Automation Releases Us From Our False Sense Of SAP Security
By John Appleby, CEO, Avantra
When it comes to the protection of our most vital devices and systems, we could be forgiven for being lulled into a false sense of security. After all, the Apples and Microsofts of this world come to us, not even when there’s a problem, but just to check-in. To update us. To add that layer of reassurance even when our minds are elsewhere.
In the corporate world, that notion is elevated by a more urgent need, of course. Most enterprise devices are well protected on a day-to-day basis and we again let our thoughts roam across other areas of operations in the knowledge that either the device manufacturer or our IT departments have everything in hand.
This is not always the case when it comes to SAP, however.
As much as 96% of the world’s GDP goes through SAP. Governments, universities, core manufacturing, utilities, consumer goods, oil & gas, transport… the list is endless. If Microsoft were attacked, Linux and Xenix would still run. If SAP environments were taken down globally, that same globe would genuinely come to a grinding halt. Not just business, but the very fabric of society.
This isn’t a SITREP designed to shock. More calmly it’s an exclamation of surprise that there haven’t been more large-scale, public SAP hacks to date, considering the lure of dramatic repercussions for cyber-criminals. It’s also therefore a reminder that what we take for granted in terms of our infrastructure security, still has room for heightened vigilance, improvement, and – critically - automation.
A Hidden – But Susceptible – Gem
As recently as July, a vulnerability named RECON exposed the vulnerability of more than 40,000 SAP systems as evidence of the risk that does lurk. SAP quickly responded with a patch but RECON’s 10 out of 10 common vulnerability scoring system (CVSS) score demonstrated the threat that was posed to people’s personal data and applications.
This is rare, however. Reasons why there hasn’t been a high-profile SAP incident until now are threefold, at a glance. Unlike firewalls, routers, and web servers, SAP systems are not edge systems – in most cases, they are core systems.
Further, because they are difficult to patch and not on the edge, businesses tend to install a layer in front of their SAP system. This serves as both protection and a distraction, as hackers are faced with potentially lower hanging fruit earlier in the process. And finally, SAP’s status as something of a specialized enigma gives it ‘security through obscurity’.
It’s essentially being guarded undercover as a hidden, unattainable gem, when it is still susceptible, as proven by RECON.
It is susceptible because of the way organizations address its protection. For most, a strategy is in place where they run an on-premises private cloud, hyper-scaler, version of R3 Business Suite, or S/4 HANA, and are expected to take care of that internally. They subsequently turn to outsourced service providers who scan systems, identify issues, and provide a list of actions to be conducted – again – internally.
This is consultancy, not protection. What if you find a zero-day vulnerability? You pass that on to SAP and wait until those issues are patched knowing you’re compromised for that duration. All 100, 200, 300 of your systems could be jeopardized in an area that’s crucial to you, your operations, your supply chain, and your revenues. And you’re not in control of fixing the situation.
Replicating The Patch Tuesday Model
There is an absolute necessity to change the SAP security mindset from periodic scanning and reaction to embedded real-time automation of detection and response.
At present, the world’s most colossal industry heavyweight, Apple, places so much emphasis on SAP protection that it conducts updates in China. No internet equals no chance of hacking.
Naturally, most enterprises simply don’t have those kinds of resources. SAP protection for most, therefore, becomes too expensive to do consistently and manually. But also, too important not to do given the threat and ramifications at hand.
The answer in-between those two polarising challenges is automation.
By forming a partnership with an AIOps provider, companies are afforded the ability to carry out vital functions that they’re currently not feasibly able to do. The theory is one of regular, tactical updates and patching, which simply can’t be done manually.
Microsoft already has a similar function on ‘Patch Tuesdays’, compounded by assessments and actions around larger systems every third Tuesday of the month.
For SAP the same ethos can be applied to the automation of SAP Kernel updates, applying scheduled and ongoing maintenance and monitoring of thousands of systems, to ensure continuous security and insight.
A Real Sense Of Security
Putting this capability into hours and dollars, just imagine if the manual protection of 1,000 systems took one hour per system. 1,000 hours of work will have just been automated, saving time, money, and considerable investment into high-level skills in what is a complex environment.
Meanwhile, your AIOps partner will be continuously detecting prospective problems that could impact your systems, seeking approval of intervention from owners of those systems, and then installing patches automatically.
Coming back full circle, you can once again allow your mind to roam towards day-to-day operations and business strategy; only this time, you’ll be doing so with your SAP systems secure. A real sense of security.
Moving forward, this level of support will evolve to become end-to-end across all SAP pieces of the jigsaw. As cyber-criminals improve and data security becomes even more of a differentiator, the ROI and peace of mind will become more pronounced the sooner you invest in that automated, guarded future.
About The Author
John Appleby is CEO of Avantra.