You can try some of these:
1. check if any non-SAP ids are created in the database, in oracle for example in dba_users
2. check if any dummy default ids that come with database are unlocked and being used
3. if you are setup to use external identification such as ops$sidadm in oracle (in places they are), check who can su or sudo to sidadm
4. obviously anyone with password for system and sap ids can login using number of tools; you can investigate options to tighten using SQL*Net listener
Hope this gives some preliminary pointers...
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.