Do not assign SAP_NEW
Concept for in-house developments
SNC secures communication with or between ABAP systems, but there are also many web-based applications in SAP system landscapes. They communicate via the Hypertext Transfer Protocol (HTTP). The data is also transmitted unencrypted when communicating via HTTP; Therefore, you should switch this communication to Hypertext Transfer Protocol Secure (HTTPS). HTTPS uses the encryption protocol Transport Layer Security (TLS) for secure data transfer on the Internet. You should therefore set up HTTPS for all users to access the Web. For communication between SAP systems, you should use HTTPS if you think the data transfer could be intercepted. You should either set up HTTPS on individual components of the infrastructure (such as proxies), or the ABAP systems should support HTTPS or TSL directly. Details of the configuration can be found in the SAPHinweis 510007.
With regard to the SAP authorization system, roles and the associated authorization objects, fields and values represent the foundation. Therefore, these check criteria are in the special focus of the authorization analysis of security-relevant characteristics of each authorization administrator. The report RSUSRAUTH is used to display role or authorization data in the respective client. The report analyzes all role data that are anchored in the table AGR_1251. This allows you to quickly find and clean up incorrect and security-critical authorizations not only by selecting the maintenance status of the authorizations, but above all by storing certain authorization objects and controlling them. This ad hoc analysis thus offers you a time-saving method of checking many roles at once according to your own critical characteristics. You can then make full use of this program by importing SAP Note 2069683.
Maintain table permission groups
Before using the system recommendations, we recommend that you implement the corrections in SAP Notes 1554475 and 1577059. It is also necessary that the systems to be managed are connected to the SAP Solution Manager and that in the transaction SMSY were assigned to a productive system and an SAP solution. Then, in the System Recommendations settings, schedule a background job that collects the relevant information about the attached systems. Relevant information is your release and support package stand, as well as SAP notes and their versions. An OSS connection from the SAP Solution Manager, which you have to set up beforehand, will then perform a calculation in the SAP Global Support Backbone, which will determine the necessary information, i.e., that the SAP Solution Manager itself hardly generates any load from the calculation. To automatically check the security level of your systems, you should also schedule this calculation as a background job.
If you get into the situation that authorizations are required that were not considered in the role concept, "Shortcut for SAP systems" allows you to assign the complete authorization for the respective authorization object.
If you want to know more about SAP authorizations, visit the website "www.sap-corner.de".
This trace data can be used by developers to maintain the permission proposal values in the transaction SU22 (see also Tip 40, "Using the permission trace to determine suggested values for custom developments").