## 13.9.2.2.1  Security Aspects of Data, Data Flow and Processes
## E-mail-Based Tendering Scenario
The figure below shows an overview of the e-mail based tendering scenario for Transportation Management (TM).
<!-- image -->
|   Step | Description                                                | Security Measure                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
|--------|------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|      2 | Proxy applies encryption and digital sig- nature to e-mail | External secure e-mail proxy needs to be maintained and activated for the TMsystem. For more information, see SAP Note 149926 . Keys must be exchanged between the sender and re- cipient prior to sending the e-mail.We highly recommend that you set up the policy for the e-mail proxy in such a way that e-mails can be sent only if encryp- tion and digital signatures are enabled. If this is not possible, for example, due to missing keys, e-mails must not be sent in an insecure way. |
|      3 | E-mail is decrypted and signature veri- fied for reading   | The e-mail client of the recipient must support encryption and digital signa- tures, and keys must have been ex- changed beforehand by the sender and the recipient.                                                                                                                                                                                                                                                                                                                              |
|      4 | Reply is encrypted and signed and sent back to TMsystem    | Refer to step 3                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
|      5 | Proxy verifies signature and decrypts e- mail content      | Refer to step 2                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
|      6 | Decrypted and verified e-mail is proc- essed               | Not applicable                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
##  Recommendation
To access the TM system externally, we recommend that you define a system alias in the web dispatcher. The web dispatcher redirects the request to the correct hostname and port so that an external user can use a hyperlink, which contains the alias, to access the system.
You create a tendering notification e-mail in the TM system. The system sends this e-mail to the carrier with a hyperlink to the carrier's worklist in the TM system or in the TM collaboration portal. The hyperlink contains the system alias instead of the physical hostname and port. To use the alias, ensure that you have implemented SAP Note 1748036 or 1747651 , and SAP Note 1783590 . Subsequently, you need to specify the following settings in the TM system:
1. Create an alias in transaction SM59 .
2. In the Target Host field, enter the system alias as specified in the web dispatcher.
3. Enter the alias in the 03 E-Mail and SMS Content screen in Customizing for Transportation Management under Freight Order Management Tendering Define General Settings for Tendering .
## File Upload Scenario
The figure below shows an overview of the file upload scenario for TM.
<!-- image -->
## File Upload Scenario
The table below shows the security aspects to be considered for the process step and what mechanism applies.
Steps for File Upload Scenario
|   Step | Description                                           | Security Measure                                             |
|--------|-------------------------------------------------------|--------------------------------------------------------------|
|      1 | User inserts link to a file he or she wants to upload | User needs to be aware of the file he or she wants to upload |
|      2 | HTTPS request is forwarded and file is sent to server | Not applicable                                               |
|   Step | Description                                                                                                                  | Security Measure                                                                                                                                                                                                                                                                                                                    |
|--------|------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|      3 | File size is checked against system parameter icm/HTTP/ max_request_size_KB ; only the amount of data specified is forwarded | Maximum file size needs to be re- stricted to secure the server. For more information, go to https:/ / help.sap.com/s4hana_op_2021, enter Security Notes for FileUpload UI El- ements into the search bar, press Enter , and open the search result with that title.                                                                |
|      4 | MIME type of file is checked against al- lowlist                                                                             | The extension of the uploaded file (but not its content) is checked against MIME type allowlist; as a prerequi- site for using the allowlist, SAP Note 1514253 must be implemented.                                                                                                                                                 |
|      5 | File is checked by virus scan and re- quest only forwarded if scan is clear                                                  | Virus scan needs to be active in your system. For more information, go to https:/ / help.sap.com/s4hana_op_2021, enter SAP Virus Scan Interface into the search bar, press Enter , and open the search result with that title. Westrongly recommend that you cre- ate a virus scan profile with linkage type All steps successful . |
|      6 | File is stored in database                                                                                                   | Not applicable                                                                                                                                                                                                                                                                                                                      |
|      7 | Information is sent back to user                                                                                             | Not applicable                                                                                                                                                                                                                                                                                                                      |
##  Caution
Only file extensions are compared to the entries in the allowlist, not the content of the files.
The file upload function can be disabled to prevent users from uploading files to your system. To disable the file upload function, you must implement SAP Note 1514253 . We recommend that you disable the upload function if it is not required by your business scenarios.
Always ensure that your virus scan is set up and working correctly before enabling file uploads. If your virus scan is not up and running, do not use the file upload.
For information about uploading TACT rates to TM, go to https:/ /help.sap.com/s4hana\_op\_2021, enter TACT Rate Upload into the search bar, press Enter , and open the search result with that title.