ITS / ITSmobile
Integration of SAP Notes
The core of SAP Basis is the application layer with one or more application servers and a message server. The message server is used for communication between the application servers and transmits jobs between them. The application layer communicates with the database layer on the one hand and the presentation layer on the other. The applications on the application server request the required data from the database, process it and prepare it for the user, who displays it in his Graphical User Interface (GUI) via the presentation layer. Conversely, the application server passes information that the user enters via the GUI on to the database.
This is where all the system's data resides. These are composed of the actual database and the DBMS, the "database management system". In earlier versions, the database here came from different manufacturers. For example, Microsoft SQL or Oracle. Since SAP HANA, a lot has changed for IT in this data layer. This is because the database comes from SAP itself and is automatically monitored by the system. There is more to this database layer than just the working data. Important elements such as the configuration tables and system data for control and application content are also stored here. This is the repository data used by applications.
SM20 Evaluation of the Security Auditlog
NEW TECHNOLOGIES AND INNOVATIONS The role of IT is changing (bi-modal IT). On the SAP basis, this new bi-modal organisation is particularly true. On the one hand, it is necessary to continue to ensure the SAP operation in the usual stability and security, and on the other hand, to act as a business innovator in order to fulfil the role as a technology consultant for SAP technology. ADJUST SAP basis NAMING The original definition and naming of the SAP basis no longer meets today's task. Therefore, it is recommended to give the SAP basis a meaningful and contemporary description depending on the future organisation form. For example, the bi-modal role listed in Recommendation [A1] should be taken into account.
An important area of SAP Security is the analysis of the customer's own SAP programs, which are classically written in the proprietary SAP language ABAP. Here, too, as in all programming languages, security vulnerabilities can be programmed - whether consciously or unconsciously. However, the patterns of security vulnerabilities in ABAP code differ from those in Java stacks or Windows programs. The goal of these conventional programs is usually to either crash the program (buffer overflow) or to artificially execute the program's own code (code injection). Both is not possible in ABAP, since a crash of a process causes nothing else than the creation of an entry in the log database (Dump ST22) and a subsequent termination of the report with return to the menu starting point. So a direct manipulation as in other high level languages or servers is not possible. However, there are other manipulation possibilities.
Some missing SAP basic functions in the standard are supplied by the PC application "Shortcut for SAP Systems".
However, manual provisioning processes are by their very nature a source of errors.
It performs the task of time-consuming analysis of log files and also ensures maximum reliability through automation.