Seguridad del sistema SAP
¡Manténgase a la vanguardia de los problemas de seguridad con esta guía completa! Obtenga instrucciones paso a paso para configurar las áreas esenciales de la seguridad del sistema SAP: aplicación, base de datos, plataforma e infraestructura. Realice tareas clave como configurar la autenticación de usuarios, proteger los protocolos de red y trabajar con registros en su entorno. Ya sea que su sistema esté en las instalaciones o en la nube, ¡mejore su seguridad con consejos de expertos para garantizar que se mantenga seguro!
- Configure la seguridad de la aplicación, la plataforma, la base de datos y la infraestructura
- Configure la gestión de identidades y accesos con cuentas de usuario, autorizaciones y autenticación
- Proteja SAP S/4HANA, SAP ERP, SAP Fiori y las aplicaciones basadas en la nube
Aprenderás sobre:
- Seguridad de las aplicaciones:
Comience con una visión general de la gestión de usuarios y la autenticación. Diseñe roles seguros que satisfagan sus necesidades empresariales y de cumplimiento normativo. Configure el inicio de sesión único y aprenda a proteger y gestionar el acceso a sus aplicaciones SAP Fiori.
- Seguridad de la base de datos:
Proteja sus datos con cifrado. Utilice el registro y la supervisión de transacciones para proteger sus bases de datos y adelantarse a comportamientos inusuales.
- Seguridad de la plataforma:
Configure los parámetros del sistema y comprenda cómo controlar los cambios en su entorno. Utilice la gestión de solicitudes de cambio y Focused Build para SAP Solution Manager a fin de realizar cambios en su sistema de manera segura, y manténgase al tanto de los eventos con SAP Enterprise Threat Detection.
- Seguridad de la infraestructura:
Establezca controles de acceso y aprenda a gestionar las conexiones de red utilizando SAProuter. Obtenga consejos y mejores prácticas para proteger las aplicaciones basadas en la nube en SAP Business Technology Platform.
Aspectos Destacados:
- SAP S/4HANA
- SAP Fiori
- Aplicaciones en la nube
- Gestión de usuarios y autenticación
- Autorizaciones y diseño de roles
- Registro y monitoreo
- Seguridad de datos
- Seguridad del cliente
- Seguridad del kernel
- Seguridad del transporte
Ver Tabla de Contenidos Completa
SAP System Security
Stay ahead of security issues with this comprehensive guide! Get click-by-click instructions to configure the essential areas of SAP system security: application, database, platform, and infrastructure. Perform key tasks such as setting up user authentication, securing network protocols, and working with logs in your environment. Whether your system is on-premise or in the cloud, boost your security with expert advice to ensure it stays safe!
- Configure application, platform, database, and infrastructure security
- Set up identity and access management with user accounts, authorizations, and authentication
- Secure SAP S/4HANA, SAP ERP, SAP Fiori, and cloud-based applications
You'll learn about:
- Application Security:
Begin with an overview of user management and authentication. Design secure roles that meet your business and compliance needs. Set up single sign-on and learn to secure and manage access to your SAP Fiori apps.
- Database Security:
Protect your data with encryption. Use logging and monitoring transactions to secure your databases and stay ahead of unusual behavior.
- Platform Security:
Set up system parameters and understand how to control changes in your environment. Use change request management and Focused Build for SAP Solution Manager to securely change over your system, and keep an eye on events with SAP Enterprise Threat Detection.
- Infrastructure Security:
Establish access controls and learn to manage network connections using SAProuter. Get tips and best practices for securing cloud-based applications on SAP Business Technology Platform.
Key Highlights:
- SAP S/4HANA
- SAP Fiori
- Cloud applications
- User management and authentication
- Authorizations and role design
- Logging and monitoring
- Data security
- Client security
- Kernel security
- Transport security
View Full Table of Contents
- Preface
- Target Audience
- How This Book Is Organized
- Acknowledgments
- PART I Application-Level Security
- 1 User Management
- 1.1 Types of SAP User IDs
- 1.2 SAP Standard Accounts
- 1.3 Transaction SU01: Managing User Account Lifecycle
- 1.4 Transaction SU10: Managing User Accounts in Bulk
- 1.4.1 Selecting Users
- 1.4.2 Actions for the Selected Users
- 1.5 User Groups
- 1.6 Tables Related to User Management
- 1.7 Securing Passwords
- 1.7.1 Password-Related SAP Hash Tables
- 1.7.2 The Logon Process
- 1.7.3 Password-Related System Parameters
- 1.7.4 Table USR40: Obviating Obvious Passwords
- 1.7.5 Some Recommendations to Secure Passwords
- 1.8 Transaction SUIM: The SAP User Information Management Reports
- 1.9 Change Documents for Users
- 1.10 Security Policies
- 1.11 Miscellaneous User Management Topics
- 1.11.1 User Naming Conventions
- 1.11.2 User Buffer
- 1.11.3 Inactive Users
- 1.12 Summary
- 2 User Authentication
- 2.1 The Single Sign-On Concept
- 2.1.1 Single Sign-On Components
- 2.1.2 Single Sign-On Adoption Project
- 2.2 Single Sign-On Technologies for SAP
- 2.2.1 Kerberos
- 2.2.2 SPNEGO
- 2.2.3 SAML
- 2.2.4 OAuth 2.0 and OpenID Connect
- 2.2.5 X.509 Certificate
- 2.3 Setting Up a Service Provider
- 2.3.1 Setting Up SAML Using Transaction SICF
- 2.3.2 Enabling ABAP Application Server as a SAML 2.0 Service Provider
- 2.4 SAP Solutions for Single-Sign On
- 2.4.1 SAP Single Sign-On 3.0
- 2.4.2 SAP Secure Login Service for SAP GUI
- 2.5 Summary
- 3 Authorizations and Role Design
- 3.1 SAP Authorization Concept
- 3.1.1 Authorization Objects
- 3.1.2 Authorization Profiles
- 3.1.3 Roles
- 3.1.4 Authorization Checks
- 3.2 The Role Concept
- 3.2.1 Role Lifecycle Management
- 3.2.2 Single Roles
- 3.2.3 Composite Roles
- 3.2.4 Master and Derived Roles
- 3.2.5 Enabler Roles
- 3.2.6 Naming Convention for Roles
- 3.2.7 Naming Conventions for SAP Fiori Catalogs, Spaces, and Pages
- 3.3 Transaction PFCG: The Profile Generator
- 3.3.1 Navigating Transaction PFCG
- 3.3.2 Creating a Single Role
- 3.3.3 Creating Composite Roles
- 3.3.4 Creating Master and Derived Roles
- 3.3.5 Working with Roles in Bulk
- 3.3.6 Comparing Role Menus
- 3.3.7 Displaying the Overview Status
- 3.3.8 Working with Role Versions
- 3.3.9 Assigning and Removing Roles
- 3.4 Mass Change of Field Values in Roles
- 3.5 More on Transaction Codes
- 3.5.1 Types of Transactions
- 3.5.2 Calling Transactions
- 3.5.3 Restricting Transactions
- 3.6 Spool-Related Authorizations
- 3.7 Checking Authorizations in ABAP Programs
- 3.8 Transaction SACF: Switchable Authorizations
- 3.9 Other Useful Authorizations
- 3.9.1 Table Access Authorizations
- 3.9.2 RFC Authorizations
- 3.9.3 Background Job Authorizations
- 3.9.4 Query Authorization
- 3.9.5 Report and Program Authorizations
- 3.9.6 Developer Authorization
- 3.9.7 Upload and Download Authorization
- 3.10 Summary
- 4 SAP Fiori Security
- 4.1 Core Foundations of SAP Fiori
- 4.1.1 Evolution of SAP Fiori
- 4.1.2 SAP Fiori Design Principles
- 4.1.3 SAPUI5 Framework
- 4.1.4 SAP Fiori Content Model
- 4.1.5 OData Services
- 4.1.6 SAP Fiori Launchpad
- 4.2 Types of SAP Fiori Apps
- 4.2.1 Transactional Apps
- 4.2.2 Analytical Apps
- 4.2.3 Object Pages
- 4.3 Managing Access to SAP Fiori Apps
- 4.3.1 Catalogs
- 4.3.2 Groups
- 4.3.3 Spaces and Pages
- 4.4 SAP Fiori Authorizations and Role Design
- 4.4.1 SAP Fiori Architecture
- 4.4.2 Technical Deployment Models
- 4.4.3 Role Management in Embedded Versus Central Hub Implementation
- 4.4.4 SAP Fiori Authorization Model
- 4.4.5 Analyzing SAP Fiori Apps in Roles
- 4.4.6 Useful Transactions in SAP Fiori
- 4.5 Summary
- 5 Client Security
- 5.1 Client Overview
- 5.2 Managing Clients
- 5.2.1 Creating a New Client
- 5.2.2 Modifying the Settings of a Client
- 5.2.3 Deleting a Client
- 5.3 Securing Clients
- 5.4 Summary
- 6 Kernel Security
- 6.1 Components of SAP Kernel
- 6.1.1 Tier 1 Components
- 6.1.2 Tier 2 Components
- 6.1.3 Tier 3 Components
- 6.2 SAP Cryptographic Library
- 6.2.1 Transaction STRUST
- 6.2.2 Configuration
- 6.2.3 Cryptographic Functions and Services
- 6.3 Updating the SAP Kernel
- 6.3.1 Kernel Versioning
- 6.3.2 Kernel Patching
- 6.4 Patch Management
- 6.4.1 SAP’s Patch Release Strategy
- 6.4.2 Basic Patching Units: SAP Notes
- 6.4.3 Applying Security Patches
- 6.5 Summary
- 7 ABAP Development Security
- 7.1 Common Threats and Vulnerabilities
- 7.1.1 Inadequate Access Control
- 7.1.2 Custom Code Vulnerabilities
- 7.1.3 Insecure Change and Transport Management
- 7.1.4 Insecure Interfaces
- 7.1.5 Insider Threats
- 7.2 Managing Access to the Development Environment
- 7.2.1 Development Environment Actors
- 7.2.2 Tools Used in the Development Environment
- 7.2.3 Segregation of Duties in the Development Environment
- 7.3 Secure Software Development Lifecycle in ABAP
- 7.3.1 SDLC Models
- 7.3.2 SSDLC for ABAP
- 7.4 Tools and Techniques for ABAP Security
- 7.4.1 Code Inspector
- 7.4.2 SAP Code Vulnerability Analyzer
- 7.4.3 ABAP Test Cockpit
- 7.5 Summary
- PART II Database-Level Security
- 8 Database Security for SAP
- 8.1 Securing a Generic Database
- 8.1.1 Attack Vectors for a Database
- 8.1.2 Defending a Database
- 8.2 Securing the SAP HANA Database
- 8.2.1 Security Administration Tools
- 8.2.2 User Privileges
- 8.2.3 User Roles
- 8.2.4 Creating Roles
- 8.2.5 Creating Users
- 8.2.6 Creating an Audit Policy
- 8.2.7 Data Masking
- 8.2.8 Anonymization
- 8.3 Securing Data at Rest: Encryption
- 8.3.1 Types of Data-at-Rest Encryption in SAP HANA
- 8.3.2 Key Management Architecture
- 8.3.3 Key Management in the Cloud Environment
- 8.3.4 Client-Side Encryption in SAP HANA
- 8.4 Summary
- 9 Logging and Monitoring for SAP Databases
- 9.1 Internal Controls and Audit Cycle
- 9.1.1 Audit Types
- 9.1.2 Audit Personas
- 9.1.3 Audit Process
- 9.1.4 Internal Control Environment
- 9.2 Database Monitoring Tools
- 9.2.1 Transaction DBACOCKPIT
- 9.2.2 Transactions ST04, DB12, and DB13
- 9.3 Logging Tools
- 9.3.1 Classic Transactions
- 9.3.2 New Transactions
- 9.4 Security-Focused Database Monitoring
- 9.4.1 User and Access Monitoring
- 9.4.2 Suspicious Activity and Performance-Related Actions
- 9.5 Summary
- PART III Platform-Level Security
- 10 System Profiles and Parameters
- 10.1 Profiles and Parameters
- 10.1.1 Profiles in OS and Database
- 10.1.2 Types of Profiles
- 10.1.3 Parameter Naming
- 10.1.4 Tables Related to Profiles
- 10.1.5 Static and Dynamic Parameters
- 10.2 Viewing and Maintaining Parameters
- 10.2.1 Viewing Parameters
- 10.2.2 Modifying Parameters
- 10.3 Profile Parameter Governance
- 10.4 Password and Other Security-Related Parameters
- 10.5 Summary
- 11 Transport Security
- 11.1 SAP Transport Mechanism
- 11.1.1 Change and Transport System
- 11.1.2 Transport Directory
- 11.1.3 Transaction SE03: Transport Organizer Tool
- 11.1.4 Transaction STMS: Transport Management System
- 11.2 Role Transport
- 11.3 Authorizations Related to Transport System
- 11.4 Viewing CTS from a Security Perspective
- 11.4.1 Securing CTS at the OS Level
- 11.4.2 Securing CTS Against Landscape-Based Attacks
- 11.5 Transport Tools
- 11.5.1 Change Request Management
- 11.5.2 Focused Build for SAP Solution Manager
- 11.5.3 Adaptation Transport Organizer and SAP Cloud Transport Management
- 11.5.4 SAP Cloud ALM
- 11.6 Summary
- 12 Logging and Monitoring for the SAP Environment
- 12.1 Logging and Monitoring at the OS Level
- 12.1.1 Command-Line Tools: sapcontrol and saposcol
- 12.1.2 Linux- and UNIX-Specific Commands
- 12.1.3 Windows-Specific Commands
- 12.2 Developing a Logging and Monitoring Strategy
- 12.3 Using Blockchain for Logging
- 12.3.1 What Is a Blockchain?
- 12.3.2 What Is a Smart Contract?
- 12.3.3 Using Blockchain to Secure SAP Security and System Logs
- 12.4 Using SAP Enterprise Threat Detection to Analyze Security Audit Logs
- 12.4.1 Core Capabilities
- 12.4.2 Architecture and Data Flow
- 12.5 Connecting SAP Logs to the Enterprise SIEM Tool
- 12.6 Summary
- PART IV Infrastructure-Level Security
- 13 Network Security
- 13.1 Network-Level Threats and Defense Strategy
- 13.2 Network Access Control
- 13.2.1 Firewalls
- 13.2.2 Application-Level Gateways
- 13.2.3 Zero-Trust Network Access
- 13.2.4 Securing SAP Services and Ports
- 13.2.5 Access Control Lists
- 13.2.6 Securing Settings for the Message Server
- 13.2.7 Periodic Review of Network Settings
- 13.3 SAP Perimeter and Connectivity Controls
- 13.3.1 Network Protocols
- 13.3.2 SAProuter
- 13.3.3 Cloud Connector
- 13.3.4 SAP Web Dispatcher
- 13.4 Unified Connectivity
- 13.4.1 UCON-Related Role and Authorization
- 13.4.2 Setting Up UCON in Your Environment
- 13.4.3 Blocking Outward Connections: Transaction UCON_CHW
- 13.5 Summary
- 14 Securing Data in Motion
- 14.1 Decrypting Cryptography
- 14.1.1 Cryptography Basics
- 14.1.2 Symmetric and Asymmetric Key Cryptography
- 14.1.3 Public Key Infrastructure
- 14.1.4 Communication Security in ABAP Application Server
- 14.2 SSL and TLS Protocols
- 14.2.1 SSL and TLS Basics
- 14.2.2 Enabling TLS in the SAP Environment
- 14.2.3 Creating a Server PSE Using Transaction STRUST
- 14.2.4 Installing a CA Certificate in the Server’s PSE
- 14.3 Internet Communication Manager
- 14.3.1 Important Parameters for Configuring ICM
- 14.3.2 Web Administration Interface
- 14.3.3 Restricting Access Through Access Control Lists
- 14.3.4 Configuring an Authorization File to Control Access
- 14.3.5 ICM Security Log
- 14.4 Summary
- 15 Securing SAP Infrastructure
- 15.1 On-Premise Versus Cloud
- 15.2 Planning for Secure SAP Landscape
- 15.2.1 System Architecture
- 15.2.2 Network and Perimeter Security
- 15.2.3 Identity and Access Management
- 15.2.4 Communication Security
- 15.2.5 Application-Level Security
- 15.2.6 Database Security
- 15.2.7 Logging and Monitoring
- 15.2.8 Patch Management
- 15.2.9 Governance and Operating Model
- 15.2.10 Security Baseline Template
- 15.2.11 Secure Operations Map
- 15.3 Developing Policies
- 15.3.1 Policies, Guidelines, and Standards
- 15.3.2 Developing an SAP Security Policy
- 15.4 Other Infrastructure-Related Considerations
- 15.4.1 Physical Security
- 15.4.2 Operating Systems
- 15.4.3 Secure Virtualization
- 15.4.4 Network Security
- 15.4.5 Monitoring
- 15.5 Summary
- 16 Securing Cloud-Based Applications
- 16.1 Identity and Access Management
- 16.1.1 Identity Authentication Service
- 16.1.2 Identity Provisioning Service
- 16.1.3 Best Practices for Identity, Authentication, and Provisioning
- 16.2 SAP Business Technology Platform Security
- 16.2.1 Security Responsibility
- 16.2.2 Relevant Applications and Services
- 16.2.3 Threat Vectors
- 16.2.4 Security Best Practices
- 16.2.5 Users, Roles, and Role Collections
- 16.3 Integration Security
- 16.4 Best Security Practices for Cloud-Based Applications
- 16.4.1 Clean Core Policy
- 16.4.2 Best Practices
- 16.5 Summary
- The Author
- Index
