Two security perspectives
Configuration validation determines whether safeguards are configured correctly. Event monitoring establishes what happened in the system. Both should work together: compliant configuration does not rule out misuse of legitimately assigned privileges.
Prepare evidence for investigation
Provide SAL, ICM and Message Server logs, HANA auditing, and BTP and Cloud Connector logs. Maintain history, integrity and restricted access. Confirm that events can be linked to a user, time and source system.
Central configuration validation
Configuration Validation and Configuration & Security Analytics in Focused Run compare configuration data with a policy. Useful datasets include ABAP parameters, clients, transports, RFC destinations and Gateway rules. Every deviation should have an owner and a handling decision.
From signal to verification
For a suspicious event, identify the affected systems and accounts, collect logs from related layers and compare them with approved changes. After remediation, check both configuration and subsequent events. Retain evidence for retrospective analysis.
Controls to review
Security Audit Log and platform auditing
Record events needed for incident detection and retrospective analysis.
Sensitive data in HANA traces
Restrict tracing to avoid recording query results during normal operations.
Message Server
Separate internal communication from client access and protect administration.
Gateway registration, startup and proxy
Restrict connections to external RFC servers and disable simulation after rollout.
Standard SAP accounts
Protect built-in accounts and remove unnecessary access.