SAP Access Control in General
Access Control in SAP is looking at access within a user or a Role to figure out if the user can perform transaction within the SAP System to harm the system or defraud the company. Since access is the first entry point into the system most of the auditing firms tend to focus on this area to see if the users are restricted properly.
Quickly Auditing your SAP System:
Generally they run a query using SUIM and see how many people can do sensitive transactions in Security like SU10 or PFCG, Basis like SM59, STMS, and Finance like F110 etc. This will give a good sense of the SAP Security Posture / Design in the SAP System.
Process for Securing your SAP System
Access control risk can be reviewed multiple ways in the SAP System. This could be securing the default password, properly configuring the system parameter or following best business practice when you are creating custom programs or custom tables
Different Type of Risks in SAP System
SAP SOD Risk: Users or roles having two conflicting transactions. This could be Maintain Customer billing document and post Journal entry.
Sensitive Risk: Having one powerful transaction this could be any mass change transaction which could destabilize the system
Object Level Risk is having a particular object like access to debug or basis object which can let you fire operating system commands from sap
Some of the Pain Points when implementing SAP Access Control Solution
Understanding the SAP GRC report:
One of the main pain point most of the customers are facing is understanding the risk report which comes out the system. The report could be 100 K lines or more and making the Business owner understand what needs to be done is a very difficult. They want a clear logic on why this issue is happening.
Option of Role Removal
One of quickest way to fix the SAP SOD violation is to remove the role from the user. But this not easy to do. There is always a push back from users saying they need the role. Then there is the approval process we have to go through to remove the role from user which is time consuming and cumbersome
SAP Transaction Removal:
Here is a bigger problem to handle. Most of the SAP SOD Issues could be resolved by removing the transactions from the role. But before removing the role a detailed analysis has to be performed to understand who all are having access to the particular transaction. Now you will to get approval from all the users / business owners for you to be able to remove the transaction. There is the issue of impact to the training and testing. So you have adjust the training and testing document to reflect the new role design
SAP Role Redesign:
This solution will cost the company time and money. This will involve starting the role design from scratch. This means you have to involve the functional Business and technical lead to get involved in the project. More over the training documentation and testing scripts have to be complexly re written
The Push Back from Business and Functional Leads:
Normally when you go tell process owners that they need to remove roles or access from users they really do not like this solution. They generally will resist any changes made to the access as it could potentially affect their support.
There is also some logic in their push back. Because SAP ECC is the transactional system and the company could solely rely on the SAP ECC system for their back end operation. They cannot lose their access and incur huge loss. Any CIO or CFO will not agree upon a plan unless it has good mitigation option
My Conclusion:
Look at process Control for SAP as a better option. With Process Controls you can clearly see all the fraud which is happening in the system and this could be the justification for access removal from the users. More over the Auditors only need to take actions on the fraud happening in the system not on fraud which could happen.
[vc_row css=”.vc_custom_1512575306373{margin-top: 50px !important;}”][vc_column width=”1/3″][vc_cta h2=”Free Step by Step SAP License Optimization Guide” shape=”square” add_button=”bottom” btn_title=”click here” btn_style=”flat” btn_color=”default” btn_i_icon_fontawesome=”stm-diamond” btn_css_animation=”left-to-right” css_animation=”left-to-right” btn_add_icon=”true” css=”.vc_custom_1512579904776{padding-top: 50px !important;padding-right: 35px !important;padding-bottom: 50px !important;padding-left: 35px !important;background-color: #3a80f1 !important;}” btn_link=”url:http%3A%2F%2Fexpressgrc.com%2Ffree-sap-license-optimization-guide%2F||” el_class=”c_action”]SAP Customer is liable to pay 70 Million additional SAP licensing fees as a result of what is broadly known as Indirect Access.[/vc_cta][/vc_column][vc_column width=”1/3″][vc_cta h2=”Free SAP GRC 10.0 Step by Step Guide” shape=”square” add_button=”bottom” btn_title=”download here” btn_style=”flat” btn_color=”default” btn_i_icon_fontawesome=”stm-diamond” btn_css_animation=”left-to-right” css_animation=”bottom-to-top” btn_add_icon=”true” css=”.vc_custom_1512579856805{padding-top: 50px !important;padding-right: 35px !important;padding-bottom: 50px !important;padding-left: 35px !important;background-color: #f1b500 !important;}” btn_link=”url:http%3A%2F%2Fexpressgrc.com%2Fsap-grc-10-1-step-step-guide%2F||” el_class=”c_action”]Are you fed up with being not able to get job? Tired of being disappointed in yourself, because you just can’t seem to get started in the career as SAP GRC Consultant?[/vc_cta][/vc_column][vc_column width=”1/3″][vc_cta h2=”Financial Loss due to Fraud Risk” shape=”square” add_button=”bottom” btn_title=”click here” btn_style=”flat” btn_color=”default” btn_i_icon_fontawesome=”stm-diamond” btn_css_animation=”left-to-right” css_animation=”right-to-left” btn_add_icon=”true” css=”.vc_custom_1512579731433{padding-top: 50px !important;padding-right: 35px !important;padding-bottom: 50px !important;padding-left: 35px !important;background-color: #1d9e3f !important;}” btn_link=”url:http%3A%2F%2Fexpressgrc.com%2Ffree-sap-process-control-step-step-guide%2F||” el_class=”c_action”]Using the right kind of SAP Controls in the right way can be trans formative for any SAP System[/vc_cta][/vc_column][/vc_row]