Module?

Prediction Module of ERPScan Smart Cybersecurity Platform for SAP can help to inventory your SAP landscape, determine the probability of security drawbacks, and continuously monitor all the arising issues within SAP and security-relevant changes.

SAP security is a combination of 3 areas: Platform Security, Сustomization Protection, and Segregation of Duties. Each area requires unique expertise. Our solution covers all these areas and performs 10,000+ security checks.

Platform Security module is divided into the following categories:

  • Asset management
  • Blackbox vulnerability analysis
  • Misconfigurations
  • Insecure connections
  • Weak passwords

Customization Protection detects 100+ different code issues:

  • Code injections
  • Missing authorizations
  • Backdoors
  • Obsolete statements
  • Data leakage

Segregation of Duties detects the following security issues:

  • Critical privileges
  • SoD conflicts
  • Multi-dimension SoD conflicts
  • SoD conflicts with custom SoD rules
  • SoD conflicts with SOX compliance

How can we help you with SAP Security Assessment?

Prediction Module of ERPScan Smart Cybersecurity Platform for SAP makes security assessment effortless. General checks are automated thereby enabling uninterrupted focus on the analysis of specific applications to meet precise needs and increasing overall productivity and work efficiency.

To simplify the Security Assessment process, we have equipped our solution with:

  • Assets Manager tool – to configure all the SAP Assets in one place and use them for the security of the assets you want to scan.
  • Policies Manager tool – to configure what checks you want to run and what the risks are.
  • Projects Manager tool – to schedule your scans periodically.
  • Reports Manager tool – to view your results in multiple ways, from a list of issues to different types of dashboards, relevant for a particular role.

Our unique set of exploits is targeted at particular SAP systems and can be used to gain unlimited access to business data.

Consulting companies will get an opportunity to save time by using automatic checks in a customer’s SAP landscape to comply with various regulations, such as SOX, PCI, NERC CIP standards, ISACA, DSAG, EAS-SEC auditing guides and industry-specific checklists.

Comprehensive reporting functionality, recommendations, and automatic corrections improve the quality and overall work performance significantly, thus providing a client with a competitive edge.

Who will benefit from Prediction Module?

This part of our ERPScan Smart Cybersecurity Platform for SAP is mostly relevant for Internal Security Team, Internal Auditors Penetration testers and Consultants as well as SAP BASIS Team.

Benefits

  • Makes you compliant with standards such as SOX, DSAG, GLBA, ISO, PCI-DSS, NERC CIP, as well as SAP security guidelines and other SAP-specific recommendations;
  • Educates using our extensive knowledge base adjusted by information security professionals and SAP experts. It helps to easily understand the revealed security issues and describes remediation steps;
  • Automates routine by identifying 10,000+ misconfigurations and vulnerabilities across all types of SAP platforms (ABAP, JAVA, HANA, BOBJ, Mobile) and industry solutions;
  • Exploits vulnerabilities, identifies weak passwords, executes multi-stage attacks and post-exploits.