SAP emergency user concepts: should you assign SAP_ALL?
Differentiated emergency roles or simply SAP_ALL? We think the differentiation puts the control in the wrong place. What matters is that emergencies stay rare and every session is reviewed without gaps.
This article deals with the design of authorizations within SAP emergency user concepts. Specifically: should you assign the profile SAP_ALL, or are differentiated emergency user roles the better way?
Why auditors look more closely
Emergency users have arrived in mid-sized companies. Auditors increasingly insist on an audit-proof technical design of the sessions, above all with a view to accounting that is sound and traceable. The reason is obvious: direct interventions in the production system with far-reaching authorizations violate the segregation of duties between IT and the business process, and the principle of minimal authorization (need to know), even if only for a short time.
What belongs in an emergency user concept
For Maxim Chuprunov, compliant handling of emergency users begins with a documented and practiced concept. According to him, it includes:
- restricted access to the credentials, no shared access,
- predefined conditions for a session,
- an approval and notification process,
- complete logging of the sessions and
- a regular evaluation of the logs. [1]
So far there is agreement. The ways part on the question of which authorizations the emergency user gets.
Differentiated roles: the obvious wish
Chuprunov considers a technical restriction of emergency user authorizations to different scenarios and user groups desirable. We hear this wish from our customers again and again: one role for financial accounting, one for logistics, one for the basis team, one for developers with display rights.
The idea is understandable. But it has a price: next to the actual authorization concept, a second one emerges that has to be maintained, audited and documented, and that can become an obstacle in the emergency itself when the tailored role is not quite enough.
Our position: few emergencies, full authorization, full review
We take the view that emergency user sessions should be limited to real emergencies. In our experience, a high number of sessions points to shortcomings in the underlying processes and system integrations, and those should be fixed promptly and with priority, instead of making the emergency users more convenient.
If the number of emergencies stays low, we see no need for graded emergency user authorizations. We rather see the danger that a shadow authorization concept establishes itself this way. Our solution ISPICIO_E therefore simply assigns SAP_ALL.
It ensures the integrity of the data and the traceability of the sessions elsewhere: through a mandatory review of all activities in the Security Audit Log. Directly after every session, the individual log is assigned to a reviewer for comment and decision, approve or reject. All sessions are thus stored together with the justification (for example a reference to a ticket), the log file and the review result in a database that can be conveniently evaluated in an audit.
Conclusion
In our view, “SAP_ALL or not?” is the wrong question. What matters is how rarely the emergency user is needed and how completely every session is reviewed. Those who have both under control can grant full authorization in an emergency, and the auditor gets what they want to see: every session, every justification, every result.
[1] See Chuprunov, Maxim: Handbuch SAP-Revision. Internes Kontrollsystem und GRC. Rheinwerk, Bonn 2012, pp. 242 f. (in German).