Default users, security parameters, the audit log, protecting RFC connections, and periodic security review.
Contents
An SAP system holds a company most sensitive data — financials, partners, prices, personnel. Securing it is a core Basis responsibility.
Default users
Standard users to deal with
User
Purpose
Action
SAP*
Superuser with all authorisations
Change the password and lock
DDIC
Dictionary; used by installation and updates
Change the password, normally lock
SAPCPIC
Legacy CPI-C communication
Delete if unused
EARLYWATCH
Monitoring
Change the password or delete
TMSADM
TMS communication
Change the password
Security parameters
Parameters to review
Parameter
Controls
login/min_password_lng
Minimum password length
login/password_expiration_time
Password lifetime
login/fails_to_user_lock
Failed attempts before locking
login/disable_multi_gui_login
Concurrent logons for one user
login/no_automatic_user_sapstar
The SAP* emergency path
rfc/reject_expired_passwd
Rejecting RFC with expired passwords
The security audit log
Events worth recording
Event
Why
Failed logons
Detect attempted intrusion
SAP* and DDIC logons
Track privileged account use
User master changes
Detect improper authorisation grants
Transaction starts
Record of sensitive activity
RFC calls
External access
Direct report execution
Running programs through SE38
RFC connections
Network protection
Measure
Content
SNC
Encrypting GUI to server traffic
SAP Router
Access control and routing for external connections
Web Dispatcher
HTTP distribution and SSL termination
Firewall
Closing unnecessary ports
Gateway configuration
reginfo and secinfo restricting external program registration
Periodic review
Who holds SAP_ALL (SUIM)
Locking users who have not logged on for a long time
Accounts belonging to people who have left
Segregation-of-duties conflicts
Production users holding debug authorisation (S_DEVELOP)
Security-related SAP Notes not yet applied
Security findings in the EarlyWatch Alert report
Check your understanding
Test what you just read.
Quiz 1
Which transaction code is used to configure the Security Audit Log?
Quiz 2
Which transaction code is used to display the Security Audit Log?
Quiz 3
Which transaction code manages instance profiles?
Quiz 4
SNC encrypts communication between SAP GUI and the server.
Quiz 5
Password policies can only be configured through ABAP programs.
Quiz 6
Which event is NOT typically recorded by the Security Audit Log?
Hear when the paid version launches
A paid version is in preparation, with no ads, saved learning progress and many more practice questions. Leave your email and you will be told when it launches.
Your email address is used only to announce the paid version.