Internet Graphics Service Security 

The IGS (Internet Graphics Service) consists of several elements linked to one another and to SAP systems via network connections. The IGS uses incoming data to generate graphics, which the user can then access as required. For more information on the different IGS elements and how they work together see IGS Architecture.

Graphics do not generally represent a security risk. However, data used to create graphics may be relevant to security. The graphics generated may also represent sensitive information (for example, salaries, sums of money agreed in contracts).

 

Security Options

There are two general security recommendations that are valid for all IGS versions:

Always use the latest IGS patch and always protect your IGS by a firewall!

 

In addition there are several options to make your IGS more secure according to the IGS version you want to use:

 

●      For ABAP-based front-end technology, you should implement the authorization for transaction SIGS/Report GRAPHICS_IGS_ADMIN. See note 988677.

●      If you do not use Web Dynpro Java, the HTTP listener should be deactivated. This is done via the HTTP listener entry in either the igs.xml file or in the profile parameters according to the IGS version you are using. To disable the HTTP listener, see note 862169.

●      As of IGS 6.40 Patch 16 and IGS 7.0 Patch 4,  the HTTP administration and monitoring is disabled by default. If you need to switch the HTTP administration on temporarily, for example in a support case, see note 959358 for instructions how to switch HTTP administration on.

If you switch the HTTP administration on, you should make sure that incoming HTTP requests are traced with the sender IP. To enable this functionality see note 992171.

●      In addition, you can use HTTPS with IGS as of IGS 7.0. See note 965076 for more information on how to use HTTPS with IGS.