Many SAP customers have a false sense of security, according to a new report from risk management consultancy Turnkey Consulting and business-critical application security firm Onapsis.
The SAP Security Survey Report 2021 is based on information from over 100 SAP customers in the United States, Europe and Asia.
Six percent of respondents admitted suffering a data breach related to SAP systems in the past couple of years, but nearly a quarter said they were not sure, which indicates that they may not have the ability to detect such a breach.
More than 40% of respondents are most concerned about internal fraud or misuse, 26% about data loss or data breaches, and only 14% about external attacks.
Roughly 45% of respondents believe — at least to some degree — that SAP is secured against cyber threats due to it sitting on the organization’s network.
Turnkey’s application and cyber security practice director, Tom Venables, noted that malicious actors have increasingly realized that SAP systems often contain valuable information. In addition, a study conducted recently by SAP and Onapsis showed that threat actors often start targeting vulnerabilities in SAP applications within days after a patch is made available.
On the other hand, only 28% of respondents could confirm that they have a vulnerability management program for SAP systems, and only half of those who took part in the survey are confident that their SAP systems are always patched.
“The overarching finding of this survey is that many SAP customers are operating under a false sense of security,” the report says. “Despite the fact that a small majority agree that SAP isn’t fully protected within the internal network, the threat from outside is not being taken quite as seriously as it should be.”
When asked if they review custom SAP code for security and quality issues, roughly half of respondents said they do, but many rely on manual reviews, which, according to Venables, is time consuming and prone to human error.
More than half of respondents also don’t — or they aren’t sure if they do — review third-party code before importing it into SAP systems. And only 53% are confident their organization can detect problematic or insecure custom code before it reaches production systems.
Code reviews are important considering that the custom code used by SAP customers, according to the authors of the report, has, on average, roughly 2,500 vulnerabilities.
Nearly 37% of respondents confirmed experiencing SAP downtime due to coding issues.
The full SAP Security Survey Report 2021 is available in PDF format on Turney’s website.
Related: ‘RECON’ Vulnerability Exposes Thousands of SAP Systems to Attacks
Related: Another Critical Vulnerability Patched in SAP Commerce
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
Latest News
- Tesla Hacked Twice at Pwn2Own Exploit Contest
- CISA Ships ‘Untitled Goose Tool’ to Hunt for Microsoft Azure Cloud Infections
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
- Watch on Demand: Supply Chain & Third-Party Risk Summit Sessions
- TikTok CEO Grilled by Skeptical Lawmakers on Safety, Content
- CISA, NSA Issue Guidance for IAM Administrators
