Today’s topics include a Cloud Security Alliance study addressing moving ERP applications to the cloud, and the open-source Metasploit Framework 5.0 improving security testing.
According to a Cloud Security Alliance study sponsored by Onapsis and released on Jan. 11, 69 percent of organizations are moving data for popular enterprise resource planning platforms including SAP and Oracle to the cloud, but there are still a number of misconceptions about security.
According to JP Perez-Etchegoyen, Onapsis’ CTO and CSA ERP Security Working Group chair, “Given the complexity of ERP applications, we still see organizations focusing their ERP security strategy in foundational security such as [Identity and Access Management], [Governance Risk and Compliance] and [Segregation of Duties]. But security must be addressed holistically, and it should consider other aspects such as ERP customizations, ERP configurations, ERP monitoring, ERP integrations, ERP vulnerabilities and other ERP risks.”
The study found that among the security controls used to help protect ERP deployments in the cloud, Identity and Access Management controls are used by 68 percent of organizations. Other tools frequently used include firewalls and vulnerability assessment.
The open-source Metasploit Framework penetration testing technology has now been updated with the new 5.0 release, allowing researchers to test exploits against targets to see if they are at risk, in an attempt to penetrate the defensive measures that are in place.
The 5.0 release of Metasploit introduces multiple new and enhanced capabilities, including automation APIs, evasion modules and usability improvements. The Metasploit 5.0 update is the first major version change since Metasploit 4 was released in 2011.
Among the core new features in Metasploit 5.0 is the extensibility of the framework’s database back end, which can now be run as a REST web service. By extending the database as a web service, multiple external tools can pull from the same base and interact with each other.