Challenges in authorization management
General authorizations
When were which changes made to a role (PFCG)? In the PFCG, click on Utilities > View Changes in the menu at the top to view the change documents. You will see a detailed list of which user made which change to which object and when.
How do I make an authorization trace on a user (STAUTHTRACE)? With the authorization trace you can record which authorization objects are used by a user. This helps, for example, in the creation of suitable roles: - Call the transaction STAUTHTRACE - Specify the desired user and start the trace - Let the user call his transaction - Stop the trace (Important, do not forget!) - Evaluate the results.
Set up login locks securely
The SAP HANA Studio application is available for maintaining and assigning HANA permissions to users. The SAP HANA Studio is installed on your workstation. You can then log in to one or more HANA databases with the user and password. The SAP HANA Studio and HANADatenbank are currently subject to extensive further developments; Therefore, the respective versions of the SAP HANA studio must be compatible with the HANA databases to be connected. For this reason, we recommend that you check the information about the use of certain versions of SAP HANA Studio in the SAP Notes.
The security audit log is evaluated via the SM20 or SM20N transaction or the RSAU_SELECT_EVENTS report. We recommend using the report as you have more options to personalise the evaluation and to include archived logs of different application servers in the evaluation.
Secure your go-live additionally with "Shortcut for SAP systems". You can assign necessary SAP authorizations quickly and easily directly in the system.
It is not difficult to find guidance on exploiting these vulnerabilities in relevant internet forums.
At www.sap-corner.de you will also find a lot of useful information on the subject of SAP authorizations.
The security section of the ESC is the entry point for the evaluation of permissions; Therefore, it currently contains the following seven critical tests: Super User Accounts (accounts with the SAP_ALL permission profile), users with the Display all Tables permission, users with the Start all Reports permission, users with the Debug/Replace permission, users with the Display Other Users Spool Request permission, users with the Administer RFC Connections permission, users with the Reset/Change User Passwords permission.