RFC without SNC lacks the described cryptographic transport protection. Traffic and transmitted passwords may be intercepted.
What SNC provides
Secure Network Communication provides strong mutual cryptographic authentication, integrity protection and the ability to encrypt traffic. Verify that the selected configuration enforces the required protection level, including confidentiality.
Use SNC particularly for RFC crossing untrusted networks, between user and server networks, and between different server networks. Encryption does not replace RFC authorizations or restrictions on remotely accessible functions.
Keys are part of the security boundary
Restrict STRUST administration, access to tables containing cryptographic material and ABAP file-system access to PSE files. Protect the SPSE authorization group and limit access to keys to the administrators and processes that require it.
Configure first, then enforce
After deploying SNC, consider blocking unencrypted communication. First confirm that partners and SNC libraries work together correctly, then test enforcement. Review SNC protection levels and encrypted-only settings in the NETENC control.
Review checklist
- Identify connections crossing trusted network boundaries.
- Confirm SNC partner configuration and actual connection encryption.
- Review access to STRUST, key material and PSE files.
- Plan enforcement after integration testing.