Whoever operates SAP production systems needs a path for the emergency: authorizations that nobody may hold in day-to-day operations, but that someone needs when a fault occurs. Classic firefighter solutions are expensive, complex and time-consuming to introduce, and often run from the cloud.
ISPICIO_E runs as a web application on your server. SAP Basis requests a one-time emergency user and works in the system. Afterwards, ISPICIO_E deletes the user, retrieves the Security Audit Log and submits the session for approval. One price, for all systems and users.
The problem
Without regulated emergency access, a fault either brings the production system to a halt or someone permanently keeps authorizations that no auditor will accept. That is why a firefighter solution belongs in every professionally run SAP landscape. The common solutions, however, come at a price.
One session, six steps
Every emergency access follows the same path in ISPICIO_E: request, one-time user, session in the SAP system, Security Audit Log, review, approval. At the end there is a log that answers every question an auditor might ask.
Whoever has to step in logs in to ISPICIO_E in the browser, selects the SAP system and enters the reason in the mandatory fields. One click on “Request Super User” starts the session. Approval comes after the session, not before: in an emergency, nobody waits for clearance.
ISPICIO_E creates a one-time user in the selected SAP system via the RFC interface and issues the credentials. There are no permanent emergency privileges. Every session gets its own user.
The session takes place in the SAP system, as the fault demands. ISPICIO_E does not intervene, but regularly checks whether the emergency user is still logged on.
After logoff, ISPICIO_E deletes the user in the SAP system and imports the Security Audit Log entries for this user into its own database. What happened during the session is thus kept in full with the session. Nobody has to gather logs afterwards.
A reviewer sees the session with reason, system, period and all SAL entries. If anything remains unclear, a query goes by email to the person who carried it out. The answer is documented on the session, until nothing is left open.
Approve or reject. Both are recorded. A rejection corrects nothing in the SAP system; it documents the finding and requires a follow-up action. The session moves to the archive, with everything that belongs to it.
Three commitments
ISPICIO_E is a web application for Apache Tomcat or a Docker container, with PostgreSQL as the database. It runs in your network, behind your firewall. Credentials, reasons and Security Audit Log entries never leave the building.
The license is independent of the number of SAP systems and SAP users. You connect as many systems as you operate and create as many users and reviewers as you need. The price stays the same.
Every session carries reason, system, period, the Security Audit Log entries, queries and the decision. The archive can be filtered by system, period and status. In the audit, you show the session instead of reconstructing it.
Three roles
ISPICIO_E separates execution and review. Approval takes place after the session, by a different person, with the Security Audit Log in view. All in the browser, no SAP GUI needed for the review.
Role
Usually SAP Basis.
Requests the one-time emergency user, works in the SAP system and answers the reviewer’s queries.
Role
A second person, so that the four-eyes principle applies.
Reviews the session afterwards on the basis of the Security Audit Log entries, approves, rejects or raises a query.
Role
SAP Basis or application management.
Connects SAP systems and the email server, creates users and reviewers, maintains password rules and the license.
In the audit
When an auditor asks about the emergency accesses of the last quarter, the reviewer filters the archive by system, period and status. Every entry opens the complete session: reason, period, Security Audit Log entries, queries, decision.
Requirements
No cloud connection, no additional agent in the SAP system. ISPICIO_E uses what is present in an SAP landscape anyway: the Security Audit Log and an RFC connection.
Next step
Four weeks of testing, in your network, with your systems. Our sales team sends the license key.
