{"id":9041,"date":"2020-03-23T22:18:00","date_gmt":"2020-03-23T21:18:00","guid":{"rendered":"https:\/\/139-162-136-174.ip.linodeusercontent.com\/?page_id=9041"},"modified":"2022-11-15T10:47:54","modified_gmt":"2022-11-15T09:47:54","slug":"sap-cybersecurity-self-assessment-tool-level-2-results","status":"publish","type":"page","link":"https:\/\/www.bowbridge.net\/en\/sap-cybersecurity-self-assessment-tool-level-2-results\/","title":{"rendered":"Level 2: Knowledge is Power \u2013 Target Reconnaissance"},"content":{"rendered":"

[vc_row css_animation=”qodef-element-from-fade”][vc_column][vc_column_text]<\/p>\n

1. In your opinion, what is the #1 tool to identify SAP systems exposed to the internet?<\/h3>\n

Best Answer: b. Google<\/h4>\n

For finding SAP systems connected to the internet, Google Advanced Search is a very powerful tool.<\/h4>\n

Many SAP systems are exposing the full application URL to the internet, so instructing google to search for splash pages or login pages with certain patterns in the URL will reveal \u2013 literally \u2013 tens of thousands of SAP systems with zero effort. Advanced searches and combinations of search terms help attackers narrow-down their target list.<\/p>\n

Examples:<\/p>\n

\"Advanced

50K results for SAP Application Servers<\/p><\/div>\n

 <\/p>\n

 <\/p>\n

\"\"

15K for SAP NetWeaver Portal Servers<\/p><\/div>\n

 <\/p>\n

Recommendation:<\/strong> Customers should implement URL rewriting to hide any reference to SAP applications in the external-facing URLs and in links within the HTML of web-facing SAP applications.<\/p>\n

Advanced Web Application Firewalls \u2013 or even better – bowbridge Secure Web Dispatcher for SAP applications (targeted for release in Q3\/2020) can perform those translations.[\/vc_column_text]

\r\n\t
<\/div>\r\n<\/div>\r\n[\/vc_column][\/vc_row][vc_row css_animation=”qodef-element-from-fade”][vc_column][vc_column_text]<\/p>\n

2. In April 2019, hackers released several exploits (collectively referred to as 10KBLAZE by Onapsis) targeting SAP business applications by uploading these exploits to a public forum. These vulnerabilities primarily target:<\/h3>\n

Best Answer: b. Insecure default configurations of on-premise SAP Gateway and SAP Message Server<\/h4>\n

Insecure default configurations of on-premise SAP Gateway and SAP Message Server.<\/h4>\n

These SAP exploits released in April 2019 primarily target insecure default configurations of on-premise SAP Gateway and SAP Message Server, two components that many SAP business applications use, and that are common in many environments.<\/p>\n

And yet, these configuration issues exist even in new SAP implementations in the cloud. Why? Because companies are not migrating SAP to the cloud with security in mind. For most organizations, basic SAP security is a huge challenge, and many don\u2019t even understand what they face in the realm of cloud security.[\/vc_column_text]

\r\n\t
<\/div>\r\n<\/div>\r\n[\/vc_column][\/vc_row][vc_row css_animation=”qodef-element-from-fade”][vc_column][vc_column_text]<\/p>\n

3. What percentage of SAP implementations allow users to upload Microsoft Office documents containing potentially malicious macros?<\/h3>\n

Best Answer: d. 87%<\/h4>\n

87% of SAP implementations allow users to upload Microsoft Office documents containing potentially malicious macros.<\/h4>\n

In bowbridge’s research and testing<\/a>, we\u00a0discovered\u00a0that\u00a087% of the implementations we tested allowed uploading of Office documents with macros\u00a0in the old format (CDF, pre-Office 2007) and 33% allowed uploading of documents with macros in the new format (OOXML).<\/p>\n

In 99% of cases, simply blocking all macros in uploads into SAP applications is the most efficient prevention. The time saved by using macros for task automation is simply not worth the massive risk macros present to your cybersecurity, not just as pertains to SAP, but for your entire system. In addition to blocking macros, having an\u00a0anti-virus solution<\/a>\u00a0specifically designed for SAP\u2019s unique structure provides added protection.[\/vc_column_text][vc_empty_space height=”50px”][vc_column_text css=”.vc_custom_1585228983304{padding-top: 20px !important;padding-right: 20px !important;padding-bottom: 20px !important;padding-left: 20px !important;background-color: #f4f4f4 !important;}”]<\/p>\n

So, how did you do? If you got all the answers right, well done! This next level, however, will really test your mettle \u2013 and your readiness for an intrusion on your SAP system. All set? Let\u2019s go!<\/h5>\n

[\/vc_column_text][vc_empty_space height=”20px”][\/vc_column][\/vc_row][vc_row content_aligment=”right”][vc_column width=”1\/4″][\/vc_column][vc_column width=”1\/2″][\/vc_column][vc_column width=”1\/4″]\n Level Up!<\/span>\n <\/i><\/span>\n<\/a>[\/vc_column][\/vc_row][vc_row][vc_column][vc_empty_space height=”60px”][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"

[vc_row css_animation=”qodef-element-from-fade”][vc_column][vc_column_text] 1. In your opinion, what is the #1 tool to identify SAP systems exposed to the internet? Best Answer:…<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"content-type":"","footnotes":""},"class_list":["post-9041","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.bowbridge.net\/en\/wp-json\/wp\/v2\/pages\/9041","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.bowbridge.net\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.bowbridge.net\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.bowbridge.net\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bowbridge.net\/en\/wp-json\/wp\/v2\/comments?post=9041"}],"version-history":[{"count":16,"href":"https:\/\/www.bowbridge.net\/en\/wp-json\/wp\/v2\/pages\/9041\/revisions"}],"predecessor-version":[{"id":9784,"href":"https:\/\/www.bowbridge.net\/en\/wp-json\/wp\/v2\/pages\/9041\/revisions\/9784"}],"wp:attachment":[{"href":"https:\/\/www.bowbridge.net\/en\/wp-json\/wp\/v2\/media?parent=9041"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}