AGLEA Blog

For those that don't know SAP's authorization aspects this title might be just a tongue-twister.

On the contrary for those who manage authorizations in SAP these are very well-known authorization objects. How should you go about managing them?

Who said that in order to have powerful systems you need to have many resources?

How can a small enterprise be compete with a big corporation?

The aim of the SoD  is to make sure that only people with the right are of competence have access to sensitive transactions.

Which are the main Security SAP Tables for SAP Roles and Profiles?

SAP contains hundreds of thousands of tables. In some cases the direct access to these tables allows one to retrieve data faster. Below a list of tables for each defined area:

• SAP Roles
• SAP Profiles
• Users
• Authorizations
• Authorization objects

How does one know if you have set up a good authorization concept in SAP??

What are the metrics and how to best exploit them? Does a SAP Security Score exist? 

Why is that all the decisions taken following authorization assignments requests fall under the IT department?

For reasons of internal policies or regulations it may be necessary to make some data inside of SAP anonymous. There are many ways to do this. The first elements we need to consider are:

• Which data needs to be anonymous
• In which systems/environments
• Which users to authorize
• How to monitor the compliance of the created segregation

SAP updates are frequent. SAP releases feature updates to its products but also new features or patch security.

Is it really possible that external consultants do not have any access to SAP production systems? 

Clearly there are various case studies, occasional or ongoing consultants, for example for maintenance contracts.

Is it really necessary to release an access to the production systems even in this last case? Can we control what happens and why it is requested?

How does segregation of duties help protect your company data?