How to securize SE16N

Question

Hello,
I have securize SE16N with SAP OSS note which is checking SY-TCODE.
Currently if you trying to launch SE16N through SE37, SE38, SA38 SEU_INT or SE93, it checks if you are authorized to SY-TCODE = SE16N.
Despite that, I have still discover that some people have found another way to use SE16N despite my controls set up.
To definitly secure my system, I need to understand how they can proceed. Do you have any idea on how they can do.
The only trace I found in STAT is :
Transaction : SESS Program : RK_SE16N
Thanks for your help.

Answer 1

One more thing to add to this discussion:
Errors that happen now and then should never be a reason for giving people day to day access to trx or functions like we discussed.
Best way to solve these issues : Have an emergency userid available!
Procedure:
1.     The error should be recorded in the system were all errors are recorded.
2.     The whole support team should be consulted to see if there is a solution possible in a regular manner
3.     One support team member should be assigned to solve the error.
4.     Before execution of the job a clear description should be added to the error rapport listing how the problem will be solved (this should also include the TRX Needed for the solution)
5.     The emergency userid should normally be locked . And it should be in separate usergroup (called emerge) which is ONLY accessible for the security team lead. The emergency userid has SAP_ALL and SAP_NEW assigned (allowed only because of the strict procedure!)
6.     A senior support manager approves the request to unlock the uid for solving the error. This approval is recorded in the error report including the name of the team member will solve the issue.
7.     The emergency uid is unlocked the password given to the team member aforementioned. Time is recorded in the error report. Trace is switched on.
8.     The four eyes principle applies here. So the team member is being watched all the time by a second person during the time the emergency uid is being unlocked.
9.     Immediately after the error has been solved the emergency uid is being locked again and the password reset.
10.     Trace report being read for TRX used, and checked against the scenario (as in point 4) any other trx used should be explained in the error report.
11.     All personnel involved should attend a close-out meeting where all points aforementioned should be addressed. And a close-out report should be signed by all and added to the error report.
12.     First Audit all error reports should be presented to the auditors for review
Be aware that All points mentioned are mandatory