Legacy ERP systems are often mission-critical for enterprises, yet they rarely support modern security standards such as MFA or SAML/OIDC. According to the ENISA Threat Landscape 2025, phishing remains the primary attack vector, and over 53% of affected organizations belong to critical infrastructure. Completely rewriting an ERP is highly risky, making it more practical to build a Zero Trust security perimeter around it.
Why legacy ERP systems are vulnerable to attacks
Legacy ERPs have several architectural limitations that make it easier for attackers to move laterally within the network:
- lack of built-in multi-factor authentication (MFA);
- excessive user and service account privileges;
- direct network access to servers and databases in flat networks;
- static and long-lived service account passwords.
According to the Cisco Cybersecurity Readiness Index 2025, identity control, device trustworthiness, and network resilience are critical to protecting such systems.
Implications for business
For enterprises and critical infrastructure, leaving legacy ERPs unprotected poses a severe operational risk. Since rewriting these mission-critical systems is practically impossible due to high risks and costs, industries must shift their security paradigm. Failing to secure these systems leads to vulnerability against lateral movement and phishing, potentially compromising sensitive corporate data and halting essential services.
Three stages of building a security perimeter
Three main tools are used to protect legacy ERPs without modifying their code:
- Identity-Aware Proxy (IAP). Positioned in front of the ERP web interface, it redirects users to the corporate Identity Provider for MFA verification. This enables external access control without changing the system's code.
- Privileged Access Management (PAM). Ensures control over administrative sessions, secure storage, and rotation of passwords for servers, databases, and service accounts.
- Microsegmentation. Restricts network flows so that the ERP database server only accepts requests from authorized application servers, and administrative protocols are accessible exclusively via PAM.
Integration security and emergency access
To secure machine-to-machine interactions, it is advisable to use integration gateways that validate tokens and certificates before forwarding requests to the ERP. Additionally, establishing a break-glass emergency access procedure is mandatory in case authentication systems fail. This procedure must include clearly defined backup paths, dedicated accounts, and mandatory activity logging.
Implementation methodology
Implementing the security perimeter is recommended in phases following the NIST AI RMF logic: defining responsibilities (Govern), mapping data flows (Map), testing rules in a pilot environment (Measure), and gradually transitioning users to the new model (Manage).
An external security perimeter does not replace updating the ERP itself or patching vulnerabilities, but it significantly reduces the attack surface and establishes controlled access immediately.
Recommendations
To secure your legacy ERP systems immediately, take the following practical steps:
- Deploy an Identity-Aware Proxy (IAP) to enforce multi-factor authentication (MFA) without changing the ERP code.
- Implement Privileged Access Management (PAM) to secure administrative credentials and session logging.
- Apply microsegmentation to isolate database servers and restrict direct network access.
- Secure integrations using gateways and establish a break-glass emergency access procedure.
- Execute the deployment in phases: Govern, Map, Measure, and Manage.
Prepared by a Software Ukraine member. Original publication.