orkungedik/SAP-basis-dataset huggingface dataset:
## 5 SAP S/4HANA System Landscape Information
There are various ways of deploying SAP S/4HANA in your new or already existing system landscape. This section describes some examples.
## Example: SAP S/4HANA New Installation
A new installation of SAP S/4HANA needs to run on the SAP HANA database. It is recommended to use the SAP Solution Manager, which can run on any database. This very simple landscape can be enhanced with the SAP cloud solutions and SAP Business Suite products.
<!-- image -->
Simple SAP S/4HANA Deployment
<!-- image -->
## Example: SAP S/4HANA in an SAP Business Suite Landscape
It is possible to integrate SAP S/4HANA into an existing SAP Business Suite landscape by replacing the SAP ERP enhancement package product with SAP S/4HANA. When performing this conversion in your system
landscape, you need to do some adaptations, for example you need to convert some of your existing business processes to the simplified SAP S/4HANA processes. Some of the SAP Business Suite processes are no longer supported, some have been changed, and there are also new processes. How to convert your existing processes to the SAP S/4HANA processes is described in the Simplification Item Catalog .
For more information about the Simplification Item Catalog , see the Conversion Guide for SAP S/4HANA at https:/ /help.sap.com/s4hana\_op\_2021 Implement Guides .
Example SAP Business Suite landscape with an embedded SAP S/4HANA system
<!-- image -->
## More Information
For more information about SAP Fiori for SAP S/4HANA see SAP Note 2590653 .
## 6 Network and Communication Security
Your network infrastructure is extremely important in protecting your system. Your network needs to support the communication necessary for your business needs without allowing unauthorized access. A well-defined network topology can eliminate many security threats. These threats can be based on software flaws, at both the operating system level and application level, or network attacks, such as eavesdropping.
If users cannot log on to your application or database servers at the operating system or database layer, then there is no way for intruders to compromise the machines and gain access to the backend system database or files.
Additionally, if users are not able to connect to the server local area network (LAN), they cannot exploit well-known bugs and security holes in network services on the server machines.
## 6.1 Communication Channel Security
SAP S/4 HANA uses several protocols for communication to internal and external applications. These can be SAP systems or third-party systems. The following protocols are supported:
- HTTPS
HTTP connections are protected by the Transport Layer Security (TLS) protocol. This protocol used to be known as Secure Sockets Layer (SSL).
- RFC RFC connections can be protected using Secure Network Communications (SNC). For detailed recommendations on securing RFC connections, see SAP Note 2008727 and the SAP Whitepaper Securing Remote Function Calls attached to it.
- SOAP SOAP connections are protected with Web services security.
- IDoc
- REST
##  Note
We strongly recommend using secure protocols (TLS, SNC) whenever possible.
For more information on securing the protocols above, see the respective chapters in the ABAP Platform Security Guide.
For more information on configuring internet communication security, see SAP Note 1616535 .
## 6.2 Network Security
## Network
SAP S/4HANA is based on ABAP Platform technology. Therefore, for information about network security, see the respective sections in the ABAP Platform Security Guide. This includes information on using firewall systems for access control and using network segmentation.
Go to https:/ /help.sap.com/s4hana\_op\_2021, enter ABAP Platform Security Guide into the search bar, press Enter , and open the search result with that title.
If your system provides Internet services, you should ensure you protect your network infrastructure with a firewall at least. Y ou can further increase the security of your system (or group of systems) by diving the system into groups, placing the groups in different network segments, and then protecting each segment from unauthorized access by a firewall.
Bear in mind that unauthorized access is also possible internally if a malicious user has managed to gain control of one of your systems.
## Ports
SAP S/4HANA is executed in ABAP Platform and uses the ports of AS ABAP. For more information, see the corresponding security guides under the topics for AS ABAP Ports.
## 6.3 Communication Destinations
The use of communication destination is application-specific. Therefore please check the application-specific chapters for details.
In this context please note that users and authorizations should be used with specific care, as the use of users and authorizations in an irresponsible manner can pose security risks. You should therefore follow the security rules below when communicating between application systems.
## General Rules
- Employ the user types 'system' and 'communication'
- Grant a user only the minimum of authorizations
- Tell users to choose a secure password and to not divulge it to anyone else
- Only store user-specific logon data for users of type 'system' and 'communication'
- Wherever possible, use trusted system functions instead of user-specific logon data
## 7 ICF and Session Security
## Internet Communication Framework (ICF) Services
You should handle Internet Communication Framework (ICF) services in a restrictive manner in order to minimize the attack surface on the web.
##  Note
As a general rule you should only activate those ICF services that are needed for the applications running in your system.
For details on the required services, see the application-specific chapters of this guide. Use transaction SICF to activate or de-activate ICF services. For more information, see the SAP NetWeaver documentation.
Additional information on the required services can be found in the RFC/ICF Security Guide.
Go to https:/ /help.sap.com/s4hana\_op\_2021, enter RFC/ICF Security Guides into the search bar, press Enter , and open the search result with that title.
##  Note
If your firewall(s) use URL filtering, note the URLs used for the services, and adjust your firewall settings accordingly.
## Session Security Protection
## Secure Session Management
To increase security and prevent access to the SAP logon ticket and security session cookie(s), we recommend activating secure session management. We also highly recommend using SSL to protect the network communications where these security-relevant cookies are transferred.
## Session Security Protection on the AS ABAP
For SAP NetWeaver version 7.0 and higher, it is recommended to activate HTTP security session management using transaction SICF\_SESSIONS. In particular it is recommended to activate extra protection of securityrelated cookies.
The HttpOnly flag instructs the browser to deny access to the cookie through client side script. As a result, even if a cross-site scripting (XSS) flaw exists, and a user accidentally accesses a link that exploits this flaw, the browser will not reveal the cookie to a third party.
The Secure flag tells the browser to send the cookie only if the request is being sent over a secure channel such as HTTPS. This helps protect the cookie from being passed over unencrypted requests.
These additional flags are configured through the following profile parameters:
| Profile Parameter                   |   Recommended Value | Description       | Comment              |
|-------------------------------------|---------------------|-------------------|----------------------|
| icf/ set_HTTPonly_flag_on_cook- ies |                   0 | Add HttpOnly flag | Client-dependent     |
| login/ticket_only_by_https          |                   1 | Add Secure flag   | Not client-dependent |
For more information, a list of the relevant profile parameters, and detailed instructions, see Activating HTTP Security Session Management on AS ABAP in the AS ABAP security documentation.
## 8 File System Access Security
## More Information
For detailed information about data storage security, see the ABAP Platform Security Guide.
## Using Logical Paths and File Names to Protect Access
Some applications in SAP S/4HANA save data in files in the file system. Therefore, it is important to explicitly provide access to the corresponding files in the file system without allowing access to other directories or files - a security issue also known as directory traversal. This is achieved by specifying logical paths and file names in the system that map to the physical paths and file names. This mapping is validated at runtime. If access is requested to a directory that does not match a stored mapping, then an error occurs.
In the application-specific part of this guide, there is a list of the logical file names and paths for each component. It also specifies for which programs these file names and paths apply.
## Activating the Validation of Logical Paths and File Names
You enter the logical paths and file names in the system for the corresponding programs. For downward compatibility, the validation at runtime is deactivated by default. To activate the validation on path level at runtime, enter the physical path using the transactions SFILE (client-independent) and SF01 (clientdependent). To determine which paths are used by your system, you can activate the appropriate settings in the Security Audit Log. The relevant SAL events are CUQ, CUR, CUS, CUT, DU5 and EU4.
For new installations it is recommended to enforce path validation as a default by setting REJECT\_EMPTY\_PATH=ON in table FILECMCUST (transaction SM30 ). For details see SAP Note 2251231 -File validation enforcement switch for empty physical path .
For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter one of the following titles into the search bar, press Enter and open the search result with the relevant title.
- Logical File Names
- Protecting Access to the File System Using Logical Path and File Names
- Security Audit Log
## 9 Virus Scanning
## Basic Concepts
We recommend installing and running a VSI 2.x-compliant virus scanner in your landscape. The SAP S/4HANA code calls this scanner using a dedicated interface during different stages of processing - during upload, download, and passage through the Gateway, and so on. You can customize the interface with the help of scan profiles.
We recommend running VSI scans for:
- Signature scans
- All files should be checked against an up-to-date list of known virus signatures.
- Mime-type detection
- Only trusted file types should be allowed.
- Active content detection
Files with active content should be blocked (for example, PDF files containing JavaScript).
For more information about virus scan profiles and customizing, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Virus Scan Interface into the search bar, press Enter , and open the search result with that title.
Additional information is available in SAP Note 786179 .
For virus scanning in SAP Content Server, see SAP Note 1585767 .
In the past, SAP offered certifications for VSI implementations. This is no longer available, but you can look up the products which were historically certified for NW-VSI 2.1 in SAP Note 1494278 .
## 9.1 General Recommendations for Virus Scan Profiles
We recommend that you enable all pre-delivered virus scan profiles. The decision to deactivate a scan profile requires a security risk assessment.
## Customer Profiles
You should set up the following customer profiles:
| Name   | Description                  |
|--------|------------------------------|
| ZBASIC | Basic virus scanning profile |
| Name      | Description                                                                     |
|-----------|---------------------------------------------------------------------------------|
| ZEXTENDED | Same as above with additional check for active content, and MIME-type detection |
All active profiles should refer to ZEXTENDED, except the following, which should refer to ZBASIC.
- /SAPC\_RUNTIME/APC\_WS\_MESSAGE\_GET
- /SAPC\_RUNTIME/APC\_WS\_MESSAGE\_SET
- /SCET/GUI\_UPLOAD
- /SIHTTP/HTTP\_UPLOAD
- /SMIM\_API/PUT
- /SOAP\_CORE/WS\_RECEIVE
- /UI5/UI5\_INFRA\_APP/REP\_DT\_PUT
For ZEXTENDED, the following settings are recommended:
- CUST\_ACTIVE\_CONTENT = 1
- CUST\_CHECK\_MIME\_TYPE = 1
- CUST\_MIME\_TYPES\_ARE\_BLACKLIST = 0 This setting indicates 'allowlisting' - which indicates entities that are OK.
These settings tell the virus scanner to scan for active content and check MIME types according to the specified allowlist of file types.
## Allowlist
Use the 'allowlisting' file type wherever possible.
Consider the following: the allowlist scanner should be as restrictive as possible. As a compromise, the list should also contain the complete set of file types required in all active customer scenarios. If you need to extend the allowlist, you should ensure that the list only contains MIME types from the IANA List .
## Template List of File Types
##  Note
Your allowlist should be as restrictive as possible. For example, you should delete non-needed types from the template list. A final allowlist is always a compromise between security and functionality.
Use the template list of file types for consideration.
- application/arj
- application/msword
- application/pdf
- application/postscript
- application/vnd.ms-excel
- application/vnd.ms-powerpoint
- application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
- application/vnd.openxmlformats-officedocument.presentationml.presentation
- application/vnd.openxmlformats-officedocument.wordprocessingml.document
- application/x-compressed
- application/x-dvi
- application/x-gzip
- application/x-zip-compressed
- application/xml
- application/zip
- image/bmp
- image/jpeg
- image/png
- image/vnd.dwg
- image/x-dwg
- text/plain
- text/richtext
- text/xml
For the possibility of using wildcards in mimetype definitions, see SAP Note 3052386 , question 12.
## 9.2 Virus Scanning in File Uploads
## Example
The system allows uploading of files. For example, users can add an attachment to business documents. Also, you can upload template files, such as e-mail HTML templates, which can be used to render data on a UI.
Once uploaded into SAP S/4HANA, such documents may be displayed in SAP Fiori apps without further security-related checks. If a document contains malicious content, unintended actions could be triggered when the item is downloaded or displayed. This can lead to situations, such as cross-site scripting vulnerabilities. That is why proper virus scanning at upload time is an essential first line of defense against (stored) XSS attacks.
For a technical description of this problem see the ABAP Platform Security Guide .
Go to https:/ /help.sap.com/s4hana\_op\_2021, enter Preventing Cross-Site Scripting From Uploads into the search bar, press Enter , and open the search result with that title.
<!-- image -->
It is clear that uploaded files need to be scanned for malware. Also, their type needs to be verified against a allowlist of MIME-types. You can meet both these requirements by installing and running a VSI 2.x-compliant virus scanner in your landscape.
SAP S/4HANA code calls the virus scanner (at upload time) through a dedicated interface, which you can customize. The pre-delivered scan profile, /SCMS/KPRO\_CREATE, needs to be adapted according to your needs. At runtime the virus scanner rejects all upload documents that are not compliant with the rules specified in the scan profile.
##  Note
Changes to the scan profile have a global effect. This means, for example, that all uploads ending up in KPro face the same virus scan settings at runtime.
## 9.3 Scan Profiles for File Downloads
The following pre-delivered profiles are used for download-time scanning:
- /SCET/GUI\_DOWNLOAD
- /SIHTTP/HTTP\_DOWNLOAD
- /SOAP\_CORE/WS\_SEND
Scanning files on download as well as upload offers additional security benefits. Typically, the virus signature database will have been updated between upload and download time. If a file containing an unknown virus is uploaded, a scan on download might detect the then-known virus and protect the downloading client.
Scanning files on upload and download of course has a performance impact. If you decide that performance considerations demand a reduction of virus scans, relying on upload scans only can be an acceptable tradeoff. In this case, deactivate the three download-time scanning profiles listed above.
## 9.4 Further Protection Against Active Content
## Lines of Defense
There are at least two lines of defense against active content. The first is performing virus scanning in order to avoid uploading malicious content in the first place.
The second line of defense is SAP WebDispatcher. An alternative is the Internet Communication Manager (ICM). These protect against malicious active content being executed at the front end. This uses additional HTTP-response headers to instruct browsers to behave in a specific way. SAP WebDispatcher and ICM both offer the possibility to modify HTTP-response headers.
For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Administration of the ICM into the search bar, press Enter , open the search result with that title, and navigate to Modification of HTTP Requests Deleting, Adding, and Enhancing HTTP Header Fields .
SAP recommends adding the following headers:
- SetResponseHeader X-Content-Type-Options "nosniff" This tells the browser not to try reading the attached file with the assumed MIME type.
- SetResponseHeader X-XSS-Protection "1; mode=block" This prevents cross-site scripting.
## Example: Secure Header Settings
Consider the following example of script code. It shows how to improve the security level. You need to adapt it to your own use case.
```
If %{RESPONSE_HEADER:Content-Disposition} regimatch ^inline [AND] If %{RESPONSE_HEADER:Content-Type} regimatch html|xml|xsl Begin SetResponseHeader Content-Security-Policy "script-src 'none'; sandbox" SetResponseHeader X-Content-Security-Policy "script-src 'none'; sandbox" End
```
If such a Content-Security-Policy header is added to HTTP responses containing previously uploaded files (when displayed inline and having content type containing html, xml or xsl), the execution of Javascript will be prevented at the frontend by all up-to-date browser versions.
## 11.1 Read Access Logging
## Use
Read access to personal data is partially based on legislation, and it is subject to logging functionality. The Read Access Logging (RAL) component can be used to monitor and log read access to data and provide information such as which business users accessed personal data (for example, fields related to bank account data), and when they did so.
In RAL, you can configure which read-access information to log and under which conditions.
SAP delivers sample configurations for applications.
You can display the configurations in the system by performing the following steps:
1. In transaction SRALMANAGER, on the Administration tab page, choose Configuration .
2. Choose the desired channel, for example, WebDynpro.
3. Choose Search . The system displays the available configurations for the selected channel.
4. Choose Display Configuration for detailed information on the configuration. For specific channels, related recordings are also be displayed.
##  Note
For a list of the delivered log domains, see the product assistance at SAP Help Portal under https:/ / help.sap.com/s4hana\_op\_2021 Product Assistance Cross Components Data Protection .
## Prerequisites
Before you can use the delivered RAL configurations, the following prerequisites are met:
- The RAL configurations have been activated.
- You have enabled RAL in each system client.
## More information
For more information, see the following sections on https:/ /help.sap.com/s4hana\_op\_2021:
- Enter Security Auditing and Logging into the search bar, press Enter and open the search result with that title. Navigate to the section Read Access Logging .
- Enter Read Access Logging (RAL) and OData into the search bar, press Enter and open the search result with that title.
For up-to-date information on the delivered RAL configurations, see SAPNote 2347271 .
## 11.2 Deletion of Personal Data
Personal data in a system can be blocked as soon as the business activities for which this data is needed are completed and the residence time for the data has elapsed. After this time, only users who are assigned additional authorizations can access the data.
When the retention period has expired, personal data can be destroyed completely so that it can no longer be retrieved. Residence and retention periods are defined in the customer system.
For this purpose, SAP uses SAP Information Lifecycle Management (ILM) to help you set up a compliant information lifecycle management process in an efficient and flexible manner.
## More Information
For more information, see the application-specific sections in this security guide as well as at https:/ / help.sap.com/s4hana\_op\_2021 under Product Assistance Cross Components Data Protection
.
## 11.3 Information Retrieval
Data subjects have the right to get information regarding their personal data undergoing processing, including the reason (purpose) for processing.
The Information Retrieval Framework component can be used to carry out a cross-application search for personal data of a specified data subject. The data is retrieved from the system and displayed in a structured, easy-to-read list, subdivided according to the purposes for which the data was initially collected and processed.
##  Note
To be able to use the IRF, you must set up your own data model which is the basis for the retrieval process. The data model contains all relevant database tables that are searched for personal data. The IRF assists you in automatically generating an initial data model which you must then verify/ enhance with the help of the IRF modeling tools.
Apart from setting up a data model, you must also maintain the purposes relevant to your organization.
Once you have set up a data model, you can use the following reports to retrieve personal data from the system:
- Start Data Collection report (transaction DTINF\_START\_COLL ) to trigger the retrieval process.
- Process Data Collection Results report (transaction DTINF\_PROC\_COLL ) to get an overview of all data collection requests as well as to display and download the search results.
## More Information
For more information about setting up and using the IRF, see https:/ /help.sap.com/s4hana\_op\_2021 under Discover Product Assistance Enterprise Technology ABAP Platform Administrating the ABAP Platform Administration Concepts and Tools Solution Life Cycle Management Information Retrieval Framework (IRF) .
For more information about data protection, see https:/ /help.sap.com/s4hana\_op\_2021 under Discover Product Assistance Cross Components Data Protection .
## 11.4 Consent Administration
## Use
Any personal data collected or processed must be linked to a specific, predefined purpose, such as the fulfillment of a contract or legal obligation.
If you must obtain consent from the data subject to use their personal data, this consent data can be stored in the SAP system as consent records.
Consent Administration enables you to search for and display stored consent records as well as to import consent records as copies from either a file (stored on your device/ an application server) or via a Web Service (e.g. the SAP Consent Repository service available on the SAP Business Technology Platform). In addition, the feature helps you to manage the retention of consent data, to control access to consent data as well as to support the process of blocking and deletion of business partner master data.
## More Information
- For more information about Consent Administration, see the product assistance for SAP S/4HANA on the SAP Help Portal at https:/ /help.sap.com/s4hana\_op\_2021 and go to Product Assistance Cross Components Data Protection Consent Administration .
- For more information about the SAP Consent Repository, see SAP Consent Repository.
- For more information about the JSON file structure necessary for the import of consent records, see SAP Note 2607792 .
## 12 SAP S/4HANA Cross Application Infrastructure
## 12.1 Data Security in SAP ILM
SAP ILM offers options for protecting data security from the archiving of data up to its storage and destruction. All system connections and ILM functions have authorization protection.
## Related Information
Data Security in SAP ILM System Connections [page 37]
Users and Authorizations in SAP ILM [page 38] Security of Stored Data in SAP ILM [page 39] Logs in SAP ILM [page 40]
## 12.1.1  Data Security in SAP ILM System Connections
## System Landscape Components
The SAP ILM system landscape includes the following main components:
- Application system (AS ABAP)
- WebDAV server on which ILM stores are set up
- System on which the service for the control of ILM stores runs Since two different services are available for controlling ILM stores, two system landscape variants are possible.
- The Storage and Retention Service (SRS) runs either in the application system (AS ABAP) or on a separate AS ABAP.
- For more information, see Configuring Storage and Retention Service for ILM Stores under SAP Information Lifecycle Management.
- XML Data Archiving Service (XML DAS) runs on an AS ABAP. For more information, see Configuring XML Data Archiving Service for ILM Stores under SAP
- Information Lifecycle Management.
## Data Security for System Connections
Communication between systems takes places with HTTP connections.
## HTTP Connection between Application System and ILM Store Service
If the service ( SRS or XML DAS ) runs on a separate system, you need an HTTP connection from the application system to that system. You use an HTTP or HTTPS protocol. The configuration of the HTTP connection is described in the documentation for the relevant service.
If you use the local SRS service of the application system to control ILM stores, you do not need a connection.
## HTTP Connection between ILM Store and ILM Store Service
The ILM Stores that are set up on a WebDAV server need to be connected to a service with an HTTP connection. A WebDAV protocol, which is an enhancement of the HTTP protocol, is used. The configuration of the HTTP connection is explained in the documentation for the relevant service.
## User Authentication for System Connections
The application system can access the service with an HTTP connection only if the connection is made by a user who has the corresponding authorizations. This user must be created in the system on which the service run and entered in the data for the HTTP connection.
In the case of a connection from the service to the WebDAV server, user authentication is performed according to the options offered by the WebDAV server. SAP supports basic authentication with a user of the WebDAV server (with password) as well as with SSL.
## 12.1.2  Users and Authorizations in SAP ILM
## User
To make SAP ILM available, you need users for the communication between the participating systems (using HTTP connections).
For more information, see Data Security in SAP ILM System Connections under SAP Information Lifecycle Management.
## Authorizations
SAP delivers roles with the relevant authorizations for access to the functions of SAP ILM .
For more information, see the following topics under SAP Information Lifecycle Management:
Assigning Authorizations for Retention Management Cockpit
Assigning Authorizations for Retention Warehouse Cockpit
Transactions and Authorizations in SAP NetWeaver ILM
## 12.1.3  Security of Stored Data in SAP ILM
## Security of Archived Data in the File System
When storing archived data in the file system, you have read and write access to the file system with the technical system user of the SAP system. The system temporarily moves the archive files to the file system and then deletes them after forwarding them to the ILM store. The archive files in the file system and the ILM store are stored not in plain text but in binary text in an SAP-specific, compressed format.
A logical path defines the storage location of the archived data in the file system. You need to specify this path in Customizing for the archiving object.
For more information, see:
Data Archiving in the SAP NetWeaver Library
Security Guide for ADK-Based Data Archiving in the Security Guide of the SAP NetWeaver Library
## Security of Data in the ILM Store
To guarantee the non-changeability of data and the protection from early deletion, the resources (archive files) and their higher level collections (hierarchy nodes of the store) are stored on an ILM-certified WebDAV server.
## Metadata Security in the Store Hierarchy
To manage the store hierarchies, the service that you use to manage ILM stores saves the metadata to the system database. Depending on which service you use, the storage location of the metadata is:
| ILM Store Service                   | Metadata Storage Location                         |
|-------------------------------------|---------------------------------------------------|
| Storage and Retention Service (SRS) | Database of the AS ABAP on which the SRS runs     |
| XMLData Archiving Service (XML DAS) | Database of the AS ABAP on which XMLDAS runs      |
|                                     | XMLDAS uses the database pool alias SAP/BC_XMLA . |
You can guarantee the security of the metadata with the standard functions of the database you are using.
For more information, see: Database Access Protection , Security Aspects for Database Connections in the SAP NetWeaver Library.
## Backup of Complete Data in the Retention Warehouse System
To ensure that the dataset you are managing in Retention Warehouse is still complete after the transfer from the legacy system, use the checksums function before and after the transfer and the ILM-compliant conversion of the data (archive files).
## 12.2 Payment Card Security
## 12.2.1  Before You Start
Since the measures described in this guideline for security in the use and administration of payment cards apply in various applications, see the security guides for those particular applications.
The most important SAP Notes that apply to secure handling of payment card data are shown in the table below.
<!-- image -->
<!-- image -->
<!-- image -->
<!-- image -->
|   SAP Note | Title                                                 | Comment                                                         |
|------------|-------------------------------------------------------|-----------------------------------------------------------------|
|    1032588 | Secure handling of credit card data in S/4HANA        |                                                                 |
|    1151936 | Key replacement for encryption of pay- ment card data |                                                                 |
|     662340 | SSF Encryption using SAPCryptolib                     |                                                                 |
|    1394093 | Security collective note                              | Summarizes information about various security-relevant problems |
## 12.2.2  Authorizations
The functions for secure handling of payment cards use the authorization concept provided by ABAP platform. Therefore, the recommendations and guidelines for authorizations as described in the ABAP Platform Security Guide also apply to the secure handling of payment cards.
The ABAP platform authorization concept is based on assigning authorizations to users based on roles. For the role maintenance for ABAP technology, use the profile generator (transaction PFCG).
## Standard Authorization Objects
The table below shows the security-relevant authorization objects that are used as part of secure handling of payment cards.
| Authorization Object   | Field            | Value     | Description                                                                                  |
|------------------------|------------------|-----------|----------------------------------------------------------------------------------------------|
| B_CCSEC                | ACTVT            | 03        | Display of unmasked pay- ment card numbers                                                   |
| B_CCSEC                | ACTVT            | 06        | Deletion of data records no longer needed and log en- tries for displaying payment card data |
| B_CCSEC                | ACTVT            | 71        | Display of log entries for dis- playing payment card data                                    |
| SSFVADM                | ACTVT SSFVAPPLIC | 01 PAYCRV | Generating a key version                                                                     |
| Authorization Object   | Field            | Value     | Description                                                  |
|------------------------|------------------|-----------|--------------------------------------------------------------|
|                        | ACTVT SSFVAPPLIC | 06 PAYCRV | Deleting a key version                                       |
|                        | ACTVT SSFVAPPLIC | 42 PAYCRV | Execution of migration pro- grams for SSF application PAYCRV |
## 12.2.3  Data Storage Security
## Use
Since payment card data is needed by many different applications for operational processes, the data is stored on the database. If you choose the security level Masked Display, and Encrypted When Saved , the system stores payment card numbers in encrypted form on the database in the following database tables:
| Database Table   | Use                                         | Comment                                                                                    |
|------------------|---------------------------------------------|--------------------------------------------------------------------------------------------|
| PCA_SECURITY_RAW | Payment Cards and SAP Business Part- ner    | In S/4HANA systems, you must exe- cute a migration program.                                |
| CCARDEC          | Payment Cards in FI, SD and Customer Master |                                                                                            |
| CCSEC_ ENC       | Other payment card processes                | The table is used if the indicator for periodic key replacement is not set in Customizing. |
| CCSEC_ENCV       | Other payment card processes                | The table is used if the indicator for periodic key replacement is set in Cus- tomizing.   |
The application database tables refer to these encrypted storage tables.
You can archive and delete the data using the following archiving objects or deletion programs:
| Database Table   | Deletion/Archiving                          | Comment                                                                                                      |
|------------------|---------------------------------------------|--------------------------------------------------------------------------------------------------------------|
| PCA_SECURITY_RAW | Archiving using archiving object CA_PCA_SEC |                                                                                                              |
| CCARDEC          | Deletion using program CCARDEC_DE- LETE     | If the data is used in an unarchived FI document, customer master record, or order, the data is not deleted. |
| Database Table   | Deletion/Archiving                           | Comment                                                                            |
|------------------|----------------------------------------------|------------------------------------------------------------------------------------|
| CCSEC_ ENC       | Archiving using archiving object CA_PCA_ SEC |                                                                                    |
| CCSEC_ENCV       | Deletion using program RCCSECV_ DATA _ DEL   | The data cannot be deleted unless the last use was more than 500 days in the past. |
## 12.2.4  Setting Up Encryption Software
To be able to encrypt payment card data in the system, you must install the function package SAPCRYPTOLIB.
The function package SAPCRYPTOLIB contains the functions necessary for encryption. To execute the encryption software, you have to make general settings in Customizing for SAP NetWeaver. Choose Application Server System Administration Maintain the Public Key Information for the System .
For more information, see SAP Note 662340.
## 12.2.6  Relevant SSF Applications
For encryption and decryption using the SSF Framework, the applications communicate using an SSF application. The keys (PSEs) used for encryption and decryption are generated for each SSF application.
If you have not activated key replacement, then, for technical reasons, various SSF applications exist for the various storage files of encrypted payment card data. If you set the Key Replacement Active indicator, then only the SSF application PAYCRV is used after that point.
| Application                                 | SSF Application, If Key Replacement Inactive   | SSF Application, If Key Replacement Active   |
|---------------------------------------------|------------------------------------------------|----------------------------------------------|
| Payment Cards and SAP Business Part- ner    | PAYCRD (in S/4HANA systems)                    | PAYCRV                                       |
| Payment Cards in FI, SD and Customer Master | CCARD                                          | PAYCRV                                       |
| Other payment card processes                | PAYCRD                                         | PAYCRV                                       |
The SSF application PAYCRV supports management of multiple key versions. This is not the case with the SSF applications PAYCRD and CCARD. Therefore, using the SSF application PAYCRV is mandatory for the process of periodic key replacement.
## 12.2.7  Generating Keys
The generation of the keys (PSEs) used for encryption and decryption differs depending on the SSF application:
## · SSF Application *PAYCRV
To generate a key version, on the SAP Easy Access screen, choose Cross-Application Components Security of Payment Card Data Encryption of Payment Cards Administration of Key Versions for PAYCRV . The system automatically generates the PSEs and distributes them to the application servers. You can display them in the transaction STRUST (Trust Manager).
The transaction for administration of key versions, in addition to the overview of already generated key versions, also provides information on how many data records are encrypted and stored on the database for a version. There you can create new key versions and delete key versions that are no longer used.
- SSF Applications CCARDEC and PAYCRD
In transaction SSFA, create a new entry for an SSF application. Create the PSE in transaction STRUST, and make sure that you use the algorithm RSA.
## 12.2.8  Migration of Payment Card Data Stored in Unencrypted Form
You can use several migration programs to migrate payment card data stored in unencrypted form to encrypted payment card data. These programs comply with the naming convention RCCSEC\_MIGRATION\_*. For information on which program you can use for your system, see the documentation of the individual programs.
You execute the program to store all payment card data in your system in encrypted form. For operative processes, you do not have to execute the migration programs. In addition, you can perform the conversion in several individual steps, whereby you convert only part of the data in each step.
Note that there are special issues related to the SAP Business Partner. For more information, see this section [page 47].
## 12.2.10  Migration to SSF Application PAYCRV
If you already encrypted credit card data in the system (using the SSF applications PAYCRD or CCARD), you can migrate this data to the SSF application PAYCRV. As a result, the system then also replaces the keys for this data on a periodic basis.
Start the migration on the SAP Easy Access screen under Cross-Application Components Security of Payment Card Data Encryption of Payment Cards Migration to SSF Application PAYCRV . Y ou can migrate each of the affected database tables individually and you can enter a maximum runtime. This means that in this case you can spread the conversion out over time.
## 12.2.11  Migration to Current Key Version
Once you have generated a new key version, you can migrate the data, which was encrypted and stored under an older key version, to the current key version. During this process, the system decrypts the data record with
the older key version, encrypts the data with the current key version, and updates the database tables. After the migration is complete, the system does not contain any more data records that still use the older key version. At that point in time, you can specify that the older key version is deletable.
To run the migration, on the SAP Easy Access screen, choose Cross-Application Components Security of Payment Card Data Encryption of Payment Cards Execute Conversion . Y ou can define parallel processing for the migration using the subarea. The entire dataset is divided into subareas represented by the numbers 000 to 999. The subareas contain a roughly equal number of encrypted records. You can start the migration program with intervals determined by the subarea, so that up to 1000 parallel jobs are possible. In addition, you can enter a maximum runtime. This means that you can make the conversion in stages.
## 12.2.12  Deleting a Key Version
Once the data of an old key version has been migrated completely to the current key version, the old key version receives the status deletable . T o ensure the utmost security, the earliest the key version can actually be deleted is after an additional waiting period of 90 days after the successful migration.
## 12.2.13  Security-Relevant Logging and Tracing
## Use
You can have the system log users' access to unmasked payment card data. In Customizing, choose the setting Access Log: Logs for Unmasked Display (see Making Settings for Payment Card Security [page 44]).
The system updates the log on database table CCSEC\_LOG. You can carry out an analysis via the SAP Easy Access screen, under Cross-Application Components Security of Payment Card Data Encryption of Payment Cards Evaluate Payment Card Log . T o analyze the access log, you need authorization for activity 71 of authorization object B\_CCSEC.
You can delete log records if they are at least one year old. To delete the records, on the SAP Easy Access screen choose Cross-Application Components Security of Payment Card Data Encryption of Payment Cards Delete Payment Card Log . T o be able to run the deletion report, you need authorization for object B\_CCSEC with activity 06.
## 12.2.14  Recommended Implementation Steps
The following recommended implementation steps differ according to which of the following situations apply to you:
- You did not yet set a security level.
- You are already using the security level for saving payment card numbers in encrypted form, and you now want to implement the process for periodic key replacement.
## Variant 1: Security Level Not Yet Set
If you have not yet set a security level in Customizing, follow these steps to implement the process for encrypted storage and periodic key replacement for payment card numbers.
1. Create a key version. To do so, on the SAP Easy Access screen, choose Cross-Application Components Security of Payment Card Data Encryption of Payment Cards Administration of Key Versions for PAYCRV . (See Generating Keys [page 46])
2. Make settings for payment card security (see Making Settings for Payment Card Security [page 44]).
1. Set the security level Masked Display, and Encrypted When Saved .
2. Activate the access log.
3. Activate the additional authorization checks for unmasked display and set up the user authorizations accordingly.
4. Set the number of visible characters at the beginning and end of the payment card number.
5. Activate the key replacement.
3. Specify the payment card types that you want to save in encrypted form. (See Making Settings for Payment Card Security [page 44])
4. Migrate the payment card data that was stored in unencrypted form. (See Migration of Payment Card Data Stored in Unencrypted Form)
5. If you use SAP Business Partner, migrate your payment card data on SAP Business Partner. (See Migration of Payment Card Data on SAP Business Partner [page 47])
## Variant 2: Security Level "Masked Display, and Encrypted When Saved" Already Used
If you already set the security level Masked Display, and Encrypted When Saved in Customizing, and you already migrated the legacy data when implementing the security level, then perform the following steps to implement the process of periodic key replacement.
1. Create a key version. To do so, on the SAP Easy Access screen, choose Cross-Application Components Security of Payment Card Data Encryption of Payment Cards Administration of Key Versions for PAYCRV .
2. Activate the key replacement. (See Making Settings for Payment Card Security [page 44])
3. Migrate the stored encrypted data to the SSF application PAYCRV (see Migration to SSF Application PAYCRV [page 48]).
## 12.3 Data Security in Behavioral Insights
## 12.3.1  Roles and Authorizations
This section describes the use of roles and authorizations in SAP S/4HANA for behavioral insights (abbreviated to: Behavioral Insights).
## 12.3.1.1  Standard Roles
Behavioral Insights uses the standard authorization concepts provided by SAP S/4HANA. SAP delivers standard roles covering the most frequent business transactions. You can use these roles as a template for your own roles.
In Behavioral Insights, PFCG delta roles are used to access content in the application. To complete the end user role, these roles must be used along with other roles delivered by SAP . These roles are designed to support your Behavioral Insights business processes.
You can use the roles below as a template for your own roles:
| Role                         | Details                                     | Description                                                 |
|------------------------------|---------------------------------------------|-------------------------------------------------------------|
| SAP_BR_ANALYTICS_SPECIALIS T | Analytics specialist                        | This role is required to access ISLM apps.                  |
| SAP_BR_BEI_DEBT_MGR          | Accounts Receivable Manager - Public Sector | This role is required to access the At- Risk Customers app. |
| SAP_BR_BEI_ADMIN             | Administrator - Public Sector               | This role is required to access the Main- tain Jobs app.    |
## 12.3.2  Data Protection
Data protection is associated with numerous legal requirements and privacy concerns. In addition to compliance with general data privacy acts, it is necessary to consider compliance with industry-specific legislation in different countries.