topic Re: S_DEVELOP in PRD without Developer access key? in Application Development and Automation Discussions

S_DEVELOP in PRD without Developer access key?

Former Member — Tue, 26 Feb 2019 18:07:11 GMT

Hello,

If a user appeared in DEVACCESS table and have access to authorization object S_DEVELOP with ACTVT value 01 and 02, and later someone deletes the user from DEVACCESS, will that still be a security issue and what all activity that user can perforrm?

Thanks

Re: S_DEVELOP in PRD without Developer access key?

TammyPowlas — Tue, 26 Feb 2019 18:31:11 GMT

Why would someone have 01 02 S_DEVELOP access in production?

Re: S_DEVELOP in PRD without Developer access key?

Former Member — Tue, 26 Feb 2019 18:42:30 GMT

Hi Tammy, In one of the clients I'm seeing users having 01 & 02 access in PRD.

Re: S_DEVELOP in PRD without Developer access key?

TammyPowlas — Tue, 26 Feb 2019 20:09:15 GMT

I would ask why they need that access - that is create and change

Re: S_DEVELOP in PRD without Developer access key?

Colleen — Tue, 26 Feb 2019 23:26:24 GMT

which ABAP release are you on? Developer Keys are no longer used in S/4HANA systems.

You need to protect via authorisations and shouldn't be assigning that level of access in production.

Refer note 2309060 - The SSCR license key procedure is not supported in SAP S/4 HANA

Re: S_DEVELOP in PRD without Developer access key?

tan_michael — Wed, 27 Feb 2019 05:46:56 GMT

Hi,

I think he/she can view the program and debug it since he got 02(changed), she/he change manipulate the data filters through debugging..

Re: S_DEVELOP in PRD without Developer access key?

Former Member — Fri, 01 Mar 2019 15:25:46 GMT

Thanks Colleen, So the client is on HANA 1.0, which means only way to restrict the access is through S_DEVELOP only, is it??

Thanks again!

Re: S_DEVELOP in PRD without Developer access key?

Colleen — Fri, 01 Mar 2019 22:42:36 GMT

restrict your S_DEVELOP and S_TRANSPRT access to display. Take note of DEBUG of for object type to avoid granting permanent access to debug display in production (there is a risk they could debug past a commit statement and end the session before completing program run) - Tan MIchael already made the comment with the ACTVT 02 access.

In PFCG authorisations, press F1 on the S_DEVELOP object as it gives you a heap of practical scenarios

As a side, I've seen developers debug past checks for DEVACCESS Key so quite happy to see guidance that security authorisations is the way to go. Also, it's less manual administration to register developers and continually review keys.

Re: S_DEVELOP in PRD without Developer access key?

Former Member — Thu, 07 Mar 2019 13:23:36 GMT

Thanks Tam for helping

Re: S_DEVELOP in PRD without Developer access key?

Former Member — Thu, 07 Mar 2019 13:26:28 GMT

Thanks Colleen, this helps a lot

Re: S_DEVELOP in PRD without Developer access key?

Former Member — Sat, 23 Mar 2019 12:39:58 GMT

Hi Colleen,

If the my SCC4 is set as no changes allowed and my SE06 not modifiable, would any user with debug access be able to update table data and maybe use debug previliges??

Re: S_DEVELOP in PRD without Developer access key?

Colleen — Sun, 24 Mar 2019 09:38:30 GMT

pretty sure they could debug past the table checks

debug display in a product environment can be a risk if user debug's past a commit statement and exits out before program has completed.

In short, protect your system integrity and restrict the object.

Re: S_DEVELOP in PRD without Developer access key?

Former Member — Tue, 26 Mar 2019 04:47:58 GMT

Thanks Colleen, In this case someone had debug access, now I wanted to understand if any changes were done using that access. Audit logging in the system is not enabled hence can’t check the sm20 logs, any other leads to see If any changes were made??

Tried checking if RSTPDAMAIN is invoked through ST03N and it appears during the period but do RSTPDAMAIN gets called even with display debug access as well?? And is it’s the right way to go about it?

Any other possible way to find out if at all any changes were made??

Thanks a lot for helping.