The latest reports about SAP HANA vulnerabilities reveal some critical vulnerabilities related to authentication, authorizations, patches and misconfigurations, which could make SAP HANA systems a high risk for customers. If any of these known vulnerabilities are exploited, it could result in significant business loss to customers running SAP HANA in applications. Other consequences related to an exploit or data breach include failed compliance, brand reputation impact and declining customer trust resulting in churn.

More About SAP HANA

SAP HANA often runs an enterprise’s most mission-critical applications. However, these enterprises may not completely understand the risk that weakened security for SAP HANA can present.

SAP HANA manages various enterprise resource planning, customer relationship management, supply chain, analytics and business intelligence systems. It stores most critical business, personal and financial data, which requires managing regulatory and compliance requirements such as PCI, PII, HIPAA, Sarbox and GDPR.

Research from the Ponemon Institute, titled “Trends in SAP Cybersecurity,” revealed a few key points about the systems:

• There is no single function in the enterprise that owns SAP security.
• There is no one role in the organization accountable in case of a SAP data breach.
• The SAP platform is likely to contain at least one malware instance.
• There is often a significant delay in discovering a data breach on a SAP system.

Because of the speed with which customers are deploying SAP HANA in hybrid deployment models, security is often neglected by database administrators (DBAs) and IT. But these customers need to understand the cost of the data stored in SAP HANA: Any misconfigurations or known vulnerabilities can cost millions of dollars in failed compliance if exploited by attackers or rogue insiders.

The Trouble With Vulnerabilities

There are many known vulnerabilities related to configurations changes, system-level privileges and missing patches that are known to cybercriminals, who are trying to exploit them. We need an automated tool that can scan all SAP HANA instances, identify critical and sensitive data, and provide a comprehensive listing of all vulnerabilities such as missing patches, use of default configurations, inadequate password policies, subpar file permissions, poor file ownership and more.

Security teams can then look at these results and understand the impact. There should be a way to provide details about how these vulnerabilities can be remediated. Remediation is the key; often, security teams and even DBAs do not know what should be done to remediate critical vulnerabilities.

Though identification of vulnerabilities is just one piece of a big problem, detailed remediation recommendations are key to helping teams learn how to harden their SAP HANA databases and subsequently lock down the system from future exploits of known vulnerabilities.

Download the Guardium Vulnerability Assessment Data Sheet