Joe Markgraf is a senior cloud architect and advisor for SAP HANA Enterprise Cloud at SAP. Before joining SAP he worked as a Basis and security administrator, contributing to both small- and large-scale SAP system implementations. He holds a business degree with a focus on information system management from Oregon State University. He enjoys playing vintage video games and shooting sports with his family in Washington State.
Alessandro Banzer is the chief executive officer of Xiting. He has worked in information technology since 2004, specializing in SAP in 2009. Since then, Alessandro has been involved with global SAP projects in various roles. Alessandro is an active contributor and moderator in the governance, risk, and compliance space on SAP Community, as well as a speaker at SAPPHIRE, ASUG, SAPinsider, and other SAP-related events. He holds a degree in business information technology, as well as an Executive Master of Business Administration from Hult International Business School in London, UK.

... Preface ... 19

... Target Audience ... 19

... System Administration: A Vast Field of Options ... 20

... What Is Basis? ... 21

... Structure of This Book ... 23

1 ... Introduction ... 25

1.1 ... Potential Threats ... 26

1.2 ... The Onion Concept ... 34

1.3 ... Risk and True Cost of Security ... 37

1.4 ... The Administrator's Role in Security ... 40

1.5 ... Summary ... 43

2 ... Configuring Profiles and Parameters ... 45

2.1 ... Understanding System Parameters ... 46

2.2 ... System Profiles ... 47

2.3 ... Profile and Parameter Structure ... 49

2.4 ... Static and Dynamic Parameters ... 53

2.5 ... Viewing and Setting Parameters ... 55

2.6 ... Key Security-Related Parameters ... 64

2.7 ... Controlling Access to Change Parameters ... 66

2.8 ... Summary ... 67

3 ... Restricting Transactional Access ... 69

3.1 ... Clients ... 71

3.2 ... Who Should Be Able to Lock and Unlock Transactions? ... 71

3.3 ... Which Transactions to Lock ... 71

3.4 ... Locking Transactions ... 73

3.5 ... Viewing Locked Transactions ... 76

3.6 ... Summary ... 78

4 ... Securing Clients ... 79

4.1 ... Client Settings ... 81

4.2 ... Client Logon Locking ... 89

4.3 ... Summary ... 92

5 ... Securing the Kernel ... 93

5.1 ... Understanding the Kernel ... 94

5.2 ... Common Cryptographic Library ... 102

5.3 ... Kernel Update ... 104

5.4 ... Summary ... 114

6 ... Managing Users ... 115

6.1 ... What Is a User ID in SAP? ... 115

6.2 ... Different User Types ... 115

6.3 ... The User Buffer ... 117

6.4 ... Creating and Maintaining a User ... 118

6.5 ... Copy a User ... 128

6.6 ... Change Documents for Users ... 129

6.7 ... Mass User Changes with Transaction SU10 ... 131

6.8 ... User Naming Convention ... 139

6.9 ... Security Policies ... 140

6.10 ... Maintain User Groups ... 145

6.11 ... Central User Administration ... 147

6.12 ... User Lock Status ... 151

6.13 ... User Classification ... 152

6.14 ... User-Related Tables ... 153

6.15 ... Securing Default Accounts ... 154

6.16 ... User Access Reviews ... 156

6.17 ... Inactive Users ... 157

6.18 ... Password and Logon Security ... 158

6.19 ... Segregation of Duties ... 163

6.20 ... Summary ... 165

7 ... Configuring Authorizations ... 167

7.1 ... Authorization Fundamentals ... 168

7.2 ... SAP Role Design Concepts ... 180

7.3 ... The Profile Generator ... 192

7.4 ... Assign and Remove Roles ... 219

7.5 ... Lock and Unlock Transactions ... 221

7.6 ... Transaction SUIM: User Information System ... 221

7.7 ... Role Transport ... 226

7.8 ... Common Standard Profiles ... 228

7.9 ... Types of Transactions ... 229

7.10 ... Ta