Quick question about SAP Security analyst responsibilities

Question

This question was posted on another site and I was asked by the moderator to  cross-post it here:
On another discussion forum, the topic of the SAP Certification program came up. In the discussion thread, there was some debate about the subject areas tested on the exam for SAP security, so I am putting the question to you.
At your current workplace, which of the following, if any, are responsibilities/ expected competencies of your experienced SAP Security analysts:
Encryption
Single Sign-on configuration/ maintenance
Network topology (SAP router and web dispatcher)
Operating system (SAP gateway)
Database security
J2EE
To categorize the responses, it would be helpful to know if you consider yours is a relatively large SAP support organization or not.
Thanks in advance for your responses and comments.
Regards,
Gretchen Lindquist

Answer 1

Hi Gretchen,
I am a consultant so have a slightly different perspective than an end user. 
A typical client security engagement for me will involve 3 or 4 out of those competency areas and on top of that: secure communications & secure application (what I know and love as roles & users, some of our friends will refer to that as secure coding).  In general, security administrators at my clients focus on roles & users and their competencies are only in those area.  That is the same for small (<500 users) and large organisations (>20k users)
In my opinion this is one of the problems with our industry and in particular with individuals who consider themselves SAP Security professional.  It is no secret that the wider security industry often views SAP Security practitioners as a bit limited in skills due to the lack of understanding of infosec basics.
SAP security is not just roles & users, SoD's & SU53's.  They are an important part of securing SAP but only a few of the components.  As you have pointed out in the competency areas SAP Security is about the environment in which the SAP system resides and operates and our need is to ensure the C,I,A over those systems that support business processes.
As an employer I expect a SAP Security professional to have understanding of all of those competencies (and a few more).  In the same way that GRC is much more than a tool provided by SAP, SAP security is a holistic subject that by necessity covers multiple subject areas.
Regarding expectations of a security analyst, I expect them to be able to understand the wider security environment around their system and to be comfortable talking about things like comms security, SSO, secure programming (the basics), OS, network topology and DB security (the basics).  Most importantly they should know how they work together to form the security environment and where the dependencies or touch points are between them.  It's not unreasonable for basis and technical teams to perform much of the work in these areas but that is not to say that "out of sight is out of mind".
I don't hide my views on the inadequacy of the certification process in it's previous incarnations.  SAP is doing great work to improve this which is a positive step.  What is critical is that a demonstration of competency (e.g. certification)  in SAP Security covers the whole subject (or as much as practical).
If people want to break the topic down then that's great but resulting certifications should be pointed out as what they are e.g. Certification in role & user administration.
I hope there is something in there to provoke thought & discussion!
Regards
Alex
Edited for clarity by: Alex Ayers on Feb 9, 2012 9:49 AM