Skip to main content

16.8 Security & Source Readiness

1. Security is end-to-end​

A Datasphere role alone does not make an SAP integration secure.

Security spans:

Identity
   |
Network
   |
Source authorization
   |
Connection
   |
Datasphere space authorization
   |
Object access
   |
Consumer authorization

2. Source-side authorization​

For ABAP-based integrations, the source must be configured with the permissions required for the supported integration scenario.

The minimum-privilege principle applies:

Grant only the source capabilities required by the integration contract.

3. Environment isolation​

Do not reuse production source credentials in DEV.

Use:

  • DEV source connection,
  • TEST source connection,
  • PROD source connection.

Keep endpoint and credential ownership explicit.

4. Sensitive data​

Before replicating sensitive SAP fields, classify:

  • personal data,
  • financial data,
  • commercially sensitive data,
  • security-relevant data.

Ask:

  • does the consumer need the field?
  • should it be masked?
  • should it be excluded?
  • is replication permitted?
  • where will copies exist?

5. Source readiness checklist​

Before go-live:

  • source release validated,
  • required SAP Notes reviewed,
  • security settings validated,
  • technical identity approved,
  • network path tested,
  • extraction object validated,
  • delta behavior validated,
  • source workload tested,
  • monitoring configured,
  • support owner assigned.

6. Connection security anti-patterns​

Avoid:

  • shared undocumented credentials,
  • excessive source privileges,
  • production testing without approval,
  • copying sensitive fields "just in case",
  • ignoring source-side audit requirements.

Architect exercise​

Design secure integration for Finance data containing sensitive supplier information.

Explain:

  • source authorization,
  • field minimization,
  • Datasphere access,
  • consumer roles,
  • audit,
  • incident response.