{"id":70,"date":"2016-10-26T12:22:13","date_gmt":"2016-10-26T11:22:13","guid":{"rendered":"http:\/\/akquinet-security-en.blog\/?p=70"},"modified":"2020-07-07T12:01:26","modified_gmt":"2020-07-07T10:01:26","slug":"how-to-reliably-prevent-the-execution-of-sap-reports","status":"publish","type":"post","link":"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/","title":{"rendered":"How to reliably prevent the execution of SAP reports."},"content":{"rendered":"<h2><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-36 alignleft\" src=\"https:\/\/sast-blog.akquinet.com\/wp-content\/uploads\/2017\/01\/istock_45277700_large_akqw_jpg.jpg\" alt=\"istock_45277700_large_akqw_jpg\" width=\"251\" height=\"179\" srcset=\"https:\/\/sast-solutions.com\/blog-en\/wp-content\/uploads\/2017\/01\/istock_45277700_large_akqw_jpg.jpg 640w, https:\/\/sast-solutions.com\/blog-en\/wp-content\/uploads\/2017\/01\/istock_45277700_large_akqw_jpg-300x214.jpg 300w\" sizes=\"auto, (max-width: 251px) 100vw, 251px\" \/><\/h2>\n<p><span style=\"color: #616262;\">Did you know that the denial of transaction SA38 does not reliably prevent SAP reports from being executed? <\/span><\/p>\n<p><span style=\"color: #616262;\">In our practical tip, read how you can best prevent \u201cWorkarounds&#8221;.<\/span><\/p>\n<p><span style=\"color: #616262;\"><!--more-->To restrict the use of SAP reports, it is common practice to withdraw authorization for transaction \u201cSA38\u201d. It\u2019s generally the right thing to do, but doesn\u2019t completely lead you to your goal, because there are several ways to start ABAP programs in SAP Systems.<\/span><\/p>\n<ol>\n<li><span style=\"color: #616262;\"><span style=\"color: #616262;\"><strong>End user reporting with SA38 and variants of SA38.<\/strong><br \/>\nIn this combination, SAP checks the authorization for S_TCODE SA38 and, if applicable, S_REPORT, if the program to be started has an authorization group. In more recent systems, object S_REPORT is also checked.<\/span><\/span><\/li>\n<li><span style=\"color: #616262;\"><strong>Developer tools SE80, SE84, SE38, and approx. 50 other transactions.<\/strong><br \/>\nIn our Security Monitoring Center, we see again and again that users use alternative transactions such as SE38, SE80, SE84 etc. to start programs as reports or, worse, use tricks to call up SE16N. In this constellation, S_TCODE is checked for SE84 and object S_DEVELOP ACTVT 03. S_PROGRAM is never checked.In many authorization concepts, object S_DEVELOP ACTVT 03 (Display), in particular, is classed as non-critical and is therefore assigned to users without hesitation. But in many systems, this means that such workarounds are available to a large number of users.<\/span><\/li>\n<\/ol>\n<p><span style=\"color: #616262;\"><strong>Our tip:<br \/>\n<\/strong><\/span><span style=\"color: #616262;\">Only assign transactions from the development environment in combination S_DEVELOP ACTVT 03 to emergency users, so that the use of SA38 and SE16N via workarounds is prevented. Create a transaction for each SA38 report, and only give assignment for reports via transactions. Your customer-specific programs should of course execute other functional authorization checks and you must check and extend the coding as required.<\/span><\/p>\n<h6><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-33 alignnone\" src=\"https:\/\/sast-blog.akquinet.com\/wp-content\/uploads\/2017\/01\/ralfkempf_akquinet.jpg\" alt=\"ralfkempf_akquinet\" width=\"130\" height=\"91\" srcset=\"https:\/\/sast-solutions.com\/blog-en\/wp-content\/uploads\/2017\/01\/ralfkempf_akquinet.jpg 640w, https:\/\/sast-solutions.com\/blog-en\/wp-content\/uploads\/2017\/01\/ralfkempf_akquinet-300x210.jpg 300w\" sizes=\"auto, (max-width: 130px) 100vw, 130px\" \/><br \/>\nRalf Kempf<br \/>\nManaging Director, AKQUINET<\/h6>\n","protected":false},"excerpt":{"rendered":"<p>Did you know that the denial of transaction SA38 does not reliably prevent SAP reports from being executed?<br \/>\nIn our practical tip, read how you can best prevent \u201cWorkarounds&#8221;.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[68,170],"class_list":["post-70","post","type-post","status-publish","format-standard","hentry","category-sap-authorizations-grc","tag-sap-authorizations","tag-security-monitoring"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to reliably prevent the execution of SAP reports.<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to reliably prevent the execution of SAP reports.\" \/>\n<meta property=\"og:description\" content=\"Did you know that the denial of transaction SA38 does not reliably prevent SAP reports from being executed?  In our practical tip, read how you can best prevent \u201cWorkarounds&quot;.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/\" \/>\n<meta property=\"og:site_name\" content=\"SAST BLOG\" \/>\n<meta property=\"article:published_time\" content=\"2016-10-26T11:22:13+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-07-07T10:01:26+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sast-blog.akquinet.com\/wp-content\/uploads\/2017\/01\/istock_45277700_large_akqw_jpg.jpg\" \/>\n<meta name=\"author\" content=\"securityblog\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"securityblog\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2016\\\/10\\\/26\\\/how-to-reliably-prevent-the-execution-of-sap-reports\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2016\\\/10\\\/26\\\/how-to-reliably-prevent-the-execution-of-sap-reports\\\/\"},\"author\":{\"name\":\"securityblog\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#\\\/schema\\\/person\\\/cd70e3749cca136a7e8a37dc1d3cfc26\"},\"headline\":\"How to reliably prevent the execution of SAP reports.\",\"datePublished\":\"2016-10-26T11:22:13+00:00\",\"dateModified\":\"2020-07-07T10:01:26+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2016\\\/10\\\/26\\\/how-to-reliably-prevent-the-execution-of-sap-reports\\\/\"},\"wordCount\":303,\"publisher\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2016\\\/10\\\/26\\\/how-to-reliably-prevent-the-execution-of-sap-reports\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sast-blog.akquinet.com\\\/wp-content\\\/uploads\\\/2017\\\/01\\\/istock_45277700_large_akqw_jpg.jpg\",\"keywords\":[\"SAP Authorizations\",\"Security Monitoring\"],\"articleSection\":[\"SAP Authorizations &amp; GRC\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2016\\\/10\\\/26\\\/how-to-reliably-prevent-the-execution-of-sap-reports\\\/\",\"url\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2016\\\/10\\\/26\\\/how-to-reliably-prevent-the-execution-of-sap-reports\\\/\",\"name\":\"How to reliably prevent the execution of SAP reports.\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2016\\\/10\\\/26\\\/how-to-reliably-prevent-the-execution-of-sap-reports\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2016\\\/10\\\/26\\\/how-to-reliably-prevent-the-execution-of-sap-reports\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sast-blog.akquinet.com\\\/wp-content\\\/uploads\\\/2017\\\/01\\\/istock_45277700_large_akqw_jpg.jpg\",\"datePublished\":\"2016-10-26T11:22:13+00:00\",\"dateModified\":\"2020-07-07T10:01:26+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2016\\\/10\\\/26\\\/how-to-reliably-prevent-the-execution-of-sap-reports\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2016\\\/10\\\/26\\\/how-to-reliably-prevent-the-execution-of-sap-reports\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2016\\\/10\\\/26\\\/how-to-reliably-prevent-the-execution-of-sap-reports\\\/#primaryimage\",\"url\":\"https:\\\/\\\/sast-blog.akquinet.com\\\/wp-content\\\/uploads\\\/2017\\\/01\\\/istock_45277700_large_akqw_jpg.jpg\",\"contentUrl\":\"https:\\\/\\\/sast-blog.akquinet.com\\\/wp-content\\\/uploads\\\/2017\\\/01\\\/istock_45277700_large_akqw_jpg.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/2016\\\/10\\\/26\\\/how-to-reliably-prevent-the-execution-of-sap-reports\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to reliably prevent the execution of SAP reports.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#website\",\"url\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/\",\"name\":\"SAST BLOG\",\"description\":\"SAP Security &amp; Compliance\",\"publisher\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#organization\",\"name\":\"SAST BLOG\",\"url\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/sast-solutions-logo.png\",\"contentUrl\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/sast-solutions-logo.png\",\"width\":358,\"height\":155,\"caption\":\"SAST BLOG\"},\"image\":{\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sast-solutions.com\\\/blog-en\\\/#\\\/schema\\\/person\\\/cd70e3749cca136a7e8a37dc1d3cfc26\",\"name\":\"securityblog\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to reliably prevent the execution of SAP reports.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/","og_locale":"en_US","og_type":"article","og_title":"How to reliably prevent the execution of SAP reports.","og_description":"Did you know that the denial of transaction SA38 does not reliably prevent SAP reports from being executed?  In our practical tip, read how you can best prevent \u201cWorkarounds\".","og_url":"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/","og_site_name":"SAST BLOG","article_published_time":"2016-10-26T11:22:13+00:00","article_modified_time":"2020-07-07T10:01:26+00:00","og_image":[{"url":"https:\/\/sast-blog.akquinet.com\/wp-content\/uploads\/2017\/01\/istock_45277700_large_akqw_jpg.jpg","type":"","width":"","height":""}],"author":"securityblog","twitter_card":"summary_large_image","twitter_misc":{"Written by":"securityblog","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/#article","isPartOf":{"@id":"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/"},"author":{"name":"securityblog","@id":"https:\/\/sast-solutions.com\/blog-en\/#\/schema\/person\/cd70e3749cca136a7e8a37dc1d3cfc26"},"headline":"How to reliably prevent the execution of SAP reports.","datePublished":"2016-10-26T11:22:13+00:00","dateModified":"2020-07-07T10:01:26+00:00","mainEntityOfPage":{"@id":"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/"},"wordCount":303,"publisher":{"@id":"https:\/\/sast-solutions.com\/blog-en\/#organization"},"image":{"@id":"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/#primaryimage"},"thumbnailUrl":"https:\/\/sast-blog.akquinet.com\/wp-content\/uploads\/2017\/01\/istock_45277700_large_akqw_jpg.jpg","keywords":["SAP Authorizations","Security Monitoring"],"articleSection":["SAP Authorizations &amp; GRC"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/","url":"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/","name":"How to reliably prevent the execution of SAP reports.","isPartOf":{"@id":"https:\/\/sast-solutions.com\/blog-en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/#primaryimage"},"image":{"@id":"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/#primaryimage"},"thumbnailUrl":"https:\/\/sast-blog.akquinet.com\/wp-content\/uploads\/2017\/01\/istock_45277700_large_akqw_jpg.jpg","datePublished":"2016-10-26T11:22:13+00:00","dateModified":"2020-07-07T10:01:26+00:00","breadcrumb":{"@id":"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/#primaryimage","url":"https:\/\/sast-blog.akquinet.com\/wp-content\/uploads\/2017\/01\/istock_45277700_large_akqw_jpg.jpg","contentUrl":"https:\/\/sast-blog.akquinet.com\/wp-content\/uploads\/2017\/01\/istock_45277700_large_akqw_jpg.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/sast-solutions.com\/blog-en\/2016\/10\/26\/how-to-reliably-prevent-the-execution-of-sap-reports\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/sast-solutions.com\/blog-en\/"},{"@type":"ListItem","position":2,"name":"How to reliably prevent the execution of SAP reports."}]},{"@type":"WebSite","@id":"https:\/\/sast-solutions.com\/blog-en\/#website","url":"https:\/\/sast-solutions.com\/blog-en\/","name":"SAST BLOG","description":"SAP Security &amp; Compliance","publisher":{"@id":"https:\/\/sast-solutions.com\/blog-en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sast-solutions.com\/blog-en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/sast-solutions.com\/blog-en\/#organization","name":"SAST BLOG","url":"https:\/\/sast-solutions.com\/blog-en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sast-solutions.com\/blog-en\/#\/schema\/logo\/image\/","url":"https:\/\/sast-solutions.com\/blog-en\/wp-content\/uploads\/2021\/03\/sast-solutions-logo.png","contentUrl":"https:\/\/sast-solutions.com\/blog-en\/wp-content\/uploads\/2021\/03\/sast-solutions-logo.png","width":358,"height":155,"caption":"SAST BLOG"},"image":{"@id":"https:\/\/sast-solutions.com\/blog-en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/sast-solutions.com\/blog-en\/#\/schema\/person\/cd70e3749cca136a7e8a37dc1d3cfc26","name":"securityblog"}]}},"_links":{"self":[{"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/posts\/70","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/comments?post=70"}],"version-history":[{"count":1,"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/posts\/70\/revisions"}],"predecessor-version":[{"id":1297,"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/posts\/70\/revisions\/1297"}],"wp:attachment":[{"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/media?parent=70"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/categories?post=70"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sast-solutions.com\/blog-en\/wp-json\/wp\/v2\/tags?post=70"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}