Onapsis Launches New Functionality to Lock Down SAP Systems

PRESS RELEASE

Boston, MA – May 8, 2018 – Onapsis, the global experts in ERP and business-critical application cybersecurity and compliance, today announced that it has extended the Onapsis Security Platform (OSP) with the launch of the Enforce and Protect product module. OSP is now the first platform to enable InfoSec and SAP teams to enforce compliance and protect business-critical applications by actively preventing these systems from drifting into an insecure or non-compliant state.

“Keeping SAP business-critical applications protected and compliant can be a constant struggle for security, compliance and BASIS teams alike. In any large, dynamic environment, multiple teams need to access and modify systems to support ever-changing business requirements,” said Ashish Larivee, Chief Product Officer at Onapsis. “This means that even securely-configured systems often unknowingly drift back into an insecure or non-compliant state. This new capability will prevent such risks and help protect SAP systems that contain the crown jewels for many businesses.”

Ensuring systems are configured securely and stay that way continues to be a difficult problem to solve. The configuration drift threat, if not monitored and managed, can be more damaging to organizations than zero days and other modern attacks and may go unnoticed until an audit or assessment is performed, leaving organizations vulnerable to attack as well as to regulatory penalties such as GDPR. Because SAP system misconfigurations are well known and their fixes have been documented in security notes over many years, attackers can potentially exploit these systems and gain access to valuable business data and assets or even full control of the system.

“Any large organization knows the difficulty of implementing secure configurations in their SAP landscape, but once configured, they have no way to ensure that they do not drive back to an insecure state. Onapsis is an example of a provider helping customers address this problem by monitoring system changes at all times and enforcing a ‘clean’ security and compliance posture,” said Scott Crawford, Research Director at 451 Research.

Onapsis built Enforce and Protect based on feedback and demand from hundreds of Global 2000 SAP customers. These organizations spend a significant amount of time and money taking critical systems offline to implement secure settings according to internal policies or regulatory baselines, only to find them changed back due to ongoing SAP change requirements. Changes to an SAP system can range from emergency fixes and problem resolution to developing and deploying new functionality or enhancements to large business projects such as digital transformation. Common problem examples include incorrectly assigning high-privilege access or turning off critical audit logs and RFC connection configurations.

“Our goal with this new functionality is to allow lock down to ensure that systems stay secure, saving significant costs and time,” continued Larivee.

Available in June, the new, patent-pending Enforce and Protect product functionality enables OSP customers to:

●      Automatically stop critical system changes to prevent SAP systems from becoming insecure or non-compliant

●      Receive immediate alerts if an unplanned update could make a system insecure or non-compliant

●      Approve out-of-band configuration changes that are required as exceptions

●      Maintain secure configuration settings that require significant time and investment

●      Record and log change activity for audit and investigations

●      Continuously assure configurations adhere to corporate policies for all SAP versions, including S/4 HANA

Onapsis’s Director of Product Management, Alex Horan, will lead a live webcast about the new product functionality on May 30 at 9am and 2pm ET. Visit the Onapsis site for additional information and product documentation.

About Onapsis

Onapsis cybersecurity solutions automate the monitoring and protection of your SAP and Oracle ERP and business-critical applications, keeping them compliant and safe from insider and outsider threats. As the proven market leader, global enterprises trust Onapsis to protect the essential information and processes that run their businesses.

Headquartered in Boston, MA, Onapsis serves over 200 customers including many of the Global 2000. Onapsis's solutions are also the de-facto standard for leading consulting and audit firms such as Deloitte, IBM, Infosys and PwC.

Onapsis solutions include the Onapsis Security Platform™, which is the most widely-used SAP-certified cybersecurity solution on the market. Unlike generic security products, Onapsis's context-aware solutions deliver both preventative vulnerability and compliance controls, as well as real-time detection and incident response capabilities to reduce risks affecting critical business processes and data. Through open interfaces, the platform can be integrated with leading SIEM, GRC and network security products, seamlessly incorporating enterprise applications into existing vulnerability, risk and incident response management programs.

These solutions are powered by the Onapsis Research Labs, who continuously provide leading intelligence on security threats affecting SAP and Oracle enterprise applications. Experts at the Onapsis Research Labs were the first to lecture on SAP cyberattacks and have uncovered and helped fix hundreds of security vulnerabilities to-date affecting SAP Business Suite, SAP HANA, SAP Cloud and SAP Mobile applications, as well as Oracle JD Edwards and Oracle E-Business Suite platforms. This patented technology is well known, industry wide, and has gained Onapsis recognition on the Deloitte Technology Fast-500, as a Red Herring North America Top 100 company and a SINET 16 Innovator.

For more information, please visit www.onapsis.com, or connect with us on Twitter, Google+, or LinkedIn.

Onapsis and Onapsis Research Labs are registered trademarks of Onapsis, Inc. All other company or product names may be the registered trademarks of their respective owners.