SAP Security

A layer of configuration parameters that should correspond to the organization's security policy. These parameters should be checked regularly.

Example:

login/password_expiration_time (default value 0, our recommendation 30)
The user must change the password after a certain number of days (for parameter 0, the forcing is not enabled).

login/min_password_lng (default value 3, our recommendation 8+)
Set the minimum password length.

login/fails_to_user_lock (default value 12, our recommendation 5)
The number of misspelled password to lock the user account.

SAP level

SAP Security Audit Log:

• main security log,
• some of the information is not very clear from a security perspective,
• SAP* user login is not a risk according to the log, while the risk is a misspelled login password.

SAP Change Documents and Table Loggin:

• Logging document changes and table changes,
• low quality if documents are not archived over time.

SAP System Log:

• SAP system master log,
• Logs overwritten after 14 days.

Levels beyond SAP

Operating system log Windows/UNIX - The problem, for example, is that the administrator must have root privileges to read the logs alone

Database log - Lack of ability to analyze database settings from the SAP level (e.g., information about accounts and their authorizations)

SAP Router/HTTP network logs - the problem is the lack of standard solutions to redirect logs to syslog

Every system is susceptible to hacking activities, SAP is no exception, so it is important to install system patches regularly.
Thanks to them, information about intrusions using known vulnerabilities is emerging.

Example 1 - a report by the U.S. Department of Security indicating that at least 36 global SAP systems were hacked using a vulnerability known (and patched) since 2010. Read more at https://bit.ly/28Kpk5r

Example 2 - annual meeting of the security community the PWNIE Awards in 2015 awarded the first prize in the Best Server-Side Bug category for the discovery of a vulnerability in SAP that allowed unauthorized access to the system https://bit.ly/29Se5hB

During the implementation of the SAP system default user accounts are created. They are used for the initial installation of the system, and are commonly known by both name and password.
It is extremely important to adequately protect these accounts.
The most critical account is SAP* (allows virtually unlimited access and changes to the system).

Default account passwords should be changed, and highly privileged profiles (e.g. SAP_ALL) should be deleted.
The important thing is that if you delete the default account - it will recreate itself automatically (with the default password).
The SAP* account should therefore have its password changed and the login/no_automatic_user_sapstar parameter set to 1 (no automatic SAP* account recovery).

As with the default accounts, SAP has (supplied with the installation) sets of authorization profiles, allowing broad access to the system. The use of these profiles should be very strictly managed and their use limited to emergency situations only.

The most important broad access profile is SAP_ALL - it allows you to execute any transaction, access any object, function or action (there is a reason why in the jargon of SAP administrators this profile is used to be referred to as "God on the system"). It is essential that this profile is not assigned anywhere. The case is similar with the SAP_NEW profile

Failure to adequately provide users with access rights to various parts of the system is an increased risk of embezzlement.

Example: if one person has both the ability to change a bank account number and the ability to make a wire transfer - it is possible to circumvent the organization's policies to move money out the door.

To sum up: it is important to manage the privilege conflict matrix properly. Such a matrix allows you to identify existing conflicts in the first place, and verification of individual user accesses will allow you to assess risks. The implementation of an effective data access policy in SAP is one of the most important elements of sealing the SAP environment against risks, the main factor of which is user action.