SAP Security Audit Log

Security of computer systems (cybersecurity, or IT security) is very important part of today's word. ERP systems are not excluded from it. In this case a term Enterprise information security is used. Systems are becoming so complex and complexity brings vulnerability, bugs etc that can be misused by an attacker.

In SAP NetWaver ABAP Stack/ABAP Platform based systems there are few tools available that support analyzing of security aspects. One of them is called SAP Security Audit Log (in short SecAudit). It comprises of few t-codes like SM18, SM19 and/or SM20. Purpose is to generate logs of security-related system on different events. Such as configuration changes or unsuccessful logon attempts (dialog, background (e.g. Over RFC)); changes to user master records; RFC calls to function modules; successful/unsuccessful transaction starts; changes to the audit configuration; files uploads/downloads, activation/deactivation of HTTP services; changes to ICF (Internet Connection Framework); usage of digital certificates/signatures; unsuccessful password checks; activities in Virus Scan Interface (VSI) etc. The events to be logged are defined in the Audit Log’s configuration. The recorded events provide information useful for monitoring changes to the SAP system or for tracking a series of events.

SM19 - Configuration of security audit log. Static/Dynamic configuration, Kernel Parameters - to create profiles for the Security Audit Log. With the filters in the profile, determine which events are to be recorded for which users.

SM20 / SM20N - Analysis of Security Audit Log

SM18 - Reorganize Security Audit Log, deletion of old SecAudit logs

 

More information:

Online docu

Support site component: BC-SEC-SAL

539404 - FAQ: Answers to questions about the Security Audit Log

2191612 - FAQ | Use of Security Audit Log as of SAP NetWeaver 7.50

2546993 - Analysis and Recommended Settings of the Security Audit Log (SM19 / SM20)

Law of Personal Data Protection in SAP BW

By default SAP BW provides logging capabilities of data access. Means all users access to data can be logged and evaluated from security and audit point of view. For regular usage of system usually this is enough. Some countries are requiring IT systems to fulfill their own rules while processing personal data. One of example is Spain which few years back introduced so call Ley Orgánica de Protección de Datos de Carácter Personal (LOPD) law.

As BW is one of systems that can store personal information; SAP had to provide capabilities within the SAP BW system to adhere the law. This resulted in introduction of LOPD Access Logging in Reporting and Planning Applications as feature of the SAP BW and/or SAP NetWeaver.

The LOPD feature involves logging all access to sensitive personal data stored in SAP BW. Technically it is delivered via BADI RSEC_LEGAL_AUDIT_SAP. By implementing mentioned BADI the LOPD feature is enabled. As next steps particular InfoProviders which store personal data need to be customized as LOPD relevant via customizing table RSECLOPDIP. Once these things are setup system collects the LOPD relevant data.

Useful information:

933441 - Frequently asked questions on BW 7.0 and data protection