APP-09

Control Description

SAP basis security settings are configured to enforce a hardened security posture in production environments, including: (1) standard/default system IDs (e.g., SAP*) are locked and default passwords are changed; (2) privileged profiles (e.g., SAP_ALL, SAP_NEW) are not assigned to end-users; (3) the production client is configured to prevent direct configuration changes, with all administrative modifications formally logged and monitored; and (4) password policies enforce minimum complexity requirements and system authorization checks are enforced for all transactions

Risk

Inadequate SAP basis hardening may enable unauthorized system access, privilege escalation, uncontrolled production modifications, and bypass of critical controls, resulting in system compromise or unauthorized changes.

Implementation Details

Default System Accounts Hardening:
• Critical initial system accounts (such as SAP* and DDIC) have their default passwords changed immediately upon system installation. The security parameter login/no_automatic_user_sapstar is configured to prevent hardcoded fallback activation, and unused default accounts are locked via user maintenance (SU01).

Privileged Authorization Restrictions:
• Highly sensitive baseline profiles like SAP_ALL and SAP_NEW are strictly excluded from assignment to any standard business end-user or active interface/communication user. SAP_ALL is not assigned to any unlocked user accounts; user access strictly adheres to the principle of least privilege, managed via Role Maintenance (PFCG).

Production Environment Lockdown:
• Direct changes within the production client are prohibited by enforcing structural and repository locks via SCC4 and SE06, with any administrative updates tracked through table T000 change logging.

Password Policy & Transactional Authorization
• Enforcement: Comprehensive password complexity, expiration, and lockout parameters are globally enforced at the application tier (governed by profile configurations verified via RSPARAM). All SAP transactions and custom programs enforce explicit system authorization checks (AUTHORITY-CHECK objects mapped through role assignments in PFCG) before allowing execution.

Test Procedures

1. Test of Design (ToD)

• Inquire of SAP Basis and Security management to understand the security hardening baselines established for the production environment, including default account management, profile assignment policies, client lockdown procedures, and password parameter standards.

• Inspect corporate security policies and SAP baseline configuration standards to verify they mandate locking default accounts (SAP*, DDIC), prohibiting SAP_ALL and SAP_NEW assignments to unlocked users, enforcing production change locks, and applying strict password and authorization parameters.

Test of Operating Effectiveness

• Default Accounts & SAP* Inspection: Execute transaction RSUSR003 to determine if system-delivered IDs (SAP*, DDIC, SAPCPIC, TMSADM) exist and verify their lock status and password status. Additionally, execute transaction SA38 or RZ11 running program RSPARAM (with "Display also unsubstituted?" checked) to confirm that login/no_automatic_user_sapstar is active.

• Privileged Profile Review: Execute transaction SUIM, navigate to User Information System -> Users by Complex Selection Criteria > By Profiles, enter profile SAP_ALL, and execute. Repeat the step for SAP_NEW to confirm that these sensitive profiles are not assigned to any active, unlocked user accounts.

• Production Lockdown Verification:
◘Navigate to SCC4 and click on the production client to inspect that client-specific objects are locked against changes.
◘ Navigate to SE06, click on System Change Option, and review the Global Setting to confirm it is set to Not Modifiable.
◘Navigate to SE11 or SE16N, display table DD09L for table T000, and verify that change logging is enabled over client settings.

• Password Parameter Review: Execute transaction SA38, enter program RSPARAM, check the box for Display also unsubstituted?, and execute to verify that active password complexity, length, expiration, history, and lockout parameter thresholds align with corporate policy.

• Authorization Enforcement & Transport Paths:
◘Review authorization check parameters via program RSPARAM (via transaction SA38) to confirm system security configuration requires authorization checks for all transactions.
◘ Execute STMS to review SAP change transport paths and verify that unauthorized configuration paths are restricted.