To inherit SAP permissions with different organisational levels
Potential security risks in application processes in IDM systems
SAP, as one of the world's leading software providers with over 100,000 employees, represents a central component of their system landscape for many companies. Thanks to the many different modules, such as "Finance" and "Human Capital Management", as well as the wide range of customization options, a broad field of professions and possible areas of focus has opened up here in almost 50 years.
In addition to the optimisation potential of Security Automation, which I explained in more detail in my last post, the E-Learning division also offers numerous possibilities for automation. Since many companies are not yet making the most of these potentials due to a lack of knowledge about this particular form of knowledge transfer, I would like to address this in the following post. E-learning is also a form of automation that, if used correctly, brings many positive aspects. In the end, e-learning is a way to store know-how in a form that can be retrieved again and again. This means, of course, a certain initial effort for the creator, which nevertheless pays off more than if the quality is sufficient. What are the opportunities for a company to take advantage of e-learning? A company has several ways in which it can exploit and use the area of e-learning for itself. The fundamental question that should arise immediately after the decision to do so is whether the company creates the content itself or whether it relies on the content from external sources. Both have advantages and disadvantages, which I would like to explain in the following.
Configuration
Presentation layer: The presentation layer is the interface to the users. With the help of SAP GUI, the data is graphically prepared here and made available to the user on the screen. Furthermore, the data newly collected here is passed on to the application programs of the application layer.
In addition to purely administrative tasks, SAP administrators are also responsible for communication tasks. They work with the company's internal support services to find ways to help users solve and avoid problems and pitfalls they may encounter when using SAP solutions. For internal purposes, the SAP administrator also prepares documentation to look for errors and try to address the root causes. If necessary, he communicates with the company's decision makers so that improvements, adjustments and optimizations can be made to the SAP software.
For administrators, a useful product - "Shortcut for SAP Systems" - is available in the SAP basis area.
However, especially with large SAP landscapes, there are strict regulations regarding the permissions of technical RFC users.
Therefore a new HANA system like all other ERP systems is also interesting for attackers.