Skip to Content
Technical Articles

Secure By Default for SAP S/4HANA 2020

With the new release SAP S/4HANA 2020, we are taking another step in our journey for secure by default and have increased the number of secure by default settings compared to SAP S/4HANA 1909. Now, with SAP S/4HANA 2020 the following security relevant settings and configurations are automatically applied with new installations, system copies and conversions:

  • 17 security relevant profile parameters are set to secure values which increases security in areas such as:
    • Strong password policies and password hashes
    • Protection of internal system communication
    • Strengthened authorizations system (already shipped with S/4HANA 1909)
    • Enhanced RFC interface protection (already shipped with S/4HANA 1909)
  • Security Audit Log is activated what allows customers to trace critical activities in the system (already shipped with S/4HANA 1909)
  • All scenarios of the Switchable Authorization Framework (SACF) are activated which adds additional functional authorization checks for technical function modules.
  • Values of additional security relevant profile parameters were changed in the kernel default

As with SAP S/4HANA 1909, customers will receive the security settings automatically with new installations, system copies and conversions. An opt-out is possible for the security relevant profile parameters, but not recommended from SAP side. More details can be found in the SAP Note 2926224.

As secure by default settings cannot and will not cover all aspects of security settings in S/4HANA systems, we highly recommend customers to perform additional reviews and improvements of their security settings. Good sources are the SAP security whitepapers. Secure by default settings provide a good starting point, but there are additional security settings and configurations which are either customer specific, cannot be shipped as default or need to be applied on a regular basis (e.g. security patching).

  • Use the SAP-provided tools and services, such as Early Watch Alert, Configuration Validation and System Recommendations in order to display missing security patches. These inform you about gaps in a cost efficient way.
  • Always introduce disruptive security settings with good timing. Conversion projects and new installations are very good points in time to increase security. As a benefit, no additional effort for security testing is required, as testing is scheduled anyway. And this is the most expensive part of security.

For SAP S/4HANA 1909 – Secure By Default, please also refer to this blog Secure By Default: Ways To Harden Your Systems At (Almost) No Cost

You must be Logged on to comment or reply to a post.
  • Hello Bj√∂rn,

    great to see that things are getting more secure out of the box!

    Some days ago I wanted to configure the monitoring of our Webdispatcher used with our S/4 system on the solution manager 7.2. However I noticed that monitoring using Solman is only possible when you have a HTTP port open. Ours was configured with HTTPS only, which I think should be default for a Webdispatcher in the DMZ, but now we had to activate a http port again. There is no option to select the protocol in Solman and only http ist working.

    Do you know when it will be able to monitor a Webdispatcher with Solman 7.2 using https instead of http? We prefer to not activate http on new systems anymore...only https using TLS 1.2.

    Best regards,

    • Hello Markus,

      thanks for your questions. I checked your topic with the SAP internal experts. The issue is known and improvements are planned. Unfortunately, I cannot provide a release date.

      Best regards, Bjoern