Senior level perceptions about SAP security
More than half of companies believe it is likely their company would have a data breach due to insecure SAP applications, according to a new Ponemon Institute study. This same group indicates their company’s SAP platform has been breached an average of two times in the past 24 months, yet 63 percent indicate C-level executives tend to underestimate the risks associated with insecure SAP applications.
This perception gap is furthered by the limited visibility organizations have into the security of SAP applications and many do not have the required expertise to quickly prevent, detect and respond to cyber attacks – a problem which 60 percent of respondents say would be catastrophic or very serious and could lead to $4.5M average cost if systems are taken offline.
“One of the big surprises in this study is this swell of silent breaches that are increasingly hitting organizations which are difficult to detect, and materially impact businesses and the overall economy,” said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. “Worryingly, while survey data indicates SAP breaches are expected to increase, there is no single group or job function most accountable. It appears that SAP cybersecurity is falling through the cracks between the SAP security teams and InfoSec teams, who need to step up to bridge the gap and make it a priority.”
The survey data indicates that senior leadership values the importance of SAP to the bottom line but ignores its cybersecurity risks: Seventy-six percent of respondents say their senior leadership understands the importance and criticality of SAP installations to profitability. However, only 21 percent of respondents say their leaders recognize SAP cybersecurity risks.
SAP security: Key takeaways
Are SAP platforms likely to contain malware? Seventy-five percent of respondents say it is very likely (33 percent) or likely (42 percent) SAP platforms have one or more malware infections.
How long would it take to detect a breach? There is little confidence a breach involving the SAP platform would be detected immediately or within one week. In fact nearly 100 percent of participants believed they could not detect an SAP breach immediately. Even a year later, 78 percent of respondents believed they could not detect an SAP breach.
Who is responsible for SAP security? Respondents believe it is the responsibility of SAP, not their company, to ensure the security of its applications and platform, according to 54 percent of respondents. Internally, the SAP security team is seldom accountable for the security of SAP systems: Twenty-five percent of respondents say no one function is most accountable for SAP security in their organizations followed by IT infrastructure (21 percent), SAP security team (19 percent), and information security (18 percent).
Who would be blamed if a data breach involving the SAP system occurred? Thirty percent of respondents say no one is most accountable if their organization had a SAP breach followed by the CIO (26 percent of respondents) and the CISO (18 percent of respondents).
What is the impact of IoT and other new technologies? Fifty-nine percent of respondents believe new technologies and trends such as cloud, mobile, big data and the Internet of Things increases the attack surface of their SAP applications.
What can organizations do to improve their SAP cybersecurity posture? Seventy-three percent of respondents say knowledge about the latest threats and vulnerabilities affecting SAP applications improves their organization’s ability to manage cybersecurity risks.
