{"id":9918,"date":"2024-01-10T14:31:17","date_gmt":"2024-01-10T12:31:17","guid":{"rendered":"https:\/\/www.inprosec.com\/?p=9918"},"modified":"2024-05-16T13:14:45","modified_gmt":"2024-05-16T11:14:45","slug":"sap-configuration-validation","status":"publish","type":"post","link":"https:\/\/www.inprosec.com\/en\/sap-configuration-validation\/","title":{"rendered":"SAP Configuration Validation"},"content":{"rendered":"

Configuration Validation<\/strong><\/em> is an SAP Solution Manager<\/strong><\/em> tool that checks if SAP systems are configured consistently with the company’s established requirements.<\/p>\n

The tool works by comparing one or more systems against a reference system, which can be an existing real system or a virtual system called Target System<\/strong><\/em>.<\/p>\n

 <\/p>\n

\"\"<\/b><\/p>\n

 <\/p>\n

Target System<\/b><\/h2>\n

A Target System<\/strong><\/em> is a virtual system containing configuration data used as a reference for comparison with other systems.<\/p>\n

These data are stored in Configuration Stores<\/strong><\/em>, which collect fields or parameters for Configuration Validation<\/strong><\/em> to analyze systems. Stores are configurable, allowing selection of fields or parameters to review, the value to check, and the operator to apply to the parameter (equal to, between, different from, etc.).<\/p>\n

 <\/p>\n

\"\"<\/p>\n

 <\/p>\n

Configuration Validation<\/strong><\/em> offers several options for creating a new Target System<\/strong><\/em>. They can be created as a copy of an existing system, meaning they will contain the same Stores<\/strong> <\/em>and values as the original.<\/p>\n

Another option is to import preconfigured Target Systems<\/strong><\/em> from the SAP SECURITY BASELINE<\/a>, which has SAP-recommended values based on best practices. These preconfigured Target Systems<\/strong><\/em> are also modifiable to suit specific organizational environments and requirements.<\/p>\n

The Target Systems<\/strong><\/em> provided by SAP are classified by a unique indicator, consisting of three parts. The first is the level of criticality defined by a numeric value from 1 to 3. The most critical value (1) refers to high-impact security needs, the standard requirements (2) recommended by SAP that should be covered in all systems, and finally, the so-called Extended (3), which are more specific requirements that organizations should evaluate for inclusion.<\/p>\n

The second part of the structure provides information about the type of technology, such as ABAP (A), JAVA (J), HANA (H), BTP Platform (P), and Other (O) referring to Web Dispatcher or SAPGUI.<\/p>\n

The third part consists of a unique mnemonic identifier for the requirement.<\/p>\n

 <\/p>\n

\"\"<\/p>\n

 <\/p>\n

In the example image, a Critical Target System<\/strong><\/em> (1) for an ABAP (A) system and referred to the Password Policy (PWDPOL) is shown.<\/p>\n

The tool also offers the possibility of creating a broader single Target System<\/strong><\/em> from the union of individual Target Systems<\/strong><\/em> of the SAP Security Baseline<\/strong><\/em>. This union is done by running the DIAGCV_MERGE_TARGET_SYSTEMS<\/strong><\/em> program in the Solution Manager backend system. It is also possible to transport Target Systems between environments using the DIAGCV_TRANSPORT_TARGET_SYSTEM<\/strong><\/em> program.<\/p>\n

Comparison Lists<\/b><\/h2>\n

Comparison lists allow grouping different systems to simultaneously obtain configuration information from all of them. It’s necessary to define the systems that should be periodically compared with the reference systems. These lists contain the comparison systems, not the reference system.<\/p>\n

There are 2 types of comparison lists:<\/p>\n

Static lists<\/strong><\/em>, where systems to include in a closed list are selected:<\/p>\n

 <\/p>\n

\"\"<\/p>\n

 <\/p>\n

Dynamic<\/strong> <\/em>lists, usually containing systems from the same environment (e.g., production environments) or of the same type (e.g., ABAP), allowing the list to be automatically updated to incorporate new systems each time a security analysis is launched.<\/p>\n

 <\/p>\n

\"\"<\/p>\n

Report Creation and Results Visualization<\/h2>\n

Reports will show compliant or non-compliant results based on the set of rules defined in the Target Systems<\/strong><\/em>.<\/p>\n

The Configuration Validation Reporting<\/strong><\/em> application allows real-time analysis to verify the current status of a Target System<\/strong> <\/em>or a comparison list.<\/p>\n

 <\/p>\n

\"\"<\/p>\n

 <\/p>\n

Configuration Validation<\/strong><\/em> enables the creation of ad-hoc reports to compare the configuration of a system or a list of systems with a Target System, allowing regular scheduling of report execution for subsequent trend analysis and compliance checking over time.<\/p>\n

 <\/p>\n

\"\"<\/p>\n

Email Notification<\/b><\/h2>\n

Configuration Validation<\/strong><\/em> can send results via email.<\/p>\n

To set this up, the DIAGCV_SEND_CONFIG_VALIDATION program must be run in the backend.<\/p>\n

 <\/p>\n

\"\"<\/p>\n

 <\/p>\n

The program has the following fields:<\/p>\n