orkungedik/SAP-basis-dataset huggingface dataset:
## 13.3.5.2.5  Internet Communication Framework Security
You should only activate those services that are needed for the applications running in your system. For the Manager and Employee roles in Performance Management, all services with the prefix HAP in the path / default\_host/sap/bc/webdynpro/sap/ are required.
- HAP\_CONFIGURATION -Configuration
- HAP\_DOCUMENT\_LINK -Web Dynpro application hap\_document\_link
- HAP\_MAIN\_DOCUMENT -Appraisal Document
- HAP\_QUALIFICATION\_PROFILE -Application for Qualification Profile
- HAP\_START\_PAGE\_POWL\_UI\_MSS -Web Dynpro application HAP\_START\_PAGE\_POWL\_UI\_MSS
- HAP\_START\_PAGE\_POWL\_UI\_ESS -Web Dynpro application HAP\_START\_PAGE\_POWL\_UI\_ESS
Use the transaction Maintain Services ( SICF ) to activate these services.
If your firewall(s) use URL filtering, also note the URLs used for the services and adjust your firewall settings accordingly.
For more information, see Activating and Deactivating ICF Services in the SAP NetWeaver documentation in SAP Library.
For more information about ICF security, see RFC/ICF Security Guide .
## 13.3.5.2.6  Data Storage Security
HANA
The Performance Management data is saved to the databases of SAP Web Application Server (Web AS) or SAP S/4HANA Component. You do not need to use any other databases in addition to these standard databases.
Performance Management stores the data in the following locations:
| Data                          | Storage Location          |
|-------------------------------|---------------------------|
| Appraisal Templates           | PD infotype tables        |
| Cascaded goals                | PD infotype tables        |
| Data from appraisal documents | HRHAP* tables             |
| Attachments                   | Knowledge Provider (KPro) |
| Download PDF                  | File system of client     |
## 13.3.5.2.7  Other Security-Relevant Information
## Access to attachments via Microsoft Internet Explorer
You use Microsoft Internet Explorer and want to display attachments in the browser. To do this, Microsoft Internet Explorer checks the content of the attachment to determine the file type and display the attachment correctly ( MIME Type Sniffing ). In the worst case, it is thus possible that damaging files of an undesired file type are displayed in the browser or cause damage in another way. To avoid this potential threat to security, deselect MIME Type Sniffing in the security settings of Microsoft Internet Explorer .
## 13.3.5.2.8  Security-Relevant Logging and Tracing
Performance Management uses logging and tracing mechanisms from ABAP Platform in the appraisal document. These mechanisms are described in detail under Auditing and Logging .
You can specify the following in the appraisal template:
- Do you want data to be logged?
- The specificity of logging of access to appraisal documents
- The specificity of loggingn of changes to appraisal documents
Changes to appraisal templates are logged using change documents.
## 13.3.5.3  Talent Management and Talent Development
## About This Chapter
This chapter of the Security Guide provides an overview of the security-relevant information for Talent Management and Talent Development (PA-TM).
## Overview of the Main Sections of This Chapter
The following sections contain the security-relevant information that is specific to Talent Management and Talent Development:
- Important SAP Notes
This section lists the most important SAP Notes with regard to the security of Talent Management.
- Authorizations
This section provides an overview of the authorization concept used for Talent Management.
- Network and communication security
This section provides an overview of the following aspects:
- Communication Channel Security
- Communication Destinations
- Internet Communication Framework Security
This section provides an overview of the services for the Internet Communication Framework (ICF) used by Talent Management.
- Data Storage Security
This section provides an overview of the critical data used by Talent Management, as well as the security mechanisms used.
- Security for Third-Party or Additional Applications
This section contains security information that applies to third-party or additional applications that are implemented together with Talent Management.
- Other Security-Relevant Information
This section contains information on uploading and displaying attachments.
## 13.3.5.3.2  Communication Channel Security
The table below shows the communication paths used by Talent Management, the protocol used for the connection, and the type of data transferred.
| Communication Paths                                                       | Protocol Used     | Type of Data Transferred                                       | Data Requiring Particular Protection   |
|---------------------------------------------------------------------------|-------------------|----------------------------------------------------------------|----------------------------------------|
| Front-end client with SAP GUI for Windows for the ap- plication server    | DIAG              | Customizing data                                               | Passwords                              |
| Front-end client with a Web browser for the application server            | HTTP(S)           | Application data                                               | Passwords, personal data               |
| Front-end client with an SAP Business Client for the appli- cation server | HTTP(S)           | Application data                                               | Passwords, personal data               |
| Connection of PDF-based print forms to the archive                        | HTTP(S)           | Person-related data (such as an employee's photo)              |                                        |
| SAP Business Information Warehouse (SAP BW)                               | Extractor program | HRmaster data, organiza- tional data, Talent Manage- ment data |                                        |
You can use Secure Network Communications (SNC) to protect DIAG and RFC connections. The Secure Sockets Layer protocol (SSL protocol) protects HTTP connections.
##  Recommendation
We strongly recommend that you use secure protocols (SSL, SNC) where possible.
##  Note
<!-- image -->
If you convert the protocol from HTTP to HTTPS and implement PDF-based print forms, see SAP Note 1461447 .
For more information, see the SAP NetWeaver Security Guide under Transport Layer Security.
## 13.3.5.3.4  Internet Communication Framework Security
You should only activate those services that are needed for the applications running in your system. For Talent Management the following services are needed:
- Talent Management Specialist
- default\_host/sap/bc/webdynpro/sap/HRTMC\_EMPLOYEE\_PROFILE
- default\_host/sap/bc/webdynpro/sap/HRTMC\_LONG\_PROFILE
- default\_host/sap/bc/webdynpro/sap/hrtmc\_rm\_maintenance
- default\_host/sap/bc/webdynpro/sap/hrtmc\_rm\_presentation
- default\_host/sap/bc/webdynpro/sap/hrtmc\_search
- default\_host/sap/bc/webdynpro/sap/hrtmc\_side\_by\_side
- default\_host/sap/bc/webdynpro/sap/hrtmc\_talent\_group
- default\_host/sap/bc/webdynpro/sap/HRTMC\_TA\_DEV\_PLAN
## · Manager
- default\_host/sap/bc/webdynpro/sap/HRTMC\_EMPLOYEE\_PROFILE
- default\_host/sap/bc/webdynpro/sap/HRTMC\_LONG\_PROFILE
- default\_host/sap/bc/webdynpro/sap/hrtmc\_side\_by\_side
- default\_host/sap/bc/webdynpro/sap/hrtmc\_talent\_group
- default\_host/sap/bc/webdynpro/sap/HRTMC\_TA\_ASSESSMENT
- default\_host/sap/bc/webdynpro/sap/HRTMC\_TA\_DASHBOARD
- default\_host/sap/bc/webdynpro/sap/HRTMC\_TA\_DEV\_PLAN
- default\_host/sap/bc/webdynpro/sap/hrtmc\_teamviewer
- Employee default\_host/sap/bc/webdynpro/sap/HRTMC\_EMPLOYEE\_PROFILE
Use the transaction SICF to activate these services.
If your firewall(s) use URL filtering, also note the URLs used for the services and adjust your firewall settings accordingly. For more information, see Activating and Deactivating ICF Services .
For more information about Internet Communication Framework security, see RFC/ICF Security Guide .
## 13.3.5.3.5  Data Storage Security
## Data Storage
The Talent Management data is stored in the SAP Netweaver Application Server or SAP S/4HANA databases. You do not need to use any other databases in addition to these standard databases.
Talent Management stores the data in the following locations:
Data and Storage Locations
| Data                                         | Storage Location          |
|----------------------------------------------|---------------------------|
| Master data, talent assessments              | HRinfotype tables         |
| Attachments, comments, calibration grid icon | Knowledge Provider (KPro) |
| Business partner master data                 | Business partner database |
| Employee photo                               | ArchiveLink               |
## Cookies
The application uses a Web browser. SAP Netweaver Application Server must set and accept cookies.
## 13.3.5.3.6  Security for Additional Applications
You can implement Talent Management together with the product SAP Talent Visualization by Nakisa . SAP Talent Visualization by Nakisa provides users with a graphical and organization-oriented view of Succession Planning and the job architecture.
##  Note
Note that you need to purchase your own license for using the product SAP Talent Visualization by Nakisa .
If you implement SAP Talent Visualization by Nakisa , the roles for the talent management specialist, the talent management superuser, and the manager need the authorization for the authorization object S\_RFC to be able to access applications that call the HRTMC\_SERVICES function group. This function group comprises the Remote Function Calls (RFCs) for external applications such as SAP Talent Visualization by Nakisa . This authorization is contained in the standard Talent Management roles. For more information about the standard roles, see section Authorizations under Talent Management and Talent Development .
For information about the security of SAP Talent Visualization by Nakisa , see the documentation for this product.
## 13.3.5.3.7  Other Security-Relevant Information
Uploading and Displaying Attachments
## Uploading Attachments
Talent Management uses the virus scan interface of SAP NetWeaver. You can use this interface to include external virus scanners to increase the security of your system.
For Talent Management, the virus scan profile /HCM\_TMC/DOCUMENT\_UPLOAD is available for checking that files or documents uploaded as attachments do not contain any viruses. This virus scan profile is not active in the standard SAP system. To activate the virus scan profile, in Customizing for Talent Management and Talent Development, make the settings under Basic Settings Attachments Define Virus Scan Profiles . In
Customizing for SAP NetWeaver under Application Server System Administration Virus Scan Interface , you need to first set up the virus scan interface.
For more information about the virus scan interface, see SAP NetWeaver Library and choose SAP NetWeaver by Key Capability Security System Security , and the Virus Scan Interface section.
You can also limit the size of files that are uploaded as attachments. To do so, in Customizing for Talent Management and Talent Development, make the settings under Basic Settings Attachments Assign Storage Locations and Maximum File Size .
## Displaying Attachments Using Microsoft Internet Explorer
If you display attachments in a browser and use Microsoft Internet Explorer for this, Microsoft Internet Explorer checks the content of the attachment to determine the file type and display the attachment correctly based on the type ( MIME Type Sniffing ). In the worst case, it is thus possible that damaging files of an undesired file type are displayed in the browser or cause damage in another way. To avoid this potential threat to security, deselect MIME Type Sniffing in the security settings of Microsoft Internet Explorer.
## 13.3.5.4  Enterprise Compensation Management
## About This Chapter
This chapter of the Security Guide provides an overview of the security-relevant information for the Enterprise Compensation Management (PA-EC) application component.
## Overview of the Main Sections of This Chapter
The following sections contain the security-relevant information that is specific to 'Enterprise Compensation Management':
- Important SAP Notes
This section lists the most important SAP Notes with regard to the security of Enterprise Compensation Management.
- Security Aspects for Data, Data Flow, and Processes
This section provides an overview of the security aspects of the most frequently used processes in Enterprise Compensation Management.
- Authorizations
This section provides an overview of the authorization concept used for Enterprise Compensation Management.
- Communication Channel Security
This section describes the communication paths and logs that Enterprise Compensation Management uses.
- Internet Communication Framework Security
This section provides an overview of the services for the Internet Communication Framework (ICF) used by Enterprise Compensation Management.
- Data Storage Security
This section provides an overview of all critical data used by Enterprise Compensation Management, as well as the security mechanisms used.
- Security-Relevant Logging and Tracing
This section provides an overview of the trace and log files that contain security-relevant information and that enable you to reproduce activities, for example, if there is a security violation.
## 13.3.5.4.1  Security Aspects for Data, Data Flow, and Processes
Enterprise Compensation Management uses applications based on the following technology:
## Role: Manager
- Web Dynpro for ABAP in the applications in Manager Self-Service
- Interactive forms based on Adobe software (Interactive forms) in the Total Compensation Statement and Compensation Review Statement applications.
For more information, see the guide for SAP Interactive Forms by Adobe under SAP Interactive Forms by Adobe Security Guide .
For more information about the Manager role, see the SAP S/4HANA Security Guide and choose the following path: Self-Services Manager Self-Service .
## Role: Employee
- Web Dynpro for ABAP in the applications in Employee Self-Service
- Interactive forms based on Adobe software (Interactive forms) in the Total Compensation Statement application.
For more information, see the guide for SAP Interactive Forms by Adobe under SAP Interactive Forms by Adobe Security Guide .
For more information about the Employee role, see the SAP S/4HANA Security Guide and choose the following path: Self-Services Employee Self-Service .
## Role: Administrator
- SAP Graphical User Interface (SAP GUI) in Customizing for Enterprise Compensation Management and administrative reports.
- Business Server Page (BSP) in the Top-Down Budgeting functions
During compensation planning, Enterprise Compensation Management sends e-mails via workflow. For information about workflow and sending e-mails, see Customizing for Enterprise Compensation Management and choose Compensation Administration Workflow Settings .
For more information about the settings, see Customizing for Enterprise Compensation Management .
## 13.3.5.4.2  Authorizations
## Use
Enterprise Compensation Management uses the following authorization concepts:
- ABAP Platform authorization concept that is based on assigning authorizations to users based on roles For this, the roles mentioned under 'Standard Roles' are available as a template. You can copy the standard roles to the customer namespace and adjust them to suit your requirements. For role maintenance you use the profile generator (transaction PFCG ).
- HR-specific concept for the general and structural authorization check For more information about the authorization checks, see General Authorization Check and Structural Authorization Check (see SAP Library for SAP S/4HANA and choose Human Resources HR Tools Authorizations for Human Resources ).
## Roles and Authorization Concept for Enterprise Compensation Management
## Standard Roles
Enterprise Compensation Management does not provide its own standard roles. It uses roles from Manager Self-Service and Employee Self-Service.
For more information, see the following:
- Authorizations in Manager Self-Service.
- Authorizations in Employee Self-Service.
## Standard Authorization Objects
Enterprise Compensation Management uses the same standard authorization objects as all of Human Resources. For more information about the standard authorization objects in Human Resources, see
Authorizations . T o do this, choose SAP S/4HANA Security Guide for Human Resources Authorizations .
## 13.3.5.4.3  Communication Channel Security
The following table shows the communication paths that Enterprise Compensation Management uses, the protocol used for the connection, and the type of data transferred.
| Communication Paths                                                      | Protocol Used                                          | Type of Data Transferred                                                        | Data Requiring Particular Protection   |
|--------------------------------------------------------------------------|--------------------------------------------------------|---------------------------------------------------------------------------------|----------------------------------------|
| Front-end client that uses SAP GUI for Windows as the application server | DIAG                                                   | All Customizing data                                                            | Passwords                              |
| Front-end client that uses a Web browser as the applica- tion server     | HTTP, HTTPS  Note Wegenerally recom- mend using HTTPS | All application data                                                            | Passwords, personal data               |
| SAP Business Information Warehouse (SAP BW)                              | Extractor program                                      | HRmaster data, organiza- tional data, Enterprise Com- pensation Management data |                                        |
You can use Secure Network Communications (SNC) to protect DIAG and RFC connections. The Secure Sockets Layer protocol (SSL protocol) protects HTTP connections.
##  Recommendation
We strongly recommend that you use secure protocols (SSL, SNC) where possible.
For more information, see the SAP NetWeaver Security Guide under Transport Layer Security.
## Printing
Enterprise Compesation Management provides a number of options for printing content. For information about security while printing, see the SNC User's Guide .
## 13.3.5.4.4  Internet Communication Framework Security
You should only activate those services that are needed for the applications running in your system. For the Manager role in Enterprise Compensation Management, all services with the prefix HCM\_ECM in the path / default\_host/sap/bc/webdynpro/sap/ are required.
- HCM\_ECM\_PLANNING\_OVERVIEW\_OIF -Compensation Planning Overview
- HCM\_ECM\_PLANNING\_UI\_GAF -Planning User Interface
- HCM\_ECM\_PROFILE\_OIF -Compensation Profile
- HCM\_ECM\_SIDEBYSIDE\_OIF -Side-by-Side Comparison
- HCM\_ECM\_TEAMVIEWER\_OIF - Compensation Profile Team Overview
The Administrator role, the services with the prefix HRECM\_BDG in the path /default\_host/sap/bc/bsp are only required if you use top-down budgeting for compensation planning.
- HRECM\_BDG\_CHKRL -Check and Release Budget
- HRECM\_BDG\_MAINT -Budget Maintenance
- HRECM\_BDG\_RA\_VL -Reassign Budget Value
- HRECM\_BDG\_SRV -Budgeting Services
- HRECM\_BSG\_SRV02 -Budget Structure Services
- HRECM\_BDG\_START -Overview
Use the transaction Maintain Services ( SICF ) to activate these services.
If your firewall(s) use URL filtering, also note the URLs used for the services and adjust your firewall settings accordingly.
For more information, see Activating and Deactivating ICF Services in the SAP NetWeaver documentation in SAP Library.
For more information about ICF security, see RFC/ICF Secuirty Guide.
## 13.3.5.4.5  Data Storage Security
All data for Enterprise Compensation Management is stored in the database of the SAP system. The data is stored in the Personnel Administration (PA) and Budget Management (PA-PM) application components as well as in the database tables that govern the processes of Enterprise Compensation Management.
The applications in Enterprise Compensation Management store sensitive, personal data for compensation planning. The data saved when managing the processes of Enterprise Compensation Management can be deleted after the compensation review using the report Delete Compensation Planning History Data (RHECM\_DELETE\_HISTORY\_DATA).
For information about data storage security, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Security Guides for the Operating System and Database Platforms into the search bar, press Enter , and open the search result with that title.
## 13.3.5.4.6  Security-Relevant Logging and Tracing
Enterprise Compensation Management uses logging and tracing mechanisms from ABAP Platform. These mechanisms are described in detail under Auditing and Logging .
Changes to data in Enterprise Compensation Management that are made within the applications of Enterprise Compensation Management are logged by the SAP system. The data can be checked with the following reports:
- Display Compensation Planning Changes (RHECM\_DISPLAY\_CHANGES)
- Display Compensation Planning Progress (RHECM\_DISPLAY\_PROGRESS)
## 13.3.6  Time and Attendance Management
## 13.3.6.1  Personnel Time Management (PT)
## Introduction
##  Note
This guide does not replace the administration or operation guides that are available for productive operations.
## Target Audience
- Technology consultants
- System administrators
This document is not included as part of the installation guides, configuration guides, technical operation manuals, or upgrade guides. Such guides are only relevant for a certain phase of the software lifecycle, whereas the security guides provide information that is relevant for all lifecycle phases.
## Why Is Security Necessary?
With the increasing use of distributed systems and the Internet for managing business data, the demands on security are also on the rise. When using a distributed system, you need to be sure that your data and processes support your business needs without allowing unauthorized access to critical information. User
errors, negligence, or attempted manipulation of your system should not result in loss of information or processing time. These demands on security apply likewise to the SAP Personnel Time Management. To assist you in securing the SAP Personnel Time Management, we provide this security guide.
## About this Document
This security guide provides an overview of the security-relevant information that applies to the SAP Personnel Time Management.
## Overview of the Main Sections
The security guide comprises the following main sections:
## · Before You Start
This section contains information about why security is necessary, how to use this document, and references to other security guides that build the foundation for this security guide.
## · Technical System Landscape
This section provides an overview of the technical components and communication paths that are used by the SAP Personnel Time Management.
## · Security Aspects of Data, Data Flow, and Processes
This section provides an overview of security aspects involved throughout the most widely used processes within the SAP Personnel Time Management.
## · Authorizations
This section provides an overview of the authorization concept that applies to the SAP Personnel Time Management.
## · Session Security Protection
This section provides information about activating secure session management, which prevents JavaScript or plug-ins from accessing the SAP logon ticket or security session cookie(s).
## · Network and Communication Security
This section provides an overview of the communication paths used by the SAP Personnel Time Management and the security mechanisms that apply. It also includes our recommendations for the network topology to restrict access at the network level.
## · Internet Communication Framework Security
This section provides an overview of the Internet Communication Framework (ICF) services that are used by the SAP Personnel Time Management.
## · Security-Relevant Logging and Tracing
This section provides an overview of the trace and log files that contain security-relevant information, for example, so you can reproduce activities if a security breach does occur.
## 13.3.6.1.1  Important SAP Notes
The SAP Personnel Time Management is built using the HR backend system, CRM backend system and SAP NetWeaver components. Therefore, the corresponding security guides also apply to the SAP Personnel Time Management.
## Important SAP Notes
The most important SAP Notes that apply to the security of the SAP Personnel Time Management are shown in the table below.
<!-- image -->
<!-- image -->
| Title                                             |   SAP Note |
|---------------------------------------------------|------------|
| Authorization objects of shift planning           |     496993 |
| Transaction authorization PA61 for shift planning |     500844 |
| Setting up the HR-PDC interface                   |     647145 |
For a list of additional security-relevant SAP News and SAP Notes, see https:/ /support.sap.com/ securitynotes .
## Additional Information
For more information about specific topics, see the Quick Links as shown in the table below.
<!-- image -->
| Content              | Quick Link                                                            |
|----------------------|-----------------------------------------------------------------------|
| Security             | https:/ /www.sap.com/community/topic/security.html                    |
| Related SAP Notes    | https:/ /support.sap.com/notes https:/ /support.sap.com/securitynotes |
| Released platforms   | https:/ /support.sap.com/pam                                          |
| SAP Solution Manager | https:/ /support.sap.com/solutionmanager                              |
| SAP Community        | https:/ /www.sap.com/community/topics.html                            |
## 13.3.6.1.4  Data Storage Security
## Archiving Objects and Reports
The following tools and reports are available for archiving data:
- Archiving Object: PA\_TIME (Time Evaluation Results from Cluster B2)
- Data Writing Report: RPAR5W00
- Data Deletion Report: RPAR5D00
Archiving is done using transactions PU22 and SARA respectively.
## Data Deletion Reports
The following tools and reports are available for deleting data:
RPTEXTPT : Using the DELETE option deletes the data already transferred (stored in PA-tables) from the following interface tables:
- PTEX2000
- PTEX2010
- PTEX2003GEN
- PTEX2003SPEC
RPWI4100 : Reorganizes interface table LSHR (Integration to Logistics).
## Using Logical Paths and File Names to Protect Access to the File System
Personnel Time Management saves data in files in the local file system. Therefore, it is important to assign explicit access to the corresponding files in the file system without access to other directories or files (also called directory traversal). This is achieved by entering logical paths and file names in the system that are assigned to the physical paths and file names. This assignment is validated at runtime. If access to a directory is requested that does not correspond to a stored assignment, an error occurs.
The following lists show the logical file names and paths that are used by Personnel Time Management, and the reports for which these file names and paths are valid. The logical file names and logical file paths were created using transaction FILE to facilitate the validation of physical file names.
Logical File Names and Path Names Used in Personnel Time Management
| Logical File Name   | Reports That Use These Logical File Names   | Logical File Path   |
|---------------------|---------------------------------------------|---------------------|
| HR_XX_DIR_RPTEDO00  | RPTEDO00                                    | HR_XX_DIR_RPTEDO00  |
| HR_XX_DIR_RPTEUP00  | RPTEUP00                                    | HR_XX_DIR_RPTEUP00  |
| HR_XX_DIR_RPTEUP10  | RPTEUP10                                    | HR_XX_DIR_RPTEUP10  |
| HR_XX_DIR_RPTEZL00  | RPTEZL00                                    | HR_XX_DIR_RPTEZL00  |
| HR_XX_DIR_RPTX2010  | RPTX2010                                    | HR_XX_DIR_RPTX2010  |
| HR_XX_DIR_RPWI0000  | RPWI0000                                    | HR_XX_DIR_RPWI0000  |
## 13.3.6.2  Cross-Application Time Sheet (CA-TS)
## 13.3.6.2.1  User Administration and Authentication
The Cross-Application Time Sheet (CA-TS) uses the user management and authentication mechanisms provided with the SAP NetWeaver platform, in particular the Application Server ABAP. Therefore, the security recommendations and guidelines for user administration and authentication as described in the Application Server ABAP also apply to the Cross-Application Time Sheet (CA-TS) In addition to these guidelines, we include information about user administration and authentication that specifically applies to the Cross-Application Time Sheet (CA-TS) in the following topics:
- User Management This topic lists the tools to use for user management, the types of users required, and the standard users that are delivered with the Cross-Application Time Sheet (CA-TS).
- Integration into Single Sign-On Environments This topic describes how the Cross-Application Time Sheet (CA-TS) supports Single Sign-On mechanisms.
## 13.3.6.2.1.1  User Management
User management for the Cross-Application Time Sheet (CA-TS) uses the mechanisms provided with the Application Server ABAP, for example, tools, user types, and password policies. For an overview of how these mechanisms apply for the Cross-Application Time Sheet (CA-TS), see the sections below.
## User Administration Tools
The table below shows the tools to use for user management and user administration with the CrossApplication Time Sheet (CA-TS).
User Management Tools
| Tool                                                                             | Detailed Description                                                                                                                                                                           | Prerequisites   |
|----------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------|
| User and Role Maintenance (transac- tion PFCG)                                   | You can use the Role Maintenance transaction PFCG to generate profiles for the Cross-Application Time Sheet (CA-TS) users. For more information, see User and Role Administration of AS ABAP . |                 |
| Technical Settings for User Manage- ment in Cross-Application Time Sheet (CA-TS) | For more information on user profiles and the roles, see Customizing for Time Sheet under Settings for All User Interfaces Authorizations .                                                    |                 |
## User Types
It is often necessary to specify different security policies for different types of users. For example, your policy may specify that individual users who perform tasks interactively have to change their passwords on a regular basis, but not those users under which background processing jobs run.
The user types that are required for the Cross-Application Time Sheet (CA-TS) include:
- Individual users:
- Dialog users are used to maintain, release, and approve working times. They are used for SAPGUI and WD ABAP Frontends
- Technical users:
- System User: Background processing and communication within a system (such as RFC users for ALE, Workflow). They are used for transferring data to target components, to check data remotely, and to process workflow items.
- Communication users are used for scenarios in which CATS BAPIs are called from external systems.
For more information on these user types, see User Types under User Authentication in the SAP NetWeaver Application Server for ABAP Security Guide.
## Standard Users
We do not deliver standard users within Cross-Application Time Sheet (CA-TS).
## 13.3.6.2.1.2  Integration into Single Sign-On Environments
The most widely-used supported mechanisms are listed below. For a complete list, see the link provided below.
- Secure Network Communications (SNC) SNC is available for user authentication and provides for a single sign-on (SSO) environment when using the SAP GUI for Windows or Remote Function Calls.
· SAP logon tickets Cross-Application Time Sheet (CA-TS) supports the use of logon tickets for SSO when using a Web browser as the frontend client. In this case, users can be issued a logon ticket after they have authenticated themselves with the initial SAP system. The ticket can then be submitted to other systems (SAP or external systems) as an authentication token. The user does not need to enter a user ID or password for authentication but can access the system directly after the system has checked the logon ticket.
- Client certificates As an alternative to user authentication using a user ID and passwords, users using a Web browser
as a frontend client can also provide X.509 client certificates to use for authentication. In this case, user authentication is performed on the Web server using the Secure Sockets Layer Protocol (SSL Protocol) and no passwords have to be transferred. User authorizations are valid in accordance with the authorization concept in the SAP system.
- Security Assertion Markup Language (SAML) 2.0 SAML 2.0 provides a standards-based mechanism for SSO. The primary reason to use SAML 2.0 is to
enable SSO across domains.
The Cross-Application Time Sheet (CA-TS) supports the Single Sign-On (SSO) mechanisms provided by ABAP Platform. Therefore, the security recommendations and guidelines for user administration and authentication as described in the ABAP Platform Security Guide also apply to the Cross-Application Time Sheet (CA-TS).
For more information about the available authentication mechanisms, see User Authentication and Single Sign-On .
## 13.3.6.2.3  Session Security Protection
To prevent access in javascript or plug-ins to the SAP logon ticket and security session cookie(s), we recommend activating secure session management.
We also highly recommend using SSL to protect the network communications where these security-relevant cookies are transferred.
## Session Security Protection on the AS ABAP
To prevent access in javascript or plug-ins to the SAP logon ticket and security session cookie(s) (SAP\_SESSIONID\_&lt;sid&gt;\_&lt;client&gt;), activate secure session management. With an existing security session, users can then start applications that require a user logon without logging on again. When a security session is ended, the system also ends all applications that are linked to this security session.
Use the transaction SICF\_SESSIONS to specify the following parameter values shown in the table below in your AS ABAP system:
Session Security Protection Profile Parameters
| Profile Parameter                |   Recommended Value | Comment              |
|----------------------------------|---------------------|----------------------|
| icf/set_HTTPonly_flag_on_cookies |                   0 | Client-Dependent     |
| login/ticket_only_by_https       |                   1 | Not Client-Dependent |
For more information and detailed instructions, see Activating HTTP Security Session Management on AS ABAP in the AS ABAP security documentation.
## 13.3.6.2.4  Network and Communication Security
Your network infrastructure is extremely important in protecting your system. Your network needs to support the communication necessary for your business needs without allowing unauthorized access. A well-defined network topology can eliminate many security threats based on software flaws (at both the operating system and application level), or network attacks such as eavesdropping. If users cannot log on to your application or database servers at the operating system or database layer, there is no way for intruders to compromise
the machines and gain access to the backend system's database or files. Additionally, if users are not able to connect to the server LAN (local area network), they cannot exploit well-known bugs and security holes in network services on the server machines.
The network topology for the Cross-Application Time Sheet (CA-TS) is based on the topology used by the ABAP Platform. Therefore, the security guidelines and recommendations described in the ABAP Platform Security Guide also apply to the Cross-Application Time Sheet (CA-TS). Details that specifically apply to the Cross-Application Time Sheet (CA-TS) are described in the following topics:
- Communication Channel Security
This topic describes the communication paths and protocols used by the Cross-Application Time Sheet (CA-TS).
- Network Security This topic describes the recommended network topology for the Cross-Application Time Sheet (CA-TS). It
shows the appropriate network segments for the various client and server components, and where to use firewalls for access protection. It also includes a list of the ports needed to operate the Cross-Application Time Sheet (CA-TS).
- Communication Destinations This topic describes the information needed for the various communication paths, for example, which users are used for which communications.
For more information, see the following sections in the ABAP Platform Security Guide:
- Network and Communication Security
- Security Guides for Connectivity and Interoperability Technologies
## 13.3.6.2.4.1  Communication Channel Security
The table below shows the communication channels used by the Cross-Application Time Sheet (CA-TS), the protocol used for the connection, and the type of data transferred.
| Communication Path                                                        | Protocol Used                           | Type of Data Transferred                                                | Data Requiring Special Pro- tection   |
|---------------------------------------------------------------------------|-----------------------------------------|-------------------------------------------------------------------------|---------------------------------------|
| Front-end client that uses SAP GUI for Windows for the application server | DIAG                                    | All customizing data, applica- tion data entered by Non-WD applications | Passwords                             |
| Front-end client that uses a Web browser for the applica- tion server     | RFC, HTTP(S) Werecommend you use HTTPS. | Application data entered by WDapplications and Web Services             | Passwords                             |
DIAG and RFC connections can be protected using Secure Network Communications (SNC). HTTP connections are protected using the Secure Sockets Layer (SSL) protocol.
<!-- image -->
We strongly recommend using secure protocols (SSL, SNC) whenever possible.
For more information, see Transport Layer Security in the ABAP Platform Security Guide.
## 13.3.6.2.4.2  Network Security
You can operate Cross-Application Time Sheet (CA-TS) in different ways. You can run the Cross-Application Time Sheet (CA-TS) and the HR system and or cProject system integrated on one system, or on different instances.
## Firewall Settings
For more information, see Using Firewall Systems for Access Control in the SAP NetWeaver Security Guide.
For more information, see Using Multiple Network Zones in the ABAP Platform Security Guide.
## Ports
The Cross-Application Time Sheet (CA-TS) runs on SAP NetWeaver and uses the ports from the AS ABAP.
For more information, see the topic for AS ABAP Ports in the corresponding ABAP Platform Security Guides.
For other components, for example, SAPinst, SAProuter, or the SAP Web Dispatcher, see https:/ /help.sap.com/ viewer/ports.
## 13.3.6.2.4.3  Communication Destinations
## Use
The table below shows an overview of the communication destinations used by the Cross-Application Time Sheet (CA-TS).
| Destination                                                        | Delivered   | Type   | User, Authorizations                                                  | Description                                                                                              |
|--------------------------------------------------------------------|-------------|--------|-----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------|
| Cross-Application Time Sheet (CA-TS) to Human Resources Management | No          | RFC    | Anonympus dialog user specified in con- nections between both systems | Customizing: Time Sheet → Settings for All User Interfaces → Data Transfer for Distributed Systems (ALE) |
| Destination                                                                  | Delivered   | Type                      | User, Authorizations                                                  | Description                                                                                                                      |
|------------------------------------------------------------------------------|-------------|---------------------------|-----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|
| Cross-Application Time Sheet (CA-TS) to cProjects                            | No          | RFC                       | Anonympus dialog user specified in con- nections between both systems | Customizing: Time Sheet → Settings for All User Interfaces → Data Transfer for Distributed Systems (ALE)                         |
| WDJava Frontend to Cross-Application Time Sheet (CA-TS)                      | Yes         | RFC/JCo                   | See Customizing                                                       | Customizing: Integration with Other SAP Components → Business Packages / Functional Packages → Manager Self Service (mySAP ERP). |
| External consumer/ex- ternal Web UI to Cross- Application Time Sheet (CA-TS) | No          | HTTP(S) and SOAP messages | Specific dialog user                                                  | Cross-Application Time Sheet (CA-TS) acts as service pro- vider.                                                                 |
## 13.3.6.2.5  Data Storage Security
The Cross-Application Time Sheet (CA-TS) data is saved in databases of the SAP system as follows:
| Data                               | Location                    |
|------------------------------------|-----------------------------|
| Application Data                   | CATSDB                      |
| Attachments and user-defined texts | SAPScript storage           |
| Templates                          | CATS_TEMP                   |
| Transfer data forHR                | PTEX2000, PTEX2010, PTEXDIR |
| Transfer data forCO                | CATSCO                      |
| Transfer data for PS               | CATSPS                      |
| Transfer data forPM                | CATSPM                      |
| Transfer data for MM-SRV           | CATSMM                      |
| Transfer data for cPro             | DPR_CONF_LI                 |
## 13.3.6.2.6  Enterprise Services Security
The following chapters in the SAP NetWeaver Security Guide and documentation are relevant for all enterprise services delivered with Cross-Application Time Sheet (CA-TS):
- Web Services Security
- Recommended WS Security Scenarios
- SAP Process Integration Security Guide
## 13.3.6.2.7  Security-Relevant Logging and Tracing
Cross-Application Time Sheet (CA-TS) relies on the logging and tracing mechanisms from ABAP Platform:
- Auditing and Logging
- Tracing and Logging
## 13.3.6.2.8  Services for Security Lifecycle Management
The following services are available from Active Global Support to assist you in maintaining security in your SAP systems on an ongoing basis.
## Security Chapter in the EarlyWatch Alert (EWA) Report
This service regularly monitors the Security chapter in the EarlyWatch Alert report of your system. It tells you:
- Whether SAP Security Notes have been identified as missing on your system. In this case, analyze and implement the identified notes, if possible. If you cannot implement the notes, the report should be able to help you decide on how to handle the individual cases.
- Whether an accumulation of critical basis authorizations has been identified. In this case, verify whether the accumulation of critical basis authorizations is okay for your system. If not, correct the situation. If you consider the situation okay, you should still check for any significant changes compared to former EWA reports.
- Whether standard users with default passwords have been identified on your system. In this case, change the corresponding passwords to non-default values.
## Security Optimization Service (SOS)
The Security Optimization Service can be used for a more thorough security analysis of your system, including:
- Critical authorizations in detail
- Security relevant configuration parameters
- Critical users
- Missing security patches
This service is available as a self service within the SAP Solution Manager or as a remote or on-site service. We recommend you use it regularly (for example, once a year) and in particular after significant system changes or in preparation of a system audit.
## Security Configuration Validation
The Security Configuration Validation can be used to continuously monitor a system landscape for compliance to predefined settings, for example, from your company-specific SAP Security Policy. This primarily covers configuration parameters, but it also covers critical security properties like the existence of a non-trivial Gateway configuration or making sure standard users do not have default passwords.
## Security in the RunSAP Methodology / Secure Operations Standard
With the E2E Solution Operations Standard Security service, a best practice recommendation is available on how to operate SAP systems and landscapes in secure manner. It guides you through the most important security operation areas and links to detailed security information from SAP's knowledge base wherever appropriate.
## More Information
For more details on these services see
- EarlyWatch Alert: https:/ /support.sap.com/en/offerings-programs/support-services/earlywatchalert.html
- Security Optimization Service / Security Notes Report: https:/ /support.sap.com/en/offerings-programs/ support-services/security-optimization-services-portfolio.html
- Comprehensive list of Security Notes: https:/ /support.sap.com/en/my-support/knowledge-base/securitynotes-news.html
- Configuration Validation
- SAP Activate Methodology Roadmaps: https:/ /support.sap.com/en/offerings-programs/methodologies/ implement.html
## 13.4 Manufacturing
## 13.4.1  Production Planning