Feeds

SAP users slack, slow and backward on security

Some systems unpatched since 2005, says researcher

Top 5 reasons to deploy VMware with Tegile

Cross-site scripting, failure to check credentials, directory traversal and SQL injection make up more than three-quarters of vulnerabilities in SAP environments, according to a presentation by ERPScan's Alexander Polyakov to RSAConference Asia Pacific 2013.

And the vulnerable state of the SAP world is increasingly attracting the attention of security researchers, Polyakov said, with nearly 60 percent of vulnerabilities found in 2013 turned up by outsiders.

That's troubling, he told delegates, because ERPScan is also observing a growing willingness by SAP users to open up interfaces to the Internet, either for remote workers, inter-office connections, or remote management.

As reported by SC Magazine Australia, which attended the conference, Polyakov said “If someone gets access to the SAP they can steal HR data, financial data or corporate secrets … or get access to a SCADA system.”

A successful intrusion into the SAP system could easily mean the “end of the business”, Polyakov claimed.

With a combination of Shodan and Google searchers, he told the conference he was able to identify more than 4,000 Internet-facing SAP environments.

And – whether it's because owners are lazy or updates are difficult – Polyakov said 35 percent of the systems ERPScan found were using NetWeaver 7 EHP 0, which hasn't been updated since 2005. Another 19 percent were running software that hasn't been patched since 2009, and 23 percent ran a version last updated in 2010.

The presentation slides can be found here. ®

Beginner's guide to SSL certificates

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.