ST03N Workload monitor
Why do you need SAP Basis admins in your company?
This makes the technical user the dialogue user and a login in the SAP system is unrestricted. So Johannes logs in with the known password of the RFC user in the production system. Thanks to very extensive permissions, it now has access to all sorts of critical tables, transactions, and programmes in production. With the identity of the RFC user Johannes starts with the technical compromise of the production system... RFC Security: All invented - or everyday threat? Whether a simple trim, altered biometric properties or an encapsulated technical user in the SAP system: the basis of the compromise is the same. A person uses a different identity to gain access and permissions to protected areas. Moreover, the evil in all three stories could have been prevented by pro-activity. When was the last time you thought about the security of your RFC interfaces? Can you say with certainty that all your technical RFC users only have the permissions they actually need? And do you know who exactly knows the passwords of these users? Can you 100% rule out that not now in this moment an SAP user with a false identity infiltrates your production systems? Change now: It's about pro activity! But before you start now and start looking for the "identity converter" (which I really do not recommend!), I suggest that you take root of evil and proactively strengthen your RFC security. So if you want to find out more, I have the following 3 tips for you: 1) Our e-book about SAP RFC interfaces 2) Clean up our free webinar about RFC interfaces 3) Blog post about our approach to optimising RFC interfaces As always, I look forward to your feedback and comments directly below these lines!
Automation of processes In an IDM, IT business processes, creating, modifying and deleting a user are defined centrally by means of a unique set of rules. All the necessary steps are then completed using automated workflows. User administration no longer has to be administered separately for each system, but only in a single point of administration. Data Consistency Employee data is created only once in a leading system in an IDM architecture. All attached systems use this data in their user management on demand. In a change of department or a new activity, permissions are automatically adjusted. Security and Documentation In a centralised user administration, users can be locked down efficiently on all systems or access rights can be changed. The connection to the personnel process automatically initiates the change process as soon as the master record is adjusted in the Human Resources Department. Documentation solutions can also be used to archive all processes without any gaps. This creates transparency which also facilitates the detection of a functioning and secure authorisation concept during audit tests. Requirements for IDM systems People get electronic identity attributes describe the role of the person Quality requirements Reliability: Abuse prevention Readability: Documentation and logging Failover: Back-up systems in compliance with legal requirements Data Protection Act What should be taken into account in application processes? When implementing an IDM and also in the day-to-day operation of an IDM, there are certain things that should be taken into account when applying. I have summarised the most important points in the form of a checklist.
SM20 Evaluation of the Security Auditlog
Presentation layer: The presentation layer is the top layer of the R/3 SAP Basis system and includes communication with the user. Here, the data is graphically prepared for the user on the terminal device by means of software components from the application programs of the application layer. The presentation layer represents the interface to the user (SAP GUI).
Therefore, there can also be critical permissions, profiles, and roles that do not fit in the naming scheme defined by SAP. Manual identification of critical SAP permissions is difficult overall. However, tools are available that automatically check for critical permissions. In this case, the critical SAP permissions are usually predefined by special verification software. If the critical permissions, profiles, and roles are identified, they should be adjusted according to the permission planning. The system will then be checked to see if the desired system behaviour has been achieved or if malfunctions occur. This adjustment process may be complex in the event of major changes and should not be carried out on the production system.
Tools such as "Shortcut for SAP Systems" are extremely useful in basic administration.
System copy, system update, etc.
This includes several possible implementation variants: for example, SAP GUI for HTML (Web GUI) and Web Dynpro for ABAP (WDA).