Skip to main content

ForeThought - DeMystifying SAP Security

ForeThought - DeMystifying SAP Security

I attended SAP Tech-Ed in Bangalore... I am now Officially SAP Netweaver Security Certified. Let me share my understanding about SAP Security.

In my opinion, Classical SAP Security model with Users and Roles is simple yet a well thought out mechanism for giving access to Data and Functionality inside SAP.

The Areas that need clearer understanding/implementation knowhow are Security model for Portals and Business Intelligence.

One of the Areas which is left to abmiguity is security in the Presentation, Session and Transport Layers. Evidently SAP is moving from SNC to HTTPS protocol for Server to server Communications.

With the new emphasis on WebDynpros(Portals) and Exchange Infrastructure(XI) the Diag and Rfc Protocols are giving way to HTTP. This transformation is not very evident as most SAP implementations are centered around SAP GUI. The Core Single-Sign On Central User Admin(CUA) is still based old model.

A Promise from from SAP to deliver the functionality using Standard MS-Office platform is still fairly limited from a security perpective.


If you are typical IT guy...Dont be surprised to see your fellow SAP Basis person speak your same language of LDAP authentication, Kerberos, SAML and SSL Accelaration.

Infact It was heart warming to see the emphasis on Standards based security implementation approach for designing Internet facing SAP Solutions. This includes emphasis on Application gateways, Load balancers, Intrusion Detection, Identity Management and Change Management.

Future of SAP activites
================
User Provisioning - Manual(within SAP), Automated(SPML based) or Managed through LDAP
Role Assignment - Manual(within SAP -PFCG), Automated(SPML based) or Managed through LDAP
Role Creation - Manual Inside SAP - PFCG
Transport Security - Standards based/handled in Appliances (e.g App. Gateways/ Load Balancers etc)
Operating System/Database Security -- Not in Scope

At the pace at which SAP is delivering the new products and functionility this new approach allow them keep a close tab security.

Comments

Unknown said…
good guidance and the following of the content is so helpful and useful. SAP SECURITY TRAINING
2:19 AM
Unknown said…
Well thanks for such wonderful list keep updates see sap community network for consulting management.
12:16 AM
Unknown said…
Well, Thanks for your article.
Its impressive to know something about your note on SAP HANA Course. Please do share your articles like this your articles for our awareness. Mostly we do also provide Online Training on SAP HANA Course. for more info Contact-Us at@ Tectist.com.
8:57 AM
Unknown said…
It was really a nice article and I was really impressed by reading this article We are also giving all software Course Online Training. The Sap SECURITY Online Training is one of the leading Online Training institute in the world.
12:22 PM
Unknown said…
This information which you provided is very much useful for us.It was very interesting and useful for sap online training.We also providing sap online training institute in USA.
8:12 AM
Post a Comment

Popular posts from this blog

ForeThought -- Global directory service for the Digital world

ForeThought Real world is full of people. We have phone books,yellow pages, maps and postal addresses to get to them. Real world is governed by laws, rules and norms. Digital world is full of devices and devices only(severs, desktops, appliances, gadgets etc..) In the digital world, We have DNS, IP Addresses/SMTP mail address, Routers/gateways. All of these methods are still rudimentery to lookup and locate attributes, features and functions of devices. Most devices serve a useful purpose. some of them are misused to inflict pain and damage in the digital world. Clear knowledge attributes, features and functions of devices can hel in reducing the risk and help us in responding to misuse of these devices. An idea of a Global Directory Service -- for locating Devices worldwide....These devices are attributed to People, Resources and Services.... This type of service can help in Asset tracking, Monitoring, Communications, Incident response, forensics and Da...
2 comments
Read more

Blueprint for a new ITaaS Service Provider

Cloud computing is raising the expectation on the agility, availability and access to sophisticated computing and communication platforms for small and medium business. Today most critical IT components for running a successful business are available as SaaS, PaaS or IaaS platforms. There is little value in recreating all these services from the scratch by a new age service provider. It may be prudent to create a skeletal platform for essential services while taking a position of services broker to organize a rich portfolio by aggregating important services into tightly knit IT-as-a –Service offering. The initial target market for such a service provider is Small and Medium Business. We will review aspirations and capabilities needed to serve the ever increasing expectations of small and medium customers from a modern service provider. The Vision, Strategy and Execution plan to create a modern Information Technology as a Service (ITaaS) provider infrastructure is described on the...
2 comments
Read more

RAINing Appliances in the Clouds

Appliances always had a soft-corner in Data center and cloud strategy. My Brush with appliances started in early 2000. We were looking at soultions for traffic management and billing for small ISP. the solutions with software and hardware were quite complicated. We came across small company out of Israel called Allot Networks (www.allot.com). they did a good job in a simple way. Later at NVIDIA, I was exposed Netapp for NAS storage which quickly pivoted into block storage with iscsi. they literally gave away the iscsi protocol license for free with the box for a long time. On the network side, my Exposure was with F5 networks while managing nvidia.com. We were facing scalability issues during product launhces and driver release announcements. We tried newer players such as Array Networks and Netscaler while they were in Beta. We ended up assisting and supporting Netscaler with our feedback to evolve the product to have in-memory caching. In VMworld 2013, I have seen a emergence ...
8 comments
Read more