Quick check of your SAP security settings with the Xiting Authorizations Management Suite (XAMS)
Clear authorization concept
The HANA database (in-memory database) is an in-house development by SAP and brings with it numerous innovations. For example, it is automatically monitored by the system. In addition, it stores not only operational (user-generated) data, but also system data for controlling application content as well as configuration tables.
He has already gathered a lot of helpful information from the day-to-day business in his department: Johannes knows the RFC interfaces and the corresponding technical RFC users from his work with the applications. He also quickly got the password for various RFC users via the radio ("As long as passwords are only communicated by phone and never exchanged in writing, we are clean!"). And that the RFC users are generously entitled even in productive systems is no longer a secret ("Better to have more permissions than too little; the RFC connections have to run, otherwise there is trouble from the specialist areas!"). Since Johannes has access to the SE37 as a developer, it is not a problem to get the necessary access using the function block BAPI_USER_CHANGE - disguised as RFC User. In short, it changes the user type of a technical RFC user in a production system from to by calling the function block.
SAP Security for Administrators
The tasks of a company's own SAP Basis department are undergoing enormous change at many companies, as SAP is also relying more and more on cloud services. Strategically, completely self-hosted SAP systems are becoming rarer and the proportion of customers using an SAP system from the cloud is increasing. The new roles of SAP Basis employees tend to be "enablers" and coordinators between the cloud provider and internal IT and the business departments. Until that time comes, companies can also rely on external service providers to offer expert know-how as well as operational support for the transition period.
If all financial and sales activities as well as production, logistics and the personnel administrators run via one system, measures must be taken to ensure reliable functioning on the one hand and to protect the system internally and externally on the other. Due to the long history, the increased availability requirements often do not match the actual protection measures, so that security risks often arise at this point.
Some missing SAP basic functions in the standard are supplied by the PC application "Shortcut for SAP Systems".
With the help of the ACL files reginfo and secinfo an access control can be implemented, in which allowed as well as forbidden communication partners can be defined.
What do RFC interfaces and RFC security have to do with the play "Hauptmann von Köpenick" and the science fiction film "Minority Report"? Probably more than you like! RFC security and theatre?! Germany, Berlin, 1906: The 46-year-old cobbler Wilhelm Voigt dreams of returning to a normal life.