Security Aspects SAP Integrated Business Planning for Supply Chain 2102 Company
Total Page:16
File Type:pdf, Size:1020Kb
Security Guide | PUBLIC Document Version: 1.5 – 2021-04-16 Security Aspects SAP Integrated Business Planning for Supply Chain 2102 company. All rights reserved. All rights company. affiliate THE BEST RUN 2021 SAP SE or an SAP SE or an SAP SAP 2021 © Content 1 Security Aspects............................................................4 2 Technical System Landscape...................................................6 3 Identity and Access Management................................................8 3.1 User Authentication.......................................................... 10 3.2 User Authorizations and Permissions..............................................12 Roles and Authorizations.................................................... 13 Data Filters..............................................................14 3.3 Basic Concepts............................................................. 45 Employees.............................................................. 45 Business Users...........................................................46 Business Roles...........................................................46 Business Catalogs.........................................................47 Restrictions..............................................................75 3.4 Apps for Identity and Access Management..........................................93 Maintain Employees (Old Version)..............................................93 Maintain Employees........................................................95 Information Lifecycle Management.............................................95 Maintain Business Users....................................................102 Maintain Business Roles....................................................105 Business Catalogs........................................................ 110 Business Role Templates....................................................112 User Groups.............................................................113 Display Technical Users.....................................................114 IAM Information System....................................................118 Display Restriction Types....................................................119 Display Communication Scenarios.............................................119 Display Authorization Trace..................................................120 IAM KeyFigures..........................................................120 Maintain Deleted Business Users..............................................121 Manage Business Role Changes After Upgrade....................................127 Manage User Permissions...................................................132 My Permissions..........................................................134 3.5 Frequently Asked Questions....................................................135 Administrator Tasks.......................................................135 Integration with the Identity Authentication Service.................................136 Security Aspects 2 PUBLIC Content Integration with SAP Identity Access Governance.................................. 137 Integration with Identity Provisioning Service.....................................138 Logging into Excel Add-In................................................... 138 User Provisioning.........................................................138 Business Catalogs and Fiori Apps............................................. 140 Business Roles and Restriction Types...........................................141 Permission Filters and Attribute Permissions..................................... 142 Integration with SAP Jam...................................................144 4 Security of Data Centers and External Auditing................................... 145 5 Data Integration...........................................................147 5.1 Virus Scanning.............................................................149 6 Secure Communication for Integrations.........................................150 6.1 Secure Communication for Inbound Integration......................................150 6.2 Secure Communication for Outbound Integration .................................... 151 6.3 Maintain Certificate Trust List...................................................151 6.4 Maintain Client Certificates.................................................... 152 7 Client-Side Protection.......................................................153 7.1 Maintain Protection Whitelists.................................................. 153 7.2 Manage Content Security Policy.................................................154 Content Security Policy (CSP) in Blocking Mode...................................155 8 Data Protection and Privacy.................................................. 157 8.1 Glossary..................................................................158 8.2 Master Data Records.........................................................161 8.3 Business User Records....................................................... 163 8.4 Relevant Business Catalogs....................................................165 8.5 Data Protection During HTTP Sessions............................................166 9 Switching Over to Self-Controlled Encryption Using Key Management Service ........... 168 10 Security Audit Logging...................................................... 171 10.1 Display Security Audit Log..................................................... 171 How to Display the Audit Analysis Report........................................172 How to Configure a Personalized View...........................................172 10.2 Time Synchronization with NTP Service............................................174 11 Customer-Initiated Penetration Testing..........................................175 Security Aspects Content PUBLIC 3 1 Security Aspects Target Audience ● Technology consultants ● Security consultants ● System administrators Why Is Security Necessary? Security has always been an important element for the complete product life cycle of all SAP products, including product development, planning, and quality-assurance. Like the other SAP Products, SAP Integrated Business Planning (IBP) was designed to protect your data both from web attacks and from attacks in the cloud. Some of the most important security focus areas are: ● Technical System Landscape [page 6] ● Security of Data Centers and External Auditing [page 145] ● Data Integration [page 147] ● User Authentication (see the SAP Help Portal at http://help.sap.com/ibp, under Application Help SAP Integrated Business Planning Administration Identity and Access Management User Authentication ) ● Identity and Access Management (see the SAP Help Portal at http://help.sap.com/ibp, under Application Help SAP Integrated Business Planning Administration Identity and Access Management ) ● Data Protection and Privacy [page 157] ● Network and communication security (see Secure Communication for Inbound Integration [page 150] and the SAP Help Portal at http://help.sap.com/ibp, under Application Help SAP Integrated Business Planning Planning with Microsoft Excel Information for Business Users Self-Service Installation (Business Users) Setting Up a Connection to IBP and the Planning Area ) ● Application-specific virus scanning (see Virus Scanning [page 149] ) ● Security-relevant logging and tracing (see the SAP Help Portal at http://help.sap.com/ibp, under Application Help SAP Integrated Business Planning Administration Identity and Access Management IAM Information System ) Note You can find SAP HANA Cloud Platform Integration for data services Security Guide at http:// help.sap.com/cpi_ds under Security Security Guide . SAP takes care of security aspects and data protection within the IBP system landscape. On your side, you need to make sure to: Security Aspects 4 PUBLIC Security Aspects ● Create and assign appropriate business roles to your business users ● Protect the clients in which the IBP add-in for Microsoft Excel is running ● Set up a secure data integration to the systems from which you import data (SAP Cloud Platform Integration for data services) Further Information To learn more about specific topics, refer to the links below: ● Security: https://community.sap.com/topics/security ● Related SAP Notes: ○ https://support.sap.com/en/my-support/knowledge-base.html ○ https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html ● Released platforms: https://support.sap.com/en/release-upgrade- maintenance.html#section_1969201630 Security Aspects Security Aspects PUBLIC 5 2 Technical System Landscape SAP Integrated Business Planning (IBP) is a cloud offering that runs in the SAP Public Cloud or a hyperscaler system. Since cloud solutions from SAP deal with business data from your core business processes, SAP adheres to the following security and quality requirements: ● The business data is stored securely in SAP data centers or the customer’s preferred hyperscaler system. ● Users who require access to the business data must authenticate themselves and their identity must be verified by Identity Authentication service or an on-premise identity provider, depending on the actual system landscape. ● Users can only perform actions and view or edit data that the business roles and permissions they are assigned permit. For more information, see User Authentication [page 10]. ● Customer data always belongs to the customer. Access to cloud solutions from