Securing Information within SAP v4.6b

The following thoughts and best practices are the end result of an upgrade, experience with the necessary clean up after the cutover and review of best practices offered by third parties. In our upgrade, we implemented some additional levels of security from both a technical and process perspective. During the months that followed, we learned what mistakes and omissions we made as well as some things that we had implemented very well. We are currently working to tighten security on an on-going basis and have limited the enterprise's exposure to a manageable acceptable level. This paper is not intended to focus on the technical aspects of creating security access for users but rather on the implications on designing a loose, difficult to manage security environment. Accordingly, the technical discussion will be limited and at a fairly high level. Although the specifics in this discussion are directed to SAP, the premise can be applied to any software system.