SICF services to be disabled

Some SICF services might be activated from the past. For security they might pose a risk. The best action is to pro-actively disable them.

Remarks on the (*): these services still might have a business need, double check these before de-activating.

Critical services according to note 887164:
/sap/bc/bsp/sap/bsp_model
/sap/bc/bsp/sap/htmlb_samples
/sap/bc/bsp/sap/it00
/sap/bc/bsp/sap/it01
/sap/bc/bsp/sap/it02
/sap/bc/bsp/sap/it03
/sap/bc/bsp/sap/it04
/sap/bc/bsp/sap/it05
/sap/bc/bsp/sap/itmvc2
/sap/bc/bsp/sap/itsm
/sap/bc/bsp/sap/sbspext_htmlb
/sap/bc/bsp/sap/sbspext_phtmlb
/sap/bc/bsp/sap/sbspext_table (see note 2948239)
/sap/bc/bsp/sap/sbspext_xhtmlb
/sap/bc/bsp/sap/system_private
/sap/bc/bsp/sap/system_public

Source: SAP security baseline.

SAP FIORI SICF services no longer in use

You might use SAP FIORI. After some time older FIORI tiles and corresponding ODATA services are move to newer FIORI or different applications. Or users might stop using certain FIORI applications (mostly due to lack of functions that are present on SAP GUI and missing on FIORI). From security point of view, you want to de-activate these non-used FIORI SICF services and ODATA services.

To identify, check the early watch, or check the instructions in OSS note 3261151 – SAPUI5 Apps – Identify unused ICF services. Mass clean up is described in OSS note 2989913 – SAP EarlyWatch Alert Dashboard: How to deactivate unused ICF services with the mass processing tool.