Security Cleanup and how to approach.

[sreekanth_sunkara]

Hi all,

I am working in SAP Security for sometime. now i need some guidance from you all. My company want to review all the SAP systems and cleanup the systems if necessary. what is best approach that i need to take inorder to review the systems. Are there any documents on what sections we need to focus while reviewing the systems. (for ex security parameters, critical objects,....)

thanks in advance,

SS

Edited by: sun on Sep 9, 2010 3:59 PM

[Former Member]

Hi,

The term "cleanup" means different things to different people.

Lets start out by finding out "exactly what do you want to achieve". If you can give us some detail on what your objective is then we can focus on them. Cleanup could be anything from deleting obsolete roles to deploying a consistent set of support roles all the way to remediating SoD's in your landscape so it will help to understand your scope.

[sreekanth_sunkara]

Hi Alex,

In my case cleanup is to review the SAP system and make recommendations. for ex: we have lot of test user ids sitting in CUA with out any roles and profiles and they are created for various projects so we want to remove them and also see if the security parameters are ok, see who has critical authorizations ( access to tables, permissions to create users and so on..)

what i wanted to know is if there is a document like checklist where i can see if every security setting in the system is ok and recommendations for best practice.

Thanks,

SS

[Former Member]

The 315 other posts here on SDN (and that is just with this user ID) should be able to give you a rough estimate of the clean-up scope..

Cheers,

Julius

[Former Member]

If you have a look at the SAPPress books (e.g. the Linkies/Off book) you will see they are broken down into subject areas and cover areas such as user maint, param settings. They give their version of good practice which you can then follow. Even the index would give you a good idea of areas that you need to look at.

@Julius 😜

[sreekanth_sunkara]

Alex,

Thank you very much for giving me some tips. i know that there won't be any direct answer for this.

Thanks a lot.

SS

[Former Member]

Sun,

I agree with Alex. If what you're discussing is a complete redesign of the security throughout all systems, you may potentially be referring to a project involving multiple resources and a budget. You also will want to consider governance. Again, as Alex suggested, it would help to give more background.