Now that we’ve covered the various attack vectors of an SAP breach, we can look at a first aid plan in such cases. Whenever you encounter an SAP breach, you need to focus on limiting the damage and restoring your security posture. With the following 10 steps, you ensure that you are responding to an attack in the right way:

1. As soon as you identified the breach, lock identified user accounts involved in the attack or isolate identified clients from the network. If not possible isolate the entire system, e.g., by cutting off the internet connection of the system, to prevent more unauthorized access.
2. Immediately assemble a threat response team consisting of SAP administrators, experts, and stakeholders.
3. Save all security-related SAP logs, like the Security Audit Log, HANA audit log, and JAVA audit log and initiate a forensic analysis and correlate them on a time scale.
4. Identify critical events or activity patterns and gather additional events within the same period to understand the attack vector and impact of the breach.
5. In parallel to the forensic activities make sure you comply with legal and regulatory requirements. Notify all relevant parties and be transparent so all affected parties can take the necessary precautions. This can also aid you in supporting a potential legal investigation.
6. Patch all vulnerabilities, update security configurations, and remediate as much as possible what can compromise the security of your systems, at least the issues related to the breach.
7. Reactivate normal SAP operations step by step and monitor closely all SAP security logs for some time to ensure secure operations.
8. To avoid future breaches, make sure you improve your overall security posture. Strengthen your security controls by extending the scope of the activities from item 6 following common SAP security frameworks like NIST or the SAP Security Recommendations.
9. Consider setting up a process for SAP users to be informed when their credentials are used from a new device and a simple feedback channel, e.g., email, to the SAP security team in case they detect a misuse. You find a good example of such Identity Protection here.
10. Consider implementing comprehensive SAP Thread Detection solutions with Zero Day threat coverage and anomaly detection features like the one from SecurityBridge. Also, include automation capabilities for efficient SAP security operations.