SAP Security Briefing

Thursday, March 7, 2013 5 years ago 14:00 - 16:30

An afternoon in which we brought you presentations and discussion on SAP security.

Calendar

This MWR Briefing has passed, but you can sign up to be notified of future events, or register for another of our upcoming events by visiting our MWR Briefings page.

SAP systems often consist of very complex architectures and employ a myriad of integration choices in order to offer interoperability with enterprise systems. This has led to a situation whereby a SAP deployment can expose an incomprehensibly massive attack surface and can often expose an organization to the very real threat of compromise. As SAP systems are the core operational system of many businesses, even the smallest level of compromise can have devastating effects.

By attending this session you will learn why Segregation of Duty (SoD) controls are just not enough, which current threats exist (data theft, espionage, fraud, sabotage etc.) to your SAP systems that could be exploited by nefarious parties, and how you can utilise traditional and familiar network and application security best practices/principals to help protect your business-critical information from attack.


In this briefing we will:

  • Look at common security issues often present in SAP systems due to Operating System, Application and Database misconfigurations.
  • Highlight how attackers exploit architectural weaknesses in networks to circumvent security controls.
  • Demonstrate practical and effective attacks against SAP systems – from simple to highly advanced.
  • Illustrate how real world threats to SAP systems can be realised.
  • Raise awareness of how these vulnerabilities are introduced into your business critical systems.
  • Offer remedial advice and present possible mitigation strategies.

 

What is the MWR Briefing?

MWR Briefings challenge perceptions and offer insights into the fast-paced arena of information security.

 

+ learn more

Home featured
Accreditations

MWR is an accredited member of The Cyber Security Incident Response Scheme (CSIR) approved by CREST (Council of Registered Ethical Security Testers).
MWR is certified under the Cyber Incident Response (CIR) scheme to deal with sophisticated targeted attacks against networks of national significance.
We are certified to comply with ISO 14001 in the UK, an internationally accepted standard that outlines how to put an effective environmental management system in place.
MWR is certified to comply with ISO 27001 to help ensure our client information is managed securely.
As an Approved Scanning Vendor MWR is approved by PCI SSC to conduct external vulnerability scanning services to PCI DSS Requirement 11.2.2.
We are members of the Council of Registered Ethical Security Testers (CREST), an organisation serving the needs of the information security sector.
MWR is a supplier to the Crown Commercial Service (CCS), which provides commercial and procurement services to the UK public sector.
MWR is a Qualified Security Assessor, meaning we have been qualified by PCI to validate other organisation's adherence to PCI DSS.
As members of CHECK we are measured against high standards set by CESG for the services we provide to Her Majesty's Government.
MWR’s consultants hold Certified Simulated Attack Manager (CCSAM) and Certified Simulated Attack Specialist (CCSAS) qualifications and are authorized by CREST to perform STAR penetration testing services.