Approving SAP emergency user sessions: ex ante or ex post?
Does every emergency user session need approval in advance, or is a mandatory review afterwards enough? Both approaches have good reasons. Why we chose the review after the session.
Handling super users, the emergency users in SAP, is a perennial topic in the audit of the annual financial statements. An emergency user concept therefore has to answer two questions: What is an emergency in the first place? And who approves the session, and when, before or after? On the second question there are two schools of thought.
Define the emergency first
The first question when drawing up an emergency user concept is the definition of the emergency itself. For us, an emergency is characterized by two criteria:
- Time-critical business processes cannot be executed. The emphasis is on “time-critical”. Anything that can wait belongs in the standard process with change request and transport, not in an emergency user session.
- Administrators or developers need direct access to the tables of the production system, bypassing the transport system.
Once the emergency is defined and the definition is documented, the question of the approval process follows.
Two approval models
Ex ante: approval before the session
In the first approach, every emergency user session has to be approved in advance by an approver, observing the segregation of duties. This approach is often combined with graded authorizations for emergency users, and there are good reasons for that. For example, the first session gets an emergency user role in which the authorization object S_DEVELOP contains display rights only, to narrow down the error and, if possible, fix it already.
The argument: a developer could bypass all control mechanisms of the system with “Debugging & Replace”. A log is then of little use if the damage has long since occurred by the time of the review.
Ex post: immediate access, mandatory review
We take the other approach and have implemented it in our emergency user suite ISPICIO_E. As described at the beginning, we argue for very restrictive handling: emergency user sessions only in a real emergency. But when time-critical business processes threaten the company’s goals, no time should be lost obtaining an approval first.
In this model, an authorized employee therefore immediately receives comprehensive access to the production system (SAP_ALL). ISPICIO_E creates a one-time user ID in the system for every session and links it to the Security Audit Log. After the session is completed, the user ID is deleted again and the associated SAL entries are extracted.
How integrity is maintained
That the access is immediate and comprehensive does not mean it is uncontrolled. The control sits elsewhere:
- In normal operation there is no emergency user in the production system. There is no user ID that could be used unnoticed.
- Every session is reviewed, 100 percent. After every session, the relevant extract of the Security Audit Log is automatically presented to a reviewer, by e-mail notification and observing the segregation of duties. The reviewer has to go through the SAL entries and close the ticket: approve or reject.
- The whole chain can be evaluated. Request, justification, log, reviewer, time and result are stored in a searchable database and shown on a dashboard: Who requested? What was the justification? What was done? Who reviewed when, with what result?
What the auditors get out of it
This setup is particularly well received by auditors, internal and external alike. They can take targeted samples and, for the rejected sessions, ask what remediation was taken. Our answer to “ex ante or ex post?” is therefore: ex post, but for every session and without exception.
More on the model and its implementation: ISPICIO_E: emergency access to SAP systems.