{"id":8791,"date":"2024-07-08T23:12:44","date_gmt":"2024-07-08T21:12:44","guid":{"rendered":"https:\/\/lukardi.com\/?p=8791"},"modified":"2026-01-09T10:12:06","modified_gmt":"2026-01-09T09:12:06","slug":"super-user-management","status":"publish","type":"post","link":"https:\/\/lukardi.com\/en\/blog\/security\/sast-super-user-management\/","title":{"rendered":"SAST Super User Management"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

SAST Super User Management<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t<\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\tShare\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Lukardi<\/a><\/span><\/span><\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t\t\t
  • \n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\n\t\t\t\tSecurity<\/span>\t\t\t\t<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t
    \n\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    SAST's Super User Management module offers a feature that allows users to work without privileges <\/span>SAP_ALL<\/strong> or other critical authorizations in the production system.<\/span><\/p>

    User FireFighter<\/strong> it's temporary user<\/strong>, which provides extended privileges,
    while allowing it to be controlled in the system.<\/p>

    Additional accounts are created by the SAP privilege administrator<\/strong> and assigns users who can use special privileges.<\/p>

    If emergency or extraordinary support is required and additional authorizations are needed, the assigned Support users have accounts available to them FireFighter (FF)<\/strong>.<\/p>

    Privilege administrators can create new FF accounts for the activities of various business units in SAP. However, such accounts cannot be used for daily work in the system.<\/p>

    In the SAST tool, we can define appropriate accounts for FireFighter users and assign people to them who are responsible for controlling the use of designated FF users. In our case, they are called auditors<\/strong>. These people after the start and after the completion of the work by FireFighter users receive notifications to their email inbox<\/strong>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    After selecting the FF user from the list of available accounts and describing the planned activities in a new window, you can proceed as a FireFighter user.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Once the support work is completed, SAST records all activities performed by the Firefighter user and provides the responsible person (auditor) with the appropriate report.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Each report should be regularly reviewed and approved by the auditor.
    If there is a discrepancy in operations, get the necessary clarification from the person who used the FireFighter user.<\/p>

    SAST User Access Management has two session activation options for the FireFighter user.<\/b><\/h6>
    1. Automatic session activation for FireFighter, which will start when the window fills up
      with planned activities<\/li>
    2. Session activation for FireFighter using a token.<\/li><\/ol>

      The procedure put in place further protects against the use of critical FireFighter users without prior auditor approval. A specially generated key is required to log in.<\/p>

      SAST also has an automatic function (Passive Monitoring) that records the activity for super users in SAP. This group includes: \"SAP*\", \"EarlyWatch\" and \"DDIC\".<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t
      \n\t\t\t\t\t\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t
      \n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t
      \n