Enterprise Application Security Vulnerability Assessment

Objective

This document will describe different areas of secure implementation of Enterprise Business Applications and ERP systems. Here, we will mainly focus on security architecture and configuration threats because program errors are well described in the "Software vulnerabilities" topic.

Purpose

The purpose of this document is to increase awareness of the administrators of Business Application security and help them to start self-assessment of their systems to find the most critical violations.

Intro

Enterprise Business Applications (like ERP, it is any software system that has been designed to support and automate the business process of medium and large business) are very large systems that consist of different components such as Database server, Front-end, Web server, Application server and other parts. Also, those systems rely on different hardware and software that can have their own vulnerabilities. Every described layer may have its own vulnerabilities and misconfigurations that can give an attacker full access to business data, even if other layers are completely secured.

All of the data was collected and categorized during our extensive experience of assessing the security of popular Business Applications such as SAP ERP, Oracle E-Business Suite, Oracle Peoplesoft, JD-Edwards and other less known or custom applications.

Main

Overall security of Enterprise Business Application consists of different layers, including:
• Network architecture security
• OS security
• Database security
• Application security
• Front-end security
In this document, we will describe top 10 violations for every layer of Enterprise Business Applications that can be easily assessed and mitigated.

Top 10 Network/Architecture issues - 2010

1 Lack of proper network filtration between EA and corporate network
2 Lacking or vulnerable encryption between corporate network and EA network
3 Lack of separation between Test, Dev, and Prod systems<
4 Lack of encryption inside EA network
5 Insecure trust relations between components
6 Insecurely configured Internet-facing applications
7 Vulnerable or default configuration of routers
8 Lack of frontend access filtration
9 Lacking or misconfigured IDS/IPS
10 Insecure or inappropriate wireless comunications

Top 10 OS issues - 2010

1 Unnecessary enabled services
2 Missing 3rd party software patches
3 Insecure trust relations
4 Universal OS passwords
5 Missing OS patches
6 Lacking or misconfigured network access control
7 Lacking or misconfigured monitoring
8 Insecure internal acces control
9 Unencrypted remote access
10 Lack of password lockout/complexity checks

Top 10 Database issues - 2010

1 Default passwords for DB access
2 Lack of DB patch management
3 Unnecessary enabled DB features
4 Lack of password lockout/complexity checks
5 Unencrypted sensitive data transport / data
6 Lacking or misconfigured network access control
7 Extensive user and group privileges
8 Lacking or misconfigured audit
9 Insecure trust relations
10 Open additional interfaces

Top 10 Frontend issues - 2010

1 Vulnerable frontend applications
2 Lack of server trust check
3 Lack of encryption
4 Autocomplete enabled in the browser
5 Insecure browser scripting options
6 Insecure configuration
7 Insecure sortware distribution service
8 Lack of AV software
9 Password stored in configuration file
10 Sensitive information storage

Top 9 Application issues - 2014

1. Lack of patch management
2. Default passwords for application access
3. Unnecessary enabled functionality
4. Open remote management interfaces
5. Insecure configuration
6. Unencrypted communication
7. Access control and SoD
8. Insecure trust relations
9. Logging and monitoring

Links

[EASSEC-PVAG-ABAP] THE SAP NETWEAVER ABAP PLATFORM VULNERABILITY ASSESSMENT GUIDE 2014

http://erpscan.com/publications/the-sap-netweaver-abap-platform-vulnerability-assessment-guide/

Authors

Alexander Polyakov Nikolay Mesherin Kirill Nikitenkov