The Cybersecurity Extension for SAP secures Microsoft platforms integrated with SAP by scanning for vulnerabilities across database and operating system layers. It detects over 300 security weaknesses in Microsoft SQL Server and Windows Server, while monitoring logs for indicators of compromise to prevent threat actors from bypassing application-level security.
SAP systems are complex ecosystems where the application layer relies on database and operating system layers. Because these layers are tightly integrated, particularly in SAP HANA installations, security must be applied holistically across the entire environment. Attackers frequently exploit vulnerabilities at the database or OS level to bypass application-level protections, leading to risks like data exfiltration or denial-of-service via ransomware. When SAP applications are coupled with Microsoft platforms, the risk increases, as these platforms are frequent targets for known exploits. The Cybersecurity Extension for SAP addresses these threats by providing comprehensive visibility across all layers. It performs over 2000 vulnerability checks for SAP solutions and 300+ checks for Microsoft SQL Server and Microsoft Server. By automating vulnerability scans and monitoring system logs for suspicious activity—such as unauthorized user changes or failed logons—the solution enables security teams to detect and respond to threats before they compromise the SAP environment.
Key Takeaways
- SAP system security requires protection across application, database, and operating system layers.
- Attackers target Microsoft OS and database layers to bypass SAP application security controls.
- The Cybersecurity Extension for SAP performs over 300 vulnerability checks on Microsoft platforms.
- Automated logging and monitoring detect indicators of compromise in real-time for Microsoft SQL Server and Windows Server.
Why is multi-layer security necessary for SAP?
Multi-layer security is necessary because SAP systems are comprised of integrated application, database, and operating system layers that share physical resources and trust relationships. Threat actors can bypass secure SAP applications by targeting weaknesses at the database or OS level to compromise the entire system. For example, ransomware can lead to a denial-of-service for SAP services by exploiting vulnerable operating systems, while application-level data protection mechanisms can be bypassed by exfiltrating data directly from the database.
How do vulnerabilities in Microsoft platforms affect SAP?
Vulnerabilities in Microsoft platforms affect SAP when the applications are coupled, as these platforms are widely targeted by threat actors and suffer from a host of known exploits. The Cybersecurity Extension for SAP is designed to secure these specific layers. It performs automated vulnerability scans for Microsoft SQL Server and Microsoft Server to detect more than 300 known security weaknesses, including:
- Active vulnerable services that widen the attack surface.
- Authentication settings, including password policies.
- File and table encryption status.
- Users with administrative privileges, including system and user administration.
- The availability of standard users.
- Logging and auditing configurations.
- Open ports and services.
- Host firewall settings.
What does the Cybersecurity Extension for SAP monitor?
The Cybersecurity Extension for SAP monitors database and operating logs to detect indicators of compromise in Microsoft platforms and triggers alerts via email or SMS. This monitoring covers a wide range of security-sensitive activities:
| Monitored Activity Category | Examples of Monitored Events |
|---|---|
| System & User Changes | System, role and user changes; user groups |
| Database & Schema | Direct access to user tables; changes to database schemas |
| Access & Authentication | Failed logons; attempted remote logons; password changes |
| Infrastructure & Security | Changes to system auditing; firewall settings; packets blocked |
| Service & Device | Scheduled tasks; stored procedures; remote procedure calls |
Frequently Asked Questions
Why must SAP security include the operating system and database?
Because SAP application, database, and OS layers are tightly integrated, they form a single software ecosystem. If an attacker compromises the OS or database, they can bypass application-level security controls, exfiltrate data, or cause a denial-of-service, even if the SAP application itself is secure.
How many vulnerability checks does the extension perform on Microsoft platforms?
The Cybersecurity Extension for SAP performs automated scans to detect more than 300 known security weaknesses in Microsoft SQL Server and Microsoft Server, in addition to over 2000 checks for SAP solutions.
What indicators of compromise does the extension monitor?
It monitors database and operating logs for system changes, direct table access, password changes, failed logons, firewall activity, service activations, and changes to system auditing, alerting security teams to potential incidents via email or SMS.