Auditing Information System AIS

Auditing Information System (AIS)

SAP Audit Information System (AIS) serves as a centralized repository for reports, queries, and views of interest to auditors. It is designed to address the overall system configuration as well as SAP business processes and their related control features, providing audit and security practitioners with the critical information they need to conduct effective reviews of their SAP systems. SAP administrators can use AIS for security auditing. The AIS plays a supportive role in providing security services for SAP systems. The primary function of AIS is auditing but auditing features can derive the measures that help in developing the security policy for SAP systems.

Administration and Maintenance

A successful security set up of a SAP system concludes with proper management and administration of user IDs, password resetting, audit trails, audit logs, access control list, and personnel responsibilities.

Security administration in SAP includes maintenance of the overall SAP security environment using the SAP Profile Generator, creating user-level activity groups and creating user master records.

The concept of SAP security is flexible as well as complex. SAP has a multi-layered integrated framework. To ensure adequate protection, security measures must be factored into all layers of the SAP infrastructure. With client/server architecture, SAP systems include many components that exchange information, each of which constitutes a layer of the SAP security infrastructure. Security is often not a priority in an implementation and as a result, the default security is not strong. SAP security functionality could be enhanced using various measures as discussed above.

Enterprises must develop a security strategy to ensure a secure and functional SAP system. A business critical application like SAP needs continuous monitoring and improvement of its security features.

Question II

Question: Hi all,

I'm new to security admin, Is there any transaction codes available for security and audit logs.

thanx

Answer:
Hi lola,

If you use the search functionality on this forum you will see this has been covered a number of times.

SM19,20 and 21 will get you started but red the posts and you will get lots more info

cheers,

al.

Answer:
Also look at transaction SERC as it has a Basis security component on "things that should be done" and are low hanging fruit for auditors.

Question I

Question: Hello,

Can someone tell me what the difference between Security Audit Log and AIS is.

Thanks

Answer:
Security Audit log will record events corresponding to user defined filters - e.g. dialog logon, transaction start.

AIS is a list of reports which can be used for some system audit tasks. In no way should AIS be relied on, however there are some useful (standard) reports which can be used as part of an auditing framework.

Audit and/or Authorization maintenance tools

Question: Hello,

Can you tell experiences about audit and authorization maintenance tools?
like PCI, VRAT, APM

Thanks

Answer:
Search the forum and you will see this has been covered a few times.

Deletion of Vendor Consignment Records

Steps for Deletion of Consignment Records:
To delete the Consignment Record, use transaction MSK2 or menu-path:
Logistics - Materials Management - Material Master - Special Stock - Vendor Consignment - Change and select the data of the record you want to be deleted.

To start the archiving:
Process, follow the menu path:
Logistics - Materials Management –Material - Master - Other - Reorganization - Special Stock – Choose to select the records to delete and
Logistics - Materials Management - Material Master - Other - Reorganization - Special Stock - Reorganize to create archive file.

Create Archive File: Consignment Record: Data selection
a) Select Action: Archive and enter a new Variant, for example: Z_CONS_SELE_01, press 'Maintain'
b) On selection screen enter the data range (Vendor, Material, etc.) you want to archive.
c) Select the 'Create Output File' if you want the selected records outputted
d) Press the green back-arrow and enter the description of this new variantt on the screen which follows.
e) Save the variantt which brings you again to the selection screen. Press green the back arrow again.
f) To start archiving process (batch-job), press the 'Start Date' button and select the time when you want to start this process. Select 'Immediate' for instant processing and press the 'Save' button on the bottom of the 'Start Time' window.
g) Select the 'Spool Parameter' button and save entries. Eventually enter a valid printer to have the result outputted.
h) You are ready now to start the process. Press the 'Start' button and monitor the success with the 'Job Overview' button
You can also go the 'fast path' by using transaction SE38, program MMREO002 for selecting the data to archive. For large data archiving, use the background jobs and run those during off-peak times. Create Archive File: Consignment Record:

Archiving process:
a) Select Action: Archive and enter a new Variant, for example: Z_CONS_ARCH_01, press 'Maintain'
b) On selection screen, select the 'Sequential Dataset' if you selected data as described in the Data Selection step, otherwise enter the material number and plant for the deletion of a single record.
c) Select the fields 'Consignment' and 'Special Stock' and Test mode, if you want to try out first.
** This applies for SAP systems prior to release 3.1H: Select also the flag called 'BATCHES'. The SAP program MMREO020 has a bug which can be worked around with this selection. Without selecting 'BATCHES', the archived records cannot be deleted. For systems with applied Hotpackages for 3.1H this workaround is not necessary
d) Press the green back-arrow and enter the description of this new variantt on the screen which follows.
e) Save the variantt which brings you again to the selection screen. Press green back arrow again.
f) To start archiving process (batch-job), press the 'Start Date' button and select the time when you want to start this process. Select 'Immediate' for instant processing and press the 'Save' button on the bottom of the 'Start Time' window.
g) Select the 'Spool Parameter' button and save entries. Eventually enter a valid printer to have the result outputted.
h) You are ready now to start the process. Press the 'Start' button and monitor the success with the 'Job Overview' button
You can also go the 'fast path' by using transaction SE38, program MMREO020 for selecting the data to archive. For large data archiving, use the background jobs and run those during off-peak times. If you run the program online, you will see a confirmation on the status bar telling 'New Archive file created:....'

Delete Archived Records: Info Record
a) Follow the menu path: Tools - Administration - Administration - Archiving
b) Select the Object Name MM_SPSTOCK for consignment / Special Stock
c) Select the menu button 'Delete'
d) Select the menu button: 'Archive Selection'
e) Click the archive created in previous step
f) Select Start Date for process and Spool Parameters for output
g) Submit selection.
h) Check status by pressing the Job Overview button

Archive DEFINITION

1) An archive is a collection of computer files that have been packaged together for backup, to transport to some other location, for saving away from the computer so that more hard disk storage can be made available, or for some other purpose. An archive can include a simple list of files or files organized under a directory or catalog structure (depending on how a particular program supports archiving).

On personal computers with the Windows operating system, WinZip is a popular program that lets you create an archive (a single file that holds a number of files that you plan to save to another medium or send someone electronically) or extract its files. WinZip also compresses the files that are archived, but compression is not required to create an archive. A WinZip archive has the file name suffix ".zip".

In Unix-based operating systems, the tar (tape archive) utility can be used to create an archive or extract files from one. On mainframe operating systems such as IBM's MVS and OS/390, procedures for archiving or backing up files are often automated as a daily operation.

2) On Web sites as well as in libraries, an archive is a collection of individual publications that are often cataloged or listed and made accessible in some way. Magazines, journals, and newspapers with Web sites sometimes refer to their back issues as an archive.

3) Web and File Transfer Protocol sites that provide software programs that can be downloaded sometimes refer to the list of downloadable files as an archive or as archives.

Applying Hot Packages Using OSS Material free downloads

Applying Hot Packages Using OSS --> http://www.zshare.net/download/108784843d8fce82/

Audit Information System

The Audit Information System (AIS) has been developed to provide internal and external auditors, Security Administrators and those with data protection and controlling responsibilities with a tool to assist in understanding and completing required tasks in the complex SAP environment. The SAP Audit Information System (AIS) provides a centralized repository for reports, queries, and views of data that have a control implication. AIS was first available for SAP R/3 Version 3.0D, and is delivered as standard in SAP R/3 Versions 4.6 and above. AIS is provided at no additional cost from SAP, and allows an auditor or manager to work online in the production system on a real time basis..

Emergency Role Firefighting

How good you do your security there may come a time when user might need emergency authorizations. Such authorization can be necessary in exceptional situations. It could be a month end close, which got closed before the month end.
Virsa provides tool called firefighter, which can help you. First you have to define what is an emergency for your company. You might have to create roles for these emergencies, and also define the time frame this role will be assigned to users. You might have to define an approval procedure for this. Hoe is this going to be audited. Work with your audit team to make sure they are ok