SAP Security Parameters Overview

Infrastructure in the area of ​​IT enterprises and the constantly growing number of cyber threats are one of the main factors that have a direct influence on the security of the organization. The recently growing trend of transitioning companies to mass remote or hybrid work has put even greater emphasis on monitoring the security of systems used by employees located all around the world. The security of central ERP systems, such as SAP, should be a priority for all companies which include them in their workspace. A comprehensive understanding of SAP system security is crucial for software optimization and additional data security obligations for each user. 

A common way to learn about the SAP security methodology is to read the technical documentation provided by the manufacturer. However, it is often a solution much too time-consuming for many people, especially without direct contact with SAP Security and the security terminology of SAP systems. What other solutions to consider in such case? An overview of the most important aspects of SAP security is a good start. What aspects ensure the security of the SAP system? What exactly does SAP security mean?

SAP Security & Authorizations is a system that protects SAP data and applications against unauthorized access and use. SAP provides various security controls to ensure that important data is always protected. SAP systems store confidential information about customers, business partners, and the company itself. Regular audits of SAP systems are essential to ensure full data integrity and security. This also applies to processes and Segregation of Duties (SoD).

One of the key elements of SAP Security that allows the assessment of the current state of the system is the verification of security configuration for areas related to the broadly understood parameters included in BASIS and SAP. It is necessary to focus on a thorough analysis and diagnose the level of their security. It will also allow the organization to identify and eliminate possible imperfections in the system configuration. By detecting and eliminating these elements, each organization is prepared for cyclical security and financial statements audits taking place in companies based on the SAP system.

The previously mentioned security parameters are inclusive components of SAP System Profiles. They are responsible for determining or identifying how to run the instance and configure numerous variables that define how the SAP instance and the system will operate.

There are two types of SAP Profiles:

Default profile – consists of global parameters for all instances in SAP

Instance profile – consists of profile data specific to a particular instance

Terminology and issues related to SAP security parameters are dealt with by the SAP Security team, which publishes an official SAP document called Security Baseline Template.

What is Security Baseline at its core? It is a set of good practices, specifying the security prerequisites that are basically required for any kind of SAP system implementation in an organization, being widely known as the SAP security benchmark. The term “Baseline” can be defined as preconditions that must be met before implementing SAP systems in the organization.

The idea behind the “Security Baseline” also defines all the security measures that are considered “essential” without further analysis within the enterprises.

The last version was updated on November 16, 2021. The documentation is regularly checked and revised by an authorized team that releases new versions now and again.

In the previously mentioned SAP Security Baseline Template article, the parameters were classified into 3 levels of security standards:

• Critical
• Standard
• Extended

All configuration parameters proposed in the publication are recommendations based on best practices, which are not binding system settings. Depending on your individual needs, you can freely change, add or remove security performance requirements at your discretion. However, it is important to make informed decisions and be aware of the risks and the level of security that may result from your own interpretation of the “Security Baseline” version.

In particular, the proposed regulations marked as “Extended” require a broader review. They go beyond critical and standard requirements and extend security standards to higher levels of protection or further areas. Therefore, they may not fit every environment and should be tailored to your internal policies and organization, overall IT landscape, and security needs.

The best practice recommended by the SAP Security team is to start with a fixed but limited set of key requirements and increase the level of SAP security gradually over time, starting with critical and standard requirements, and gradually implementing extended ones in the future.

Security parameters and their values apply to different platforms or technologies used when configuring SAP systems in an enterprise. One of the most common are ABAP, Java and HANA. There are also solutions such as Web Dispatcher or RFC Gateway.

The tables below present a detailed summary of the majority of the previously mentioned SAP security parameters included in the SAP Security Baseline Template (version 2.3).

They were ranked according to priority, starting with critical, then standard and extended.

The columns describe the parameter name, parameter description, risk level, platform/technology, default value and value recommended by the Security Baseline Template (SBT).

Table 1. Critical Parameters

Table 2. Standard parameters

Table 3. Extended parameters

There are, of course, many more broadly understood parameters in the SAP environment and they go beyond the scope of the discussed Security Baseline material. In this article, we focused mainly on those responsible for the understood spectrum of the system’s “security”.

In conclusion, a general awareness of SAP security parameter terminology and related background information is an important prerequisite for achieving the expected level of system security. Of course, not everyone has to be a security expert, but it’s worth being involved and keeping track of SAP Security updates. This will allow you to identify threats and assess when the help of experts in verifying security settings may be necessary. Ignoring, avoiding or even trying to circumvent the security mechanisms may pose a threat to the entire SAP environment. Transparency and simplicity are the keys to successful implementation of security parameters.

It is also worth remembering that SAP security is not a one-time approach, but a continuous process of improvement.

SAP also provides dedicated tools that allow you to monitor security parameters such as SAP Focused Run, Enterprise Threat Detection or SAP Access Control. If you are interested in their operation, please visit our website www.grcadvisory.com and follow our blog grc.ninja.