I'm responsible for rolling out SAP GUI 730 to my global organization, replacing our current SAP GUI 720 desktop installation package. Since there are now more options for administrators to configure SAP GUI using the Windows registry (thanks SAP!) I wanted to ask what other organizations are doing before we finalize our choices. Here are the options we're planning to implement:
- Grant ability for SAP GUI to read/write/delete files on the local client by default
SAP’s default setting is to ask the user whenever an action that passes SAP GUI’s security rules will access the client machine’s file system (this
is the authorization pop-up you get when you try to download a file from SAP to your desktop)
I think our risk of SAP GUI performing rogue activity on client machines is very low, plus few of our users would be able to classify activity as
harmful by interpreting the information in the pop-up. This setting is suggested as a convenience to our user community, most members of whom will probably allow any activity anyway.
- Delete the cache of documents downloaded from SAP each time SAP Logon is shut down
Other options are to prevent caching of downloaded files altogether or to delete them after a specific number of days
I believe deletion when SAP Logon is closed as a compromise between convenience and security since users access many more documents from
DMS that aren’t sensitive
Any document written to the hard drive could potentially be recovered even after erasure by someone using data recovery tools until the
hard drive sectors are physically overwritten. Turning document caching off completely might reduce that risk, although additional research would be required to confirm that documents are never written to the hard drive if not cached.
- Allow SAP GUI trace files to remain on the client indefinitely
This is the SAP standard setting
While trace files could potentially contain sensitive input data, the likelihood is low. The alternative is to prevent caching or delete the trace file
cache after a defined number of days
- Prevent Firefighter passwords from being saved in the local SAP input history database
SAP currently stores all user input, except SAP login passwords, in an unencrypted local database. Apparently Firefighter passwords aren’t recognized as SAP passwords. This is from SAP Note 1250351
I personally find the input history helpful when using SAP GUI for business transactions so I don’t suggest deactivating it altogether. Any other commonly-used sensitive data elements that should be considered; SSNs or credit card numbers?
- Allow SAP GUI scripting
This is the SAP standard setting
My organization currently disables SAP GUI scripting at the server level out of a concern that a technically-savy user who writes a bad script could really do some (likely inadvertent) damage to our production systems. Maintaining control at the server level makes it easier to adjust on an as-needed basis
- Prevent end users from changing selected SAP GUI options set by the administrator
The only features to be made unchangeable by users are:
- SAP GUI security rules
- Retention of the document cache (we want to be sure it is always
deleted when the user leaves SAP Logon) - Branding image location (so users can’t replace the Perrigo logo
in the upper right corner of the screen with their own image)
Thanks everyone for your input, and I hope the suggestions I've shared above are helpful to others.
Robert Garst
SAP Basis Administrator, Perrigo Company