Why There’s No Malware Protection Guarantee–Even for SAP

If Benjamin Franklin were alive today, he would likely expand his famous aphorism to say: “There are only three certainties in life—death and taxes—and malware.”

Malware is a certainty in life and business because there is no way to protect your organization against the damage of malware attacks everywhere, all the time.

There are no malware protection guarantees. Not in this day and age.

Instead, for the best malware protection, you must implement multiple layers of defense, with each layer doing the best job possible.

Why 100% Malware Protection Is Impossible

There are no malware protection guarantees because no single tool or piece of hardware can provide 100% malware protection. One reason for this is that protections against cyber attacks have traditionally been deep but narrow. Another reason is the vast number of attack vectors.

Depth versus breadth

Software and hardware vendors in the cybersecurity space have typically concentrated on protecting a few types of data really well. These vendors have developed data-loss-prevention solutions, information-rights-management applications, encryption methods and other niche offerings that delivered protection that was an inch wide but a mile deep.

But what’s needed today is broad protection. Solutions must be designed to protect as much data as possible, in as many places as possible, all the time.

Multiple attack vectors

Another reason that 100% malware protection is impossible to guarantee? It’s because the number of attack vectors is ever growing. There are only three attack surfaces (digital, physical, and social engineering), but there are dozens of attack vectors. These include, in alphabetical order:

1. Brute force attacks
2. Compromised user credentials
3. Cross-site scripting
4. Distributed denial of service
5. Insider attacks
6. Man-in-the-middle attacks
7. Misconfigured systems
8. Missing encryption
9. Phishing
10. Poor encryption
11. Ransomware
12. Session hijacking
13. SQL injections
14. Trojans
15. Vulnerabilities from third-party and fourth-party suppliers
16. Weak user credentials

Cybersecurity companies face an immense challenge in designing applications and hardware that protect organizations across all attack surfaces and against all attack vectors.

The Best Defense Is Layered Defense

The best way to protect corporate networks and data against malware is to use a layered approach. Don’t rely on one or even a few solutions. You must build a defense that uses multiple tools and policies that protect all areas of your network against multiple types of attack.

This layered defense, which is also called a multilayered defense, or defense in-depth, must protect your organization at varying levels of vulnerability, namely:

• System level
• Network level
• Transmission level
• Application level

The Open Systems Interconnection (OSI) model takes this layered approach even further, defining seven levels of IT security:

1. Human Layer
2. Perimeter Layer
3. Network Layer
4. Endpoint Layer
5. Application Layer
6. Data Layer
7. Mission Critical Assets

The primary goal of a multilayered approach to security is cyber resilience, the ability to prepare for, respond to and recover from cyber threats in agile ways. Organizations that are cyber resilient have the tools, policies and training in place to adapt to known and unknown cyber threats quickly and effectively—an absolute must to combat today’s sophisticated and ravenous cyberattackers.

Third-party Software and SAP Applications

If your organization uses SAP software, then one of the reasons you do not have 100% protection against malware is that SAP does not offer this protection. Even third-party, enterprise-level anti-virus solutions fail to protect SAP. This is because files uploaded to SAP are encrypted in transit and then stored in an SAP-proprietary repository. Operating system anti-virus programs can’t scan these files for threats. And even though SAP has an anti-virus interface (NW-VSI), regular anti-virus software is not compatible with this interface.

To protect your SAP systems against viruses and your SAP applications against content-based attacks, you require software that’s built specifically for SAP, such as bowbridge Anti-Virus for SAP Solutions and Application Security for SAP Solutions. These solutions are both built on expertise in SAP and information technology to deliver robust protection against cyberattacks, while working seamlessly with SAP’s unique internal architecture.

It's also worth noting that bowbridge Anti-Virus for SAP Solutions is the only solution that allows multiple layers of anti-virus scanning within the product itself, as it's the only product that contains multiple commercial enterprise-grade virus scanning engines (specifically, McAfee and Sophos). 

Better Malware Protection Requires Covering All Your Bases

Can you get 100% guaranteed protection against any and all malware touching your organization?

Unfortunately, no.

Cyber attacks continue to skyrocket both in volume, scope and sophistication. As such, organizations need to look at ways in which their existing cybersecurity solutions could be reinforced. Just as multiple layers on an air filter block more impurities, multiple layers for your cybersecurity are an effective filter for malware – keeping your organization breathing easily.

To keep cyber attackers from using FIORI's vulnerabilities to penetrate your SAP applications and networks, read our guide: Introduction to SAP FIORI Cybersecurity. Once you understand the cybersecurity risks that are inherent to SAP FIORI, you can take steps to protect your business and its sensitive data. That’s a certainty.