Attackers don’t care about the segregation of responsibility or domain experience that exists within an organization. On the contrary, in a targeted attack, they even strategically exploit these vulnerabilities and attack the weaknesses in organizational structures. We have seen Threat actors orchestrate their activities using tactics, techniques and procedures (TTPs) with this knowledge in mind. 

In a hypothetical attack scenario where SAP HR is targeted, the attacker may attempt to gain access to the system, leaving a trail of clues at the network level.

For SAP experts, there’s an obvious need to know that this is happening. Unfortunately, they don’t typically know about the activity due to a missing link in the organization. Log levels and monitoring efforts can be increased, but only if the SAP team responsible knows that their system is the target of a threat actor. This is not only true for scenarios where the attacker successfully exploits an SAP vulnerability, it also relates to attack attempts.

With cross-layered detection and response methodology in place, the application security team would be alerted to the attacker and expect to see them reaching the borders of their system. They can shine the spotlight on the intruder and collect all evidence about the ongoing attack. Once the attack is confirmed, and before any harm can be done to the system, the SAP team can trigger network action to remove the malicious terminal.