## 10 Additional System Hardening Activities
## Click-Jacking Protection
Click-jacking is an attack type where an attacker tries to hijack the clicks of an authenticated user in order to trigger malicious actions. This attack is based on framing the attacked page into an attacker-controlled enclosing page.
SAP S/4HANA uses an ABAP Platform protection to prevent click-jacking attacks. This is an allowlist-based solution that controls which pages are allowed to render your application within a frame. To enable the protection, you need to access and edit the allowlist.
A typical setup will contain host/port of the system (as seen from a browser) and host/port of any trusted system that hosts applications which are going to frame applications from the current system.
For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Using an Allowlist for Clickjacking Framing Protection into the search bar, press Enter and open the search result with that title.
SAP GUI for HTML transactions, Web Dynpro applications, and non-SAPUI5-based applications already use this flexible protection mechanism. SAP Fiori launchpad currently uses a slightly different, high security solution.
## Unified Connectivity
If your SAP S/4HANA system can be accessed remotely using Remote Function Calls (RFCs), you can significantly increase protection by using the Unified Connectivity (UCON) administration framework.
Generally, external access to the function modules using RFCs is controlled by special authorization checks and the corresponding roles with purpose-specific assignments to users. UCON also provides a simple but comprehensive way of controlling which Remote Function Modules (RFM) can be called by other systems: an RFM can only be called externally if it is assigned to a Communication Assembly (CA).
External access is blocked for all RFMs not assigned to a CA. In this way, it is possible to control and restrict external access to RFMs independently from the user context.
For details, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Unified Connectivity into the search bar, press Enter and open the search result with that title.
## Switchable Authorizations Check Framework (SACF)
The Switchable Authorizations Check Framework (SACF) provides additional authorization checks for specific scenarios. These checks do not change the behavior of the application until you activate the respective scenario. A scenario definition comprises certain authorization objects and rules telling the system how to check them. An active scenario is a development object, which can be transferred through your landscape.
By default, most additional scenario-based authorizations checks are initially set to inactive in SAP S/4HANA (for compatibility reasons).
For more information, see the chapter Activating Switchable Authorization Checks in the SAP Whitepaper Securing Remote Function Calls which is attached to SAP Note 2008727 .
##  Note
From a security perspective, SAP strongly recommends to activate all scenario-checks in SAP S/4HANA in order to maximize the resilience of systems.
Use the transaction SACF for the customizing and transaction SACF\_COMPARE for comparison.
Please also read the important information contained in SAP Note 1922808
For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Customizing Scenario-Based Authorizations into the search bar, press Enter and open the search result with that title.
## Securing CALL TRANSACTION Statements
When a user manually launches an SAP transaction, the ABAP Kernel automatically checks the user's corresponding authorization (Authorization Object S\_TCODE ).
The system behaves differently if an SAP transaction is called by a program (ABAP statement CALL TRANSACTION ). In this case, the authorization check ( S\_TCODE-) depends on the system configuration. This can be controlled using transaction SE97 and profile parameter auth/check/calltransaction .
Two cases exist:
## · New installations
We recommend setting the profile parameter auth/check/calltransaction=3 . This switches on the authorization check for CALL TRANSACTION statements - as long as you have not explicitly switched it off using transaction SE97 . This improves the security level because all roles need to contain appropriate authorizations.
· Installations migrated from an SAP ERP enhancement package to SAP S/4HANA Roles formerly used in SAP ERP must be examined thoroughly and adopted with care into the new SAP S/4HANA environment. Only for the sake of a smooth transition you can avoid this temporarily by setting auth/check/calltransaction=2 . This keeps the check behavior as it was before. However, as a permanent setting this is not recommended, as in the end you should adopt your roles to the new environment actively and with care.
For details, see the system documentation of transaction SE97 .