SAP-Security.nl

Segregation of Duties in SAP: a brief instruction

noreply@blogger.com (Unknown) — Thu, 05 Jul 2012 12:02:00 +0000

July 5th 2012: Instruction document is now in English!

As of SAP Web AS 6.20 the ABAP report RSUSR008_009_NEW (transaction S_BCE_68002111) has been made available in SAP.

This report combines the (quite useless!) old reports RSUSR008 and RSUSR009 and had has become a simple but reliable tool to import your SoD rule set and to report on it.

It's possible to report on sole 'authorization id' (Critical Authorizations) or on a combination of 2 different 'authorization id's' (SoD).

For both reports you can create various reporting variants and you can colorize the various results.

Reporting is only possible on userids, so when checking your authorization concept itself, it is necessary to create dummy users per role (in a development system e.g.).

The possible granularity of the checks is equal with all the existing tools on the market: apart from checking on transaction codes, you can check on every object value and adequate AND/OR operators are available.

It is not possible to downdrill in your report and to make detailed analyses of the cause of the conflict. 'Heavy users' will still have to rely on the third-party tools for detailed analysis, but when you make a start with SoD reporting this tool can be of great use!

Here you can find the SAP Help for this report.

I also made an instruction with various screenprints on how to implement critical authorizations, combinations and report variants.

How to secure PFCG & SU01 combination for SoD

noreply@blogger.com (Unknown) — Fri, 18 May 2012 11:02:00 +0000

I found an interesting article on SAPTechies.com on how to assign SU01 & PFCG (one in display mode of course) to the same user, but still manage to secure SoD that exists in maintaining roles and users:

After you import the correction, the ASSIGN_ROLE_AUTH switch described in note 312682 (PRGN_CUST table) is also effective in the PFCG. If you have set ASSIGN_RpE_AUTH=ASSIGN, in addition to S_USER_GRP, ACTVT=22 you only need S_USER_AGR, ACTVT=22 for the user assignment but you no longer need S_USER_AGR, ACTVT=02. However, you can no longer assign users if you only have change authorization for the role (S_USER_AGR, ACTVT=02).

Depending on the authorization you have, the system behaves as follows:

You only have authorization for the user assignment (S_USER_AGR, ACTVT=22):
Since you are not allowed to change the role itself, first you can change to change mode after you have navigated to the "user" tab in the display mode. Provided that you are still in change mode when you exit this tab, the system automatically switches back to display mode. If you have not saved changed user assignments yet, a dialog box appears asking you whether you wan to do this. Note that the text in this dialog box appears in English if you have imported the solution using correction instructions.
You only have authorization to change the role (S_USER_AGR, ACTVT=02):You can change to change mode everywhere, however, you cannot change the user assignment because the corresponding fields on the "User" tab are not ready for input and the pushbuttons (Select, Delete, and so on) are missing for processing entries that already exist.
You have both authorizations (S_USER_AGR, ACTVT=02 and 22):
All change options provided are available on each tab.

If ASSIGN_ROLE_AUTH does not have the ASSIGN value (which is the default value), you need both the role as well as the S_USER_AGR, ACTVT=02 user assignment to make changes.

More comments:

Basically, the two "User master comparison" and "HR Organizational Management" functions on the tab are also active in display mode. This does not result in any safety hazards because the role itself cannot be changed by these functions and the required authorizations, in particular S_USER_AGR, ACTVT=22, are always checked. However, if you want to deactivate the two functions in display mode, set the USRPROF_IN_DISP_MODE switch in the PRGN_CUST table to NO. Both pushbuttons can then no longer be selected but the status specifications (green or red traffic lights) continue to be displayed.
On the "Display/change roles (activity groups)" screen of the PFCG, you can call the "Settings: Role maintenance (activity group maintenance)" the dialog box under the "Utilities" -> "Settings" menu path. There you will find the checkbox "Automatic comparison of user master when saving the role (activity group)" as the first item. When you select this field, you define that a user master comparison is performed each time a role is saved. The setting is only valid for the user who has set it (in this case, you) and only in the current client. For more information about this, also refer to note 511200.
If the automatic user master comparison is deactivated globally (AUTO_USERCOMPARE=NO in table PRGN_CUST), you cannot make any individual changes. In this case, the checkbox as of Release 4.6C is inactive and in Release 4.6B, it is hidden altogether. In Release 4.5B, the 293(S#) error message (see above) appears instead of the "Settings: Activity group maintenance" dialog box

Source: http://www.saptechies.com/pfcg-authorization-check-with-role-assignment/

Verslag bijeenkomst over SAP GRC Access Control van 13 december 2011

noreply@blogger.com (Unknown) — Tue, 24 Jan 2012 09:05:00 +0000

Op dinsdag 13 december hadden we de laatste bijeenkomst van 2011 bij Logica in Rotterdam (gastheer was Jurgen de Kok). Deze bijeenkomst stond geheel in het teken van SAP GRC.

Helaas was Erwin Albers van SAP verhinderd wegens ziekte, maar gelukkig kon Henk Peter Wind met veel improvisatietalent een prima inhoudelijke presentatie geven over SAP GRC Access Control 10.0. Ook de klantpresentaties over SAP GRC Access Control bij L’Oreál (Jurgen de Kok) en PostNL (Bernd Mobach & Virgil Verloop) waren zeer de moeite waard.

Kijk bij Documenten voor de diverse downloads van deze presentaties (bij GRC AC 10.0 staat de presentatie die Erwin Albers had willen geven).
Tevens zijn er data gepland voor de bijeenkomsten in 2012:

· donderdag 15 maart 2012
· dinsdag 12 juni 2012
· donderdag 13 september 2012
· dinsdag 11 december 2012

Vóór de eerste bijeenkomst van 15 maart zullen we enquête versturen en daarin vragen welke onderwerpen aan de orde zouden moeten komen in 2012 en welke bijdrage jullie daaraan zouden kunnen leveren. Ook zullen we inventariseren welke locaties we zouden kunnen gebruiken.

Bron: http://t.co/Uzqv5YsB

SAP Espresso Sessies

noreply@blogger.com (Unknown) — Mon, 26 Sep 2011 13:21:00 +0000

Afgelopen donderdag zat er weer een uitnodiging in de mailbox voor de nieuwe SAP Espresso Sessies: webinars van 25 minuten waarin je wordt bijgepraat over diverse onderwerpen. In de afgelopen anderhalf jaar zijn er i.i.g. een tweetal sessies geweest die ook interessant waren voor de SAP Security community. Ik heb hierover niet bericht maar gelukkig zijn deze presentaties wel terug te kijken:

Als er in de toekomst nog meer relevante Espresso Sessie komen dan zal ik dat vanaf nu hier vooraf melden.

Useful information on how to use SU25

noreply@blogger.com (Unknown) — Fri, 16 Sep 2011 07:31:00 +0000

I was looking for instruction material for SU25 (Profile Generator: Upgrade & First Installation) and found these useful instructions:

SAP Help

Sapsecurity.info

Mariewagener.de

SAP SCN

Verslag VNSG Focusgroepbijeenkomst op 8 september over Basis Security

noreply@blogger.com (Unknown) — Tue, 13 Sep 2011 14:03:00 +0000

Op 8 september waren we te gast bij IVENT (MinDef) op de Frederikkazerne in Den Haag. Gelukkig was de zaal groot genoeg, want met zo’n 35 personen hadden we weer een zeer aardige opkomst. En we werden niet teleurgesteld want de presentaties waren zeer interessant en onderhoudend.

Allereerst werder we verwelkomd door Kolonel Eric Molenaar en werden we ingewijd in de wondere wereld van het project SPEER: één van de grootste SAP-implementatietrajecten in Nederland dat al bijna 10 jaar loopt en dat erg veel last heeft gehad van het enorme ambitieniveau van het Ministerie van Defensie.

Joris van de Vis & Fred van de Langenberg van ERP Security lieten op zeer overtuigende wijze zien dat SAP Security meer is dan alleen Autorisaties. Het was goed om te zien dat meerdere leden dit ook al in de praktijk uitvoeren, maar het kan niet genoeg benadrukt worden dat de focus van de autorisatiebeheerder verbreed dient te worden en vaak toch een leading rol gaan moeten spelen om ook de Basis Security te borgen, alhoewel in de uitvoering daarvan meestal ook andere specialisten ingeschakeld zullen worden.

Maaike Duchateau van Philips gaf in haar presentatie een kijkje in de keuken bij over hoe bij Philips de SAP Security notes worden beoordeeld, uitgevoerd en geïmplementeerd worden over 22 productiesystemen!

Ook gaf ze tips over hoe je een dergelijk proces (géén project) bij je eigen bedrijf kunt inrichten en hoe belangrijk het is dat alle stakeholders (management, business en IT support) het eens zijn over het belang van het tijdig implementeren van deze notes.

Al met al was het een zeer leerzame en gezellige bijeenkomst, waarbij de heerlijke zelfgebakken appelflappen van gastheer Jeen Murk natuurlijk niet onvermeld mogen blijven!

Bron: www.vnsg.nl/aut

How to monitor the use of &SAP_EDIT and how to disable it

noreply@blogger.com (Unknown) — Fri, 26 Aug 2011 12:29:00 +0000

Although the lates SAP releases have decreased the possibility to tamper with table data, there are still some loopholes that need your attention.

This fine article on home4sap.com shows you how to stay in control.

Hire me! #NLonly

noreply@blogger.com (Unknown) — Fri, 19 Aug 2011 13:38:00 +0000

If you are looking for an experienced SAP Security Consultant for a project, a redesign of your authorization concept or for temporary reinforcement of your SAP Security Team, I can be your man!

See my linkedin profile

Contact me via mail or twitter

SAP Security » SU24 Concept

noreply@blogger.com (Unknown) — Tue, 08 Feb 2011 10:20:00 +0000

Found a nice instruction on transaction SU24:

SAP Security » SU24 Concept

Segregation of Duties in SAP: a brief instruction

noreply@blogger.com (Unknown) — Thu, 09 Dec 2010 16:22:00 +0000

As of SAP Web AS 6.20 the ABAP report RSUSR008_009_NEW (transaction S_BCE_68002111) has been made available in SAP.

This report combines the (quite useless!) old reports RSUSR008 and RSUSR009 and had has become a simple but reliable tool to import your SoD rule set and to report on it.

It's possible to report on sole 'authorization id' (Critical Authorizations) or on a combination of 2 different 'authorization id's' (SoD).

For both reports you can create various reporting variants and you can colorize the various results.

Reporting is only possible on userids, so when checking your authorization concept itself, it is necessary to create dummy users per role (in a development system e.g.).

Here you can find the SAP Help for this report.

I also made an instruction with various screenprints on how to implement critical authorizations, combinations and report variants.

An easy way to export your user stats

noreply@blogger.com (Unknown) — Tue, 10 Aug 2010 19:03:00 +0000

All SAP Security specialists will know how to use transaction ST03N in order to export user statistics, particularly useful in Authorization Redesign projects.
This transaction is very informative yet somewhat elaborate, because you need to drill down from every instance, to every month, to every user.
Since SAPKB700 the Function Module SWNC_COLLECTOR_GET_AGGREGATES can be used to access this information all at once. See this blog for more information.
If you are authorized for SE37, you can execute this function directly. Otherwise, you need to build a little ABAP Report around it, for example this one I found on the SDN Forum:

REPORT Z_GETSTATS.
PARAMETER: day TYPE dats DEFAULT sy-datum.
DATA: t_usertcode TYPE swnc_t_aggusertcode, wa_usertcode TYPE swncaggusertcode.
START-OF-SELECTION.
CALL FUNCTION 'SWNC_COLLECTOR_GET_AGGREGATES' EXPORTING component = 'TOTAL' periodtype = 'D' periodstrt = day TABLES usertcode = t_usertcode EXCEPTIONS no_data_found = 1 OTHERS = 2.
LOOP AT t_usertcode INTO wa_usertcode.
WRITE:/ wa_usertcode-entry_id.
WRITE:/ wa_usertcode-respti, wa_usertcode-procti, wa_usertcode-cputi, wa_usertcode-dcount, wa_usertcode-ucount.
WRITE:/ '*************************************'.
ENDLOOP.

You still will have to make a selection on Date & System, but you can dowload all user data in one go.

I hope this can make life somewhat easier for you in your project.

Results of survey on Testing SAP Authorizations

noreply@blogger.com (Unknown) — Fri, 28 May 2010 09:14:00 +0000

I finally finalized the results of the survey on testing SAP authorizations.
You can download the results here.

How to load SAP HR/HCM structural authorization to BW/BI?

noreply@blogger.com (Unknown) — Tue, 20 Apr 2010 11:14:00 +0000

A very logical but generally not implemented requirement is the the transfer from HCM Structural Authorizations to BI.
I searched, collected and created some documentation on this subject, in order for you to make a kick start on this issue, see below:

BW365_Structural Authorizations BI_mySAP ERP HCM
Part of the SAP BI Authorization course (BW365) handling this topic

BWHRSTRUCTAUTH
An old (2002) but still useful 'How to' document

OSS Note 771168
This note is useful if you use context-sensitive authorizations (P_ORGINCON)

Structural Authorizations in SAP BW
A very compact action list

Structuur autorisaties in SAP BW
Some information in Dutch

Have fun with it!

Survey on Testing SAP Authorizations

noreply@blogger.com (Unknown) — Tue, 02 Feb 2010 15:29:00 +0000

As Chairman of the Dutch SAP User Group on Authorizations I developed a survey on testing SAP Authorizations in order to obtain input for a meeting on this subject.

The results of this survey will be publicized on www.sap-security.nl. If you fill in your email address you wil be notified when the results are available.

Update 04/20: The survey has been closed. I will post the results shortly

SAP Security News on Twitter

noreply@blogger.com (Unknown) — Thu, 21 Jan 2010 15:21:00 +0000

I have created a Twitter account that is fed with all the relevant RSS feeds available about SAP Security & SAP GRC (provided bij SAP.com). Also the updates from SAP-Security.nl are included, but no job feeds are included!
If you know another interesting feed to follow, please let me know by commenting on this message.

Click on the button below to follow these SAP Security tweets:

Transporting User Groups across the landscape

noreply@blogger.com (Unknown) — Fri, 03 Jul 2009 13:40:00 +0000

I am presently confronted with a landscape with 2 CUA's, a very elaborate change management process and different user groups in almost every client!
Therefore I was looking for a way to synchronize the user groups throughout the landscape and remain in sync when needing user group changes.
This thread on SDN contains and explains 2 ways of work in order to achieve this:

Manual transport of tables USGRP and USGRPT via SE01 --> this is useful to get all User Groups in sync initially
Implement the setting CUA_USERGROUPS_CHECK in table PRGN_CUST --> this enables you to distribute User Groups via the CUA (idoc-controlled) and is perfect for ongoing maintenance

New SAP Security Notes!

noreply@blogger.com (Unknown) — Fri, 03 Jul 2009 08:18:00 +0000

On June 10th the following OSS notes have been added to the SAP Security Notes list:

This list includes OSS note 1012066 that I mentioned earlier in this blog

How to protect you Standard SAP Users

noreply@blogger.com (Unknown) — Wed, 03 Jun 2009 14:28:00 +0000

In every SAP Support environment I have ever participated, the question 'How to protect the Standard SAP users' (SAP*, DDIC and EARLYWATCH) always pops up.
This questions used to be a difficult one to answer but today's SAP Help pages are really helping you in this issue!

New SAP Security Notes published & one on its way!

noreply@blogger.com (Unknown) — Tue, 02 Jun 2009 11:59:00 +0000

Some new SAP Security notes have been published have been published on http://service.sap.com/securitynotes on May 25th.
I also had a discussion with SAP about OSS note 1012066.
Because this vulnarability also applies - not mentioned in the note - for all Transport Organizer transactions (SE0*-transactions) it has been recognized by secure@sap.com that it qualifies as a Security Note as well.
The list will be refreshed in a couple of days.

Monitoring Security With Standard SAP Tools

noreply@blogger.com (Unknown) — Tue, 26 May 2009 11:57:00 +0000

In these days when all kinds of fancy and (very) expensive solutions for monitoring Security in SAP are booming you would almost forget that SAP used to build its own tools which were freely available in every SAP Kernel.
Most of these features still exist in present day releases, and could fulfill the needs of small and mid-size companies
I found this ASUG powerpoint from 2003(!) which still gives you a nice overview of Standard SAP Security monitoring tools

SAP Security Notes 'Disclosure'

noreply@blogger.com (Unknown) — Wed, 22 Apr 2009 10:44:00 +0000

SAP CEO's Kagermann & Apotheker have sent out a message in which the urgently address the need to implement the following OSS Notes:
Note 1298160 - Security note: Forbidden program execution possible
Note 1168813 - Security note: Program DISPLAY_FUNC_INCLUDE
Note 1167258 - Security note: Program RS_REPAIR_SOURCE
Note 1304803 – Security note: Changing a transport without authorization

I was especially triggered by the sentence: "We have noticed that the number of customers who access and execute these critical security-related service notes is below our expectation."
To my opinion this is due to the fact that Security Notes are not included in the SAP Support Portal Newsletter and the lacking possibility of subsribing to an RSS Feed.

I sent out a mail to secure@sap.com and I got a very prompt response:

Dear Mr Borsboom,

Thanks for the idea.

Actually, we are planning to get rid of the manually maintained list. In future - I cannot state any date yet - we may handle security notes like "HotNews" notes. Then, any new security note would show up in the SAP Support Portal Newsletter.

An RSS feed would be an alternative, but at present I can only promise that we will consider it.

Best regards,

Bernd Reske
Product Security Response Team
SAP AG
Dietmar-Hopp-Allee 16
69190 Walldorf, Germany
mailto:secure@sap.com
http://www.sap.com
http://www.sap.com/security
http://service.sap.com/securitynotes

VNSG dag 2

noreply@blogger.com (SAP Security Links) — Fri, 17 Apr 2009 17:41:00 +0000

De vrijdag begon goed met een heldere en humoristische presentatie over de kredietcrisis, waar vooral de schuldigen extra in het zonnetje gezet werden ;-)

Van de parallelsessies was vooral het GRC forum o.l.v. Astrid Joosten leerzaam en prikkelend. Lesson learned: steek nooit een groene kaart op als alle andere bezoekers een rode kaart opsteken ;-)

Vandaag was ik wél aanwezig bij de prijsuitrijking van CSI maar kwam mijn naam helaas niet uit de black box voor een TomTom (gisteren wel maar ik stond niet bij de stand, dus toen ging de prijs aan mijn neus voorbij!)

De afsluiting van Mark van de Veerdonk was spetterend en relativerend.

Super feest VNSG

noreply@blogger.com (SAP Security Links) — Thu, 16 Apr 2009 22:59:00 +0000

Nathalie, Van Dik Hout, Nick en Simon en Eric E. maakten van VNSG feest een super avond. Zit nu in de bus naar hotel.

Annemarie van Gaal

noreply@blogger.com (SAP Security Links) — Thu, 16 Apr 2009 16:40:00 +0000

Annemarie van Gaal was de laatste keynote van de dag. Ze vertelde over haar succes in Rusland met Indipendant Media. Haar advies: werk zonder hoofdkantoor, zonder ervaring of opleiding en zonder gezond verstand! Pas dan kun je en durf je de out of the box beslissingen te nemen die leiden tot succes.

Op de VNSG stand werd uit alle nieuwe aanmeldingen voor de VNSG Focusgroepen een ballonvaart voor 2 personen verloot!

De eerste dag tot zover

noreply@blogger.com (SAP Security Links) — Thu, 16 Apr 2009 14:01:00 +0000

Na veel interessante en minder interessante sessies, veel (oude bekenden) gesproken te hebben, een paar mensen te hebben geworven voor VNSG Focusgroepen en na een paar interessante business proposals zit ik nu in de grote zaal voor de afsluiting van de eerste dag.