SAP Security – How Secured are SAP Systems?

SAP is one of the leaders in enterprise application software and has the largest market share in Enterprise Resource Planning or ERP solution . SAP stands for “Systems, Applications and Products” in data processing and provides end-to-end solutions for financials, manufacturing, human resource planning, logistics, distribution, and so. SAP’s application software which comprise of different modules is based on the concepts of specialization and integration.  Each of the modules or products inside the SAP family meets a particular need of an organization and is integrated with the other modules.

Why SAP Needs to Enhance its Product Security?

After evolving in 1993, SAP software has come a long way and is now integrated with web-based tools and technologies. This has made SAP incredibly efficient and it can provide instant solutions to business problems. But with this has come the burden of infrastructure complexity, security issues, and architecture. SAP Security Training for all is an easy to follow, lucid course, which highlights the basic skills required to become an SAP Security administrator in an organization and gives a good insight into all SAP routine administration tasks.

SAP Security Solutions

SAP security cannot be an afterthought for SAP product implementations. The security considerations and security planning should be done at the initial design stage. There are three underlying aspects to all security infrastructure layers – data integrity, user access, and user authorization. It is important for the company implementing SAP products to determine which users can log in securely, how should the log in process be, what are the data the user can view, what the user can do with the data after access is granted, how are the data secured and protected, and how will the data exchange occur back into SAP.

SAP NetWeaver

To address this security issue, SAP NetWeaver Technology has evolved to include SAP security components and infrastructure. In each of SAP’s NetWeaver scenarios, lies a security layer. SAP describes these as usage types, which determine the intended purpose of a system or sub-system. These are available after installing and configuring the different components of SAP.

ABAP WEB AS

Trust Manager and Security Audit Log are the security functions that apply specifically for SAP WEB AS ABAP. Trust Manager is the tools when public-key technology is used with the WEB AS ABAP server and the Security Audit Log is used to keep a track of security-related events on the server. The access passwords are kept encrypted and cannot be accessed by unauthorized users. Before proceeding with SAP WEB AS ABAP, if you want to check out details on SAP ABAP, then SAP ABAP provides a comprehensive online training on ABAP.

SAP Systems support the use of external security product by using the Secure Store and Forward (SSF) mechanism. SSF supports use of digital signatures and document encryption. The SAP WEB AS also supports the Secure Sockets Layer (SSL) protocol, which ensures authentication between communication partners and encrypted communications. SAP WEB AS ABAP supports a number of user authentication mechanisms and here are listed a few of them:

• Using Secure Network Connection: Secure Network Connection (SNC) integrates an external security product with the SAP system to provide additional security functions not directly available with SAP systems. SNC verifies identity and provides authentication, provides data integrity protection, and privacy protection.
• Using User ID and Password: User ID and password are the default authentication mechanism supported by all SAP NetWeaver products. The password set by the administrator must meet the SAP predefined and customer defined password rules and security profile parameter settings
• Using X.509 Client Certificate: The X.509 Client Certificate is a digital identification key which the users need to have. These certificates should be signed by a trusted CA. Apart from protecting the Presentation Layer, this security mechanism can also protect the Transport Layer, and specially protect the HTTP connections between the client and server components.
• User Master Record: This is the storage for all user related information, including authorizations and other user settings. New users can be created by using the SU01 transaction and SU10 can be used to maintain a large number of users. SU10 is used to change logon data, company address, defaults, parameters, roles, profiles, groups, and licensing data on a mass scale.
• Manage User Profile: RZ10 transaction code can be used to manage profiles of all instances running in a SAP R/3 system. By running RZ10, you can edit Profiles and can view and do the following:

• Administration data
• Basic Maintenance
• Extended Maintenance

J2EE WEB AS 7.0

The JAVA WEB Application server provides complete user management services called User Management Engine or UME which helps in data integration. UME provides central user administration for all application developed using Java. The UME administers users and uses databases, directory services, or the SAP ABAP user administration to store the data.

SAP’s GRC

The GRC (Governance, Risk, and Compliance) tools from SAP offers a complete suite of tools to control and manage risk. SAP GRC Access Control delivers a comprehensive access control facilities and helps companies to define and monitor Segregation of Duties (SOD), profile management, and compliance. In SAP’s risk detection module, SAP’s applications for Access Control detect access and authorization risks across SAP applications. Access control also prevents new risks from entering the system.

Conclusion

After implementing SAP Products, ensuring security is a vital issue. If you have already implemented SAP security, you need to ensure that the system runs smoothly and doesn’t get breached. There has to be a Central User Administration (CUA) system in place for constant monitoring. So you need in-depth knowledge about administration, authorization concepts, Web Application Servers, and SAP system architecture. If you need deeper knowledge on SAP security architecture, SAP security entities, then SAP Administration will be the guiding course for you. These courses will guide you how to handle the security issues relating to the operating system and the database in an SAP implementation.