City of Edmonton - Office of the City Auditor

AUDIT PLAN
SAP User Access

SAP Security and Access - Risk and Audit Procedures Matrix

Submitted by Vince Rykes, Audit Coordinator City of Edmonton Vincent.Rykes@edmonton.ca

SECTION A: Security Administration

Risk: Failure to implement adequate SAP security administration procedures could result in unauthorized access to sensitive data
and programs, affecting the integrity, availability, or confidentiality of the system and its data.

Internal Controls Audit Procedures Audit Observations

Access to perform security administration functions including the profile I1.Inquire of SAP Security
generator should be restricted. This is controlled via the following Administration who has access
authorization objects: to security administration
• User master maintenance: User groups; functions and determine if they
are adequately restricted.
• User master maintenance: Authorization profile; I2.Use the SAP Audit
• User master maintenance: Authorizations; Information System (AIS) to
• Authorization check for transaction start. review access to Basis Client
levels. (000, 001).
I3.Use the AIS to Identify users
with access to other sensitive
authorization objects.

19907114.doc 07/23/09
1
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access
For proper segregation of duties for security administration of the I4.Inquire/Verify of SAP Security
Profile Generator, SAP recommends that following 3 roles be Administration who is performs
segregated: the roles and determine if roles
1. User administrator (defines and maintains user master records) are adequately segregated.
2. Data administrator (creates/changes activity groups and
authorizations)
3. Profile administrator (display activity groups and their data).
Profile and Data administration should be performed in the development
environment. Segregation of the Data and Profile roles provides a
strong control over the accuracy and authorization of changes.

Security administrators may grant themselves access to inappropriate I5.Inquire of SAP Security
transactions. They can be restricted from maintaining their own access Administration if SAP is linked to
rights but would still be able to create a new user master record which an external security system.
they could use to access the inappropriate transaction. Security
administrator access can only be fully restricted if SAP Is linked to an
external security system (SFCUDE or KERBEPOS).

If security is maintained in a decentralized manner, all users must be I6.Use the AIS to Identify users
assigned to 'User groups' in order to confine decentralized user who are not assigned to User
administrators to their own users. This prevents a user administrator Groups. Follow up and assess
from one group maintaining a user in another group. However, if a user for propriety.
is not assigned to a group, they can be maintained by a user
administrator with access to any group.

19907114.doc 07/23/09
2
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access
SAP security administration procedures should be documented and I7.Obtain documented security
include procedures to address the following tasks: procedures and assess
appropriateness and
• addition, change and deletion of user access privileges; completeness.
I8.Use the AIS to identify users
who have never logged on.
• access to the SAP system which should be authorized and approved
in writing by the relevant data or process owners;

• removal of access (upon completion of assignment) for temporary I9.Audit a sample of access
staff (e.g. contractors). This can be achieved via the use of validity forms and profiles against
periods on the user master records; authorization forms.

• deletion of users who have never logged in, have not logged in for a
certain number of days or who have left the organization.
Consideration should be given to locking out users who have not
logged on in over 30 days;

• automatic notification of security administration staff when staff

leave the organization or are transferred to a new position, so that
they may remove SAP access as well as access to other systems
(e.g. operating system, local area network);

An audit trail of security administration activity should be reviewed on a I10.Inquire of SAP Security
regular basis in order to detect any unusual activity. Administration who reviews
audit trail of administration
activity. Obtain and review any
recent reports.

19907114.doc 07/23/09
3
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access

SECTION B: SAP Security Parameters

Risk: Unauthorized access due to inadequate password and control controls and conventions.

Internal Controls Audit Procedures Audit Observations

User master records should be locked after a certain number of J1.Inquire/verify of SAP
unsuccessful attempts to log-in to the system with an incorrect Security Administration what
password (e.g. three attempts). This protects against an unauthorized controls are in place to identify
user continually attempting to guess another user's password. Locked unsuccessful log-ins. Do they
user-ids are automatically unlocked at midnight and a daily review of use the Audit Security Log that
locked users is therefore recommended. This can be achieved via comes standard with SAP?
review of the system log or a scheduled report of the locked users (run
immediately prior to the automatic unlocking). J2.Use AIS to Identify
unauthorized access attempts.

If the SAP* user master record is deleted, SAP* reverts to its original J3.Check system parameters .
state with complete access and a default password. A system parameter regarding deletion of SAP*
can be set to prevent users from being able to log on as SAP* with the J4.Check history of any SAP*
default password in the event that the SAP* user master record has deletions.
been deleted.

Users should be forced to change their passwords at regular intervals J5.Use AIS to review login and
(e.g. every 30 days). This reduces the likelihood of a third party gaining password parameters for
unauthorized access to the system. compliance with corporate
guidelines.

19907114.doc 07/23/09
4
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access
The minimum password length should be set to an appropriate value J6.Use AIS to examine
(e.g. six characters) to prevent passwords being guessed. The default password table (USR40) for
system setting is three characters and the maximum length is eight invalid or inappropriate
characters. passwords.

SAP should stop the current session after a certain number of J7.Examine SAP Security Log
unsuccessful attempts to log-in to the system (e.g. three attempts). This for unsuccessful login attempts.
may deter an unauthorized user from attempting to guess another users
password

Users should be logged off the system after a specified period of J8.Use AIS to identify users
inactivity. This may prevent an unauthorized user from gaining access who have never logged on or
to an idle terminal if the workstation has been left unattended for an have not logged on after long
extended period of time. Time-out facilities at the local area network periods of inactivity.
level should therefore also be utilized.

It is possible to disable the systems check of a user’s authorization for a J9.Inquire/verify of SAP
transaction code at the commencement of each transaction. This check Security Administration whether
is turned on by default and should not be deactivated. this check is turned on.

If the profile generator is activated it is possible to disable standard J10.Inquire/verify of SAP

authorization checks. If used inappropriately this could create Security Administration whether
significant access exposures. This functionality should therefore be standard authorization checks
appropriately secured and changes closely scrutinized have been disabled.
J11.Examine log or history files.

19907114.doc 07/23/09
5
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access

SECTION C: Restricting Access to Data/Programs

Risk: Unauthorized access to SAP data and programs could result in unauthorized changes to system data including the
processing of fraudulent transactions.

Internal Controls Audit Procedures Audit Observations

Any custom transactions or programs that are developed should follow K1.Inquire/verify of SAP
a consistent naming standard which complies with SAP conventions. It Security Administration
should be ensured that custom transactions and programs have the whether standard naming
necessary access control checks included within them. conventions are used.
K2.Determine whether
necessary access controls
are in place.

SAP supplied user master records are very powerful and are delivered K3.Inquire/verify of SAP
with default passwords. These passwords are well known and should Security Administration
be changed immediately to ensure the system is protected from whether default passwords
unauthorized access attempts. These user-ids are the first to be have been changed for SAP
attempted by unauthorized users, such as hackers, trying to break into supplied user master records.
an SAP system. K4.Check passwords for
SAP* and DDIC.

19907114.doc 07/23/09
6
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access
There is a standard SAP program which allows the user to access the K5.Inquire of SAP Security
operating system command line. This enables the user to perform Administration whether access
operating system commands from within SAP using the powerful access to these utilities is appropriately
rights of the SAP user-id in the operating system. There is also a restricted from users in the
standard transaction which allows access to perform a pre-defined set production environment.
of operating system commands as well as creating and executing new K6.Use the AIS to Identify SAP
programs (ABAP) that are not
commands. Access to these utilities should be restricted from all users
placed in an authorization
in the production environment. Operating system access should be group.
administered via the operating system itself and not from within SAP.

Adequate security guidelines should be in place to ensure that users K7.Review and assess existing
and IT staff are prevented from accessing programs and data. This security guidelines re user and
security policy should be enforced by appropriate consistent security IT access to programs and data.
settings across all IT environments (database management system,
operating system and local area network).

There should be clearly defined emergency access procedures for the K8.Review and assess
production SAP system. This should include monitoring of all activity emergency access procedures
performed while emergency access is granted to ensure that for the production SAP system.
unauthorized or incorrect changes to data or programs are detected.

Any sensitive transactions that are not used can be locked in the K9.Review and assess existing
system to prevent intentional or unintentional use. procedures for locking sensitive
transactions.
Use AIS to identify locked
transactions.

19907114.doc 07/23/09
7
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access

SECTION D: Restricting Access to Powerful System Functions

Risk: Failure to adequately restrict profiles and authorizations to the appropriate users will result in unauthorized access to
various functions within the system. This could result in unauthorized or even fraudulent transactions being processed and could
threaten the integrity of data in the system.

Internal Controls Audit Procedures Audit Observations

SAP comes with a number of standard profiles and authorizations which L1.Inquire of SAP Security
can be used by the organization. These standard profiles and Administration whether these
authorizations should not be used in production because they provide profiles are used in
very generic access and generally do not adequately address production.
segregation of duty issues. These standard profiles and authorizations L2.Use AIS to identify users
are also subject to changes in future releases of SAP which may result who can execute all SAP
in changes to user access rights after the software is upgraded. transactions.

Users should be restricted from executing ABAP programs in the L3.Inquire/verify of SAP
production environment. There are many powerful ABAP programs in Security Administration
the system which perform sensitive functions (e.g. deleting master data) whether ABAP programs can
that do not incorporate any security checks. Access to the transactions be executed in the production
used to nominate then execute ABAP programs (including report environment, review access
painter) should be restricted. All ABAP reports that need to be executed to ABAP programs.
should be attached to info system report trees. In order to totally secure L4.Inquire/verify of SAP
ABAP programs from unauthorized use, all programs can be assigned Security Administration
to an authorization group and access restricted via authorization group whether all reports are
using the authorization object ‘ABAP/4: Program run checks’. attached to report trees.

19907114.doc 07/23/09
8
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access
Access to development functions including the ability to maintain ABAP L5.Inquire of SAP Security
programs should be totally restricted in the production environment. Administration whether these
This is controlled via the authorization object ‘ABAP/4 Development profiles are used in
workbench' which (apart from display access) should not be allocated production.
in production L6.Use AIS to identify users
who have ability to execute
UNIX commands.
L7.Use AIS to review
authorizations granted to
developers.

There are various powerful standard profiles in the system which should L8.Use Audit System Log to
not be granted to users including: identify users with SAP_ALL
• ‘All authorizations for the R/3 system' (SAP_ALL): this Profile allows and SAP_NEW profiles,
the user to perform all functions in the system and is especially ensure that they do not have
powerful. It should not be granted to any users in the production access to the production
environment environment.
• ‘All authorizations for newly created objects' (SAP_NEW): this
profile provides general access to any new profiles and
authorizations which are included in a new release of SAP. These
may provide access to inappropriate functions. This profile should
not be allocated to any users in production.

Debug access should not be provided to any users in the production L9.Inquire of SAP Security
environment. This could allow a user to bypass the authority checks Administration whether debug
included in ABAP programs/transactions. access is used in production.
L10.Examine any history or
log files.

19907114.doc 07/23/09
9
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access
Access to perform corrections and transports should be restricted in all L11.Use AIS to identify users
environments. This access is provided by the authorization object with correction and transport
'Workbench organizer and transport system' which should be granted to capabilities and determine
authorized users only. appropriateness.

Access to the 'System Administration Functions' authorization object L12.Inquire of SAP Security
should be restricted as this provides users with access to powerful Administration as to who has
systems administration functions including the following: this capability and determine
appropriateness.
creating new clients: L13.Use AIS to review
locking/unlocking transactions; production and acceptance
controlling others spool (print) requests; and settings to ensure direct
deleting data without archiving. changes cannot be made.

Access to the batch processing authorization objects should be L14.Inquire/verify of SAP

restricted, as these provide access to background job administration Security Administration
functions. These functions should be restricted to authorized users only. whether batch processing
authorization objects are
restricted.

Access to maintain ABAP program attributes and copy or delete L15.Inquire of SAP Security
programs should also be restricted from unauthorized users via the Administration who has
authorization object ABAP/4: Program run checks.' access to maintain ABAP
program attributes.
L16.Use AIS to review
program changes and
evaluate whether the
changes were authorized.

19907114.doc 07/23/09
10
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access

SECTION E: System ‘Super Users’

Risk: Super users have powerful system access rights and should be adequately protected to ensure that unauthorized access to
the system is prevented. If access is gained to super user accounts it could result in unauthorized transactions being processed
and the integrity of system data being compromised.

Internal Controls Audit Procedures Audit Observations

The SAP* user is delivered as the standard super user with the System. M1.Inquire of SAP Security
It should not be deleted because it will be reinstated by the System with Administration if SAP* has
a default password which is widely known and easily guessed. SAP been deleted from access
recommends that the SAP* user be copied to another user master profiles and whether or not it
record (this will become the super user to provide emergency access has been copied to another
privileges), and the profiles allocated to SAP* removed to reduce further user.
the likelihood of unauthorized access. M2.Examine profiles attached
to SAP* and assess
appropriateness

Default passwords for the standard SAP* delivered user master records M3.Inquire of SAP Security
should be changed to prevent unauthorized access to the system. Administration if SAP*
passwords for user master
records have been changed

The combination of powerful profiles which are assigned to SAP* M4.Use AIS to check users
should not be assigned to any other single user master record with the with profiles similar to SAP*
exception of the user created to replace the SAP* user master record.

19907114.doc 07/23/09
11
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access
Policies and procedures should be developed to ensure access to M5.Inquire of SAP Security
'super users' is adequately restricted, Procedures should include the Administration of Policies and
storage of super user account passwords in a secured location (e.g. a Procedures for restricting and
safe) and processes to require the changing of the password after each monitoring access to super
use. The activity of super user accounts should also be monitored to user profiles.
ensure that access is used only for appropriate purposes. M6.Use AIS to review access,
use and passwords of
restricted profiles.

The SAP system is delivered with a standard user master record called M7.Inquire/verify of SAP
'EARLYWATCH' which is used by SAP to provide an optional online Security Administration if
support service. This user is assigned all authorizations for the SAP ‘EARLYWATCH’ is used. If so
system which is an inappropriate level of access to the organization’s ensure access is restricted.
programs and sensitive data. This user and any other user master
record accessed by SAP should be restricted to required functions only.

19907114.doc 07/23/09
12
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access

SECTION F: Restricting Access to System Tables

Risk: Unauthorized access to the table maintenance function could result in system data and configuration settings being
corrupted.

Internal Controls Audit Procedures Audit Observations

Specific transactions exist which allow direct updating of tables. Access N1.Inquire of SAP Security
to such transactions must be restricted only to authorized users through Administration whether
the authorization object ‘TabIe maintenance’. access to ‘Table
Maintenance’ is restricted.
N2.Use AIS to identify users
who have table maintenance
capabilities.

Some tables are client-independent which means that if they are N3.Inquire/verify of SAP
updated in one client this affects all SAP clients in the same Security Administration
environment (system). Access to maintain client-independent tables for whether access to
non-production clients which reside on the production client machine ‘Maintenance of client
should be restricted. Access to maintain client-independent tables is independent’ authorization is
provided by the authorization object 'Maintenance of client independent’ restricted.
tables.

All system tables are delivered with a 'table class' assigned. All users N4.Inquire of SAP Security
with table maintenance responsibilities should be restricted to the Administration whether table
appropriate table class, and care should he taken when assigning maintenance access is
access to maintain tables in the class 'w/o auth group' (tables that are matched to appropriate table
not assigned a specific class). Access to display tables should also be class.
restricted as many tables contain sensitive information. This access N5.Use AIS to identify tables
should be restricted by table class. that are not placed in
Authorization groups and
assess appropriateness.

19907114.doc 07/23/09
13
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access

Access to data dictionary (system tables) transactions should be N6.Inquire/verify of SAP

adequately restricted in all clients in the production system. These Security Administration
transactions include the ability to maintain and display data dictionary whether access to data
tables as well as maintaining technical settings and running utilities for dictionary transactions is
system tables. restricted.

Changes to sensitive system customizing tables (including CTS tables) N7.Inquire/verify of SAP
should he logged in both the development and production environments Security Administration
and the report 'Analysis of table log database' reviewed on a regular whether logging and report
basis to ensure that any unauthorized table changes are detected. reviewing is done.
N8.Use AIS to review
changes to Critical System
tables.

19907114.doc 07/23/09
14
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access

SECTION G: Segregation of Duties

Risk: Certain combinations of roles within a user master record may allow a user to process transactions which, in combination,
result in a compromise of segregation of duties.

Internal Controls Audit Procedures Audit Observations

As part of the security implementation project, the profiles being O1.Inquire of SAP Security
designed should be assessed to determine whether they provide Administration whether
access to conflicting duties in the system. Care should be taken to segregation of duties issues
ensure that the activity groups/profiles created provide only the level of were addressed.
access which is intended by management. A job roles matrix should be
developed as a part of the security implementation strategy to ensure
that the roles assigned to each 'job' or ‘position' in the SAP system are O2.Obtain job roles matrix
clearly defined and justified. and review for conflicting
duties.

19907114.doc 07/23/09
15
 City of Edmonton - Office of the City Auditor
AUDIT PLAN
SAP User Access
Procedures should be developed for user administration to ensure that O3.Inquire/verify of SAP
segregation of duties issues are considered. These procedures should Security Administration of
ensure that: Policies and Procedures in
• new users are not granted any combination of profiles/activity place for ensuring that
groups that would result in them having access to perform functions segregation of duties issues
which are not consistent with their job role or position in the are addressed.
organization (e.g. a materials management specialist) having the
ability to post an invoice);
• the access rights of existing users are assessed prior to new
profiles/activity/ groups being included in their user master records.
The allocation of a new profile/activity group could result in the user
having inappropriate access to functions which are inconsistent with
their job role. It may be necessary to remove existing profiles/activity
groups from the user master record.

A periodic review should be performed to evaluate the levels of access O4.Use AIS to review any
that have been granted to system users This may be performed existing incompatible
manually or with the aid of third party software tools. The aim of the functions as defined by
review should be to identify any potential conflicts in the users' access transaction starts in function
rights and to ensure that these are corrected table (SUKRI).

19907114.doc 07/23/09
16