Cross-layered detection and response (XDR) for SAP

In this article, we want to share our thoughts on the meaning of cross-layered detection and response and elaborate on why we think it’s an important step to maturity for IT-Security.

Gartner recently introduced the term XDR. It stands for Extended Detection and Response and is defined as “a SaaS-based, vendor-specific, security threat detection and incident response tool that natively integrates multiple security products into a cohesive security operations system that unifies all licensed components.”.

Gartner’s definition describes an „XDR system“ as a central system that can actively respond to issues and helps to decrease response time.

Why is it important?

Attackers don’t care about the segregation of responsibility or domain experience that exists within an organization. On the contrary, in a targeted attack, they even strategically exploit these vulnerabilities and attack the weaknesses in organizational structures. We have seen Threat actors orchestrate their activities using tactics, techniques and procedures (TTPs) with this knowledge in mind. 

In a hypothetical attack scenario where SAP HR is targeted, the attacker may attempt to gain access to the system, leaving a trail of clues at the network level.

For SAP experts, there’s an obvious need to know that this is happening. Unfortunately, they don’t typically know about the activity due to a missing link in the organization. Log levels and monitoring efforts can be increased, but only if the SAP team responsible knows that their system is the target of a threat actor. This is not only true for scenarios where the attacker successfully exploits an SAP vulnerability, it also relates to attack attempts.

With cross-layered detection and response methodology in place, the application security team would be alerted to the attacker and expect to see them reaching the borders of their system. They can shine the spotlight on the intruder and collect all evidence about the ongoing attack. Once the attack is confirmed, and before any harm can be done to the system, the SAP team can trigger network action to remove the malicious terminal.

How does XDR work?

The XDR application helps break down information silos and facilitates an accurate response. In doing so it needs to collect and correlate data across critical enterprise applications, email, endpoints, servers, cloud workloads, and networks, enabling visibility and context into advanced threats. Many different security solutions exist today. The top three are:

• security information and event management (SIEM) tools,
• intrusion detection system (IDS) application and
• endpoint detection and response (EDR) services.

XDR tries to define an alternative to traditional reactive approaches that provide only layered visibility into attacks and sets the focus on the response.

Is it relevant for SAP?

Looking beyond the definition provided by Gartner and setting a focus on the targets and methods described by XDR we believe these are definitely beneficial for any organization wanting to protect their SAP systems. Particularly the following is needed to raise the protection level against sophisticated attack and exploitation methods:

• converting a large stream of logs from SAP and other sources into a much smaller number of incidents
• providing integrated incident response options that have the necessary context from all security components
• providing response options that go beyond application points
• providing automation capabilities
• reducing training efforts by providing context-rich security information for all domain level experts

At SecurityBridge we work to break down information silos and domain-level knowledge borders, by providing out-of-the-box integration and connecting SAP to security management systems. We engage members of different security teams to collaborate by using a universal language, which results in a cohesive security solution.

Posted by

Find recent Security Advisories for SAP©

View Advisory for March’21

Looking into securing your SAP landscape? This white-paper tells you the “Top Mistakes to Avoid in SAP Security“. Download it now.