{"id":1466,"date":"2012-10-07T07:33:29","date_gmt":"2012-10-07T07:33:29","guid":{"rendered":"http:\/\/sapsecurityanalyst.com\/WP\/?page_id=1466"},"modified":"2017-02-19T09:33:32","modified_gmt":"2017-02-19T09:33:32","slug":"sap-security-audit-guidelines-part-ii","status":"publish","type":"page","link":"https:\/\/sapsecurityanalyst.com\/WP\/sap-security-audit-guidelines-part-ii\/","title":{"rendered":"SAP Security Audit Guidelines – Part II"},"content":{"rendered":"

<\/p>\n

 <\/p>\n

This post is part 2 of our discussion on SAP Security Audit Guidelines. In the previous post<\/span><\/a><\/span>, we had discussed about some of the important points which need to be followed for SAP Security Audit Guidelines. We would continue to do so in this part as well and try to cover as many important points as possible.<\/p>\n

<\/p>\n

<\/h3>\n

 <\/p>\n

 <\/p>\n

List of some common tables for which table logging should be enabled<\/span><\/h3>\n

<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

Table<\/span><\/h2>\n<\/th>\n

\n

Description<\/span><\/h2>\n<\/th>\n<\/tr>\n<\/thead>\n

\n

\u00a0T000<\/span><\/h3>\n<\/td>\n

\n

\u00a0List of clients<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0T001<\/span><\/h3>\n<\/td>\n

\n

\u00a0Company Codes<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0TSTC<\/span><\/h3>\n<\/td>\n

\n

\u00a0Definition of tcodes<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0TOBJ<\/span><\/h3>\n<\/td>\n

\n

\u00a0Definition of Authorization objects<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0TACTZ<\/span><\/h3>\n<\/td>\n

\n

\u00a0Valid activities<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0TSTCP<\/span><\/h3>\n<\/td>\n

\n

\u00a0Parameters for Transactions<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0TPGP<\/span><\/h3>\n<\/td>\n

\n

\u00a0Authorization Groups for Programs<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0TBRG<\/span><\/h3>\n<\/td>\n

\n

\u00a0Authorization Groups for Tables<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0TDDAT<\/span><\/h3>\n<\/td>\n

\n

\u00a0Table to Authorization group mapping<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0TNRO<\/span><\/h3>\n<\/td>\n

\n

\u00a0Definition of number range objects<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0TSTCA<\/span><\/h3>\n<\/td>\n

\n

\u00a0Values for Transaction code authorizations<\/span><\/h3>\n<\/td>\n<\/tr>\n<\/tbody>\n

<\/td>\n<\/td>\n<\/tr>\n<\/tfoot>\n<\/table>\n
<\/div>\n

<\/p>\n

 <\/p>\n

Some transaction codes are very critical and should not be assigned to any one in production system and should be locked. Also, there are some transaction codes which should only be assigned to Basis or Security team or to some super user roles. These super user roles can be assigned for temporary period of time based on emergency requirements after following a proper approval process. Below is a list of a few such critical transaction codes:<\/p>\n

<\/p>\n

 <\/p>\n

 <\/p>\n

<\/p>\n

Critical Transaction Codes in Production:<\/span><\/h3>\n

<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

\u00a0Transaction Code<\/span><\/h2>\n<\/th>\n

\n

\u00a0Description<\/span><\/h2>\n<\/th>\n

\n

\u00a0Assignment Status in Production<\/span><\/h2>\n<\/th>\n<\/tr>\n<\/thead>\n

\n

\u00a0SU01<\/span><\/h3>\n<\/td>\n

\n

\u00a0Create User<\/span><\/h3>\n<\/td>\n

\n

\u00a0Security Team<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SU10<\/span><\/h3>\n<\/td>\n

\n

\u00a0Mass User creation<\/span><\/h3>\n<\/td>\n

\n

\u00a0Security Team<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0PFCG<\/span><\/h3>\n<\/td>\n

\n

\u00a0Role Maintenance<\/span><\/h3>\n<\/td>\n

\n

\u00a0Display only version to Security Team<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0ST01<\/span><\/h3>\n<\/td>\n

\n

\u00a0System Trace<\/span><\/h3>\n<\/td>\n

\n

\u00a0Basis\/Security Team<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SM19<\/span><\/h3>\n<\/td>\n

\n

\u00a0Security Audit Configuration<\/span><\/h3>\n<\/td>\n

\n

\u00a0Basis\/Security Team<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SM20<\/span><\/h3>\n<\/td>\n

\n

\u00a0Analysis of Security Audit Log<\/span><\/h3>\n<\/td>\n

\n

\u00a0Basis\/Security Team<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SM18<\/span><\/h3>\n<\/td>\n

\n

\u00a0Reorganize Security Audit Log<\/span><\/h3>\n<\/td>\n

\n

\u00a0Basis Team<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0EWZ5<\/span><\/h3>\n<\/td>\n

\n

\u00a0Lock Users<\/span><\/h3>\n<\/td>\n

\n

\u00a0Security Team<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0RZ10<\/span><\/h3>\n<\/td>\n

\n

\u00a0Maintain Profile Parameters<\/span><\/h3>\n<\/td>\n

\n

\u00a0Basis Team<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SM12<\/span><\/h3>\n<\/td>\n

\n

\u00a0Display and Delete Locks<\/span><\/h3>\n<\/td>\n

\n

\u00a0Basis Team<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SM04<\/span><\/h3>\n<\/td>\n

\n

\u00a0User List<\/span><\/h3>\n<\/td>\n

\n

\u00a0Basis Team<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SM59<\/span><\/h3>\n<\/td>\n

\n

\u00a0RFC Destinations (Display\/Maintain)<\/span><\/h3>\n<\/td>\n

\n

\u00a0Basis Team<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SA38<\/span><\/h3>\n<\/td>\n

\n

\u00a0ABAP Reporting<\/span><\/h3>\n<\/td>\n

\n

\u00a0Super User Role<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SP01<\/span><\/h3>\n<\/td>\n

\n

\u00a0Output Controller<\/span><\/h3>\n<\/td>\n

\n

\u00a0Basis Team<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SECATT<\/span><\/h3>\n<\/td>\n

\n

\u00a0Extended Computer Aided Test Tool<\/span><\/h3>\n<\/td>\n

\n

\u00a0Super User Role<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SCC4<\/span><\/h3>\n<\/td>\n

\n

\u00a0Client Administration<\/span><\/h3>\n<\/td>\n

\n

\u00a0Locked<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SE09 \/ SE10<\/span><\/h3>\n<\/td>\n

\n

\u00a0Transport Organizer<\/span><\/h3>\n<\/td>\n

\n

\u00a0Locked<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SM49<\/span><\/h3>\n<\/td>\n

\n

\u00a0Execute external OS commands<\/span><\/h3>\n<\/td>\n

\n

\u00a0Locked<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SM69<\/span><\/h3>\n<\/td>\n

\n

\u00a0Maintain External OS Commands<\/span><\/h3>\n<\/td>\n

\n

\u00a0Locked<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SHD0<\/span><\/h3>\n<\/td>\n

\n

\u00a0Transaction and Screen Variants<\/span><\/h3>\n<\/td>\n

\n

\u00a0Locked<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SE38<\/span><\/h3>\n<\/td>\n

\n

\u00a0ABAP Editor<\/span><\/h3>\n<\/td>\n

\n

\u00a0Locked<\/span><\/h3>\n<\/td>\n<\/tr>\n

\n

\u00a0SE93<\/span><\/h3>\n<\/td>\n

\n

\u00a0Maintain Transaction Codes<\/span><\/h3>\n<\/td>\n

\n

\u00a0Locked<\/span><\/h3>\n<\/td>\n<\/tr>\n<\/tbody>\n

\n

\u00a0<\/span><\/h3>\n<\/td>\n

\n

\u00a0<\/span><\/h3>\n<\/td>\n

\n

\u00a0<\/span><\/h3>\n<\/td>\n<\/tr>\n<\/tfoot>\n<\/table>\n
<\/div>\n

<\/p>\n

<\/p>\n

 <\/p>\n

<\/p>\n

Lets have a look at some of the critical authorization objects in SAP. From Audit perspective, it is pertinent that special care must be taken while assigning full access ‘*’ to any field value.<\/span><\/h3>\n

 <\/p>\n

    \n
  • S_PROGRAM – All critical programs and reports should be linked with proper authorization groups<\/span>. Appropriate action should be maintained for this object.<\/li>\n
  • S_TABU_DIS – Caution should be taken while maintaining change access for this object.<\/li>\n
  • S_TABU_CLI – Access to this object should be strictly restricted.<\/li>\n
  • S_TCODE – Make sure that this authorization object does not give access ‘*’ access or access to big ranges using wildcards on the TCD field.<\/li>\n
  • S_DEVELOP – Should be assigned with caution. Make sure not to give the change – debug access in production.<\/li>\n
  • S_RZL_ADM – For\u00a0R\/3 System administration using the CCMS. This should only be required by Basis.<\/li>\n
  • S_ADMI_FCD – For checking\u00a0access to some Basis functions, like spool administration and monitoring. Normally for Basis Team only.<\/li>\n
  • S_BTCH_ADM – For processing background jobs. Only needed by Basis or Background admin.<\/li>\n
  • S_BDC_MONI – For\u00a0batch input management and monitoring – Can be assigned to Functional Team when they upload data using LSMW<\/li>\n
  • S_CTS_ADMI – For administration functions in the Change and Transport System. Only to Basis.<\/li>\n
  • S_LOG_COM – For executing external operating system commands – Only to Basis.<\/li>\n
  • S_TRANSPRT – For transport organizer – Only to Basis.<\/li>\n
  • S_DATASET – For accessing files from ABAP\/4 programs. ABAP Program name and File Path should be maintained with caution.<\/li>\n
  • S_USER_* – Should be maintained very carefully. Make sure to give display access (activity 03) only. For Security Team.<\/li>\n<\/ul>\n

     <\/p>\n

    <\/p>\n

     <\/p>\n

     <\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"_links":{"self":[{"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/pages\/1466"}],"collection":[{"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/comments?post=1466"}],"version-history":[{"count":10,"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/pages\/1466\/revisions"}],"predecessor-version":[{"id":2177,"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/pages\/1466\/revisions\/2177"}],"wp:attachment":[{"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/media?parent=1466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}