Log In
E-mail or User ID
  Keep me signed in
Recover Password
Create an Account

Maintaining ERP Security

By Rick Cook


Your ERP system is a critical part of your business, so naturally you want it to be as secure as possible from intruders, criminals, spies and other assorted bad guys.


Unfortunately this is easier said than done. While ERP systems have some unique, or nearly unique, vulnerabilities, the most basic problem comes from the nature of the ERP edifice.


Remember when you're talking about ERP security you're not just talking about the security of the ERP software. You also have to be concerned about the underlying operating system, storage systems, etc., not to mention the users that are running on top of the ERP system. If any one of these areas is not secure, the entire stack is insecure.


What that means in practical terms is you have to work to keep the whole edifice secure. That requires understanding potential security holes and how to fix them.


One of the most elementary things you can do is apply patches and fixes to all that software as soon as it becomes available.


It's easy to get so caught up in maintaining the ERP software that you ignore what's below that. But for security everything, from the hardware up, needs to be patched as the fixes become available.


Software vendors, particularly of applications like ERP and operating systems, will strive to keep you informed of changes and updates. Some of them, like Microsoft Windows, will automatically upgrade your system, if you will let them.


While this is convenient, it isn't an unmixed blessing. The software modifications may interfere with the operation of the other parts of the system, and you may find you have to back out of the latest patches to get a stable version.


What's important here is that security patches be applied immediately. Most of the time those patches represent a recently discovered vulnerability that the  bad guys already know about. They're sure to be out there trying exploits built around the vulnerabilities and if you don't patch immediately it's the luck of the draw whether you get hit before the patches go on.


Another common security vulnerability is the passwords that your employees use. Passwords are a pain, but they are a vitally necessary pain. They need to be applied, checked for strength, and changed regularly.


Passwords should be changed once every three months at a minimum and should represent a strong combination of numbers and letters. It's also important that the passwords not be easy to figure out.


Note that's “figure out”, not “guess”. One of the most common tools of the hacker is a dictionary of hundreds of thousands of names, dates, addresses, words, phrases and such that experience has shown are likely to be used for passwords. The bad guys don't have to guess that your dog's name is Fido, they simply run a list including common pet names and they'll find it – usually in a matter of minutes.


For this reason it's important to avoid names and common number strings, like birthdays or addresses, as passwords.


You can expect a certain amount of grumbling from your employees if you enforce password security diligently, which you need to do. Point out that the work involved in changing passwords to something hard to guess is a lot less than the work required to clean up after a break-in.


Another important part of password security is to make sure that all the default passwords are changed throughout the system. Default passwords are pre-installed passwords used by hardware makers and software vendors to help set up the system. These are usually things like “password” and are not designed to provide any level of security at all. They need to be changed before your system goes live.

Sadly, they all to often are not changed for secure passwords and represent one of the most common vulnerabilities.


Each piece of your system, from your disk arrays, through your servers, and up to your software, will come with documentation that includes, or should include, a section on security. Study those pages and make sure to follow the recommendations.


These steps aren't difficult and they aren't particularly burdensome to perform, but for the safety of your system, you need to make sure they are performed.

Comment on this article

Leave a Comment

Connect to this blog to be notified of new entries.
You are not logged in.
Sign In to post unmoderated comments.
Join the community to create your free profile today.
Keyword Tags:  ERP   Rick Cook   Security

Receive the latest blog posts:
Share Your Perspective

PCMag Digital Group AdChoices

TRUSTe Privacy Certification