SAP NetWeaver Application Server ABAP Security Guide 
Caution
This guide does not replace the administration or operation guides that are available for productive operations.
This document is not included as part of the Installation Guides, Configuration Guides, Technical Operation Manuals, or Upgrade Guides. Such guides are only relevant for a certain phase of the software life cycle, whereby the Security Guides provide information that is relevant for all life cycle phases.
Why is Security Necessary
With the increasing use of distributed systems and the Internet for managing business data, the demands on security are also on the rise. When using a distributed system, you need to be sure that your data and processes support your business needs without allowing unauthorized access to critical information. User errors, negligence, or attempted manipulation on your system should not result in loss of information or processing time. These demands on security apply likewise to SAP NetWeaver Application Server (AS) ABAP. To assist you in securing the AS ABAP, we provide this Security Guide.
About This Document
The Security Guide provides an overview of the security-relevant information that applies to the AS ABAP.
Overview of the Main Sections
The Security Guide comprises the following main sections:
This section describes security aspects involved with user authentication, for example, logon security, password rules and preventing unauthorized logons. In addition, it describes how to protect the standard users SAP*, DDIC, and EARLYWATCH.
This section provides a brief overview of the SAP authorization concept and how you can use it to protect your applications from misuse.
Network Security for SAP NetWeaver AS ABAP
This section provides an overview of the protocols used by the SAP NetWeaver AS ABAP and the mechanisms to use to provide security for connections at the network transport layer.
Protecting Your Productive System (Change & Transport System)
This section describes how to prevent undesirable changes from being made in your productive system by using the Change and Transport System (CTS) and the Transport Management System (TMS).
Security Issues for Web Dynpro ABAP
Consider security aspects when you create Web applications using the Web Dynpro ABAP programming model. Security functions are available both for when you create Web applications as well as for when you operate them.
The aim of this guide is to help you make informed choices about your security policy in your testing environment by explaining the authorizations required for different kinds of eCATT users. It also explains the security features implemented to protect your systems from unwanted GUI scripting access.
Secure Store & Forward Mechanisms (SSF) and Digital Signatures
This section describes the security aspects involved when using public-key technology for digital signature and encryption functions.
Security Aspects for the Service Implementation Workbench
This section describes the security aspects involved when using the service implementation workbench.
Security aspects that apply to additional topics are also included. Such topics are:
Executing logical operating system commands in SAP systems
Batch input
Preventing disclosure of the SAPconnect RFC user
Internet Graphics Service security
More Information
Security Aspects for BSP in the Security Aspects for Usage Type DI and Other Development Technologies section of the SAP NetWeaver Security Guide: