Software supply chain attacks are advanced cyberattacks that target information systems through third party software. Threat actors compromise systems and data by exploiting software builds or interfaces for trusted software. This enables attackers to introduce malware without detection including backdoors.
The recent software supply chain attack experienced by SolarWinds is widely regarded as one of the most devastating cyber attacks in history. It impacted as many as 425 of the US Fortune 500, the top ten US telecommunications companies, the top five US accounting firms, all branches of the US Military, the Pentagon, the State Department, the world’s largest cybersecurity firm, as well as thousands of organizations worldwide. The attack cost affected companies an average of $12M.
Download the whitepaper from Layer Seven Security for guidance on securing software supply chains in SAP landscapes. The whitepaper outlines the threat vectors that could be exploited by attackers to compromise third party software that support SAP applications. It provides practical steps for minimizing third party software and external connections in SAP landscapes, avoiding the use of open source components, and monitoring third party software. The steps are aligned to the Cyber Supply Chain Risk Management (C-SCRM) practices recommended by the National Institute of Standards and Technology (NIST).
Ransomware is headline news, and recent attacks have demonstrated the devastating impact of attacks that target critical infrastructure. According to the Department of Homeland Security ransomware attacks have increased by 300% over the past year, impacting all industries and sectors. The average downtime from an attack is 21 days, but full recovery takes an average of 287 days.
Ransomware can impact SAP systems through vulnerable operating systems. However, securing host systems alone does not safeguard SAP systems from ransomware. Attackers can exploit trust relationships between SAP applications and underlying operating systems to execute privileged OS commands that avoid detection. This can include commands that enable threat actors to transfer, install, and execute ransomware tools.
This webinar will discuss steps you can take to secure your business-critical SAP systems from ransomware. It will provide an integrated strategy for:
• Identifying and prioritizing critical SAP assets and infrastructure;
• Hardening SAP systems to reduce the attack surface;
• Activating and monitoring SAP logs to detect suspected attacks; and
• Backing up and restoring SAP systems to minimize the downtime from successful attacks.
The webinar will also discuss how to use SAP Solution Manager to support your anti-ransomware program, from identifying and removing vulnerabilities that could be exploited to attack your systems to detecting and alerting for suspected security breaches.
Earlier this month, SAP issued a joint report with a security research firm to highlight active cyber threats targeting SAP applications. According to the report, there is conclusive evidence that attackers are actively targeting and exploiting unsecured SAP applications. The report also reveals that some SAP vulnerabilities are being weaponized in less than 72 hours from the release of SAP patches. Unprotected cloud installations of SAP are being discovered and compromised in less than 3 hours.
The investigation performed for the report identified over 300 successful exploitations of SAP systems. This included attempts to modify users and configurations and exfiltrate business information. Most of the exploits targeted the six CVEs below. Although the vulnerabilities have been patched by SAP, many organizations have not applied the recommended mitigations to protect SAP systems.
SAP recommends customers to immediately assess vulnerable systems to identify indicators of compromise such as unauthorized privileged users. The assessment should include systems within SAP landscapes that are connected to the vulnerable targets. The related SAP security notes and recommendations should also be applied in impacted systems.
SAP also urges customers to implement appropriate cybersecurity measures to protect SAP applications. The Cybersecurity Extension for SAP is an SAP-certified solution that performs automated vulnerability management, threat detection and incident response to secure SAP systems from cyber threats. This includes exploits that target the CVEs highlighted in the report. The Extension detects misconfigured and unpatched systems. It also detects the signatures of exploits that target the CVEs, triggers alerts and notifications for suspected breaches, and provides guided procedures for investigating incidents. To learn more, contact Layer Seven Security.
SUSE Linux Enterprise Server (SLES) is the leading operating system for SAP HANA and SAP S/4HANA solutions, supporting 85 percent of HANA deployments worldwide. SLES for SAP Applications is optimized to support high availability and persistent memory and endorsed by SAP.
Securing operating systems is a critical component of SAP system hardening. Vulnerable hosts can provide a pathway to SAP applications, databases and other components, bypassing security mechanisms applied in those layers. This can lead to the compromise of SAP systems including the corruption of critical files and tables. It can also support ransomware attacks that disrupt the availability of SAP services.
The Cybersecurity Extension for SAP performs daily automated scans to identify vulnerabilities in SAP hosts. For SLES, this includes authentication settings, firewall configurations, file and service permissions, root access, missing security patches, vulnerable packages and services, and misconfigured settings for logging and auditing. It also includes the detection of open TCP/ UDP ports that are targeted by attackers, including FTP, RPC, RDP, SSH, and Telnet.
SLES vulnerabilities are mapped to SAP systems, supporting holistic security across code, application, database and operating system layers.
The SAP-Certified extension also monitors SLES logs to identify indicators of compromise in SAP hosts. Alerts and notifications are triggered for security incidents and channeled to SIEM and service desk systems. This includes the following scenarios:
Changes to operating system configuration, profile, and kernel parameters
Firewall and other network settings
File system mounts and unmounts
Group, user and password changes
Cron jobs
Daemon and service changes
OS scripts
External connections
Sudo users
Root and sudo commands
Failed logon and file access attempts
Critical file changes
File permission changes
OS code injection
User locks and unlocks
Audit records from the SLES audit log are displayed in the alert details. The records include the audit event number and auid of the initial user that triggered the event.
The Cybersecurity Extension for SAP includes integrated incident response procedures to support forensic investigations. Users can select the Respond option from an alert to start an investigation and document the findings.
Toronto, Canada – March 8, 2021 – Layer Seven Security today announced its Cybersecurity Extension v3.4 for SAP®Solutions has achieved SAP®-certified integration with the SAP NetWeaver® technology platform. The solution has been proven to integrate with SAP solutions, providing automated vulnerability management, threat detection and incident response for SAP applications and infrastructure.
“We are delighted to announce that our Cybersecurity Extension v3.4 for SAP Solutions has achieved SAP-certified integration with SAP NetWeaver,” said Ian Thomson, Chief Operating Officer at Layer Seven Security. “The certification will support the successful integration of the extension in SAP landscapes, helping customers to protect business-critical SAP systems against the threat of cyber attacks.”
The SAP® Integration and Certification Center (SAP ICC) has certified that Cybersecurity Extension v3.4 for SAP Solutions integrates with SAP NetWeaver. Technology or infrastructure products that have SAP-certified integration with SAP NetWeaver have proven to interoperate with the technology platform.
Layer Seven Security is a partner in the SAP PartnerEdge® program. As such, it is empowered to build, market and sell software applications on top of market-leading technology platforms from SAP. The SAP PartnerEdge program provides the enablement tools, benefits, and support to facilitate building high-quality, disruptive applications focused on specific business needs – quickly and cost-effectively. The program provides access to all relevant SAP technologies in one simple framework under a single, global contract.
About Layer Seven Security
Layer Seven Security is an SAP partner, headquartered in Toronto, Canada. The company’s Cybersecurity Extension for SAP® Solutions performs advanced security diagnostics and monitoring for SAP systems. The Extension delivers real-time security intelligence for cloud and on-premise SAP systems including SAP HANA®, ABAP® and J2EE platforms. It supports security monitoring across the SAP system stack including application, database, operating system, and program layers, as well as components such as the SAProuter and SAP Web Dispatcher.
###
SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE in Germany and other countries. Please see https://www.sap.com/copyright for additional trademark information and notices. All other product and service names mentioned are the trademarks of their respective companies.
Any statements in this release that are not historical facts are forward-looking statements as defined in the U.S. Private Securities Litigation Reform Act of 1995. All forward-looking statements are subject to various risks and uncertainties described in SAP’s filings with the U.S. Securities and Exchange Commission, including its most recent annual report on Form 20-F, that could cause actual results to differ materially from expectations. SAP cautions readers not to place undue reliance on these forward-looking statements which SAP has no obligation to update and which speak only as of their dates.
The SAP Web Dispatcher is an application gateway that filters Internet based traffic to SAP systems including HTTP requests. As an entry point for Web-based communications in SAP landscapes, the Web Dispatcher can help to secure remote access to SAP systems by enforcing security standards for external connections and filtering connection requests.
However, the Web Dispatcher can also be the focal point for attackers looking for an externally reachable pathway to SAP systems. Therefore, it is critical to secure the Web Dispatcher against misuse and prevent attackers from compromising SAP landscapes through poorly configured gateways.
The Web Dispatcher should be regularly patched and updated to prevent attackers from exploiting known program-level vulnerabilities. You should monitor composite note 538405 to stay up-to-date with the latest Web Dispatcher versions.
Default error messages that disclose sensitive information to attackers should be blocked and replaced with custom messages.
The admin port for the Web Dispatcher should not be accessible from external networks. Administration should be restricted to internal hosts. Public monitoring information in the Web admin interface should be blocked.
SSL should be enforced for connections including communications between the Web Dispatcher and back-end systems and metadata exchange with message servers and application servers.
Finally, filtering should be enabled to enforce positive or negative lists for access requests. The Web Dispatcher supports multiple filtering mechanisms including ACL files and authentication handlers. ACL files can be used if access should be filtered based on client IP address or IP range. Authentication handlers should be used if requests need to be filtered for specific URLs. Both approaches support logging of successful and unsuccessful requests. Access to the following URLs should be blocked or restricted:
The Cybersecurity Extension for SAP monitors the security of the Web Dispatcher using the SAP Solution Manager platform. The SAP-certified addon detects vulnerable Web Dispatcher versions and patch levels, improper error handling that could lead to information disclosure, the use of insecure Web Dispatcher settings, protocols, and filters, and calls to critical URLs captured in Web Dispatcher logs.
The software supply chain attack suffered by SolarWinds may have impacted as many as 425 of the US Fortune 500, the top ten US telecommunications companies, the top five US accounting firms, all branches of the US Military, the Pentagon, the State Department, the world’s largest cybersecurity firm, as well as hundreds of organizations worldwide.
The attack targeted the Orion Platform used for SolarWinds products including tools for automated patch management and security & compliance. According to SolarWinds, the initial breach is suspected to have occurred in September 2019. The attackers subsequently modified an Orion plug-in that was distributed as trojanized updates to SolarWinds customers from February 2020. The attack remained undetected until December 2020.
The trojanized component was detected and labeled as SUNBURST by FireEye. According to FireEye, “After an initial dormant period of up to two weeks, (SUNBURST) retrieves and executes commands, called ‘Jobs,’ that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services….The malware masquerades its network traffic as the Orion Improvement Program (OIP) protocol and stores reconnaissance results within legitimate plugin configuration files allowing it to blend in with legitimate SolarWinds activity. The backdoor uses multiple obfuscated blocklists to identify forensic and anti-virus tools running as processes, services, and drivers.”
SUNBURST was used by attackers to move laterally within networks and target other servers and components. Backdoors were often created in compromised systems to install the malware dropper known as TEARDROP. This was used to deploy a version of the Cobalt Strike BEACON payload, a commercial penetration testing and post-exploitation agent.
SUNBURST is a highly sophisticated software supply-chain attack. Such attacks are difficult to detect since they exploit trust relationships between software vendors and customers that are the basis for server-to-server communications used to deliver software updates.
The attack has significant implications for SAP cyber security by dramatically increasing the risk associated with the use of third-party security platforms. Such platforms provide a direct channel to business-critical SAP applications and infrastructure. The agents, consoles and sensors installed in SAP landscapes for third party solutions could be exploited to compromise connected SAP systems. The risk is heightened when such solutions connect directly to external servers for software updates. Transport layer encryption and digitally signed certificates for delivering updates do not protect against software supply chain attacks if the updates are trojanized at source.
Open-source software packaged in third party security solutions also provide vulnerable targets for threat attackers targeting supply chain attacks. Certain cyber security solution providers include the open-source Ubuntu operating system in images powering their consoles or sensors. Ubuntu has approximately 1200 vulnerabilities disclosed in the National Vulnerability Database. SAP customers that rely on third party software are completely dependent on external vendors to ensure open-source platforms and components such as Ubuntu are hardened and patched regularly.
Finally, while third party solutions monitor the security of SAP applications, it is not clear if these solutions include capabilities to self-monitor and detect incidents and breaches that occur within the solutions.
SAP customers can avoid the risks of software supply chain attacks by using their SAP Solution Manager installations for security monitoring. Unlike third party security solutions, Solution Manager is updated through a direct connection to SAP Support. Updates for monitoring the patch level of SAP systems are therefore sourced directly from SAP rather than external sources.
SAP Solution Manager also does not include vulnerable open-source software such as Ubuntu. Solution Manager installations operate with closed-source, enterprise-level operating systems.
Finally, SAP Solution Manager performs self-monitoring. In a dual landscape, Solution Manager installations can monitor each other. Therefore, Solution Manager can detect vulnerabilities, missing patches, user anomalies, and security incidents occurring within the platform.
Overall, SAP Solution Manager provides a more robust, secure platform for protecting SAP landscapes from cyber threats than third-party solutions that are susceptible to software supply chain attacks.
The SAP Security Baseline is a widely used benchmark for securing SAP applications. The benchmark includes SAP recommendations for system hardening, authentication and authorization, logging and auditing, and other areas. The recommendations draw on SAP security notes, guides and whitepapers. The SAP Security Baseline was updated by SAP earlier this year and provides an up-to-date framework for safeguarding SAP ABAP, HANA and Java systems against known vulnerabilities and threats. Note 2253549 includes a link to the latest version of the framework.
The Cybersecurity Extension for SAP Solution Manager performs automated gap assessments for SAP systems against the SAP Security Baseline. The extension identifies compliance gaps in SAP systems to highlight configuration, user and other issues that do not meet SAP requirements defined in the baseline. The extension eliminates the need for periodic, manual audits and supports on-demand compliance reporting.
Control gaps are automatically discovered via daily background jobs. The gaps are reported in the Compliance Report application, accessible from the Fiori launchpad for SAP Solution Manager.
The SAP Security Baseline template can be selected from the list of supported frameworks.
There are optional filters to select specific baseline requirements and systems based on environment or priority. Reports can also be filtered to include or exclude requirements based on risk rating and compliance result. Once the framework and system is selected, users can select Go to view the results.
The overall compliance level for the system is displayed the report header. The results for each requirement of the SAP Security Baseline are displayed in the main body of the report.
Users can drilldown into each requirement to review the results for specific controls. Control ratings and descriptions are included in the report to support analysis.
Reports can be exported to CSV or PDF. The Report Detail option specifies whether results are exported at the Requirement, Control or Description level.
Users can also save shortcuts for prefiltered reports to the Fiori launchpad.
Security monitoring using SAP Solution Manager is driven by a series of background jobs that automate data collection and analysis for system vulnerabilities, security notes, and event logs. Vulnerability data is extracted daily, notes information is collected weekly, and event data can be collected as frequently as every minute. Any interruption to the background jobs for these areas could impact the coverage of security monitoring.
SAP Solution Manager supports centralized monitoring for jobs in SAP systems with automated detection and alerting for job errors. Monitoring for scheduled jobs is setup using a guided procedure that includes steps for selecting relevant jobs, activating alerts, and enabling email/ SMS notifications for alerts.
You can access Job Monitoring from Application Operations in SAP Solution Manager Configuration.
Steps 1-3 of the guided procedure prepare the infrastructure for job monitoring including setup of the required users. Steps 4-6 involve the selection of scheduled jobs for monitoring and configuring alerts and notifications. In the following example, we will create a monitoring scenario for the standard job SM:SYSTEM RECOMMENDATIONS. This job connects to SAP Support on a weekly schedule to calculate required security, correction, performance, legal, and other notes for systems. It also connects to managed systems to determine the implementation status of calculated notes.
In the first step of the scenario configuration, we define a name and description for the scenario.
During the second step, we select the systems for the scenario. Since SM:SYSTEM RECOMMENDATIONS runs from Solution Manager, we will select a SolMan installation.
Next, we maintain the scope for the scenario in terms of the specific job.
Once the job is selected, we can adjust the metric settings including thresholds for job errors, processing times, terminations and warnings.
Finally, we activate the alerting and select the required language, severity and description for the alert.
Recipients for email notifications triggered for alerts can be maintained in the Incident and Notifications tab.
Once the scenario is activated in the final step, we will be immediately alerted and notified by Solution Manager for any issue that interrupts the successful execution of the system recommendations job. The steps can be repeated for other scheduled jobs in SAP Solution Manager and managed systems.
Securing SAP hosts is a critical component of SAP system hardening. Vulnerable operating systems can provide a pathway to SAP applications, databases and other components, bypassing security mechanisms applied in such layers. This can lead to the compromise of SAP systems including the corruption of critical files and tables. It can also support ransomware attacks that disrupt the availability of SAP services.
The Cybersecurity Extension for SAP Solution Manager performs daily automated scans to identify vulnerabilities in SAP hosts. For Linux operating systems, this includes authentication settings, firewall configurations, file and service permissions, root access, missing security patches, vulnerable packages and services, and misconfigured settings for logging and auditing. It also includes the detection of open TCP/ UDP ports that are targeted by attackers, including FTP, RPC, RDP, SSH, and Telnet.
OS findings are mapped to SAP systems, supporting holistic security across code, application, database and operating system layers.
The Extension also monitors OS logs to identify indicators of compromise in SAP hosts. Alerts and notifications are triggered for security incidents and channeled to SIEM and service desk systems. This includes the following scenarios:
Changes to operating system configuration, profile, and kernel parameters
Firewall and other network settings
File system mounts and unmounts
Group, user and password changes
Cron jobs
Daemon and service changes
OS scripts
External connections
Sudo users
Root and sudo commands
Failed logon and file access attempts
Critical file changes
File permission changes
OS code injection
User locks and unlocks
Changes to audit settings and records
Audit records from the Linux audit log are displayed in the alert details. The records include the audit event number and auid of the initial user that triggered the event.
The Cybersecurity Extension for SAP Solution Manager includes integrated incident response procedures to support forensic investigations. Users can select the Respond option from an alert to start an investigation and document the findings.
The Extension currently supports monitoring for Red Hat Enterprise Linux (RHEL) and SUSE Linux Enterprise Server (SLES). Support for IBM AIX and Microsoft Windows Server is expected in 2021.
