Skip to content

Cross-layered detection and response (XDR) for SAP

Cross-layered detection and response

In this article, we want to share our thoughts on the meaning of cross-layered detection and response and elaborate on why we think it’s an important step to maturity for IT-Security.

Gartner recently introduced the term XDR. It stands for Extended Detection and Response and is defined as “a SaaS-based, vendor-specific, security threat detection and incident response tool that natively integrates multiple security products into a cohesive security operations system that unifies all licensed components.”.

Gartner’s definition describes an „XDR system“ as a central system that can actively respond to issues and helps to decrease response time.

Why is it important?

Attackers don’t care about the segregation of responsibility or domain experience that exists within an organization. On the contrary, in a targeted attack, they even strategically exploit these vulnerabilities and attack the weaknesses in organizational structures. We have seen Threat actors orchestrate their activities using tactics, techniques and procedures (TTPs) with this knowledge in mind. 

In a hypothetical attack scenario where SAP HR is targeted, the attacker may attempt to gain access to the system, leaving a trail of clues at the network level.

For SAP experts, there’s an obvious need to know that this is happening. Unfortunately, they don’t typically know about the activity due to a missing link in the organization. Log levels and monitoring efforts can be increased, but only if the SAP team responsible knows that their system is the target of a threat actor. This is not only true for scenarios where the attacker successfully exploits an SAP vulnerability, it also relates to attack attempts.

With cross-layered detection and response methodology in place, the application security team would be alerted to the attacker and expect to see them reaching the borders of their system. They can shine the spotlight on the intruder and collect all evidence about the ongoing attack. Once the attack is confirmed, and before any harm can be done to the system, the SAP team can trigger network action to remove the malicious terminal.

How does XDR work?

The XDR application helps break down information silos and facilitates an accurate response. In doing so it needs to collect and correlate data across critical enterprise applications, email, endpoints, servers, cloud workloads, and networks, enabling visibility and context into advanced threats. Many different security solutions exist today. The top three are:

  • security information and event management (SIEM) tools,
  • intrusion detection system (IDS) application and
  • endpoint detection and response (EDR) services.

XDR tries to define an alternative to traditional reactive approaches that provide only layered visibility into attacks and sets the focus on the response.

Security onion-layer digramm
Security layer diagram SAP

Is it relevant for SAP?

Looking beyond the definition provided by Gartner and setting a focus on the targets and methods described by XDR we believe these are definitely beneficial for any organization wanting to protect their SAP systems. Particularly the following is needed to raise the protection level against sophisticated attack and exploitation methods:

  • converting a large stream of logs from SAP and other sources into a much smaller number of incidents
  • providing integrated incident response options that have the necessary context from all security components
  • providing response options that go beyond application points
  • providing automation capabilities
  • reducing training efforts by providing context-rich security information for all domain level experts

At SecurityBridge we work to break down information silos and domain-level knowledge borders, by providing out-of-the-box integration and connecting SAP to security management systems. We engage members of different security teams to collaborate by using a universal language, which results in a cohesive security solution.

Posted by

Christoph Nagy
Find recent Security Advisories for SAP©

Looking into securing your SAP landscape? This white-paper tells you the “Top Mistakes to Avoid in SAP Security“. Download it now.

Webinar: SAP Security Baseline: Surviving an SAP Audit

With the recent increase in attention to SAP security from auditors, we decided to investigate SAP baselines. We took a closer look into what SAP baselines are, how they can help you, and how to survive an audit.

SAP Security – What you can do to protect yourself

Join IBM and SecurityBridge to hear exclusive content from SAP cybersecurity experts who will share invaluable insight into the best practices and upcoming strategies for SAP cybersecurity.
Senior SAP Developer Singapore
As a Senior SAP Developer, you will be responsible for designing, developing, and maintaining SAP solutions while leading and guiding a team of developers. You will play a crucial role in the development of standard products, and your technical expertise and communication skills will be instrumental in ensuring the success of our projects. This role demands strong leadership, technical acumen, and the ability to collaborate effectively in an international development team.
Earlier this year, IBM presented its 18th edition of ‘The Cost of a Data Breach Report’ (you can find it here). This publication provides detailed and valuable insights into various factors related to data breaches. It is based on research carried out at 553 impacted organizations - any IT security professional should check it out. In this article, we will highlight some of this report’s findings and bring them into the context of SAP security.
We're hiring a financial controller/analyst
As a Controller/Financial Analyst at SecurityBridge, you will play a crucial role in managing and optimizing financial processes, ensuring accurate reporting, and providing strategic financial insights. This is an exciting opportunity for a detail-oriented professional to contribute to the financial success of the fastest-growing cybersecurity provider for SAP systems.