Cross-layered detection and response (XDR) for SAP

In this article, we want to share our thoughts on the meaning of cross-layered detection and response and elaborate on why we think it’s an important step to maturity for IT-Security.

Gartner recently introduced the term XDR. It stands for Extended Detection and Response and is defined as “a SaaS-based, vendor-specific, security threat detection and incident response tool that natively integrates multiple security products into a cohesive security operations system that unifies all licensed components.”.

Gartner’s definition describes an „XDR system“ as a central system that can actively respond to issues and helps to decrease response time.

Why is it important?

Attackers don’t care about the segregation of responsibility or domain experience that exists within an organization. On the contrary, in a targeted attack, they even strategically exploit these vulnerabilities and attack the weaknesses in organizational structures. We have seen Threat actors orchestrate their activities using tactics, techniques and procedures (TTPs) with this knowledge in mind. 

In a hypothetical attack scenario where SAP HR is targeted, the attacker may attempt to gain access to the system, leaving a trail of clues at the network level.

For SAP experts, there’s an obvious need to know that this is happening. Unfortunately, they don’t typically know about the activity due to a missing link in the organization. Log levels and monitoring efforts can be increased, but only if the SAP team responsible knows that their system is the target of a threat actor. This is not only true for scenarios where the attacker successfully exploits an SAP vulnerability, it also relates to attack attempts.

With cross-layered detection and response methodology in place, the application security team would be alerted to the attacker and expect to see them reaching the borders of their system. They can shine the spotlight on the intruder and collect all evidence about the ongoing attack. Once the attack is confirmed, and before any harm can be done to the system, the SAP team can trigger network action to remove the malicious terminal.

How does XDR work?

The XDR application helps break down information silos and facilitates an accurate response. In doing so it needs to collect and correlate data across critical enterprise applications, email, endpoints, servers, cloud workloads, and networks, enabling visibility and context into advanced threats. Many different security solutions exist today. The top three are:

  • security information and event management (SIEM) tools,
  • intrusion detection system (IDS) application and
  • endpoint detection and response (EDR) services.

XDR tries to define an alternative to traditional reactive approaches that provide only layered visibility into attacks and sets the focus on the response.

Security onion-layer digramm
Security layer diagram SAP

Is it relevant for SAP?

Looking beyond the definition provided by Gartner and setting a focus on the targets and methods described by XDR we believe these are definitely beneficial for any organization wanting to protect their SAP systems. Particularly the following is needed to raise the protection level against sophisticated attack and exploitation methods:

  • converting a large stream of logs from SAP and other sources into a much smaller number of incidents
  • providing integrated incident response options that have the necessary context from all security components
  • providing response options that go beyond application points
  • providing automation capabilities
  • reducing training efforts by providing context-rich security information for all domain level experts

At SecurityBridge we work to break down information silos and domain-level knowledge borders, by providing out-of-the-box integration and connecting SAP to security management systems. We engage members of different security teams to collaborate by using a universal language, which results in a cohesive security solution.

Posted by

Christoph Nagy
Share on linkedin
Share on twitter
Share on email
Find recent Security Advisories for SAP©

Looking into securing your SAP landscape? This white-paper tells you the “Top Mistakes to Avoid in SAP Security“. Download it now.

SAP Sicherheit auf dem Prüfstand – Ein ganzheitlicher Ansatz

#ITOK21 | IT-Onlinekonferenz.de | Helge Sanden und Christoph Nagy
Ständig hört man von Cyberangriffen und die meisten Unternehmen haben bereits …

How to implement and enforce a security baseline for SAP ?

Join and listen to our webinar, to learn how you can use the SecurityBridge platform to define and apply one or multiple baselines, receive alerts whenever the system again deviates…
S/4HANA migration
SAP Cybersecurity- SAP Security Automation- Security News
“There are a few constants in life” – a statement that also applies to the SAP user community. It has always been a challenge for SAP customers to bring their large SAP environments to a current release level. Although the vendor has done a lot in the past to simplify this, it is still not a complex undertaking.
SecurityBridge
Here at SecurityBridge, we are extremely lucky to have a team full of amazing professionals. Thanks to our team, we have achieved extraordinary things in the past couple of years. With that in mind, we thought it was time for us to start introducing you to the team that drives everything behind the scenes. And we couldn't have chosen a better example to start with than our very own, Harish Dahima! Read on and learn all about Harish's life as a Senior Product Developer, his role, and life at SecurityBridge.
SAP Cloud Connector
SAP Cloud Security- SAP Cybersecurity- Security News
Every organization constantly faces the challenge of minimizing the attack surface that an adversary could use to perform malicious operations. To do this, administrators must install the deployed components and understand them in detail to identify risks and proactively mitigate or prevent those. Today we are looking at what is necessary to protect the SAP Cloud Connector.
SAP Cycling event
Life at SecurityBridge- Partner News- Security News
It was John F. Kennedy who once said: “nothing compares to the simple pleasure of a bike ride”. And what a pleasure it has been! We had our annual bike ride with friends from Accenture, Deloitte, CGI, McCoy, Thales, KPN, Hunt &Hacket, and security leaders from major customers. We had a lot of opportunities for exchange in the cozy atmosphere among like-minded people who all love road cycling and have SAP Security improvement in mind.