Foreword 11
1. Introduction 13
1.1 Regarding the book 13
1.2 SAP R/3-Environment 17
1.3 Complex System Landscapes 27
1.4 Summary 30
2. SAP R/3-Users and Authorization 31
2.1 Introductory remark: Security within the SAP R/3-System 31
2.2 SAP R/3-Users 34
2.3 The SAP R/3-Authorization Concept 45
2.4 System Presetting 64
2.5 Authorization Checks in SAP-Applications 70
2.6 Protection of tables 78
2.7 Protection of reports 81
2.8 Basic Security 83
2.9 HR-Security 89
2.10 Innovations to Release 4.6 99
2.11 Central User Management and Global User Manager 102
2.12 History of SAP-Technologies within the Authorization Environment 104
2.12.1 Background 104
2.13 Summary 107
2.14 Important SAP-Points within the Authorization Environment 111
3. Imbedding in the internal control system 113
3.1 Necessity of an internal control system 114
3.2 Transferal to the control environment 123
3.3 Identification of the conversion 130
3.4 Monitoring and checking the IKS 134
4. Procedure Model for the Design of an Authorization Concept 137
4.1 The IBM-Phase Model 137
4.2 Parties involved 149
4.3 Fundamental Aspects in Detail 154
4.4 Definition of the areas of work 172
5. Procedure model for the realization of an Authorization Concept 179
5.1 Overview 179
5.2 Realization 180
5.3 Test of implemented roles 196
5.4 Setting up of User Master Record 206
5.5 Productive Start 207
5.6 Running Operation 208
5.7 Emergency Concept 214
5.8 Technical Details 216
6. Test of SAP R/3-Authorization Concepts 219
6.1 User Information 220
6.2 Audit Information System 223
6.3 Direct Table Access 239
6.4 Supplementary Test Data Fields 240
6.5 Further Testing Tools 241
7. SAP Enterprise Portal 247
7.1 General Aspects 247
7.2 Components of the Portals 249
7.3 Interaction Portal and SAP R/3 251
7.4 Access Control and Management 254
7.5 Further Security Measures 267
8. Future Developments and Courses 275
8.1 Introductory Remark 275
8.2 Further Subjects Covered 282
8.3 Outlook 284
Appendix
A Authorization Objects 285
B SAP-References 291
C Bibliography 295
Index 299
