Data Security Concerns in Cloud-Based ERP Systems

The provided content discusses data security issues and concerns related to cloud-based Software-as-a-Service (SaaS) Enterprise Resource Planning (ERP) systems. The articles highlight the importance of securing ERP data and preventing theft, shoplifting, and unauthorized access to sensitive information. Various solutions are proposed, including radio frequency identification technology (RFID), image analysis of security cameras, and a SaaS service for shoplifting prevention. Formal security analysis is also conducted using Casper/FDR to evaluate the security properties of EAP Reauthentication Protocol (ERP). The articles emphasize the need for organizations to prioritize information security and implement effective measures to protect ERP data.

Article 1
Data security issues in cloud-based Software-as-
a-Service ERP
This paper discusses the data security issues and concerns that are prevalent when
organizations are moving their Enterprise Resource Planning (ERP) systems to the
cloud. Cloud computing has reinvented how organizations conduct business and has
enabled them to innovate and compete in a dynamic environment through new and
innovative business models. The growing popularity and success of the cloud has led to
the emergence of cloud-based Software-as-a-Service (SaaS) ERP systems, a new
alternative approach to traditional on-premise ERP systems. Cloud-based ERP has a
myriad of benefits for organizations. However, infrastructure engineers need to address
data security issues before moving their enterprise applications to the cloud. Cloud-
based ERP raises specific concerns about the confidentiality and integrity of the data
stored in the cloud. Such concerns that affect the adoption of cloud-based ERP are
based on the size of the organization. Small to medium enterprises (SMEs) gain the
maximum benefits from cloud-based ERP as many of the concerns around data security
are not relevant to them. On the contrary, larger organizations are more cautious in
moving their mission critical enterprise applications to the cloud. A hybrid solution where
organizations can choose to keep their sensitive applications on-premise while
leveraging the benefits of the cloud is proposed in this paper as an effective solution that
is gaining momentum and popularity for large organizations.
Article 2
Security, privacy and trust in cloud computing: A
comparative study
"Use the computer without a computer," this is the dream of all managers who believe in
"Cloud Computing". The Cloud has become a dream and an obsession for all fans of the
computer because of the many benefits this service offers: availability of services and
data is ensured, cost is relative to consumption, ease of deployment, technical
infrastructure is adaptable to the volume of business activity, its convenience to the
common business applications (CRM, HR, BI, ERP, mail, etc.), the fact that this service
provides a business function and not the technical components requiring computer
skills..., Besides these advantages, there are serious risks related to the use of Cloud
computing, such as: temporary or permanent loss of data, security of data, lack of
traceability and accountability... These risks are the main challenges faced while
adopting a Cloud computing architecture., In this paper, we studied the literature
focusing on three major notions on collaborative systems in Cloud computing: Security,
privacy and trust. That's why we will try to bring out the main requirements regarding
these three concepts from both points of view (user's and provider's), before presenting
some related approaches which treat these three concepts.

Article 3
Security Perspective in RAMI 4.0
Abstract:
Cloud Computing, Internet of Things (IoT) are the main technologies contributing to the
adoption of the fourth revolution in manufacturing, Industry 4.0 also known as smart
manufacturing or digital manufacturing. Smart manufacturing facilitates and accelerates
the process of manufacturing with the connection of all the systems related to the
manufacturing process starting with the Enterprise Resource Planning (ERP) systems,
the Industrial Control Systems (ICSs) which control the production line and the Cyber
Physical Systems (CPSs). Before the emerging of web applications, cloud applications
and thin clients, ICSs and CPSs were already present but the protocols used for those
systems were not designed for the Internet. In this paper, we tackle the security
challenges that are accompanied by the emerging of this new technology, the mitigation
techniques and the governance and compliance issues associated with it.
SECTION II.
RAMI 4.0
In 2015, the "Platform 4.0" developed the so-called Reference Architecture
Model for Industry 4.0 (RAMI 4.0). [1] RAMI 4.0 is a three-dimensional
layered model, the first axis is the architecture axis, which consists of six
unique levels: Assets, integration, communication, information, functional,
and business layers. Detailing the above levels with a bottom up approach,
the bottom layer is the "Asset" layer, which actually represents the physical
and non-physical layers. Each component or function of the upcoming layers
must be affiliated to an object of the asset layer. The "Integration" layer
consists of computerized interaction between the physical layer and the
users or software. It mainly falls underneath the umbrella of Information
Technology (IT).
Article 4
Ensuring the security of warehouse using
automatic identification by RFID
Abstract:
Every company and institution faces the necessity to manage its inventory. For high
accuracy, security and easy operation of inventory management system it is necessary
to have an easily recognizable identifier on all managed objects. The aim of our present
project is to modernize the methods of automatic inventory management and asset
protection with the help of the application of radio frequency identification technology

(RFID hereinafter) to automatically identify the occurrence of marked objects. During the
solutions we have to deal with many obstacles such as the bindings of data flowing from
RFID system with internal information systems of asset owner companies. Appropriate
choice of tags for individual subjects, their testing and readability experiments also have
to be done. Another important part of the solution, that has to be developed in the
project, is the system of reading gates. The gates are integrated in the door frames to
allow automated identification of the objects brought in and out of the selected room. By
modifying of mentioned solution we also introduce the design of a gatehouse that is able
to prevent theft or unauthorized take away of material and equipment. In contrast, when
the permitted items are taken away the system can easily generate the necessary forms
to manage status of selected objects, decreasing the administrative burden. The result
of the project is a solution consisting of information system and described hardware
components for inventory management. The information system is possible to integrate
with corporate ERP information systems. The pilot project was implemented and tested
at VřB laboratories and we suppose deployment of the system in close future in
cooperation with TINT Ltd. Company.
Article 5
Security camera movie and ERP data matching
system to prevent theft
Abstract:
In this paper, we propose a SaaS service which prevents shoplifting using image
analysis and ERP. In Japan, total damage of shoplifting reaches 450 billion yen. Based
on cloud and data analysis technology, we propose a shoplifting prevention service with
image analysis of security camera and ERP data check for small shops. We evaluated
movie analysis.
Article 6
Undertaking an ERP: Evaluating the Security of
Apex 5 Developed Software
Abstract:
Actually, information security is an increasing concern in organizations and enterprises,
higher even in financial platforms, where resides a big amount of sensible data. In this
paper, we contemplate the different techniques used in the pentesting performed into the
server that hosts the software and the ERP software, developed by Universidad del
Azuay, using APEX 5 as development platform, including the six penetration test stages:
I) conceptualization, stage that allows defining the scope of the tests to be performed. II)
Preparation of the laboratory, which defines some of the tools that we used to initiate
security tests. (III) Obtaining information, that refers to the stages of recognition and
scanning, in which possible objectives will be identified and then to explore in greater

depth some intrinsic characteristics that can be exploited. (IV) Analysis of the
vulnerabilities encountered in the previous stage. (V) Exploitation of those vulnerabilities
through the selection of appropriate tools to achieve this purpose. And vi) The post-
exploitation stage, where the destruction of evidence of attack, the conservation of the
connection and the accesses obtained to extract information are contemplated; tests
explained here were carried out within the facilities of the Universidad del Azuay,
considering the development environment in which the ERP project is currently located.
Article 7
Formal Security Analysis of EAP-ERP Using
Casper
Abstract:
Future wireless networks will exploit a variety of wireless technologies to provide
ubiquities connectivity to mobile devices in the form of cellular, Wireless Local Area
Networks, and femtocells. Inevitably, future wireless networks will be diverse in nature,
employing a number of different techniques to associate the hand held devices that are
deemed to use the network. Furthermore, mobile users seek for seamless connectivity,
while roaming in the midst of different networks. This requires the mobile device and the
wireless networks be capable of performing a vertical handover, when the mobile nodes
find themselves in the vicinity of a foreign network. Regardless of the technological
challenges in terms of security, data integrity and mutual authentication between
participating agents remain a significant concern in heterogeneous networks. This paper
explores these concerns by examining a number of solutions proposed for vertical
handover, and identifies EAP Reauthentication Protocol (ERP) as a technology-
independent flexible mechanism for a vertical handover. EAP-ERP satisfies the mobility
requirements of future hand held devices while promising the desired security futures. In
view of thoroughly exploring EAP-ERP, Casper/FDR has been used in this paper to
analyze its security properties under various conditions. The results indicate that despite
the initial perception, EAP-ERP lacks mutual authentication between agents, while the
integrity of keying material is adequately protected.