OS-02

Control Description

Management performs a periodic review of operating system user accounts and privilege assignments to verify access is limited to authorized personnel only and that elevated privileges (e.g., sudo, root) are restricted to database and system administrators. Inappropriate access is remediated and findings documented.

Risk

Failure to periodically review and remediate operating system access may result in inappropriate or excessive OS-level privileges granted to users, enabling unauthorized system modifications, database access, or circumvention of application controls, leading to system compromise or data corruption

Implementation Details

Periodic Cadence & Automated Extraction:
• Run automated scripts or configuration collection tools on a recurring schedule (at least quarterly
• Pull active user lists, SSH configuration files (/etc/ssh/sshd_config), PAM rules, group memberships (/etc/group), and privilege escalation rules (/etc/sudoers and /etc/sudoers.d/).

Identity Governance
• Compare the extracted local accounts and privileged group members against an authoritative human resources or IT asset inventory to ensure terminated employees or external contractors have been removed.

• Validate that root SSH login is strictly disabled (PermitRootLogin no) and that direct shell access via local credentials is minimized in favor of centralized directory groups.

Formal Management Review & Sign-Off:
• Compile the collected data into an access review report.
• Require IT infrastructure management or system owners to formally review the listing of privileged users and sudo rights, investigate anomalies, and sign off on the review.

Test Procedures

Test of Design (ToD):

• Inquire of Linux/OS administrators and IT management to understand the server hardening standards, directory integration procedures, access review policies, and configuration files implemented for the SAP hosting environment.

• Inspect corporate policies to confirm requirements for periodic OS user/access reviews, root login restrictions, and privilege escalation governance

Test of Operating Effectiveness (ToE):

1- Configuration & File Inspection: Inspect key system configuration files on representative SAP server nodes, including /etc/ssh/sshd_config (to verify root SSH login is disabled), /etc/pam.d/sshd or PAM configurations (to check allowed login groups), and /etc/sudoers / /etc/sudoers.d/ (to review privileged escalation rights), to confirm settings align with corporate hardening baselines.

2- Access Review Verification: Inspect documentation, extraction scripts, and completed sign-offs for periodic OS access reviews to verify that active local accounts, privileged group memberships (/etc/group), and sudo permissions are reviewed and approved by IT management on a recurring basi