Journal:Moving ERP systems to the cloud: Data security issues

Full article title	Moving ERP systems to the cloud: Data security issues
Journal	Journal of Information Systems Engineering & Management
Author(s)	Saa, Pablo; Costales, Andrés Cueva; Moscoso-Zea, Oswaldo; Lujan-Mora, Sergio
Author affiliation(s)	Universidad Tecnológica Equinoccial, Yachay Public Company, University of Alicante
Primary contact	Email: psaa at ute dot edu dot ec
Year published	2017
Volume and issue	2(4)
Page(s)	21
DOI	10.20897/jisem.201721
ISSN	2468-4376
Distribution license	Creative Commons Attribution 4.0 International
Website	http://www.lectitopublishing.nl/Article/Detail/8972P1SA
Download	http://www.lectitopublishing.nl/download/8972P1SA (PDF)

Abstract

This paper brings to light data security issues and concerns for organizations by moving their enterprise resource planning (ERP) systems to the cloud. Cloud computing has become the new trend of how organizations conduct business and has enabled them to innovate and compete in a dynamic environment through new and innovative business models. The growing popularity and success of the cloud has led to the emergence of cloud-based software as a service (SaaS) ERP systems, a new alternative approach to traditional on-premise ERP systems. Cloud-based ERP has a myriad of benefits for organizations. However, infrastructure engineers need to address data security issues before moving their enterprise applications to the cloud. Cloud-based ERP raises specific concerns about the confidentiality and integrity of the data stored in the cloud. Such concerns that affect the adoption of cloud-based ERP are based on the size of the organization. Small to medium enterprises (SMEs) gain the maximum benefits from cloud-based ERP as many of the concerns around data security are not relevant to them. On the contrary, larger organizations are more cautious in moving their mission-critical enterprise applications to the cloud. A hybrid solution where organizations can choose to keep their sensitive applications on-premise while leveraging the benefits of the cloud is proposed in this paper as an effective solution that is gaining momentum and popularity for large organizations.

Keywords: ERP, cloud computing, cloud ERP, data security, confidentiality, integrity

Introduction

“The cloud” has been a buzzword in the last few years and has caused a revolution in the information and communication technologies (ICT) industry. As IBM states, “Cloud computing, often referred to as simply ‘the cloud,’ is the delivery of on-demand computing resources, everything from applications to data centers over the internet on a pay-for-use basis.” This new trend changes the way organizations deploy services, platforms, and infrastructure of information technologies (IT). The variety of applications and services offered by this new concept affect organizations and individuals who notice the benefits of cloud services in terms of efficiency, flexibility, and reduced investment effort, while technology companies and traditional operators see an opportunity to expand their businesses.

According to Gartner, cloud-based services can be defined as “massively scalable system capabilities delivered as a service to external users using internet technologies.” A study about cloud computing models describes that based on the completeness and abstraction levels of services delivered to the end user, there are three types of services offered through the cloud, namely infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS).

Cloud computing has marked a substantial change in how IT services are developed, implemented, updated, maintained, and paid for. The evolution from traditional service organizations to the emergence of full internet-based service providers, namely through the cloud, enables the provision of flexible, scalable, and economical services.

In an environment of global competition, there is growing recognition of the central role of IT in determining the overall success of organizations. The alignment of business objectives, strategic vision, and information technology, combined with strategic planning, could be seen as a key objective to seek efficiency in their operations. Enterprise resource planning (ERP) systems have played an important role in the integration of business functions within organizations to support the generation of products and services. In any modern organization, the term ERP refers to the software used to plan and manage the organization’s resources across all functional areas by integrating the information through those functions and beyond the boundaries of the organization.

In today’s highly competitive business landscape, the trend for organizations is to focus their resources and efforts on what they do best and leave the supportive services in the hands of more specialized third parties. The world’s economic model in IT today is moving from “buy and own” (on-premise) to a subscription-based, pay-per-use (cloud-based) model. The migration from traditional (on-premise) ERP to cloud-based ERP could help organizations to manage their costs efficiently and improve their operations. As such, deploying ERP software in a hosted or on-demand environment could support organizations to improve their business processes and remain competitive.

Cloud-based ERP provides organizations with the possibility to choose the provider that best suits their needs, eliminating inflexible traditional on-premise ERP solutions. However, Lenart argued that while there are many advantages to the use of ERP implemented in a SaaS model, there also are drawbacks, especially those related to security and integrity of the data stored in the cloud.

Hence, the research question explored in this paper is “what are the data security issues in cloud-based SaaS ERPs?”

The next section presents the methodology used in this study. Following that is a literature review done on cloud-based ERP, comparing the advantages of ERP when adopted as a pay-per-use model versus a traditional on-premise solution. After the literature review several findings are presented on cloud ERP, illustrating the adoption factors and benefits for small, medium, and large organizations. Finally, the paper concludes with recommendations for organizations to ensure the security of sensitive corporate information when adopting cloud-based ERP, as well as the conclusion.

Method

The research approach was based on an exploratory search to review the existing literature on SaaS cloud-based ERPs and their benefits. Additionally, several papers were studied to identify issues on data security, particularly confidentiality and integrity problems that organizations should be aware of before adopting cloud-based ERP solutions. More than 50 articles from 2008 to 2015 were found from several A and A* journals such as Journal of Information Systems, MIS quarterly, Journal of Innovation, Management and Technology, Journal of Systems and Information Technology, International Journal of Computer Applications, and Journal of Network and Computer Applications, among others. Searches were made using remarked academic databases and search engines for computer science and information systems fields: IEEE Xplore, Emerald, ACM Digital Library, Gartner Core Research, Science Direct, and Google Scholar. Furthermore, specific search terms included “cloud ERP,” “hybrid ERP,” “implementation of ERP,” “SaaS ERP,” “cloud computing,” and “data security issues.”

After reviewing all the articles and papers, key insights and findings were gathered and classified according to the size of organizations. Based on the findings, several recommendations and possible solutions are outlined in this paper.

Literature review

Cloud ERP

The success of cloud computing, combined with the increasing pressure on organizations to respond to unique customer needs in the increasingly competitive business environments of today, has given rise to the new subscription-based delivery model for ERP, also referred to as cloud-based ERP or SaaS ERP. This new model of ERP systems functions in the same way as a traditional on-premise ERP solution. The main difference is that the infrastructure (the software, as well as the hardware and network connection) adopts a pay-per-use model; in other words, ERP is delivered as a service. The ERP in a SaaS model is accessed over the internet, while the application and data is controlled by the cloud service provider and offered as a “ready-to-use” product to the end client for a monthly subscription fee.

Traditional ERP vs cloud ERP

A cloud-based ERP system uses the advantages of cloud computing to offer a new and more flexible approach to host and use ERP systems. A widespread shift from traditional ERP system architecture towards cloud-based SaaS ERP systems is ongoing. The advantages of cloud computing are for example easy usage and accessibility, virtualized resources, scalability, affordability, and availability, guaranteed through service level agreements (SLA). Cloud computing, and in particular SaaS technology, enables ERP systems to invert some of their typical weaknesses which are inflexibility, lack of scalability, and consummation of massive local resources (hardware, manpower, and financial expenditures) into advantages. Although significant concerns remain in the form of limited functionality, the potential loss of internal control, performance reliability, and security, cloud-based models continue to gain traction.

Figure 1 clearly shows the differences in operating costs, solution complexity, and implementation time of a traditional on-premise ERP system in comparison to cloud-based ERP systems.

Figure 1. ERP systems deployment models

In comparison to traditional ERPs, the advantages of cloud-based ERPs include:

• enabling smaller clients who are not able to set up a complete, complex ERP system on-premise to use ERP;
• saving infrastructure expenditures (no large up-front capital investment necessary), as well as software, maintenance, and updating costs;
• reducing the staff needed for support and maintenance;
• enabling faster implementation of a cloud-based ERP, with less effort needed due to its agile design; and
• offering better scalability (hardware/performance/user accounts can be increased quickly when needed but can also be easily reduced as well when resources are not needed anymore);
• enabling mobility (server in the cloud is always accessible, wherever the employee works).

Possible disadvantages include:

• organizational data is stored in the cloud and not on-premise;
• possible integrity and security issues due to loss of control over data storage and systems; and
• dependency on the cloud provider.

Data security issues in cloud ERP

As discussed in the previous sections, there is a clear tendency to move enterprise services and systems to the cloud. However, it is important for organizations that want to implement or use an ERP in the cloud (SaaS, PaaS or IaaS) to address the possible issues and risks of migration. Some of the main drawbacks in any cloud-based ERP are related to data security, performance, and availability. Dillon et al. have categorized security of data as the primary concern for organizations. Accordingly, this paper is focused on data security issues for cloud (SaaS) ERP.

Bishop states that computer security relies on the confidentiality, integrity, and availability of data. From that context, cloud computing and ERP systems directly influence the required level of security. For example, as mentioned in the previous sections, ERP systems manage organizational data for essential business operations. Therefore, it is crucial for organizations to ensure data confidentiality and integrity in a cloud environment.

Notes

This presentation is faithful to the original, with only a few minor changes to presentation. In some cases important information was missing from the references, and that information was added. The original article lists references alphabetically, but this version — by design — lists them in order of appearance.