DB-03

Control Description

The SAP HANA SYSTEM account is disabled in production. Temporary access requires advance approval with documented justification. All SYSTEM account activity is logged via HANA audit policies, and the account is locked upon completion of use

Risk

Failure to restrict and control HANA SYSTEM account access may result in unauthorized use of a privileged shared account, preventing accountability for database modifications, enabling undetected fraud, direct data manipulation, and circumvention of application controls and segregation of duties.

Implementation Details

In production landscapes, the native superuser SYSTEM account is deactivated under normal operating conditions to enforce individual, named administrative accountability.

• When emergency maintenance requires the use of the SYSTEM account, a formal break-glass procedure is enforced:

• Advance approval is required, accompanied by a documented business justification and a tracking ticket reference.

• All actions performed during the session are fully recorded by targeted SAP HANA audit policies.

• Upon completion of the approved maintenance window, the SYSTEM account is immediately locked or disabled.

Test Procedures

Test of Design (ToD):
• Inquire of database administrators and IT management to understand the procedures governing emergency access, break-glass workflows, and operational restrictions for the production SYSTEM account.

Test of Operating Effectiveness (ToE):

• Inspect user account statuses via SAP HANA Cockpit or SQL to confirm that the SYSTEM account is disabled during normal steady-state operations. (e.g by running SELECT* FROM SYS.USERS WHERE USER_NAME='SYSTEM' )

• Audit Log & Event Review: Query the database audit logs (or view STATISTICS / audit analysis tools) for user administration events, specifically targeting ALTER USER SYSTEM ACTIVATE and ALTER USER SYSTEM DEACTIVATE commands, to identify any instances where the superuser account was invoked during the audit period.

• Workflow & Documentation Reconciliation: For any activation events identified in the audit logs, cross-reference the ACTIVATE and DEACTIVATE timestamps to verify the exact duration the SYSTEM account was active. Reconcile this active window against the corresponding change tickets, advance approvals, and business justifications to confirm the usage was properly authorized, closely monitored, and promptly locked upon task completion.