SAP Administration II
SUIM User information system
In this article on SAP Security Automation I would like to take a look at the future of automated processes in the SAP Security area. For many companies, the topic of security automation still offers a lot of potential in terms of time savings and process optimisation. Our daily work environment offers numerous tasks that could be handled excellently automatically. For this reason, in this article I present two of the possibilities that already exist in the broad area of security automation. Security Automation via SAP Security Check The first option of Security Automation, which I want to introduce here, is the automatic verification of the existing permissions. Have you ever wondered who has critical permissions in your SAP system? And have you ever tried to do this by hand? Depending on the level of expertise and experience of the privilege administrator, this is a time-consuming work. If an audit is also announced and the SAP system is to be checked for critical permissions and segregation of duties, then it is very difficult to meet all requirements and secure the eligibility landscape in this respect. For this reason, various vendors provide solutions to automate the verification of the permission system with regard to critical permissions and segregation of duties using tool support. This allows permission administrators to use their valuable time to correct the errors rather than just looking for them. For example, we use a tool that runs through the verification of over 250 rules. We then get an evaluation of which rules are violated and which points are correct. A simple example of such rules is the use of the SAP_ALL profile. Another would be to grant the jump permission in debugging (S_DEVELOP permission object with the ACTVT = 02 field). These are two relatively simple examples of Security Check tools' rulebook. In addition, queries are also made, which are located in the field of Segregation of Duties. Using this tool allowed us to move from manual validation of critical permissions to an automatic process.
Reachable at any time: Your competent contact person is available at all times. If you operate SAP Basis Support in your own company, personnel bottlenecks may occur. If your SAP employees are absent due to illness or vacation, there may be no equivalent replacement available.
Authorizations
The SAP Patch Manager (SPAM) is the online correction support (OCS) customer site. The SPAM transaction gives you the ability to easily and efficiently import support packages provided by SAP into your system. Depending on the system used or the configuration of your system, you must insert different types of Support Packages [page 8]. You will receive support packages in SAPNet - Web Frontend, in SAPNet - R/3 Frontend or on Collection CDs. Since SPAM runs within the SAP system, you do not need to know the operating system to handle the transaction. In the language usage of SAP, the term patch has been replaced by the term support package. Note that you can only work with this transaction in SAP GUI for Java and SAP GUI for Windows.
SPAM/SAINT updates (SPAM update) provide updates and improvements to SAP Patch Manager and SAP Add-On Installation Tool. There is always one SPAM update per review that will be updated over time. The version can be found in the short description, e.g.: SPAM/SAINT update - version 4.6A/0001 A SPAM update always comes first in the list of support packages in the SAPNet - R/3 frontend, i.e. before the other support packages. We recommend that you always install the latest version of a SPAM update before installing Support Packages. Prerequisites You can successfully commit a SPAM update only if there are no broken support packages in the system. If there are cancelled support packages, a dialogue box will alert you. You have two options: You will first complete the queue and then the SPAM update. You reset the status of the queue, play the SPAM update first and then the queue. You can reset the status of the Queue by using the Add Status Reset Queue. Note that your system is inconsistent when you reset the queue after objects have already been imported (for example, after an error in the DDIC_IMPORT step and following). Therefore, you should only reset the queue if DDIC_IMPORT was cancelled before the step. For more information, see Steps of the SPAM [page 26]. Note that starting with SPAM/SAINT version 11, it is no longer possible to reset the queue after the DDIC_IMPORT step and following. How to Check if the SPAM update you are offering is newer than the one you are receiving. The current SPAM version appears in the title bar of the SPAM window. To play the latest SPAM update, select Support Package Insert SPAMUpdate. SPAM updates are automatically confirmed after successful insertion. Load Support Package Usage Before you can insert Support Packages, you must first load the appropriate Support Packages.
Tools such as "Shortcut for SAP Systems" are extremely useful in basic administration.
They work with it on a daily basis and can provide quick solutions to concrete problems.
SAP Basis refers to the administration of SAP system that includes activities like installation and configuration, load balancing, and performance of SAP applications running on Java stack and SAP ABAP. This includes the maintenance of different services related to database, operating system, application and web servers in SAP system landscape and stopping and starting the system. Here you can find some useful information about SAP Basis: www.sap-corner.de.
EARLY INVOLVEMENT IN THE PROJECT IS ESSENTIAL.