+APP.4.2.A8 Protection of the SAP RFC Interface (B)

APP.4.2.A8 Protection of the SAP RFC Interface (B)

To protect the Remote Function Call (RFC) interface, RFC connections, RFC authorisations, and RFC gateways MUST be configured securely.

Uniform administrative guidelines MUST be created and implemented for all RFC connections. For this purpose, the required RFC connections SHOULD be defined and documented. Connections with a stored password SHOULD not be configured from lower- to higher-privileged systems (e.g. from Dev to Prod). RFC connections that are no longer used MUST be deleted.

All RFC gateways MUST be securely administered and suitable profile parameters MUST be set (e.g. gw/monitor, gw/reg_no_conn_info and snc/permit_insecure_start). All connections that are established via a gateway MUST be analysed and evaluated in terms of their security. Furthermore, logging MUST be enabled. Access control lists (ACLs) MUST be defined.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.14 Interception of Information / Espionage
blocks G 0.22 Manipulation of Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.25 Failure of Devices or Systems
blocks G 0.28 Software Vulnerabilities or Errors
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.31 Incorrect Use or Administration of Devices and Systems
blocks G 0.32 Misuse of Authorisation
blocks G 0.39 Malware
blocks G 0.43 Attack with Specially Crafted Messages
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information