S/4HANA Security Guidance- 2024

[Supriya_Roy]

What are the best practices for implementing the SAP S/4HANA security baseline? We have defined parameters and critical authorization in our SAP ECC systems as per security baseline. Are there any new parameter or crtical authorizations have been introduced in S/4HANA which we have to take care of and can be mentioned in baseline security guardrails of an organisation.

Happy to hear from anyone who has worked on this and share their experience.

[Tobias_Lejczyk · Accepted solution]

Hi Roy,

welcome to the community :).
That is quite an interesting topic. I have written down my thoughts for example here: https://sapinsider.org/making-sap-s-4hana-secure-from-the-start/

It basically boils down to: From a basis perspective, it is not that big of a change from an ECC system. The main change is the user access via the browser, so we have to be aware of how to do HTTP access in a secure way as well as how authorizations work in a UI5 based environment.
In addition, the HANA database and its management tools might be new to some admins as well.

But apart from that, the main changes happen on an application level. The underlying architecture is still an AS ABAP.

In addition to the Security Baseline Concept (or basically any AS ABAP security recommendation) I would also recommend to look into the S/4HANA Security Guidance in the help pages (https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE?locale=en-US => Security Guide) as a starting point.

I hope this helps as a first indicator for a direction to take.

Best regards,
Tobias

[Supriya_Roy · Accepted solution]

Thank you so much Tobias for this insights. As of now I have observed we are following and reviewing same security procedure as of SAP ECC. So I am more curious, do we have other critical authorization or parameters which we must consider in security guardrail for S/4HANA

[Tobias_Lejczyk · Accepted solution]

Well, apart from the things above, no. Wrt authorizations, I cannot say anything, because that is not my specialty. But from a parametrization perspective, I think I didn't encounter any S/4HANA specific parameters. This was all basically in the area of general ABAP Platform parametrization.