Download - Layer Seven Security

SAP VULNERABILITY
ASSESSMENT

SECURE THE HEART OF YOUR BUSINESS
SAP drives your business. It stores and processes the most critical information in your company. This is well known by
attackers. SAP has become one of the most lucrative targets for cyber criminals. More than 95% of SAP systems
assessed by security professionals are vulnerable to attacks that could lead to fraud, espionage or sabotage resulting
in severe nancial losses or reputational harm. Most of these systems are considered SOX or PCI compliant.
SEGREGATION OF DUTIES IS NOT ENOUGH
Layer Seven Security perform a complete assessment of the technical components of
your SAP environment to identify vulnerabilities that could be exploited by attackers.
The company uses state-of-the-art soſtware that automatically scans for over 400
security weaknesses in SAP. The soſtware is certied by SAP for integration with
Netweaver and has been successfully used by many Fortune 500 companies and
organizations such as the U.S Army.
HOW DOES VULNERABILITY ASSESSMENT WORK
The service leverages a proprietary, professional-grade tool to automatically detect SAP components in your
landscape. Once detected, the tool performs a non-obtrusive vulnerability scan of the components. The soſtware is
certied by SAP for integration with Netweaver and eliminates the risk of service disruption by staggering the
execution of queries against system components.
IDENTIFY
ASSESS ILLUSTRATE COMPLY
Automatically discovers
SAP components in your
network and begins
building the foundations
for a comprehensive
security analysis.
Performs a fast, safe
and non-obtrusive
assessment of the
identied
components.
Generates detailed
reports that document
the business impact and
compliance breaches of
vulnerabilities using
non-technical terms.
Provides step-by-step
details on how to
eectively close
vulnerabilities.
1

WHY DO WE NEED TO PERFORM A VULNERABILITY ASSESSMENT
Many of the default security settings in SAP systems are insecure and highly
vulnerable to internal and external attack. These vulnerabilities are widely known
and could leave your organization open to fraud, espionage and sabotage. Firewalls,
anti-virus applications and intrusion prevention systems do not adequately
safeguard SAP systems against contemporary threats.
Auditors and Compliance professionals are increasingly focusing upon technical
risks in SAP when reviewing information security controls against SOX, PCI and
other standards. There is a growing awareness that the existence of such risks may
undermine the ability of companies to protect information from unauthorized
changes and disclosure.
Layer Seven Security will review the technical settings in your SAP environment and pinpoint weaknesses that need
to be patched in order to protect your information assets. It will provide a risk assessment, map compliance gaps
against SOX and PCI requirements and provide detailed, easy-to-follow instructions for remediation.
The powerful, proactive assessment delivered by Layer Seven Security will assist your organization to secure critical
SAP infrastructure against unintended service disruptions, productivity losses and data breaches.
“
“
99% of intrusions result from
exploitation of known vulnerabilities
or configuration errors
“
- CERT CC, Soſtware Engineering Institute,
Carnegie Mellon University
Enterprises that implement a
vulnerability management process
experience 90% fewer successful
attacks.
“
- Gartner Research
VULNERABILITY DETECTION
Many of the 400 vulnerabilities examined by Layer
Seven Security are deemed high risk by SAP and
independent assessors. They include:
• Insecure default congurations
• Dangerous active services
• Unauthorized remote command executions
• Information disclosure
• Use of unencrypted interfaces
• Improperly applied security lters
• Broad administrative user privileges
• Weak access credentials
• Missing SAP Security Notes and patches
2

CHECKS PERFORMED BY
AGAINST SAP SECURITY RECOMMENDATIONS IN THE WHITE PAPER SECURE
CONFIGURATION OF SAP NETWEAVER APPLICATION SERVER USING ABAP
PART 1
HTTPS & SNC
NETWORK FILTERING
• Review of SNC encryption for RFC and
SAP GUI communications
• Check for HTTPS and review of TLS
security conguration
• Detection of unnecessary SAP services
which can widen the attack surface.
• Review of the SAProuter conguration
including Route Permission Tables.
• Review of security protocols for ABAP
systems communication traffic
• Access to tables storing cryptographic
keys
SAP GUI
Review of the SAP GUI security conguration
REMOTE FUNCTION CALLS
• Analysis of trust relationships and
detection of insecure interfaces
• Review of RFC connections with stored
logon credentials and between systems
with diering security classications
WEB SERVICES
• Detection of dangerous active ICF services
• Review of ICF services for stored logon
data and missing authority ckecks
3

CHECKS PERFORMED BY
AGAINST SAP SECURITY RECOMMENDATIONS IN THE WHITE PAPER SECURE
CONFIGURATION OF SAP NETWEAVER APPLICATION SERVER USING ABAP
PART 2
GATEWAY & MESSAGE SERVER
MONITORING
• Evaluation of reginfo and secinfo les for
insecure rules
• Review of Gateway and Message Server
security conguration
Evaluation of the security conguration of the
entire SAP platform, detecting risks that may
result in attacks to business-critical
infrastructure
• Check for the disabling of remote
conguration and enabling of logging
• Review of Message Server ports, ACL
les and other settings
PATCH MANAGEMENT
• Check for implemented SAP security Notes
PASSWORD MANAGEMENT
• Review of the eectiveness of the patch
management process
• Review of password parameters against
SAP hardening guidelines
• Access to tables storing password
hashes
• Analysis of hashing mechanisms and
downwards compatibility
• Review of default passwords for
standard users
OTHER
• Checks for hundreds of other SAP
vulnerabilities not covered in the SAP
white paper
4

Secure your SAP systems against
real-world threats and attacks
FAST FACTS
• Dramatically reduces security risks in your SAP
environment
• Leverages reliable and powerful SAP-certied
soſtware based upon the world's largest
knowledge base of SAP vulnerabilities
• Supported by a world-renowned research lab that
continuously investigates SAP vulnerabilities and
updates the underlying soſtware with new modules
• Lowers audit, compliance and security costs
• Provides immediate results leading to improved
response times
• Comprehensive reporting that clearly demonstrates
the business impact of technical risks
• Integrated compliance management including gap
analysis for SOX, PCI and SAP security
recommendations
• Detailed recommendations to close security gaps
• Avoids the need to invest in soſtware, training,
support and maintenance
• Best in class service and support
• Unparalleled SAP Expertise
THE VULNERABILITY ASSESSMENT SOFTWARE USED BY LAYER SEVEN
SECURITY IS CERTIFIED BY SAP FOR INTEGRATION WITH NETWEAVER
5

LAYER SEVEN SECURITY
Layer Seven Security specialize in SAP security. The company serves customers
across the globe to protect SAP systems against internal and external threats and
comply with industry and statutory reporting requirements. It fuses technical
expertise with business acumen to deliver unparalleled implementation, consulting & audit services targeted at
managing risks in contemporary SAP systems.
Layer Seven Security employs a distinctive approach to SAP risk management that examines and manages
vulnerabilities at the platform, application, program and client level. Through partnerships with leading soſtware
developers, the company is able to develop SAP systems with Defense in Depth and perform integrated security
assessments that improve the quality and lower the cost of SAP audits. Layer Seven Security leverage leading
SAP-certied solutions to provide comprehensive and rapid results covering risks in every component of SAP
landscapes.
The company is privately owned and headquartered in Toronto, Canada.
www.layersevensecurity.com
CONTACT US
Westbury Corporate Centre,
75 Upper Middle Road East, Suite 101
Oakville, Ontario, L6H 0C, Canada
Tel. (Toll Free): 1 888 995 099
Tel. (Office): 905 491 6950
Fax.: 905 491 6801
E-mail: info@layersevensecurity.com