ERP Security

Checking ERP Security

Security is a major consideration for most companies. And running checks on ERP (Enterprise Resource Planning) security is important to ensuring the proper upkeep of the system. Many firms use user-based controls for authorized users to log in with their secured username and password. And even with ERP and the constant flow of information between departments, you may be restricted to certain areas depending on your staff status and level of authorization. For example, if you work in purchasing, you might not automatically have access to the warehouse’s module or supply chain management.

Data encryption is utilized to limit a staff person’s ability to export database information, but there are also concerns about authorized personnel having access to unauthorized application modules in other units. So security concerns involve both internal as well as external threats. A hacker will try to break the system just for the fun of it, and an employee may attempt to see if he or she can manipulate the system.

Audit logs will of course track departmental usage and any changes in the system, but they may not reveal the type of transaction that took place. However, internal auditors can check the audit logs for any irregular activity that has occurred over a period of time. On the other hand, some ERP systems may not utilize audit logs. For those who do though, systems administrators can monitor audit reports and check for irregularities and when they might have taken place, such as time, date, location. But ERP security can only be as robust or as weak as a company feels is necessary.

Organizations have to be concerned about security precautions not just for fraud or illegal break-ins, but also for internal mistakes such as duplicate payments, which translates to over payments and a loss of revenue for funds that are not recovered. Companies also typically lose 3 percent to 6 percent of their annual revenue to fraud. And the fact remains that applications remain highly vulnerable to external security threats. Once an external hacker gets through and starts snooping around, it won’t be long before he seeks to discover how to get into the safe.

At the end of the day, ERP security efforts will depend to a great extent on management and their ERP service provider or vendor. Indeed, many companies desire a security component to go along with implementation of the system, as cost for securing the system are already very high.