An SAP system holds a company most sensitive data โ financials, partners, prices, personnel. Securing it is a core Basis responsibility.
Default users
| User | Purpose | Action |
|---|---|---|
| SAP* | Superuser with all authorisations | Change the password and lock |
| DDIC | Dictionary; used by installation and updates | Change the password, normally lock |
| SAPCPIC | Legacy CPI-C communication | Delete if unused |
| EARLYWATCH | Monitoring | Change the password or delete |
| TMSADM | TMS communication | Change the password |
Security parameters
| Parameter | Controls |
|---|---|
| login/min_password_lng | Minimum password length |
| login/password_expiration_time | Password lifetime |
| login/fails_to_user_lock | Failed attempts before locking |
| login/disable_multi_gui_login | Concurrent logons for one user |
| login/no_automatic_user_sapstar | The SAP* emergency path |
| rfc/reject_expired_passwd | Rejecting RFC with expired passwords |
The security audit log
| Event | Why |
|---|---|
| Failed logons | Detect attempted intrusion |
| SAP* and DDIC logons | Track privileged account use |
| User master changes | Detect improper authorisation grants |
| Transaction starts | Record of sensitive activity |
| RFC calls | External access |
| Direct report execution | Running programs through SE38 |
RFC connections
Network protection
| Measure | Content |
|---|---|
| SNC | Encrypting GUI to server traffic |
| SAP Router | Access control and routing for external connections |
| Web Dispatcher | HTTP distribution and SSL termination |
| Firewall | Closing unnecessary ports |
| Gateway configuration | reginfo and secinfo restricting external program registration |
Periodic review
- Who holds SAP_ALL (SUIM)
- Locking users who have not logged on for a long time
- Accounts belonging to people who have left
- Segregation-of-duties conflicts
- Production users holding debug authorisation (S_DEVELOP)
- Security-related SAP Notes not yet applied
- Security findings in the EarlyWatch Alert report