With the new release SAP S/4HANA 2020, we are taking another step in our journey for secure by default and have increased the number of secure by default settings compared to SAP S/4HANA 1909. Now, with SAP S/4HANA 2020 the following security relevant settings and configurations are automatically applied with new installations, system copies and conversions:
- 17 security relevant profile parameters are set to secure values which increases security in areas such as:
- Strong password policies and password hashes
- Protection of internal system communication
- Strengthened authorizations system (already shipped with S/4HANA 1909)
- Enhanced RFC interface protection (already shipped with S/4HANA 1909)
- Security Audit Log is activated what allows customers to trace critical activities in the system (already shipped with S/4HANA 1909)
- All scenarios of the Switchable Authorization Framework (SACF) are activated which adds additional functional authorization checks for technical function modules.
- Values of additional security relevant profile parameters were changed in the kernel default
As with SAP S/4HANA 1909, customers will receive the security settings automatically with new installations, system copies and conversions. An opt-out is possible for the security relevant profile parameters, but not recommended from SAP side. More details can be found in the
SAP Note 2926224.
As secure by default settings cannot and will not cover all aspects of security settings in S/4HANA systems, we highly recommend customers to perform additional reviews and improvements of their security settings. Good sources are the
SAP security whitepapers. Secure by default settings provide a good starting point, but there are additional security settings and configurations which are either customer specific, cannot be shipped as default or need to be applied on a regular basis (e.g. security patching).
- Use the SAP-provided tools and services, such as Early Watch Alert, Configuration Validation and System Recommendations in order to display missing security patches. These inform you about gaps in a cost efficient way.
- Always introduce disruptive security settings with good timing. Conversion projects and new installations are very good points in time to increase security. As a benefit, no additional effort for security testing is required, as testing is scheduled anyway. And this is the most expensive part of security.
For SAP S/4HANA 1909 - Secure By Default, please also refer to this blog
Secure By Default: Ways To Harden Your Systems At (Almost) No Cost
