SAP AG D-69190 Walldorf R/3 Security

1 SAP AGNeurottstr. 16D-69190 WalldorfR/3 SecurityR/3 Security Guide: VOLUME IAn Overview of R/3 Security ServicesVersion : EnglishMarch 22, 1999An Overview of R/3 Security ServicesCopyrightSAP AGVersion : March 22, 1999iCopyright Copyright 1999 SAP AG. All rights part of this documentation may be reproduced or transmitted in any form or for any purpose withoutthe express permission of SAP AG further does not warrant the accuracy or completeness of the information, text, graphics, linksor other items contained within these materials. SAP AG shall not be liable for any special, indirect,incidental, or consequential damages, including without limitation, lost revenues or lost profits, whichmay result from the use of these materials.

2 The information in this documentation is subject to changewithout notice and does not represent a commitment on the part of SAP AG in the software products marketed by SAP AG and its distributors contain proprietary softwarecomponents of other software , WINDOWS , NT and EXCEL and SQL-Server are registered trademarks ofMicrosoft , OS/2 , DB2/6000 , AIX , OS/400 and AS/400 are a registered trademark of is a registered trademark of Open Software is a registered trademark of ORACLE Corporation, California, -OnLine for SAP is a registered trademark of Informix Software and X/Open are registered trademarks of SCO Santa Cruz is a registered trademark of Software is a registered trademark of GMD-German National Research Center for , R/2 , R/3 , RIVA , ABAP , SAPoffice , SAPmail , SAPaccess , SAP-EDI , SAPA rchiveLink , SAP EarlyWatch , SAP Business Workflow , R/3 Retail are registered trademarksof SAP AG assumes no responsibility for errors or omissions in these rights Security Guide: VOLUME ICopyrightiiVersion : March 22, 1999 SAP AGAn Overview of R/3 Security ServicesTable of ContentsSAP AGVersion.

3 March 22, 1999iiiTable of ContentsCHAPTER 1 2: Security (non-repudiation)..2-3 Auditing and 3:THE R/3 Security Password Sign-On / Smart Card Unauthorized Logon Authorization Network Communications (SNC)..3-9 Secure Store & Forward (SSF) Mechanisms and Digital and Audit Info System (AIS)..3-15 The Security Audit Internet Applications 4:CUSTOMER Consulting Audit User Security Guide: VOLUME ITable of FiguresivVersion : March 22, 1999 SAP AGTable of FiguresFigure 4-1: An Overview of R/3 Security 4-2: 4-3: Single 4-4: Generating Profiles using the Profile 4-5: The Authorization 4-6: 4-7: Network Area Protected with 4-8: Digital 4-9: Digital 4-10: The Internet Transaction 4-11: Providing ITS Overview of R/3 Security ServicesHow to Use the R/3 Security GuideSAP AGVersion : March 22, 1999vHow to Use the R/3 Security GuideThe R/3 Security Guide consists of three separate volumes, with different levels of detail.

4 R/3 Security Guide VOLUME I:An Overview of R/3 Security ServicesR/3 Security Guide VOLUME II:R/3 Security Services in DetailR/3 Security Guide VOLUME III:ChecklistsR/3 Security Guide VOLUME I : An Overview of R/3 Security ServicesThe R/3 Security Guide VOLUME I provides a general overview of the Security services that we offer inR/3. With VOLUME I, you can familiarize yourself with these services, for example, before establishinga Security policy or before installing an R/3 Security Guide VOLUME II : R/3 Security Services in DetailThis part of the R/3 Security Guide concentrates on the technical measures involved with R/3 Systemsecurity. It contains descriptions of the tasks involved, as well as our recommendations for the variouscomponents of the R/3 System.

5 Use VOLUME II once you have established a Security policy and areready to implement it for your R/3 Security Guide VOLUME III : ChecklistsThe third part of the R/3 Security Guide complements VOLUME II with checklists. You can use thesechecklists to record those measures that you have taken and for assistance when reviewing andmonitoring will also publish updates to the guide as necessary. These updates will also be available overSAPNet in regular ReleasesThis version of the R/3 Security Guide applies to R/3 Releases , , and Where applicable,references to other releases are explicitly Security Guide: VOLUME IHow to Use the R/3 Security GuideviVersion : March 22, 1999 SAP AGTypographical Information and Standard NotationsThe following tables explain the meanings of the various formats, symbols, and standard notations usedin the 1.

6 Typographical Information Used in this GuideThis text formathelps you identifyScreen Textwords or characters you see on the screen (this includes systemmessages, field names, screen titles, menu names, and menu items).User Entryexact user input. These are words and characters you type on thekeyboard exactly as they are in the documentation.<Variable User Entry>variable user input. Pointed brackets indicate that you replace thesevariables with appropriate keyboard CAPITALS report names, program names, transaction codes, table names, ABAP language elements, file names, and Titlecross-references to other books or namekeys on your keyboard. Most often, function keys (for example, F2 and theENTER key) are represented this Object Namenames of technical objects outside of the R/3 System (for example, UNIX orWindows NT filenames or environment variables).

7 This iconhelps you identifyExamplean Example. Examples help clarify complicated concepts or Note. Notes can contain important information like special considerationsor Caution. Cautions help you avoid errors such as those that could lead todata Overview of R/3 Security ServicesChapter 1: IntroductionSAP AGVersion : March 22, 19991-1 Chapter 1: IntroductionWith the increasing use of distributed systems to manage business data, the demands on Security arealso on the rise. When using a distributed system, you need to be sure that your data and processessupport your business needs without allowing unauthorized access to critical information. User errors,negligence, or attempted manipulation on your system should not result in loss of information orprocessing time.

8 These demands on Security apply likewise to the SAP R/3 System. Therefore, at SAP,we offer a number of services to meet the Security demands on the R/3 , to effectively use our services, you need to make your own contribution as well. You need todetermine which Security demands apply specifically to your system. We encourage you to carefullyanalyze your requirements on system Security and define priorities. Where are you most vulnerable?What information do you consider critical? Where is critical information stored or transferred? Whatsecurity options are available to protect your critical data and communications?We recommend you establish a Security policy that reflects these requirements and priorities.

9 Yoursecurity policy needs to be supported and encouraged from upper management as well as from youremployees. It should be practiced company-wide and cover your entire IT-infrastructure, to include yourR/3 System. It should encompass all Security aspects that are important to your system. Securityaspects that you could consider include: User Authentication Authorization Protection Integrity Protection Privacy Protection Proof of Obligation (non-repudiation) Auditing and LoggingTo enforce your Security policy and meet your Security requirements on the R/3 System, we offer avariety of R/3 Security Services based on these aspects. Our services include: User Authentication- R/3 Password Rules- Single Sign-On / Smart Card Authentication- Retributing Unauthorized Logon Attempts R/3 Authorization Concept- Authority Checks- Profile Generator- Authorization Infosystem Network Communications- SAProuter- Secure Network Communications (SNC)R/3 Security Guide: VOLUME IChapter 1: Introduction1-2 Version.

10 March 22, 1999 SAP AG Secure Store & Forward (SSF) Mechanisms and Digital Signatures Auditing and Logging- The Audit Info System (AIS)- The Security Audit Log R/3 Internet Applications SecurityWe have designed our services to give you an individual and flexible approach to R/3 on your priorities, you may decide to use some or all of these provide the R/3 Security Guide to assist you when using our services with the R/3 System. In thisvolume of the guide you receive an overview of our services that relate to Security . See the R/3 SecurityGuide VOLUME II: R/3 Security Services in Detail for a detailed description on how to configure andadminister the various components of the R/3 System that are relevant to Security .