100 Things You Should Know About Authorizations in SAP ?· learn SAP security, 100 Things You Should…

  • Published on

  • View

  • Download

Embed Size (px)


<ul><li><p>1ISACA JOURNAL Volume 6, 20142014 ISACA. All rights reserved. www.isaca.org</p><p>There are many things to know about authorizations in SAP. Ask SAP security administrators or auditors, and they will say that they discover new things all the time. The reason is that SAP is a developing product that frequently rolls out new components and has become so complex that working with SAP is a constant journey of learning.</p><p>That said, the fundamentals of SAP security remain stable in each silo supporting the functional components, such as modules, applications, portal and application server. Considering this stability and the fact that many new consultants and auditors want or need to learn SAP security, 100 Things You Should Know About Authorizations in SAP provides a strong foundation for anyone interested in becoming familiar with SAP.</p><p>To outsiders, security is often seen as being just the tool to grant a user access to the system and its functionality. But, security is much more than that. Understanding, knowing and applying the SAP security/authorization concept is an important prerequisite for successful SAP implementation, sustainment, ongoing administration and business controls. Knowledge of the SAP security/authorization concept can also be valuable when conducting a financial, business controls/IT or quarterly Sarbanes-Oxley audit. SAP security provides the means to grant users access to the functionality they need for their daily business tasks in the SAP system. At the same time, it also allows for organizations to follow the principle of least privilege, control </p><p>the work flow or segregate duties for user access. This book helps the reader understand the basics of SAP authorizations and security.</p><p>This 364-page book is well structured and contains many useful screen shots, explaining concepts, tasks and maintenance steps, and the 100 tips are delivered as stand-alone topics. The books focus is R/3, ABAP, profile generator, transaction and role security. These are the core concepts everyone who wants to dig deeper into SAP security must understand. The chapters in this book cover user master records, development security, segregation of duties, upgrades, auditing, security templates, and continuous compliance and governance. </p><p>This book is recommended as a study guide and reference book. It also touches on more specific topics, such as single sign-on, creating a transaction variant, structural authorizations, ABAP code security inspection, use of parameter transactions, master derived roles, change logs, and analyzing security or risk analysis with SAP GRC 10.</p><p>EDITORS NOTE100 Things You Should Know About Authorizations in SAP is available from the ISACA Bookstore. For information, see the ISACA Bookstore Supplement in this Journal, visit www.isaca.org/bookstore, email bookstore@isaca.org or telephone +1.847.660.5650.</p><p>By Andrea Cavalleri and </p><p>Massimo Manara</p><p>Reviewed by Horst Karin, </p><p>Ph.D., CISA, CRISC, </p><p>CISSP, ITIL, president of </p><p>DELTA Information Security </p><p>Consulting Inc. He has been </p><p>working in SAP/IT security </p><p>and risk management for </p><p>16 years. He served as chair </p><p>of the ISACA Publications </p><p>Committee for three years and </p><p>is coauthor of SAP Security </p><p>and Risk Management.</p><p>100 Things You Should Know About Authorizations in SAP</p><p>The ISACA Journal is published by ISACA. Membership in the association, a voluntary organization serving IT governance professionals, entitles one to receive an annual subscription to the ISACA Journal.</p><p>Opinions expressed in the ISACA Journal represent the views of the authors and advertisers. They may differ from policies and official statements of ISACA and/or the IT Governance Institute and their committees, and from opinions endorsed by authors employers, or the editors of this Journal. ISACA Journal does not attest to the originality of authors content.</p><p> 2014 ISACA. All rights reserved.</p><p>Instructors are permitted to photocopy isolated articles for noncommercial classroom use without fee. For other copying, reprint or republication, permission must be obtained in writing from the association. Where necessary, permission is granted by the copyright owners for those registered with the Copyright Clearance Center (CCC), 27 Congress St., Salem, MA 01970, to photocopy articles owned by ISACA, for a flat fee of US $2.50 per article plus 25 per page. Send payment to the CCC stating the ISSN (1526-7407), date, volume, and first and last page number of each article. Copying for other than personal use or internal reference, or of articles or columns not owned by the association without express permission of the association or the copyright owner is expressly prohibited.</p><p>www.isaca.org</p></li></ul>