Wednesday, November 25, 2015

Information GRC Tool: SAP Fire Fighter 50000 foot view

Information GRC Tool: SAP Fire Fighter 50000 foot view
Problem: Giving extra access to user for limited time.
Example: User want to open a period in production but only needs the access for one of the month . The user will call the help desk for additional access. Then the additional access is given but there is not insight on what the user actually did. There is also additional cost in manually assigning access to user
Tool Information: The Fire fighter tool lets the user have additional access for limited amount of time and also logs the access.
Implementation: New roles are created with additional access and linked to the select group of user. The user is added in fire fighter tool and assigned a supervisor. This will enable the supervisor to get email when the user utilizes the additional access through fire fighter. The user can be enabled access for limited time or longer time.
Implementation Strategies:
1. The enabling access to the fire fighter should be assigned to functional team so the decision making process can rest with knowledgeable people
2. The logs should be reviewed by functional leads and audit group so they can analyze how often the access is used. This analysis can reveal if the transaction should be added to the users current roles or remain in Fire Fighter role
Advantages:
1. Emergency access Can be properly managed and tracked
2. Additional access can be provided to certain users who are back up
3. Production support and pre go live trouble ticket calls can be reduced
4. Can be used as mitigation control
Caution: The tool should not be used as substitute for poor sap security role design.

Sunday, December 4, 2011

Learning SAP


Learning SAP
SAP Security is part of SAP Basis module in SAP. Basis module is the system administration piece in SAP. This cuts across all the modules. This is more to do with SAP Administration and systems management. To learn SAP Basis or SAP Security the person need not be a functional consultant or do not need to have any domain experience
Who is Suited for Learning SAP Security Module
The person who is well suited for getting into SAP Module is the person who is comfortable with working on computers mainly using word, excel, internet and email.  Mainly be able to comfortably navigate the screens in any software in the computer. Should be able do simple tasks like copy paste cut delete etc
Trouble Shooting Skills will be helpful for Learning SAP
There are some people who will be arts major but they will be very good in trouble shooting the common problems in the computer and network. If the computer does not work or not able to connect to the internet. They will be able to trouble shoot and fix the problem. Unknowingly they will logically trouble shoot the problem and get to the solution. This is what is required for learning SAP.
Learning SAP is not a Rocket Science:
SAP is a prepackaged solution which has multiple modules. You are not re-engineering or developing new software. The job of the SAP Consultant is to understand the business requirement of the particular company and configuring the software as per the company’s requirement.
Central User Administration also called SAP CUA
 Common Problem:
Let say in your company you have 4 system (Sandbox, Development, Quality and Production).  If the Sandbox, development and Quality systems have 3 clients each and production has on client. If there is a new user in the company then you have create his user id 10 times as you have to individually create users in each system.
Following are the problems encountered with this approach
Master data like user name, first name, last name, email etc not matching between clients. It is a time consuming manual work to create user id 10 times

SAP Central User Administration (SAP CUA)
With SAP CUA we can select one client in the Development or Quality system as SAP CUA central client. Then all the other clients and systems can be hooked to the central client with RFC connection. With this you will be able to create the user master in the central client the users will transferred to the child system. So the above scenario the user can be created once and will be transferred to other nine systems.

Advantages:
SAP CUA helps the client manage the users from one centralized location and reduces repetitive manual work
SAP CUA help the Master data is consistent across all the clients
Disadvantages:

Client copies are difficult as the SAP CUA setup has to be unhooked and re hooked
If the Central system client in SAP CUA setup is down then all the users in the SAP CUA child system cannot be managed
Mass user changes are difficult to make as it take time and it stresses the infrastructure.
Since there is communication involved the user creation has to be verified before communicating the credentials
Future of SAP CUA:
The future for this technology is not bright as SAP GRC compliant user provisioning and SAP Identity management is also trying to centralize the user provisioning process.  I think more and more clients will start using those technologies
Steps for Configuring SAP CUA
Identify the logical system for the clients in your landscape
Pick the SAP CUA Central Client
Make SM59 RFC Connection between the SAP CUA Central client and SAP CUA Child clients
Define the SAP CUA model using BD64
Distribute the ALE Profile and SAP CUA Mode
Define the SAP CUA model using SCUA
Transfer the users into the central system using SCUL
Configure the data to be maintained in SCUM
Complete a text compare and schedule text compare regularly
Check the SAP CUA Logs logs and idocs regularly


How to create user in CUA
How do we transfer users to CUA Master
How to setup what can be changed in Child System
How to Setup CUA in SAP System

Saturday, December 3, 2011

SAP Table- Restricting Data Acces


SAP Table

Table is part of SAP System. All the data entered in SAP is stored in tables in the backed database.  From the SAP application you will be able see the data through SAP Transaction SE16, SE16n, SE17, and SE11. When the user is given unrestricted access to these transactions he will be able to see all the data in the SAP Table. This is a huge security hole in the system.  For example if the user is knowledgeable he can go to HR table and pull out all the salary information of the entire company  or get the product pricing information of all the products sold in the company. This security breach could be used to blackmail the company or sold to competitors


SAP Table option for grouping

SAP has grouped tables by authorization groups.  So for example if the tables belongs to Human Resources personal administration then they group them into HRPA authorization group. This will be helpful in Security for restricting the role to particular sap table. So it  is a best practice to assign a authorization group to all the custom tables created by the client. Usually the customer crated tables will start with Z or Y. The system will not let you start the table with any other naming convention
SAP Table Authorization Group
SAP Table Authorization Group

SAP Table - Securing in the Role

The table in the role can be secured with the authorization object S_TABU_DIS.  This object has two fields. One is authorization group and the other is activity.  This authorization group is the group which the table belongs to.  But you do not want to give the user any of the table browsing transaction such as SE16, SE17 and SE16N. So the only option is to create a custom transaction and link the table to the custom transaction

Assigning the SAP Table to Authorization Group:

If the client has lot of custom tables which are not assigned to an authorization group then these table have to be assigned to proper authorization groups. Once you have the list of tables then we will consult the development and functional team to identify the authorization groups. These authorization groups can be existing or we can create new authorization group.
Audit Best Practice- Locking SAP Table with Custom Transaction
One of the best practice is to create a custom transaction to the table so the user will only be able display or maintain that particular table. The custom transaction can be create in transaction SE93.  The transaction should be a call transaction type. This will let the user only maintain that particular SAP Table with transaction SM30

Learning SAP|SAP Tutorials|SAP Demo