CIS2005 Principles of Information Security S2 2011 - Assignment 2 Practical SAP Report
Description / Marks out of / Weighting / Due dateAssignment 2 – Practical report usingSAP / 100 / 15% / 2nd September 2011
The key concepts and frameworks covered in modules 1–4 are particularly relevant for this assignment. Assignment 2 relates to the specific course learning objectives 1, 2 and 3:
1. have a strong understanding of the vulnerabilities and threats relating to information systems and the controls which can be implemented to mitigate their effect
2. understand the need for information systems security
3. describe various network related threats and controls as covered in this course
And assesses the following graduate skills: The Academic & Professional Literacy and Written & Oral Communication at level 2.
Assignment 2requires you to cover two specific tasks regarding SAP security. Your Assignment 2 must be professionally structured, worded for readability and appropriate for the intendedaudience. Your assignment 2 must be structured as follows:
● Cover page for your assignment 2
● Table of contents
● Body of report – main section for each task with appropriate use of subsections for
each task sub report
● Task 1 – with appropriate sub section headings for each report
● Task 2 – with appropriate sub section headings for each report
Task 1 Specifications – Analyze SAP Security Audit Log Data.
You are provided with a data file – Userdata.xls.
Userdata.xls is a summarizedrecord of user activity on a client’s SAP system. Each record contains the following fields:
USERID
YYYYMM
TCODE
TEXT
TCODESTAT
TCD
TSTATUS
TCOUNT
TTEXT
YYYYMMdescribes when the user action took place. YYYYMM is useful for summarising user activity by month. TCODE refers to the transaction (option on the menu) performed by the user. TEXT describes the outcome of the action, including its success or failure. Some tcodes are blank. Accordingly, TCODESTAT is an invented transaction code for each action indicating whether the action was successful (-0) or failed (-1). TCD is the same as TCODESTAT, except there is no -0 or -1. TSTATUS indicates whether the action was successful or not (0/1). TCOUNT is the number of times the user has performed this action, with this outcome, in the month YYYYMM. TTEXT is the narrative description of the TCODE.
Task 1 Requirements
You are required to use software of your choice (spreadsheet, database, statistical package etc) to analyze the provided SAP security audit log data (Userdata.xls), generate appropriate reports and provide an analysis of your findings. Of particular interest are the following reports:
- Alphabetic list of all actions and their frequency by any selected user, e.g. USER-040.
- List of users performing unsuccessful activities.
- List of transaction codes performed,with their frequency by each user.
- List of users engaging in security-related actions.
- Top 10 users in terms of frequency of activity.
- List of users who are dormant – in the range USER-001 to USER-050.
- You should also produce at least 3 reports/charts/plots based on any of the above previous reports that summarise activity over time using YYYYMM.
TASK 2 Specifications – Analyze SAP System-Wide Security Settings.
You are required to review the system-wide security settings on our SAP system. The data file RSPARAM contains an extract from the client’s system.
You are to produce a report (HTML) summarizing the current user settings, default settings and recommended settings. Prepare a written evaluation of the current settings highlighting any weaknesses, with explanations, and recommendations (1000 words approx.). The report should take the following form:
ABC DISTRIBUTION COMPANY
System-Wide Security Settings
Date:
Prepared by:
System SettingUserDefaultRecommended
ValueValueValue
No auto user SAP*0>0
Failed logins to end
Failed logins to lock
Auto failed unlock
Min password length
Password expiry (days)
Idle logout (seconds)
No check on Tcodes
Default login client
1