Exploring the Fundamentals of SAP System Security

security

measures taken to protect information, systems, and networks from unauthorized access, breaches, and attacks

threats

comprise of specific security goals

safeguards

protect systems against certain threats

security goal

a specific objective or outcome that an organization or individual aims to achieve to protect their assets, information, and resources from unauthorized access, theft, damage, or other security threats

availability

ensures that users can access their resources whenever needed

authentication

determines the real identify of the user and can be achieved through authorization, confidentiality, and integrity

authorization

defines the rights and privileges of the identified user and determines the functions a user can access

confidentiality

ensures the user’s history and communication are kept confidential

integrity

ensures that user information transmitted or stored has not been altered

repudiation

the process of denying that you have done something

non-repudiation

ensures people cannot deny their actions

security system threat

any potential danger of risk to a system’s effectiveness or integrity

malware

malicious software, such as viruses, worms, Trojans, ransomware, and spyware, that can compromise a system’s security

phishing

the use of fraudulent emails, websites, and messages to trick users into revealing personal and sensitive information

Denial of Service (DoS) / Distributed Denial of Service (DDoS)

attacks that overwhelm a system or network with excessive traffic, disrupting services

insider threats

employees or other trusted individuals accessing the system may intentionally or unintentionally compromise its security

social engineering

attackers manipulate people into disclosing confidential information or performing specific actions that compromise security

Advanced Persistent Threats (APTs)

sophisticated, long-term attacks that aim to steal sensitive information or disrupt operations

zero-day exploits

attacks targeting vulnerabilities in software or hardware that are not yet known to the vendor or security community

Man-in-the-Middle attacks

hackers intercept communication between two parties to eavesdrop, steal information, or manipulate the data being exchanged

data breaches

unauthorized access to sensitive data, often resulting in theft or exposure of confidential information

physical security breaches

occur due to unauthorized access to facilities, device theft, or other physical security vulnerabilities

buffer overflow

an application can receive data that it is not expecting or prepared to accept, resulting in unpredictable results

spoofing

programs can be written to modify the internet protocol (IP) address of the source of the Transmission Control Protocol/Internet Protocol (TCP/IP) packet, and trick the network because the true IP identity is concealed or disguised and looks like the packet is coming from within the network

masquerading

a person can masquerade as another user

repudiation

a buyer could deny purchasing an item from an online store

security system safeguards

the measures and technologies used to protect a physical location or digital system from security threats

technical safeguards

firewalls, cryptographic algorithms, and certificates

organizational safeguards

security policies, rules, or guidelines

physical safeguards

fire detection, secured rooms, and buildings

on-premise system infrastructure

the components are physically located within an organization, typically in a company’s own data center

S/4 Cloud system infrastructure

the computing resources are hosted in the cloud, typically by a third provider/host over the internet

Public Cloud edition

hosted on public cloud infrastructure - hardware and resources shared with other organizations

Private Cloud edition

hosted on private cloud infrastructure - hardware and resources are dedicated to a single organization, providing them with more control and customization options

hybrid system infrastructure

infrastructure composed of on-premise and cloud elements that combine the “best of both worlds”

Security Information and Event Management (SIEM) systems

used by organizations to detect, analyze, and respond to security threats

presentation layer

the topmost tier in SAP’s three-tier client/server architecture that acts as the front-end user interface where end-users interact with the SAP system

application layer

the middle tier in SAP’s three-tier client/server architecture that represents where the business logic and configured business process functionality are designed and implemented

data storage layer

the bottom tier in SAP’s three-tier client/server architecture that comprises precisely of one database and is the repository for all the SAP system’s data and objects

SAP Fiori

the dominant interface for access to new SAP applications and solutions, both on-premise and within the cloud

SAP Fiori Launchpad

serves as the central entry point for all user apps so that users do not have to log on to different clients and platforms

homepage

the heart of the SAP Fiori Launchpad and the central access point for SAP Fiori apps

space

structure the most relevant apps for users with a specific business roletil

tile

a container that represents and displays an app that can be launched on the Fiori Launchpad page

User Actions Menu

allows users to access their settings, preferences, and secondary shell functions

notifications

displays system-generated notifications from various sources, such as the workflow inbox or chat notifications for taking immediate action

user master record

a data set that defines an account’s identity, technical logon settings, and security permissions, allowing a person, machine, or process to acces an SAP system; where an administrators assigns security roles

security roles

control the business actions the user is authorized to perform

business user

defined as a natural person represented in the application by a business partner and linked to the SAP system by a user ID

SAP S/4HANA Business User Management

enables and supports the entire lifecycle of business users, including organizational changes, changes of employment, and retirement

authorization check

a security mechanism that verifies whether a user has the necessary permissions to perform a specific action, run a transaction, or access sensitive data in the system

user type

determines the level of access and permissions a user has within the system

dialog user

standard user type for interactive access to SAP applications

system user

user type used for technical system processes and background operations

service user

user type used for specific application services within the SAP system

reference user

user type used for creating templates for new users

communication user

user type used for external communication with other systems or applications

user group

a way to group users based on similar characteristics or roles

authorization object class

groups related authorization objects for better organization and easier management

authorization object

a predefined set of authorization fields that define a particular combination of conditions required for access control

authorization field

the smallest individual control element used to define specific access rights, organizational units, or activities within the system

user master record comparison

determines whether authorization profiles can be added or removed from the current user based on their current or updated role assignments

legacy apps

Web Dynpro and GUI for HTML applications

SAP Fiori Search

part of the SAP Fiori Launchpad and provides contextual search

SAP Fiori SAPUI5 apps

role-bsaed, responsive web applications built using the SAPUI5 JavaScript framework that follow the SAP Fiori user experience (UX) design guidelines

SAP Fiori Launchpad Content Manager

used by administrators to browse Launchpad content and set up business catalogs according to their needs

access governance

the control layer that manages and monitors user, role, and system permissions to execute transactions and view sensitive data within SAP environments

SAP Access Governance and Control

delivers a suite of products and solutions that support comprehensive access governance throughout the digital identity lifecycle

SAP Access Control

an enterprise software solution that enables an organization to control access, identify risk, and document compliance

risk and control catalogs

allow for the central definition of risk and the documentation of mitigating controls that can be applied to specific users, user groups, security roles, and so on, to support compliance and audit-related activities

risk analysis engine

integrated with a workflow provisioning process and a role management process to allow customers to identify risk early before provisioning access to production environments

Access Control Dashboards

gives management and internal auditors a graphical representation of the status of Risk and Remediation activities across each connected system

Risk Simulation analysis

gives auditors the ability to develop the appropriate remediation strategy by simulating changes to user access and/or role design to eliminate conflict

self-service portal

an offering from SAP Access Control that allows users to request access to systems and applications and automated workflows for access request approval and provisioning

Business Role Management

provides the framework to define a standard role creation and role maintenance methodology

Emergency Access Management (EAM)

a standard SAP GRC Access Control function that provides a controlled framework for defining, managing, granting, and monitoring emergency system access

firefighter

a temporary, elevated user ID or role used to handle critical or emergency tasks in a production system

firefighter owner

the designated business person or manager responsible for overseeing, approving, and managing temporary privileged user access (firefighter IDs or roles)

firefighter controller

responsible for monitoring and reviewing the logs and activities performed by the firefighter

Alert Monitoring

collects data on user access and generates alerts when conflicting or critical access is executed

Alert Dashboard

provides a user-friendly graphical view of alert data and occurrences

authorization concept

a structured framework that controls what specific transactions, programs, and data a user can access and modify after logging into an SAP system

business user

an employee, contractor, administrator, or anyone who can log on to the SAP S/4HANA Cloud, public edition, and must complete the relevant business tasks

business role

a collection of access rights that can be assigned to business users

business catalog

a set of applications that usually belong together semantically

restrictions

allow you to define what a business user can view (read) or edit (write) with the information/functionality granted per each business catalog within the assigned business role

Business Catalogs app

a central administrative tool used to view, monitor, and manage business catalogs and their apps

Display Restrictions app

a tool used to display an overview of all limits and their use in business catalogs

Manage Workforce app

a tool used to perform the first tasks of Identity and Access Management (IAM) on SAP S/4HANA Cloud, public edition, by allowing you to create workforce users and assign business users

Maintain Business Users app

a tool that allows for modifying and deleting business users within the system

Mass Change wizard

a tool used to apply changes to multiple business users simultaneously

SAP Fiori Apps Reference Library

a comprehensive online repository that contains detailed information about every SAP Fiori app available by SAP product and version

Implementation Information

outlines technical details and prerequisites for each app’s use and deployment, along with any business catalogs and business roles that SAP has delivered

Maintain Business Roles app

a tool that allows you to define a business role from scratch and add each business catalog required for that role

Business Role ID

can be created in the customer namespace and contain the letters BR to denote it is a business role

Business Role Description

an easy-to-understand description describing the purpose of the business role and its function(s)

Business Role Long Text

a field that is used to provide a more detailed description or explanation of the business role, including its applications, any dependencies with other roles, documentation concerning changes and updates to the business role, and so on

Business Role Groups

assignable to help you organize by areas and easily search for all business roles of a specific category - facilitates the maintenance of authorizations

Access Categories

represent the default access categories for the business roles - restrictions can be used to refine and restrict access

SAP Cloud Identity Access Governance

a leading platform that provides comprehensive security solutions for business