SAP Chief Security Officer, Justin Somaini, opened the first of a series of five webcasts from the America’s SAP User Group (ASUG) on the topic of SAP security. The series is intended to present SAP’s response to the growing concern over cybersecurity by discussing: The IT threat landscape and SAP’s approach to strategic security; Best-practices to safeguard both on-premise and cloud SAP landscapes; Secure configuration and patch management; Security for SAP HANA; and SAP’s secur ...

Despite the $75 billion spent by organizations on security software in 2015, average times to detection for cyber attacks are an astounding 170 days (DBIR, 2016). Most attacks therefore go undetected for almost six months. An incident response strategy can address this gap by enabling organizations to proactively discover and contain security incidents that could lead to data breaches if left unchecked.  The cornerstone of effective incident response is detection. This involves collecting and ...

Note 2319506 addresses a blind SQL injection vulnerability in Database Monitors for Oracle. The vulnerability impacts all versions of SAP Basis and rates extremely high on the impact scale using the common vulnerability scoring system. Content-based and time-based blind SQL injection is used by attackers to determine when input is interpreted as a SQL statement. The results are used to fingerprint databases, build database schemas and escalate attacks. The blind SQL injection vulnerability in t ...