🔐 SASA. Curriculum Design - SAP Security Architecture

🎯 Course Overview

📘 Theme 1: User Master Record Fundamentals & Management

Focus: Foundational tasks for user administrators — accurate identification and efficient daily maintenance.

Learning Topics

• Establishing sustainable SAP User ID naming conventions (e.g., using personnel numbers)

• Simplifying long-term user management

• Improving user record accuracy using hidden fields in Transaction SU01

• Practical application for companies without SAP HCM

• Using BAPIs (e.g., BAPI_USER_CHANGE) for programmatic updates

• Transaction SU10 for mass maintenance of user master records and address data

• Customizing rules for automatically generated passwords

• Balancing complexity requirements with user-friendliness

🛠️ Key Transactions

• SU01 — User Maintenance

• SU10 — Mass User Maintenance

📘 Theme 2: Authorization Design & The Profile Generator (PFCG)

Focus: Technical side of creating and maintaining roles to ensure a sustainable security concept.

Learning Topics

• Implementing a "pattern language" for role names

• Identifying module, role type (template, derived, composite), and access mode (management, edit, view)

• Job role template concept

• Maintaining alignment between template job roles and localized (derived) job roles

• Permanently enabling technical name views in Transaction PFCG

• Simplifying troubleshooting and understanding of authorization trees

• Using standard programs (e.g., SUPRN_REGENERATE_DEPENDENT)

• Mass-adjusting derived roles to keep them aligned with parent roles

🛠️ Key Transactions

• PFCG — Profile Generator / Role Maintenance

📘 Theme 3: Development & Transactional Security

Focus: Securing custom ABAP code and managing how users access various system functionalities.

Learning Topics

• Using the Code Inspector (Transaction SE38) to scan ABAP code for backdoors or security holes

• Pre-production security scanning practices

• Using Transaction SHD0 to create transaction variants

• Hiding buttons or setting static values when standard authorizations are insufficient

• Using Transaction SE97 to control and block transactions called indirectly

• Managing the CALL TRANSACTION statement

• Avoiding direct access to critical transactions (like SE16 or SE38)

• Defining parameter transactions for specific programs or tables

🛠️ Key Transactions

• SE38 — Code Inspector

• SHD0 — Transaction Variants

• SE97 — Transaction Call Authorization

📘 Theme 4: Segregation of Duties (SoD) & Governance

Focus: Using SAP GRC Access Control to manage risks and ensure compliance with internal and external policies.

Learning Topics

• Tailoring ad-hoc analysis using custom groups

• New selection criteria available in SAP GRC 10.0

• Defining a structured firefighter user ID naming method

• Identifying emergency users and improving log collection performance

• Organizational-Level Mapping in GRC 10.0

• Using the new "Business Role" type to simplify role derivation and abstraction

• Using standard reports to identify and remove invalid mitigation controls

• Keeping mitigation tables accurate

🛠️ Key Tools

• SAP GRC Access Control 10.0

• Firefighter / Emergency Access Management

📘 Theme 5: Handling Upgrades & Conversions

Focus: Strategies for maintaining authorizations during release upgrades and transitioning from older security models.

Learning Topics

• Understanding critical steps of SU25 (e.g., step 2c for authorization merging)

• Preparing roles in advance to avoid errors during upgrades

• Using Transaction SU25 step 6 to convert obsolete manual profiles

• Transitioning to modern, role-based authorizations

• Identifying and managing new transaction codes introduced in upgrades

• Browsing Table PRGN_CORR2 for delta transactions

• Alerting end users to new password rules (e.g., case sensitivity)

• Using static logon screen messages via Transaction SE61

🛠️ Key Transactions

• SU25 — Authorization Profile Upgrade

• SE61 — Document Maintenance (Logon Screens)

• Table PRGN_CORR2

📘 Theme 6: Auditing & Continuous Compliance

Focus: Monitoring system activity and preparing documentation for periodic reviews.

Learning Topics

• Configuring the Security Audit Log (Transactions SM19/SM20N)

• Monitoring superuser activity and customizing event classifications

• Activating table logging to track changes to critical custom tables

• Configuring change documents for security organization structures

• Using Transaction ST03N workload statistics

• Identifying unused roles and ensuring users have minimum authorizations

• Using pivot tables and specialized queries (e.g., via Transaction SQVI)

• Delivering understandable data to business owners for annual revalidation

🛠️ Key Transactions

• SM19 / SM20N — Security Audit Log

• ST03N — Workload Monitor

• SQVI — QuickViewer

📋 Course Design Notes

This curriculum follows an activity-based, emergent learning approach — bridging theoretical SAP security concepts with real-world application scenarios.