Homepage for SAP Professionals

Everybody has Access to your DATA!!!

White-collar crime is the fastest growing type of crime in North America, and co-workers and disgruntled employees have many motivations to cause damages or increase their wealth. Especially in the current economy it is every company’s responsibility to keep honest employees honest by preventing opportunities and temptation! The first thing intruders do before taking any illegal action is to get access to another colleague’s user profile for extended access so that the other person will be blamed. Below we will point out how easy this unfortunately is…

We know about one company that lost over $60 Million in a 4 year period. A director used one of his employee’s user profiles and passwords to commit the fraud in the SAP financial system. When the fraud was discovered, this employee spent half a year in jail for a crime that she did not commit. Eventually, her boss was arrested for stealing her password and committing the fraud. continue reading…

I am sure that your data governance is up do date and you are happy with your eCATT and LSMW scripts, or even happy that you saved some money to hire some interns or temps to enter data in your system. But why doing it the better & more cost effective way if you have money to burn? Just kidding!

continue reading…

There are quiet a few companies that want to give end-users access to extract table data via SE16 or SE16N. If you decide to give SE16N, please read our blog that shoes the pitfalls & danger of giving SE16N – In addition, the auditors, security people and basis folks worry about using having transactions such as SQVI, SQ01 etc…. Why is that? For starters, users can access confidential data once they can use SQVI as it is not protecting the data to be extracted by company code or other organizational values. A guideline on how to convert SQVI report into a InfoSet query will be published on this blog.

In addition, SQVI reports, if created poorly, can have a drag on system performance as the endusers never have performance in their minds and run queries over millions of records with inadequate table joins.  The same applies to SQ01 – SQ03 transactions. These are a red flag for most of the auditors also if the user is allowed to add custom code on InfoSet level.  Security managers usually recommend that SQxx transactions are used in a development environment and the queries mapped to transactions so that these can go through Change Control and given to users via roles in a controlled manner . continue reading…

I have been asked many times if I could tell what functional area a transaction, program, table etc. belong to. Each time I did a short onsite or online demo for clients I work as a virtual consultant and created a short documentation. Now, that I have setup a blog, I thought it would be a good idea to document this here so that I can just reference it via a hyperlink. continue reading…

Working as a virtual consultant for the past few years, I am very happy that this model is starting to take off. Talking to other consultants & business partners, I came across this article by Herbert Goertz, SAP Consulting Exchange

Thanks largely to the recession, many professional services firms have been forced to abandon billable hours as a business model. Witness Monday’s Wall Street Journal article, ““Billable Hour” Under Attack.” Although the article happens to be about law firms, the issues raised apply just as much to technology consulting. continue reading…