Use SAP Code Vulnerability Analyser
Preventing sprawl with the workload monitor
For the scenario of sending initials passwords, signing emails is not so relevant. Although it is possible to send an encrypted e-mail with a fake sender address, in this case the initial passwords in the system would not work. It looks different when you send business data; In such cases, verification of the sender via a digital signature is recommended. If you want to send e-mails digitally signed, we advise you to send them at the system's e-mail address. To do this, use the SEND_EMAIL_FOR_USER method described and place the sender's tag on the system. In this case, you need a public key pair for your ABAP system, which is stored as a Personal System Security Environment (PSE). For a detailed description of the configuration, including for verification and decryption of received emails, see the SAP Online Help at http://help.sap.com/saphelp_nw73ehp1/helpdata/en/d2/7c5672be474525b7aed5559524a282/frameset.htm and SAP Note 1637415.
Other project settings should be defined on the Scope, Project Views, Project Employees, Status Values, Keywords, Document Types, Transport Orders, and Cross Reference tabs. After all entries have been made, you must secure the project. Do not forget to generate the project. The SPRO transaction allows you to edit the newly created customising project. The first call does not display the newly created project. To view it, click the Record button in the Work Inventory ( ), select your project, and then confirm your selection. After you have successfully created, generated, or edited the project, you will perform the PFCG transaction to create a customising role for the project. Select a name for the role, and then click Create Single Role. Now open the Menu tab and follow the path: Tools > Customising Permissions > Add > Insert Customising Activities. Then choose between IMG Project and View of an IMG Project. All transaction codes are added from the IMG project to the Role menu. Note that this can be a very large number of transactions and can therefore take longer. You can then use the Permissions tab to express the authorization objects as usual. Back up and generate the role.
A concept for SAP authorizations prevents system errors and DSGVO violations
The most important security services regarding permissions are the EarlyWatch Alert (EWA) and the SAP Security Optimisation Service (SOS). You compare the settings in your SAP systems with the recommendations of SAP. Both services are delivered as partially automated remote services; You can also use the SOS as a fully automated self-service. The EWA and SOS shall carry out eligibility tests, the results of which shall always be as follows: The heading indicates the check in question. A short text describes the importance of the audited entitlement and the risk of unnecessary award. A list indicates the number of users with the validated permission in the different clients of the analysed SAP system. The SOS also allows you to list the users. In the SOS, a recommendation is made for each check to minimise the identified risk. A final formal description represents the checked permissions. However, not only the explicitly mentioned transactions are evaluated, but also equivalent parameter or variant transactions.
Every action of the emergency user must be traceable, which requires the appropriate configuration of logging components such as the Security Audit Log. After the event, all log files are always evaluated and all details are recorded in documentation. It is also possible to specify in the concept that, in the event of an emergency, extended authorization may be granted to other selected users; this is up to the company to decide.
With "Shortcut for SAP systems" you can automate the assignment of roles after a go-live.
When you run the report, you will notice that the external services for your own developments are not present and therefore do not appear in the role menu.
Reference users have another benefit: You can also use it to inherit the contractual user type.