PLATFORM
Protect your SAP applications with our comprehensive SAP security solution that addresses all your security needs. Our platform seamlessly integrates within your SAP environment and provides actionable insights in hours. Reduce the risk of data breaches and compliance violations with our trusted solution.
Incident & Response
Get complete visibility into your SAP security, custom code risks, and vulnerabilities with the SecurityBridge platform.
Our brochure provides detailed information on how our platform can help protect your company from cyber threats. Discover how our cutting-edge technology helps you identify and address security risks in real-time. Download our brochure today to learn more.
SecurityBridge
Customers around the Globe rely on us
“We selected SecurityBridge as the platform most comprehensive in functionality that is completely and seamlessly integrated within the SAP technology stack. SecurityBridge’s agile and holistic approach enable us to transition very quickly and smoothly.”
Stéphane Peteytas, Head of SAP Cybersecurity at Sanofi
SecurityBridge
PARTNERs & ALLIANCES
“The expansion of our partnership with SecurityBridge is an important step in complementing our portfolio. It will help us strengthen our position in a dynamic market environment and underpin our leading role as SAP Partner.”
EVP, Global Innovation & IP, Global SAP Alliances & Region NEE
NTT DATA Business Solutions AG
Protect Your Business: How SecurityBridge Can Keep Your Organization Safe
Introducing the first and only holistic, natively integrated SAP security product that addresses all aspects necessary to protect organizations against cyber threats. The SecurityBridge Platform identifies SAP vulnerabilities and risks, providing mitigation measures to safeguard your organization’s critical assets. With our product, you can rest assured that your business is protected against potential security breaches.
Fast implementation, rapid discovery, actionable insights. Advanced SAP security technology includes anomaly detection for identifying sophisticated threats.
Eliminate false positives, optimize Security Analyst’s effort with a specialized Security Operation Center (SOC) integration for SAP.
Experience truly integrated real-time threat monitoring with SecurityBridge for SAP Threat Detection. Evolving results increase awareness of your organization’s threat posture.
Streamline your SOC team’s focus with SecurityBridge, the easy-to-maintain, deploy, and install SAP security solution.
Experience a unified platform with SecurityBridge. Our open architecture enables intelligent sharing of findings across all modules.
Streamline your security operations with the SAP SIEM connector. Our platform offers seamless, out-of-the-box integration with leading SIEM products.
Automate Patch detection with SecurityBridge. Our platform detects missing patches, including SNotes and SAP Kernel Patches, for a timely implementation.
Get a single source of truth with our Dashboard, providing comprehensive insights in one place.
Report security incidents with one click, document risk acceptance inline, and access the integrated knowledge base.
Ready to meet security like never before?
BUSINESS CASE CALCULATOR
How much can you save?
Calculate an individual business case for SecurityBridge usage and related improvement.
CYBER SECURITY
Customer Security Story
Reinforcing the security of the global organization.
Learn more
Press
Resilience, security, and responsiveness are your core operational requirements. Our solutions help you to deliver your…
Discover our press centre
alliance
How to detect SAP Attacks?
SecurityBridge integrates with Fortinet’s FortiGate a NextGen Firewall to increase the accuracy of detecting attacks on SAP applications.
Recent Highlights
The Platform receives frequent updates of attack detection patterns, compliance rules, and SAP security features. In our publications, we also inform you about active threats or security trends for SAP customers.
Engineering an expansion: Meet Barry, our North America Sales Engineer
Today, we share the experience and insights of one of our Sales Engineers and new joiners – Barry Snow. Learn more about his influential role, gain invaluable insights into life at SecurityBridge, and uncover his opinion regarding the true impact of our product.
SAP RFC: The Power of Process Integration is Nothing Without Security
Seamless integration and efficient communication between software systems is crucial to optimize organizations’ operations and efficiency, especially in today’s rapidly evolving digital landscape. SAP Remote Function Call (RFC) is an SAP vital component that permits secure and trustworthy communication between SAP systems and external applications. Explore in this article how SAP RFC can help you streamline integration and data exchange and how you can secure RFC communications to ensure business continuity.
SAP Security Patch Day – July 2023
Today is July 11th, the 192nd day of 2023, and it’s SAP Security Patch Day! SAP’s Response Team has released 17 security updates (containing 2 updates from previous releases), including two with Hot News Priority and several High Priority patches.
Protecting SAP Against ICMAD Vulnerabilities: Effective and Automated Security Measures
SAP ICMAD Vulnerabilities are those vulnerabilities that are present in the ICM component of SAP, including SAP NetWeaver, S/4HANA, and SAP Web Dispatcher.
LifeAtSecurityBridge: Building our pipeline with Amber, Business Development Director
At SecurityBridge, we’re fortunate to be surrounded by a team of outstanding professionals. Our team is constantly working to position SecurityBridge as the leading cybersecurity platform for SAP systems. With this in mind, we have decided to introduce you to the talented individuals who drive our operations behind the scenes. Meet Amber, our Business Development Director, and discover her pivotal role, gain insights into our values, and uncover her forecast concerning our market and product.
ASUG Best Practices: Oil, Gas, and Energy
Learn from Oil, Gas, and Energy SAP Users, just like you.
Get ready to ignite your energy enterprise! Join us at the ASUG Best Practices: SAP for Oil, Gas, and Energy event in Dallas from Sept. 13-15, 2023.
Sorry, you have been blocked
This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.
What can I do to resolve this?
You can email the site owner to let them know you were blocked. Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.
Cloudflare Ray ID: 7e94ea696d6d3267 • Your IP: Click to reveal 178.132.110.75 • Performance & security by Cloudflare
Bridge Security
While developing the security protocols for the XP.NETWORK bridge, we have used NISTIR 8286A (2nd draft) — the Interagency Report 8286A, entitled ‘Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management (ERM)’, by the US National Institute of Standards and Technology.
Apart from the report, we’ve aligned the cyber security risk management (CSRM) features of the NFT bridge with the NIST framework v1.1. The core of the framework are the five functions: Identify, Protect, Detect, Respond, and Recover. For each of these functions, there is a set of outcome categories – things that an organization has to do to keep its systems and users safe.
The following table summarizes how the NIST framework applies to the XP.NETWORK bridge infrastructure:
| Functions | Implementation | Categories |
|---|---|---|
| Identify | Understand the impact of cyber security risks on the bridge, its users and their assets (NFTs) | Bridge Systems Users & Team Assets (NFTs) |
| Protect | Safeguard persistent bridge functionality by limiting or containing the impact of potential security events | Employee Identity management, Awareness & Training (users, employees), KYC Data Security, Bridge Maintenance in the working state |
| Detect | Timely detect cybersecurity events by continuous monitoring | SCs / Validators’ Anomalies Detecting Cyber Security Events |
| Respond | Stopping, limiting or containing potential or ongoing incidents | Incident response planning Incident mitigation roadmaps |
| Recover | Restore the capabilities impacted by an event | Backing up and recovery Hardening and resilience improvements |
Layers of security
Since risks can originate from multiple sources, we have implemented a layered security system where a potential penetration through one of the layers, instead of allowing the attacker to exploit a hypothetical vulnerability, exposes their ‘footprints’ to the internal security wardens. Meanwhile, the attacker runs into subsequent layers of protection that are even harder to penetrate.
Smart contract audit
Due to the different nature of the bridge components, the means of their protection vary. As discussed earlier, the bridge consists of on-chain smart contracts, which are publicly available (and whose binary code can in many cases be restored to a human-readable form), and off-chain relay validators, responsible for mirroring the state of the source chain to the chosen target chain.
A smart contract requires proper code review, penetration testing, and audit before it is deployed to the blockchain. Once a contract goes live, any bugs or vulnerabilities in it cannot be fixed: the only remedy is to redeploy the contract from scratch.
Even the most popular smart contracts can contain vulnerabilities and get exploited; LarvaLabs’ famous CryptoPunk NFTs are a good example. As part of a community https://github.com/larvalabs/cryptopunks/issues/1#issuecomment-309288762 loyalty campaign, every user who had a CryptoPunk could mint one random Meebit (a new type of digital character) for free. There was a small chance that the resulting Meebit would turn out to have rare features and thus would be very expensive. A user under the name 0xNietzsche found a way to exploit the contract and minted Meebits repeatedly with the same CryptoPunk until he obtained a rare Meebit, which he immediately sold for ETH 200, having spent only ETH 5 on transaction fees.
To avoid such mishaps, all XP.NETWORK smart contracts undergo meticulous testing before deployment, including penetration testing and code audit by the industry’s acknowledged security companies. Apart from verifying that there are no bugs and vulnerabilities, the audit confirms the integrity of the contract’s binary code and in the way data associated with it moves between accounts.
Validator penetration testing
Off-chain relay validators are more complex than smart contracts, because they are composed of multiple parts residing on different physical or virtual machines. The first layer of security we apply to validators are the classic cyber security protocols that protect validators from physical access and human error.
Another preventive measure is validator penetration testing. It simulates attacks by black-hat (malicious) hackers, who range from professionals equipped with sophisticated hardware and software to young coding prodigies who may accidentally discover a contract vulnerability and exploit it, resulting in asset theft or reputational damage.
While XP.NETWORK will contract skilled white-hat hackers to simulate professional attacks, we will also introduce a community bug bounty program for users who can reproduce attacks by amateurs. These talented enthusiasts within the community will be rewarded if they discover unexpected and potentially dangerous contract behavior.
Elliptic-curve cryptography and digital signatures
Asymmetric cryptography is the cornerstone of modern cyber security. Initially only governments had access to such tools, but in 1970 a pioneering paper entitled ‘New Directions in Cryptography’ (by Martin Hellman, Whitfield Diffie, and Ralph Merkle) opened up the possibilities of public-key cryptography to the wider world. Blockchain technology owes its existence to this fundamental breakthrough.
A blockchain account is in fact a key pair tuple (PK, SK). The PK or public key can be safely displayed anywhere and serves as a unique identifier of an otherwise anonymous user on the blockchain. Sometimes a public key is accompanied by a https://etherscan.io/address/0x270ff2308a29099744230de56e7b41c8ced46ffb chain-specific prefix like “0x” or “erd”, which can make it incompatible with other chains, even if they use the same encryption algorithm.
Private keys are used to sign transactions and must be kept secret from anyone except the owner of the account. A private key falling into the wrong hand will result in asset theft or other malicious activity on the chain.
One can derive an unlimited number of public keys from a single private key using so-called elliptic curve cryptography, but it’s impossible to recreate a private key based on a public key – at least within a reasonable amount of time and using today’s technology. There is a possibility that quantum computers of the future will be able to reverse-engineer private keys, but this should not become a practical concern for at least a few more years.
XP.network’s relay validators use blockchain key pairs to participate in the multisig process and submit their signatures to bridge smart contracts on target chains. The exact signature algorithm varies: most EVM-compatible chains use ECDSA (Elliptic Curve Digital Signature Algorithm), namely the secp256k1 curve for back compatibility with Bitcoin. Non-EVM chains like Elrond, Algorand, Solana, and Cardano use the Edwards Curve (Ed25519) algorithm. Ontology is EVM-compatible and uses ECDSA, but with the NIST P-256 curve.
BFT tolerance and multisignature
A distributed system should be able to function even when some of its members (nodes) become unavailable or start behaving maliciously – in other words, it should be fault-tolerant. The term ‘Byzantine Fault Tolerance’ comes from a 1982 paper entitled “The Byzantine Generals Problem’. It describes a group of generals who have to arrive at a consensus decision by sending messengers to each other. However, some of the generals and messengers can be traitors and pass on false messages to sabotage the enterprise. The solution is to send more messengers than necessary, so that the whole army can still function if some of the agents become unreliable.
Replicating the messenger analogy, in XP.NETWORK a group of physically separated validators comprise the validator pool to avoid a single point of failure. In order for a transaction to be acknowledged as valid, a BFT threshold of ⅔ + 1 signatures must be collected. Signature collection takes place in the smart contract on the target blockchain bridge, which is immutable and protected by the blockchain’s validators. At least 67% of the validators must sign a proposed transaction for it to succeed.
Thanks to the BFT consensus, up to ⅓ of the validators can act maliciously or be down without any damage to the bridge functionality, since they will be ignored by the smart contracts. System consensus will still be reached even if 33% of the validators are down or attempt to act maliciously. It makes the system resistant to the notorious 51% or even 66% attacks.
While high availability of the validators is crucial for the bridge to work smoothly, sometimes validator nodes will go offline or lag. This can happen due to network congestion, cloud server maintenance, etc. There will be a threshold of downtime tolerance, but excessive downtime will be penalized – just like intentional misbehavior, such as double signing or signing transactions that other validators don’t confirm. The validators caught misbehaving are excluded from the pool, and their XPNET stakes are slashed (i.e. some of their XPNET are taken away as a fine).
Network, Endpoint & Cloud Security requirements for the bridge validators
Since validators are composed of multiple components hosted on remote physical or virtual servers, they need a secure way to communicate with the bridged blockchains. The required validator cloud server settings are as follows:
Validators must be hosted behind a proxy firewall with a small number of whitelisted IP addresses.
Ports for accessing the instances must not be assigned common port numbers like 22, 80, or 443. Unusual high-numbered ports should be used to make them more difficult to detect using port scanners.
All communications are TLS 1.2 or TLS 1.3-encrypted, whereas in TLS v 1.2 only secure cypher suites are allowed. Backward compatibility with TLS v 1.1 and 1.0, as well as SSL and certificate downgrading, are not supported.
DoS & DDoS protection rate limit is imposed, and excessively inquisitive IPs are blacklisted.
Validator endpoints are set up to be resistant to all relevant OWASP vulnerabilities such as directory listing, directory traversal, source code disclosure, security misconfiguration, insecure deserialization of incoming data, etc.
Endpoint operating systems should have an uptime of at least 99% and the latest security patches with no default configurations. No weak authentication mechanisms are allowed. 2FA must be implemented on all employee accounts that have access to the validators. Incidents are logged and reported to the XP.NETWORK team and the entity controlling the corresponding validator.
Endpoint vulnerability scans are executed on a daily basis.
Perimeter security
The physical security of a facility is often overlooked, and yet it’s a common attack vector. For example, even if a computer that contains crucial digital assets is kept unplugged from the internet, a nefarious agent can penetrate the room and infect the device with a virus stored on a USB drive. Alternatively, attackers can bribe an employee to steal or infect files, and so forth.
To prevent such physical penetration attacks, XP.NETWORK will create a so-called zero-trust DMZ (exclusion zone). Apart from fingerprint entry control, employees will be able to access only those data, equipment, and software that are required to do their job. The ‘exclusion zone’ will prevent employees from unintentionally or deliberately infecting the systems with spyware or exposing sensitive data. The zero-trust strategy makes phishing or social engineering attacks against random company employees less effective, if useful at all.
Data Security and the human factor
XP.NETWORK will never request, store, or access any of the sensitive user data: mnemonics (seed phrase) and private keys. These will always be stored on user devices. The private key is needed for bridged blockchain wallets to sign user-initiated transactions, while mnemonics (usually a set of 12-14 words) is used to restore an account or attach it to a new wallet. Bridge transactions are signed directly from wallets, such as Metamask, ElrondWallet, etc and never by the bridge.
As noted above, it is the user’s responsibility to manage the private key (PK) in a secure manner – and this also applies to XP.NETWORK employees and everyone involved with the bridge infrastructure. In 95% of cyber breaches, a human error is involved, such as exposing a private key as a result of a phishing or a social engineering attack. Therefore, proper key management, including key back-ups and protection with other defence tools, is critical for controlling the human factor risks.
People involved in bridge interactions can be broadly divided in several categories, for each of which we’ve implemented different security protocols depending on the level of access and therefore potential impact on the system.
The Proton Mail Bridge security model
Proton Mail Bridge is a desktop application that runs in the background on your computer and encrypts and decrypts your mail as it enters and leaves your device. It allows for full integration of your Proton Mail account with email clients like Microsoft Outlook, Mozilla Thunderbird, and Apple Mail.
This document discusses how Bridge handles sensitive information, describes its potential attack vectors, and explains the security features that mitigate these attacks. (Note: This security model applies to the Bridge application for Linux, macOS, and Windows.)
This security model is technical in nature, but was written in plain language so that the average user can understand the important takeaways. You can also read more about what Proton Mail is and is not designed to protect you from in the Proton Mail threat model (new window) .
You can view Bridge’s open source code on GitHub (new window) , review the security audit report (new window) by SEC Consult, and read more about it in our open source Bridge announcement (new window) .
Bridge security features
As part of normal, day-to-day operations, Bridge must handle different types of data with varying levels of sensitivity. This data includes (but is not limited to):
- User credentials and an access token for authentication with the Proton servers
- Public and private keys for sending and reading messages
- Encrypted messages, attachments, and metadata
We explain how Bridge secures this sensitive data in greater detail below.
Your passwords never leave your machine
Users log in to Bridge, which in turn authenticates with the Proton Mail API using the Secure Remote Password protocol (new window) . This authentication process ensures a user’s password never leaves their machine, and it generates an access token and a refresh token.
The access token is relatively short-lived and is used to authenticate any subsequent API requests; it is stored in the device’s memory. The refresh token is used to generate new access tokens and is stored securely in the operating system’s keychain (Windows Credentials Manager, macOS Keychain, or pass/gnome-keyring on Linux). The user’s hashed and salted mailbox password (used to decrypt their PGP keys) and Bridge password (used to connect an email client to Bridge) are also held in the operating system’s keychain.
Ensuring a secure connection to Proton servers
Bridge communicates with the Proton Mail API over an encrypted TLS connection. It additionally employs TLS certificate public key pinning to ensure it only connects to trusted Proton Mail servers. If Bridge receives an untrusted public key, it will assume an unknown intermediary is pretending to be a Proton server and immediately warn the user.
Bridge never stores or shares a user’s PGP keys
After the user logs in, Bridge downloads their encrypted, private PGP keys from the Proton servers and unlocks them. These keys are held in the device’s memory, never on disk. Whenever a user turns off their device, they wipe its memory. This makes it unlikely an attacker will be able to obtain a copy of a user’s PGP keys, even if they steal the user’s device. These keys are also never shared with other applications on your device and stay within Bridge’s memory space.
Bridge does not store decrypted message data
When an IMAP client requests a message body or attachment, it is downloaded from the Proton servers as an encrypted PGP message, decrypted locally, and then transmitted to the IMAP client. Similar to the user’s PGP keys, Bridge does not permanently store any message bodies or attachments to disk, further reducing the amount of sensitive data available on the device.
Attack mitigation
Here we describe the potential attack vectors of Bridge and how we mitigate these attacks.
Reducing the threat of a MITM attack
As described, Bridge employs TLS certificate pinning, which mitigates the risk of a network-level man-in-the-middle (MITM) attack.
Furthermore, the content of messages sent from Bridge to Proton Mail users or external recipients using PGP has an additional layer of protection thanks to end-to-end encryption. This means Bridge encrypts the user’s message before it leaves their device. The message remains encrypted until it reaches the recipient’s device, which decrypts it. This prevents any third party, including Proton Mail, from accessing the content of a user’s message. Messages sent this way remain inaccessible because a user’s mailbox password never leaves their device and, thus, is never transmitted to an attacker.
Secure updates
Bridge on Windows and macOS includes a feature that allows it to self-update. The update process has additional safeguards in place to verify that only trusted versions of Bridge that are created and signed by Proton Mail are installed.
Bridge recommended use cases
Bridge is a unique tool when compared to the other Proton Mail apps. As such, there are specific cases in which it would be more practical and useful than other Proton Mail apps.
Below are some examples of recommended use cases for Bridge:
Offline editing
If you find yourself without a stable Internet connection, you can use your favorite email client with Bridge to download emails while you do have good Internet access and then process them offline later. Most email clients will automatically send and receive your drafts once you are back online.
Offline backups of your emails are required
If you need to have offline copies of your messages for whatever reason, Bridge is the easiest way to accomplish this. The Bridge app enables your IMAP/SMTP client to do this automatically if you choose to do so.
Add Proton Mail security to already known email clients
If you or your staff do not feel confident learning how to use a new email service, Bridge lets you add Proton Mail encryption to your messages while continuing to use your favorite IMAP/SMTP email client. These clients include Outlook, Thunderbird, and Apple Mail, all applications that many people are familiar with. This means that once you set up Bridge, using it does not require any new training.
Bridge security model scope
No application is 100% secure, and no piece of software can protect its user against every potential threat. Proton Mail Bridge is engineered to provide additional protection to its users’ data, but certain conditions are outside of the scope of the security model.
User device security
We assume users run the Bridge app in a safe environment. For instance, we assume that Bridge program files are installed to a location where normal (non-admin) users have no write privileges. Furthermore, we expect the user’s device to be free of any malicious software (keyloggers, screen recorders, memory scanners, etc.) that could access the device’s data in memory or on disk. Bridge, unfortunately, cannot secure your data if your device is already compromised.
Additionally, we assume that the IMAP/SMTP ports that the email client connects to are not exposed beyond the device that Bridge is running on. The Bridge application ignores all connections that do not originate from the localhost, and we assume the user will not attempt to circumvent this.
Bridge installer security
We assume that the user securely downloaded the Bridge installer from our server (the server should present a valid and expected SSL certificate). For Windows and macOS, the operating system inspects the signatures on the installer file automatically before installation. It then displays the results to the user, which we assume they properly verify. We recommend Linux users refer to our support article on Verifying the Proton Mail Bridge package (new window) for instructions. If you download the Bridge application from an unauthorized source, we cannot guarantee the safety of the installer.
Our recommendations for keeping your device secure
We have invested heavily in the security of our Bridge app. You can help maximize the security of your own device by taking a few simple measures:
- Encrypt your device’s hard drive. Windows (new window) and macOS (new window) devices all have built-in encryption systems, but you have to turn them on. Once you have encrypted your drive, write down your recovery code and store it in a secure place.
- Enable your operating system’s antivirus protection, if available.
- Ensure your network ports are secured by a firewall to prevent outside machines from connecting to them.
- Do not install untrusted programs on your device. This includes unknown open source versions of Bridge. Downloading Bridge directly from Proton Mail (new window) is the safest option.
- Do not open links or download attachments from untrusted senders.
Conclusion
Our first priority is always our users’ security. Our goal is to make it easy for anyone to protect their privacy by creating tools that apply advanced cryptography to their messages automatically. The Bridge tool was designed to add additional security to already existing IMAP/SMTP email clients. By keeping your device secure, you can use these email clients and still take charge of your data. Thank you for your support!
We also provide a free VPN service (new window) to protect your privacy.
Proton Mail and Proton VPN are funded by community contributions. If you would like to support our development efforts, you can upgrade to a paid plan (new window) . Thank you for your support.