{"id":9167,"date":"2024-07-09T23:32:41","date_gmt":"2024-07-09T21:32:41","guid":{"rendered":"https:\/\/lukardi.com\/?p=9167"},"modified":"2026-01-09T09:39:42","modified_gmt":"2026-01-09T08:39:42","slug":"czy-reorganizacja-konfliktow-sod-i-uprawnien-sap-musi-byc-bolesna","status":"publish","type":"post","link":"https:\/\/lukardi.com\/en\/blog\/security\/does-the-reorganization-of-conflicts-and-sap-authorities-must-be-painful\/","title":{"rendered":"Does it Have to be Painful to Reorganize SoD Conflicts and SAP Authorizations?"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Does it Have to be Painful to Reorganize SoD Conflicts and SAP Authorizations?<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t<\/i>\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\tShare\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Lukardi<\/a><\/span><\/span><\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t\t\t
  • \n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\n\t\t\t\tSecurity<\/span>\t\t\t\t<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t
    \n\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    <\/p>\n

    At the conference on SAP Security - Tips for Security, I shared with you the knowledge I've gained from both SoD and authorizations reorganization projects and daily tasks in Managed Services. For those of you who could not attend the conference, we have prepared a brief summary.<\/p>\n

    <\/p>\n

    At the outset, we asked ourselves what might be the reason for the decision to embark on such a venture as the Authorization Reorganization Project. Example scenarios are:<\/p>\n

    <\/p>\n

      \n
    1. \n
        <\/ol>\n<\/li>\n<\/ol>\n

        \u00a0<\/p>\n

          \n
        1. \n
            \n
          1. The company has experienced data leakage<\/strong> or financial fraud<\/strong> resulting from overly broad user rights.
            We learned about the incident by accident. How many incidents did we not find out about<\/li>\n
          2. There has been a failure on the production system -. unintentional human mistake<\/strong>. Were the authorizations too broad? Do we know how to reproduce the error? Does the system keep logs, and do we know how to read them?<\/li>\n
          3. SAP role clutter, loss of sense of control over roles. Add new permissions to roles, do not remove permissions. The result: everyone has access to (almost) everything<\/strong>.<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

            <\/p>\n

              \n
            1. \u00a0<\/li>\n<\/ol>\n

              <\/p>\n

                \n
              1. \u00a0<\/li>\n<\/ol>\n

                <\/p>\n

                <\/p>\n

                SoD Concepts<\/h2>\n

                <\/p>\n

                We also recalled the basic concepts of SoD - from the general to the specific:<\/p>\n

                <\/p>\n

                \n\n\n\n\n\n\n\n\n\n\n\n
                Deadline<\/th>\nDefinition<\/th>\n<\/tr>\n<\/thead>\n
                SoD Matrix<\/td>\nA set of defined and described authority conflicts in a given area (e.g., FI, TR, SD, HR, Basis)<\/td>\n<\/tr>\n
                SoD conflict<\/td>\nA critical combination of at least two business processes (e.g., issuing payroll + changing bank account, opening accounting periods + releasing documents for payment, system configuration + importing transportation)<\/td>\n<\/tr>\n
                Risks<\/td>\nA description of the SoD conflict from the business point of view and the possible consequences of the assigned powers<\/td>\n<\/tr>\n
                Process<\/td>\nBusiness operation (e.g., opening an accounting period, releasing documents for payment)<\/td>\n<\/tr>\n
                Authorization ID<\/td>\ndefined transactions, reports, tables that is, the values of SAP fields checked by the engine of the matrix defined and configured on the SAP system. All that we want to catch as \"critical\" in the permissions of controlled users<\/td>\n<\/tr>\n
                Mitigations<\/td>\nControl of risks to which access should be withdrawn\/maintained for specific users; controls can be manual, compensatory, automatic, following the \"four eyes principle\"<\/td>\n<\/tr>\n
                SoD Segregation of duties<\/td>\nThat is, each employee performs only his part of the process and no one is authorized to act beyond his position responsibilities!<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

                <\/p>\n

                PRU Planning<\/h2>\n

                <\/p>\n

                When planning a PRU, at least the following 5 phases should be planned:<\/p>\n

                <\/p>\n

                  \n
                1. \n
                    <\/ol>\n<\/li>\n<\/ol>\n

                    \u00a0<\/p>\n

                      \n
                    1. \n
                        \n
                      1. Analysis<\/strong> Current SoD conflicts, authorization problems, status of roles, status of procedures<\/li>\n
                      2. Planning<\/strong> tasks and responsibilities in the PRU, the new Concept of Authorization<\/li>\n
                      3. Configuration <\/strong>new roles, Firefighter<\/li>\n
                      4. Tests\/Pilot<\/strong><\/li>\n
                      5. Production Start <\/strong>- Hyper care, documentation has its owners, mitigations<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                        <\/p>\n

                          \n
                        1. \u00a0<\/li>\n<\/ol>\n

                          <\/p>\n

                            \n
                          1. \u00a0<\/li>\n<\/ol>\n

                            <\/p>\n

                              \n
                            1. \u00a0<\/li>\n<\/ol>\n

                              <\/p>\n

                                \n
                              1. \u00a0<\/li>\n<\/ol>\n

                                <\/p>\n

                                <\/p>\n

                                A whole host of challenges and pitfalls await us during the project, such as when we analyze critical accesses on the SAP system and detect who has an assigned SAP_ALL profile....<\/p>\n

                                <\/p>\n

                                It may not be so easy for individuals to want to give up such wide, comfortable access. The argument: \"I'm a key user and need wide access on a moment's notice in case of an emergency on the system.\"
                                Another surprise concerns another important aspect in the project. Well, the authorization and SoD reorganization project is an eminently interdisciplinary project. To create a perfect project team, we need to involve and divide tasks among both business and technical users (Authorization Team, module consultants, developers, Basis). Unfortunately, very often when a project has \"authorization\" in its name the project owner is often assigned in IT teams:\"\"<\/p>\n

                                <\/p>\n

                                Examples of Standard SAP Tools Compared to SAST Suite Tools<\/h2>\n

                                <\/p>\n

                                After defining the owners of topics and tasks in each phase of the project, it is important to think about the appropriate tools that can be useful in an entitlement and SoD reorganization project. It is worth looking at the tools available from SAP and in the market that reduce time-consuming and automate work<\/strong> project team. Below I give examples of how SAP standard tools are juxtaposed with SAST Suite tools.<\/p>\n

                                  \n
                                1. SoD conflict matrix - or our authorization engine. Let's start our activities by collecting and documenting the critical processes in the organization.
                                  SAP Standard<\/strong>: configuration of \"Critical combinations\" and \"Critical authorizations\" in SUIM. Verification at the Tcode (transaction) access level only.
                                  SAST Suite<\/strong>: ready library of SOD conflicts (more than 300 defined conflicts) by SAP modules. Verification at the level of Tcode access + permission object + value of permission object fields.<\/li>\n
                                2. SAP role management - during a privilege reorganization project, we will often create new roles or modify existing ones.
                                  SAP Standard<\/strong>: create and modify roles as needed and defined (if any) positions - PFCG
                                  SAST Suite<\/strong>: ready-to-use role templates (uploaded to the system with a standard SAP transport) - broken down into business roles, technical roles, SAP modules and positions
                                  Result<\/strong>: Standardized role naming convention + Comprehensive role description.<\/li>\n
                                3. SAP role management - mini rollout projects occur for rapidly growing companies. It is then necessary to organize new authorizations for new organizational levels.
                                  SAP Standard:<\/strong> You need to create reference roles, on the basis of which you create derived roles with new organizational levels - copying roles + manual modification in PFCG.
                                  SAST Suite: <\/strong>Define reference roles + create orgsets with values of new organizational levels + automatically create derived roles.
                                  Automatically create roles with new organizational levels:
                                  The result: <\/strong>After defining the values in the orgset, automatically create a role named: YFI_C_AC00:AA-DAILY with the completed organizational levels.<\/li>\n
                                4. Trace - we use this functionality to trace user actions on the system against the authorizations used.
                                  SAP Standard: <\/strong>ST01 or SM20 (Security Audit Log), SU53, STUSOBTRACE
                                  SAST Suite: <\/strong>Ability to start tracking any users from a single dashboard + full data on activities performed + creation of a role from trace.
                                  User tracking + creating a role from the permissions used + displaying missing permissions
                                  The result:<\/strong> creation of a role from the trace on the selected user.<\/li>\n<\/ol>\n

                                  <\/p>\n

                                  <\/p>\n

                                  <\/p>\n

                                  <\/p>\n

                                  <\/p>\n

                                  <\/p>\n

                                  <\/p>\n

                                  <\/p>\n

                                  <\/p>\n

                                  Summary<\/h3>\n

                                  <\/p>\n

                                  Let's not forget the other challenges of the Authorizations Reorganization Project:<\/p>\n

                                  <\/p>\n

                                    \n
                                  • \n
                                      <\/ul>\nConcept of Entitlement - maintenance - this document is a \"living organism\"<\/li>\n
                                    • Authorization and user management processes<\/li>\n
                                    • Identify area owners and roles<\/li>\n
                                    • Cyclic checks of SoD and authorizations - at least once a year<\/li>\n
                                    • Maintain continuity of the authorization system and SoD<\/li>\n<\/ul>\n

                                      <\/p>\n

                                      <\/p>\n

                                      <\/p>\n

                                      <\/p>\n

                                      <\/p>\n

                                      <\/p>\n

                                      Let's Collaborate<\/h3>\n

                                      <\/p>\n

                                      Should you be particularly interested in any of the issues discussed, you are cordially invited to contact me.\u00a0<\/p>\n

                                      <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

                                      \n\t\t\t\t
                                      \n\t\t\t\t\t\t\t
                                      \n\t\t\t\t\t
                                      \n\t\t\t\t
                                      \n\t\t
                                      \n\t\t\t\t
                                      \n\t\t\t\t
                                      \n\t\t\t\t\t\t\t
                                      \n