Secure custom developer programs and transactions

Question

Hi Guys,
I am given a task in my company to maintain authority check for all costom developed programs and transaction.
In combination TADIR, TRDIR & TSTC i found more then 1000 transactions and 1500 programs custom developed.
So now I am having difficulty in finding authority check at program level for all the custom programs and transactions. I tried to use RSABAPSC but this gives for each program/ transaction.
Can you guys help me to find a best way to get the list for the whol transactions and good approach to complete the task at ace and good way.
Please comment your best practices and approaches for this.
Let me know if you guys need any more information from me to make the above more clear.
Thanks.

Answer 1

Hi Amit
I do not think you will find any relevant standard report/functionality in the SAP System, that could scan your Z-Report and find out if it's correctly secured with authorizations checks. Many of those checks could hide in called functionmodules, Methods etc.
And you still have need to define and check each SAP report for your companies specific security requirement.
With 1000/1500 Z-transactions/reports, my guess is, that a lot of them might be obsolete, never used, temp programs for dataloads etc. So mayby you do not have to focus on all of them, so I think that my approach would be, to try to limit the number of report that I needed to investigate thoroughly, and then take the reports one by one.
The steps involved would be something like:
1. Find out which of your Z-reports/T-codes thats actually used. You should be able to se that in SM20(if you have activated the secure audit log with the correct filters), ST03N etc. Report/T-codes that are not used could be locked in SM01.
2. Investigate the used reports one by one, Check the Source-Code, do an Authorisation trace etc - Remember that if your Z-Report used BAPI and other SAP Standard functionality, Or if i reads from at DATASET etc.. you might not be able to spot the Authority-check statement in your source code
3. Implement and test the relevant and requirered additional authorization check
4. Document in SU24
5. Adjust the roles
And your ready for test.
And yes I know,,,  It can be a hugh job, but I do not think that you can find a quick-fix for this.
Regards
Morten Nielsen