Detect critical base permissions that should not be in application roles
Authorization roles (transaction PFCG)
Customising the organisational criteria is cross-client. Activation of the organisational criteria depends on the client. If you want to use these permissions in different clients, you must activate the respective organisational criteria for the respective client. Now you can use the organisational criterion in your PFCG role. To do this, enter the S_TABU_LIN authorization object with the organisational criterion you created. Assign the respective attributes with the organisational values for which the user should be entitled. Along with the individual values, you can specify intervals for your organisational criterion so that you can assign permissions to users for multiple organisational values.
Always make sure you use the latest version of the Note Assistant. To do this, look for SAP hints about the BC-UPG-NA component in the system recommendations. We also recommend that you perform the security patch process as part of a release or support package upgrade to avoid additional testing by security advisories already released at the time of the upgrade.
Perform Risk Analysis with the Critical Permissions Report
Before using the system recommendations, we recommend that you implement the corrections in SAP Notes 1554475 and 1577059. It is also necessary that the systems to be managed are connected to the SAP Solution Manager and that in the transaction SMSY were assigned to a productive system and an SAP solution. Then, in the System Recommendations settings, schedule a background job that collects the relevant information about the attached systems. Relevant information is your release and support package stand, as well as SAP notes and their versions. An OSS connection from the SAP Solution Manager, which you have to set up beforehand, will then perform a calculation in the SAP Global Support Backbone, which will determine the necessary information, i.e., that the SAP Solution Manager itself hardly generates any load from the calculation. To automatically check the security level of your systems, you should also schedule this calculation as a background job.
At www.sap-corner.de you will also find a lot of useful information on the subject of SAP authorizations.
Documents: The documents in the audit structure describe the audit steps. You can create them in accordance with your audit requirements. You can recognise documents by the symbol. Double-click on this icon to open the document.
If you get into the situation that authorizations are required that were not considered in the role concept, "Shortcut for SAP systems" allows you to assign the complete authorization for the respective authorization object.
You should always implement SNC between SAP GUI and application server, as this communication can also run over open networks.
To store all the information on the subject of SAP - and others - in a knowledge database, Scribble Papers is suitable.
Double-clicking on a authorization object will direct you to the authorization object definition, and double-clicking on the transaction will direct you to the programme location where the permission check is performed.