How do you update your ERP security strategy?

Knowing your current security status is not a one-time thing, but a continuous process. Regular audits and assessments can help you find out about new risks that may come up due to software updates, changes in regulations, or new cyber threats. To catch any security issues, use real-time monitoring and automated alerts. Also, involve key people like department heads, IT teams, and even end-users in these assessments. This will give you a better understanding of how the ERP system is used and where security weaknesses may exist. By working together, you can make sure the security strategy is aligned with the organisation's operational needs, striking a balance between security and functionality.

From an ERP-centric viewpoint, refining the security framework centres on understanding the inherent functionalities and interconnectedness of ERP modules. Primarily, it's about strengthening the inherent access controls and ensuring that the multitude of ERP modules function seamlessly without compromising data integrity. •Implement granular, role-based controls tailored to ERP modules, ensuring users can only access data relevant to their tasks. •Prioritize timely updates with a focus on ERP-specific vulnerabilities, ensuring each module is patched against known threats. •Separate sensitive data within ERP modules, ensuring that compromised access to one module doesn't jeopardize the entire dataset.

Ideally, the management system should be designed and created within the organization. In standard practice, ERP systems are delivered off the shelf, and are often created using several types of software. However, software security begins with strategic principles and standards within the organization, especially since the main leaks come from inside organizations, since only large players in the market are subject to hacker attacks. Assessing the safe use of an asset management system should begin at the workplace, in employee processes and functions, and externally through Internet communications channels and standard corporate network security systems. Security assessment should be carried out by a cross-functional team.

Security strategy with ERP application should be continuously reviewed, monitored and updated. Most ERP applications come with default security roles, however its essential for the Security roles or profiles to be redefined to the granular level. Enforcement of policies and controls which each module to enforce governance within and across module.

Organisations need to understand that the ERP security strategy involve all components that required to run the ERP system, and not only the ERP application, so ERP security team should integrate with other teams to cover the following security aspects. - Infrastructure security - Network security - Operating system security - Database security - ERP application security & updates - User accounts and roles security update - Backup and recovery - Disaster recovery The implementation of an ERP security strategy should be a continuous process, as new threats and vulnerabilities are constantly emerging. By regularly reviewing and updating the security strategy, organisations can help to protect their ERP systems from attack.

The most effective means of protection are fool-proof systems. the simpler the system is organized, and the more it is thought out in terms of processes and logic, the more opportunities to avoid the occurrence of risks, and especially incidents. data access and network access are two completely different tasks, and they need to be solved separately. in modern solutions, I began to use mechanisms that restrict user access to personal data, which, with the proper level of communication, provides protection against copying and leaking data to the side. so I repeat again - the logic of organizing the work of employees is a key aspect in comprehensive data protection. Network security, again thought out, is much easier to organize.

Ensure periodic Audit review with Process Owners and HR relating to which employees have changed roles and still holding having access to previous assigned access. With the tight integration of Active Directory and other Security solutions with ERP application, its essential for the ERP security professional to check with IT security to validate employees who have left the organization with a signoff to validate the assessment. Some cases exist where ERP access was not disabled owing to the believe that AD access is disabled. Integrating an Identity Access Management tool could support this control requirement.

Collaborate ERP access logs with HR , network access records. User accounts which have not been used beyond say a 45 horizon should periodically be disabled, and as people join, leave or move roles within the organisation, access should be reviewed according to their profile. Limiting direct database access to queries such as SQL, SQVI can prevent workaround for access to private data that's not necessarily related to their traditional function. Exception based reporting for access outside of business or waking hours may attribute to risk based reporting, or access outside of geographical regions.

Employees of the organization must understand why and what they do. An enterprise resource management system is an excellent guide to processes. reducing the likelihood of violations of the security regime by employees is possible through initial briefing and subsequent operational monitoring of processes, and preventive measures to prevent the possibility of such violations. Monitoring mechanisms at workplaces are usually built into the software logging system, which, if properly configured, makes it possible to trace the chains of actions and identify violations, and therefore exclude their recurrence in the future.

Keeping software versions up-to-date is an important aspect in the work of IT departments, and an important element in the security system. Patches and updates to business management software should be reviewed and ideally tested on a test copy of a working system, both to ensure a smooth transition to an updated version and to mitigate potential risks of data corruption or security holes. The system for monitoring network activity, the system for managing mail messages and correspondence in instant messengers should take into account possible software connections with the outside world, and this should be the first thing to pay attention to when testing updates.

Major software vendors for ERP periodically release builds and patch systems for security flaws and feature updates. It is important that your application team is subscribed to vendor specific mailing lists and considers an iterative deployment schedule, say quarterly or every 6 months. Regression testing should occur for key business processes in a sandpit environment to test for customisations, and domain specific usage so that any impact can be assessed.

Unfortunately, we do not have universal tools, and even when creating systems from various ready-made solutions, we play black cubes, not being completely sure that everything inside is wonderful and safe. which means that we need to build mechanisms for analyzing logs or intercepting events into our system with the activation of verification mechanisms according to certain predetermined criteria and created algorithms. this is especially important when tracking virus introductions on the network. as the system is used, we need to improve it both through changes based on the results of identified incidents, and by adapting it to changing business processes and environmental conditions.

Although there is no single approach to monitoring security in ERP for system accessibility, Modules, master and transaction data, reporting and integrations. having a dedicated team to work with these tools help provide the required security measures. Another key silent and important security gap are integrations with other solutions, using admin roles or elevated access rights in the ERP system.

Get qualitative feedback from primary users of the system, and people that have joined the business in the last 6 months to ensure that their access roles is fit for purpose. Also keep ERP training logs as some business users have access to sensitive and far reaching data, and it's important that they are trained by an experienced person in case they make unintended changes with financial impact. Unusual activity including access to commercially sensitive information which is not inherent to their role can also be flagged. The functional leads within business areas can provide a fair assessment of this.

In addition to the ERP strategy, Security evaluation must be considered as criteria during ERP selection. Security and governance planning should be done prior to implementing the project. And finally, ensure you have an experienced ERP professional who know the solution well enough to guide during before, during and after the ERP project implementation.

God saves man who saves himself, our ancestors said, hinting that it is better to think before you do, and that listening to the experience of others, by passing it through yourself, is one of the best ways to protect yourself from potential threats. Besides, being always ready to respond quickly in the right direction with right tools is much better than being able to quickly mobilize resources.

Consider reporting systems, satellite systems and APIs which may connect to your core ERP or CRM system. There was a well publicised data breach in recent times with Optus having sensitive credential information and a lack of IP masking which led to the doxxing attack in Australia. Quite often, applications and reporting is developed rapidly, but there should be a review of security and access afterwards.