Sequence of implementing SAP security notes

[#1]

Dear Experts,

We have a 3 system landscape – Development (DEV), Quality (QAS) & Production (PRD) system.

We have identified the security notes from ST13->RSECNOTE tool for each system & were able to find the common notes for all 3 systems.

1->Please let us know the sequence in which we need to apply the notes? Date wise or note number wise (increasing order)

2->Also can we club the common notes in one transport request and then transport it in all 3 systems ?

As per custom, we would be applying security notes starting from DEV->QAS->PRD.

Issue is , we found some notes which are different for each system. Please guide how do we proceed ?

Whether to import the uncommon notes first or common notes, or in total sequence for each system independently ?

3->By clicking the ‘check side effects button’ We were able to also find some list of notes. These must be the side effects notes of previously applied notes…Should these notes also be implemented first ?

4-> We are also able to see different corrections section as per release version in most of the notes.Should we implement the note(containing all the corrections release wise) or the correction corresponding to the release of our system (in this case we should download the correction only and not the note then ? )

Please guide me...

Regards

Imaan

[former_member80258]

Hello Imaan

I suggest you that follow the next points:

1. First, apply the yellow and after the red alerts.

2. No, each SAP Note applied must be in transport request, not all Notes in one transport request.

3. No, the Side Effects are independent SAP Notes, here must to plan the implementation.

4. The corrections corresponding about SAP release.

Regards

Erick Verbena

PROLAMSA

[bxiv]

To @Erick's second point, if you lump all the corrections into one large transport it will make it faster/easier to move the the landscapes, but if it breaks a critical process you then have no idea what correction brought down your system(s).

In the case of Solution Manager I solved 60% or more of my security issues by just updating my kernel, so while you may have a lot of notes showing up in ST13->RSECNOTE (or EWA) some are for kernel exploits.

[Former Member]

@Eric & Billy - Thanks for the response...

1-> If we follow first yellow alerts then in that also should we follow date wise or note number wise ??

2-> we have approx 40 notes per system . So 40 transport requests to be created...This will be very slow..

3-> I didnt get your point.. Should we implement the side effect notes first before applying any new note ?? Can you let me know why these notes appear in the system..

4-> As per instructions in below link, i understand that we implement the note(containing all the corrections release wise) & system will automatically check the corresponding correction..please correct me...

''To implement the correction instructions from an SAP Note in your system, select the Note on the initial screen in Note Assistant and choose Implement Note.

The system first checks which correction instructions in the SAP Note correspond to your system release and Support Package level.''

http://help.sap.com/saphelp_nw73ehp1/helpdata/en/48/b41a59fc096ff4e10000000a42189b/content.htm?frame...

[bxiv]

I would opt to go for the oldest notes first, but thats just my train of thought.

When you are in snote and you tell the system to download a snote it will prompt for the # of the snote; at which point the system will download the correct set of instructions into the system.

Perhaps an easier way to go about this is to do 5 notes a week/bi-week as this will slowly start fixing your Security note check and will keep a fairly stable environment for you and your user base.

Have you also consider verifying that SP updates will resolve these security issues?

[former_member80258]

Good day everybody

1. Must be date wise in function yellow alert, and the last, date wise red alert.

2. Each SAP security note applied in one Transport Request, not many SAP security Notes in one Transport Request. Therefore, start at Monday with 3 or 5 SAP Security Notes implemented each week

3. The Side Effects goes in Transport Request about SAP security note.

4. That's right, within SNOTE transaction you implement any SAP note and SAP security note.

Erick Verbena

PROLAMSA