SAP Apparel And Footwear (AFS)

5Session Security ProtectionTo increase security and prevent access to the SAP logon ticket and security session cookie(s), we recommendactivating secure session management.We also highly recommend using SSL to protect the network communications where these security-relevantcookies are transferred.Session Security Protection on the AS ABAPTo activate session security on the AS ABAP, set the corresponding profile parameters and activate the sessionsecurity for the client(s) using the transaction SICF SESSIONS.For more information, a list of the relevant profile parameters, and detailed instructions, see Activating HTTPSecurity Session Management on AS ABAP [SAP Library] in the AS ABAP security documentation.14Customer 2016 SAP SE. All rights reserved.SAP Apparel and Footwear (AFS)Session Security Protection

6Network and Communication SecurityYour network infrastructure is extremely important in protecting your system. Your network needs to support thecommunication necessary for your business needs without allowing unauthorized access. A well-defined networktopology can eliminate many security threats based on software flaws (at both the operating system level andapplication level) or network attacks such as eavesdropping. If users cannot log on to your application or databaseservers at the operating system or database layer, then there is no way for intruders to compromise the machinesand gain access to the backend system’s database or files. Additionally, if users are not able to connect to theserver LAN (local area network), they cannot exploit well-known bugs and security holes in network services onthe server machines.The network topology for the SAP Apparel and Footwear is based on the topology used by the SAP NetWeaverplatform. Therefore, the security guidelines and recommendations described in the SAP NetWeaver SecurityGuide also apply to the SAP Apparel and Footwear. Details that specifically apply to the SAP Apparel and Footwearare described in the following topics: Communication Channel SecurityThis topic describes the communication paths and protocols used by the SAP Apparel and Footwear. Network SecurityThis topic describes the recommended network topology for the SAP Apparel and Footwear. It shows theappropriate network segments for the various client and server components and where to use firewalls foraccess protection. It also includes a list of the ports needed to operate the SAP Apparel and Footwear. Communication DestinationsThis topic describes the information needed for the various communication paths, for example, which usersare used for which communications.For more information, see the following sections in the SAP NetWeaver Security Guide: Network and Communication Security Security Guides for Connectivity and Interoperability TechnologiesSAP Apparel and Footwear (AFS)Network and Communication SecurityCustomer 2016 SAP SE. All rights reserved.15

6.1Communication Channel SecurityUseThe table below shows the communication channels used by the SAP Apparel and Footwear, the protocol used forthe connection, and the type of data transferred.Communication PathProtocol UsedType of DataTransferredData Requiring SpecialProtectionFront-end client usingSAP GUI for Windows toapplication serverDIAGAll application dataFor example, masterdata, business dataFrontend client using aWeb browser toapplication serverHTTP (S)All application dataFor example,passwords, businessdata, master dataApplication server toapplication serverRFC, HTTP(S), SOAPIntegration dataFor example, businessdata, field dataDIAG and RFC connections can be protected using Secure Network Communications (SNC). HTTP connectionsare protected using the Secure Sockets Layer (SSL) protocol. SOAP connections are protected with Web servicessecurity.RecommendationWe strongly recommend using secure protocols (SSL, SNC) whenever possible.For more information, see Transport Layer Security and Web Services Security in the SAP NetWeaver SecurityGuide.16Customer 2016 SAP SE. All rights reserved.SAP Apparel and Footwear (AFS)Network and Communication Security

6.2Network SecurityUsePortsThe SAP Apparel and Footwear runs on SAP NetWeaver and uses the ports from the AS ABAP or AS Java. Formore information, see the topics for AS ABAP Ports and AS Java Ports in the corresponding SAP NetWeaverSecurity Guides. For other components, for example, SAPinst, SAProuter, or the SAP Web Dispatcher, see alsothe document TCP/IP Ports Used by SAP Applications, which is located on SAP Developer Network athttp://scn.sap.com/community/security under Infrastructure Security Network and CommunicationsSecurity.SAP Apparel and Footwear (AFS)Network and Communication SecurityCustomer 2016 SAP SE. All rights reserved.17

6.3Communication DestinationsUseThe table below shows an overview of the communication destinations used by the SAP Apparel and Footwear.Users and authorizations can be a security risk if used irresponsibly. For this reason, you must note the followingsecurity measures when communicating between SAP ERP systems: Use the System and Communication user categories. Do not give a user more authorizations than necessary. Choose a secure password and do not inform anyone else of your password. Only save user-specific logon data for users from the System and Communication category. As far as possible, use trusted system functions, rather than user-specific logon data when saving data.SAP Apparel and Footwear uses standard interfaces to SAP Customer Relationship Management (SAP CRM),SAP Supply Chain Management (SAP SCM), SAP Global Trade Services (SAP GTS), SAP Business Intelligence(SAP BI), Internet Sales and SAP Retail systems.Quick Links to Additional Information18DestinationDeliveredSAP Customer RelationshipManagement (SAP CRM)service.sap.com/securityguide SAP Security Guides SAPBusiness Suite Applications - SAP CRM - SAP Security Guidefor SAP CRMSAP Supply ChainManagement (SAP SCM)service.sap.com/securityguide SAP Security Guides SAPBusiness Suite Applications - SAP SCM - SAP Security Guidefor SAP SCMSAP Global Trade Services(SAP GTS)service.sap.com/securityguide SAP ERP 2005 SecurityGuides Update SAP ERP 2005 Security Guides EHP4 SECGUIDE ECC 604 EN 20102008.pdf (refer to the section onGlobal Trade)SAP Business Intelligence(SAP BI)service.sap.com/securityguide SAP Business InformationWarehouse Security Guides SAP Business InformationWarehouse Sec.GuideInternet Salesservice.sap.com/securityguide SAP CRM Security Guides Security Guide for SAP CRM 7.0 EHP1 (Refer to section onComponent-Specific Guidelines: Web Channel Enablement)Customer 2016 SAP SE. All rights reserved.SAP Apparel and Footwear (AFS)Network and Communication Security

DestinationDeliveredSAP Retailservice.sap.com/securityguide SAP ERP 2005 SecurityGuides Update SAP ERP 2005 Security Guides EHP4 SECGUIDE ECC 604 EN 20102008.pdf (refer to the section onRetail)SAP Apparel and Footwear (AFS)Network and Communication SecurityCustomer 2016 SAP SE. All rights reserved.19

7Internet Communication FrameworkSecurityYou should only activate those services that are needed for the applications running in your system. Use thetransaction SICF to activate these services.If your firewall(s) use URL filtering, also note the URLs used for the services and adjust your firewall settingsaccordingly.For more information, see Activating and Deactivating ICF Services in the SAP NetWeaver Library documentation.For more information about ICF security, see the RFC/ICF Security Guide.20Customer 2016 SAP SE. All rights reserved.SAP Apparel and Footwear (AFS)Internet Communication Framework Security

8Data Storage SecurityUseThe data storage security of SAP NetWeaver and components installed on this base is described in detail in theSAP NetWeaver Security Guide.For information about the data storage security of SAP NetWeaver, see SAP Service Marketplace atservice.sap.com/securityguide SAP NetWeaver Security Guide Security Guides for the Operating Systemand Database Platforms.SAP Apparel and Footwear (AFS)Data Storage SecurityCustomer 2016 SAP SE. All rights reserved.21

9Data ProtectionData protection is associated with numerous legal requirements and privacy concerns. In addition to compliancewith general data privacy acts, it is necessary to consider compliance with industry-specific legislation in differentcountries. This section describes the specific features and functions that SAP provides to support compliancewith the relevant legal requirements and data privacy.This section and any other sections in this Security Guide do not give any advice on whether these features andfunctions are the best method to support company, industry, regional or country-specific requirements.Furthermore, this guide does not give any advice or recommendations with regard to additional features thatwould be required in a particular environment; decisions related to data protection must be made on a case-bycase basis and under consideration of the given system landscape and the applicable legal requirements.NoteIn the majority of cases, compliance with data privacy laws is not a product feature.SAP software supports data privacy by providing security features and specific data-protection-relevantfunctions such as functions for the simplified blocking and deletion of personal data.SAP does not provide legal advice in any form. The definitions and other terms used in this guide are nottaken from any given legal source.GlossaryTermDefinitionPersonal dataInformation about an identified or identifiable natural person.Business purposeA legal, contractual, or in other form justified reason for the processing ofpersonal data. The assumption is that any purpose has an end that is usuallyalready defined when the purpose starts.BlockingA method of restricting access to data for which the primary business purposehas ended.DeletionDeletion of personal data so that the data is no longer usable.Retention periodThe time period during which data must be available.End of purpose (EoP)A method of identifying the point in time for a data set when the processing ofpersonal data is no longer required for the primary business purpose. After theEoP has been reached, the data is blocked and can only be accessed by userswith special authorization.Some basic requirements that support data protection are often referred to as technical and organizationalmeasures (TOM). The following topics are related to data protection and require appropriate TOMs: 22Access control: SAP Apparel and Footwear uses the user management and authentication mechanismsprovided with the SAP NetWeaver platform. Therefore, the security recommendations and guidelines for useradministration and authentication as described in the SAP NetWeaver Application Server ABAP SecurityGuide [SAP Library] also apply to SAP Apparel and Footwear.Customer 2016 SAP SE. All rights reserved.SAP Apparel and Footwear (AFS)Data Protection

Authorizations: Authorization concept as described in section Authorizations. Transmission control / Communication security: as described in section Network and CommunicationSecurity. Availability control as described in:o Section Data Storage Securityo SAP NetWeaver Database Administration [SAP Library] documentationo SAP Business Continuity documentation in the SAP NetWeaver Application Help under Function-OrientedView Solution Life Cycle Management SAP Business Continuity Separation by purpose: Is subject to the organizational model implemented and must be applied as part ofthe authorization concept.CautionThe extent to which data protection is ensured depends on secure system operation. Network security,security note implementation, adequate logging of system changes, and appropriate usage of the systemare the basic technical requirements for compliance with data privacy legislation and other legislation.Configuration of Data Protection FunctionsCertain central functions that support data protection compliance are grouped in Customizing for CrossApplication Components under Data Protection.Additional industry-specific, scenario-specific or application-specific configuration might be required.For information about the application-specific configuration, see the application-specific Customizing in SPRO.9.1Deletion of Personal DataUseSAP Apparel and Footwear might process data (personal data) that is subject to the data protection lawsapplicable in specific countries as described in SAP Note 1825544.The SAP Information Lifecycle Management (ILM) component supports the entire software lifecycle including thestorage, retention, blocking, and deletion of data. SAP Apparel and Footwear uses SAP ILM to support the deletionof personal data as described in the following sections.SAP delivers an end of purpose check for SAP Apparel and Footwear. For more information, see Business PartnerEnd of Purpose Check in SAP Apparel and Footwear.For information about the Customizing of blocking and deletion for SAP Apparel and Footwear, see Configuration:Simplified Blocking and Deletion.End of Purpose Check (EoP)An end of purpose check determines whether data is still relevant for business activities based on the retentionperiod defined for the data. The retention period of data consists of the following phases. Phase one: The relevant data is actively used. Phase two: The relevant data is actively available in the system.SAP Apparel and Footwear (AFS)Data ProtectionCustomer 2016 SAP SE. All rights reserved.23

Phase three: The relevant data needs to be retained for other reasons.For example, processing of data is no longer required for the primary business purpose, but to comply withlegal rules for retention, the data must still be available. In phase three, the relevant data is blocked.Blocking of data prevents the business users of SAP applications from displaying and using data that mayinclude personal data and is no longer relevant for business activities.Blocking of data can impact system behavior in the following ways: Display: The system does not display blocked data. Change: It is not possible to change a business object that contains blocked data. Create: It is not possible to create a business object that contains blocked data. Copy/Follow-Up: It is not possible to copy a business object or perform follow-up activities for a businessobject that contains blocked data. Search: It is not possible to search for blocked data or to search for a business object using blocked data inthe search criteria.It is possible to display blocked data if a user has special authorization; however, it is still not possible to create,change, copy, or perform follow-up activities on blocked data.For information about the configuration settings required to enable this three-phase based end of purpose check,see Process Flow and Configuration: Simplified Blocking and Deletion.Integration with Other SolutionsIn the majority of cases, different installed applications run interdependently as shown in following graphic.Integrated Systems using Central Master DataMaster DatacBPBPCRMLIFNRBPERPKUNNRTransactional Data:Orders, DocumentsSD transactional dataCRM transactional dataBPISFI transactional dataHCM transactional dataBP MandatoryFoundation 2014 SAP AG or an SAP affiliate company. All rights reserved.24Customer 2016 SAP SE. All rights reserved. c AddressManagementConfidential1SAP Apparel and Footwear (AFS)Data Protection

An example of an application that uses central master data is an SAP for Healthcare (IS-H) application that usesthe purchase order data stored in Financial Accounting (FI) or Controlling (CO).Relevant Application Objects and Available Deletion FunctionalityApplication AreaApplication ObjectsProvided Deletion FunctionalityVendor Capacity PlanningJ 3ASUCAHDestruction object: J 3ASUCAHJ 3ASUCALILM object: J 3ASUCAHAllocation run (ARUN) logs/AFS/ARUN/PROSchedule a regular job for deletion report/AFS/MRP DES.Material requirements planning(MRP) logsJ 3ADBBASchedule a regular job for deletion report/AFS/ARUN DES.Relevant Application Objects and Available EoP functionalityApplicationImplemented Solution (EoP orWU

The SAP Apparel and Footwear is built from the component applications. Therefore, the corresponding Security Guides also apply to SAP Apparel and Footwear. As SAP Apparel and Footwear is provided as an ABAP add-on to SAP ERP, the security guidelines applicable to SAP ERP also apply to SAP Apparel and Footwear. Pay particular