An Australian bank gave its SAP team seven days to patch, SecurityBridge says. SAP hosts the systems, but customers secure the application.
That was the directive at one of Australia's largest banks, according to Onno Coenen in an interview ERP Today published on Friday.
Coenen is Asia-Pacific managing director of SecurityBridge, which sells SAP security software. He did not name the bank.
He called one assumption "the number one mistake" among customers of RISE with SAP, SAP's service for hosting a customer's systems in a private cloud: that SAP takes care of application security. SAP manages much of the underlying technology under that contract, the article says. Customers remain responsible for users and settings, along with custom-written software and activity inside the application.
Coenen said Australian cyber teams are finding SAP missing from the systems they monitor for security problems. He said a first scan of custom-written software can flag thousands of things to check, and that the people who wrote it, often contractors, have frequently moved on.
ERP Today notes that SecurityBridge sponsors the Mastering SAP event it was interviewed about. SAP is not quoted.
SAP supplies the patches; installing them is the customer's side of that split. ERP Today's advice to customers is to check the shared responsibility model in their contract, because a seven-day target lands on whoever has to do the patching.
Sources
Our file on SAP
- 13 Nov
IT leaders are listing SAP's ERP among software they may replace, CIO reported. Gartner says most won't make the switch for years.
- 13 Nov
Trek says SAP online store fixes now take a day, not one to two weeks. Developers still approve every AI change.
- 13 Nov
SAP now shows emissions for selected cloud products, based on its servers. It still calls its spend-based estimate the reporting reference.
- 12 Nov
SAP is building seven AI agent families to help upgrade customer code. Its ABAP chief said ABAP changes are usually not undone.
- 12 Nov
SAP says Joule AI, used by 110,000 staff, brought 20% gains. Bloomberg reported SAP has not shown how it measured them.
For your next steering committee
- 1Ask when systems of this kind in your landscape were last patched, and who confirms it.
- 2Ask which finance and ERP accounts can be reached from outside, and how each sign-in is protected.
- 3Ask how long a restore took the last time it was tested.
Issue 01 of the ERP LEADERS brief puts a timeline, the three-number review and six questions on one page. Read issue 01
Welcome back. · Issue 01
7 comments on LinkedInRead the discussion
