Protect SAP Supply Chains by Preventing Cyber Attacks – Source: www.cyberdefensemagazine.com

Christoph Nagy

SecurityBridge

December 17, 2024

Highly advanced and extremely dangerous cyberattacks are targeting SAP (from the company originally called “System Analysis Program” Development) software supply chains with an alarming increase in frequency. By taking advantage of vulnerabilities within SAP’s infrastructure, particularly during the software implementation phase, these attacks jeopardize critical operations of enterprises worldwide. This article will examine the nature, impacts, and measures SAP administrators and IT security personnel can take to prevent these attacks.

Where Do the Vulnerabilities Lay?

No system, including SAP systems, is immune from supply chain attacks. The defense needs to focus on third-party vendors and the deployment process. The weak spots are SAP transport requests, which implement code changes.

A little-known feature in SAP programs is that transport requests allow for changes, and malicious actors find this allowance their point of attack. Transport requests are vehicles for source code deployment and are vulnerable to attack because they allow for modifications. With proper authorization, third-party coders and rogue employees can affix payloads to transport requests that get around the defensive barriers and activate malicious scripts when imported into the production system.

Attack Vectors

Malicious code can be hidden in legitimate SAP code. Attackers can inject their codes via third-party software packages. Digital signatures will not secure the packages because third-party vendors are not allowed to sign them. Ironically, the signature process leaves a window of vulnerability in the verification process. This weakness is where hackers can use relied-upon software packages to deliver damaging payloads.

Another vector of attack can occur with the change management process. This process can be altered to reverse the release status of a transport request from “Released” to “Modifiable,” thus allowing the injection of malicious objects that execute upon deployment. If the attackers understand an organization’s internal processes and protocols, this manipulation can be tricky to detect and mitigate.

In addition, threats to SAP systems can come from inside and outside; employees with proper access can also be the bad guys. Those with official clearance can change transport requests after export. This authorized ability to modify requests requires rigid security protocols to protect the deployment process.

Steps For Protection

A varied and sophisticated approach is needed to secure SAP supply chains. Routine patch management can handle known vulnerabilities. SAP announces its updates on the second Tuesday of every month, and organizations must pay attention to this date. For example, SAP’s security advisory SNOTE 3097887, which fixes the vulnerability CVE-2021-38178, is critical for guarding file systems and preventing manipulation.

• Real-time monitoring is another significant detection mode for abnormalities in the SAP landscape. Any deviations from baseline configurations can be set to trigger automated alerts in real-time for swift defensive reaction. Implementing extensive patching and vulnerability management strategies to bolster infrastructure and applications is also crucial. To complement that, routine security audits and implementing advanced threat detection systems can significantly assist security.
• Code security must be assured during the implementation and deployment phases. Automated code scanners and manual review processes can be significant measures for detecting and mitigating vulnerabilities before they enter production environments. Intensified change management controls that include extra checks and verifications can prevent unauthorized changes and ensure that only vetted changes are deployed.
• Protect the SAP supply chain by checking vendor security practices. Be sure to require the same level of security from third-party vendors as your organization and verify the integrity of third-party software packages before deployment.
• Build a security foundation for DevSecOps from initial coding to final deployment. This foundation will ensure security is embedded in every development lifecycle stage. By taking this tact, organizations can identify and mitigate risks early in the development process, thus lessening the chances of unleashing vulnerabilities into the production environment.
• Implement routine audits and reviews of transport logs to detect tampering before production imports. This proactive step will help address potential threats before they hit the system. Regular security training will educate employees about current threats and introduce them to best practices for securing SAP systems.

Conclusion

The SAP software supply chain is a prime target for cyberattacks due to its critical role in global enterprise operations. Organizations can protect themselves from supply chain attacks if the vulnerabilities are understood and robust security measures are taken. Regular patch management, real-time monitoring, hardened infrastructure, secure code implementation, enhanced change management, vendor security practices, and DevSecOps are all excellent steps for safeguarding SAP environments. Remaining vigilant and instilling a proactive posture will go a long way toward ensuring the integrity and security of SAP systems, thus allowing reliability and efficiency of operation.

About the Author

Christoph Nagy is a founding member and CEO at SecurityBridge–a global SAP security provider, serving many of the world’s leading brands and now operating in the U.S. Christoph has 20 years of working experience within the SAP industry. Through his efforts, the SecurityBridge Platform for SAP has become renowned as a strategic security solution for automated analysis of SAP security settings, and detection of cyber-attacks in real-time. Before SecurityBridge, Christph applied his skills as a SAP technology consultant at Adidas and Audi. He can be reached online at [email protected] and at https://securitybridge.com/