A routine external scan of a financial institution finds "something" answering on TCP port 3299. It turns out to be an SAP router connected to the internet and the internal network. What is it doing there, and why is the discovery itself a warning sign?

It was set up by the SAP basis team to give the software vendor access for online service and support, as the vendor requires. Since then it has also been used for remote work by external SAP consultants and for data exchange with business partners. If such a component is only found by chance in a scan, it has evidently not been listed among the critical cyber security components.

* One gateway, three kinds of outside users, and direct reach into the SAP systems. *

The institution runs SAP R/3 for accounting and managing its financial business, and its SAP landscape has grown complex over the years, with many external consultants supporting the internal SAP administration. The router was added for one legitimate purpose and quietly accumulated more, without anyone treating it as what it had become: a door in the perimeter.

A side note on the vendor: SAP publishes relatively little freely accessible documentation; most deeper material requires a customer login, which makes independent assessment harder.

Go deeper:

• Port scanner — Wikipedia — the kind of external scan that found the router.
• SAP R/3 — Wikipedia — the ERP system behind the case.