In the rapidly evolving digital landscape of 2024, securing your ERP system against threats has become more critical than ever.
In a recent panel discussion we held with industry leaders in ERP and cybersecurity from ALLOut Security, Hoffman Corporation and Steltix, we tried to bring some light on the challenges and opportunities surrounding the protection of JD Edwards in 2024 and the upcoming years.
External Threats in 2024
As organizations navigate 2024 they may encounter some of the most common external threats nowadays.
These threats include an increase in AI-powered cyberattacks, phishing extending beyond emails, personalized phishing messages using AI tools like ChatGPT, and fraudulent schemes targeting direct payment systems.
It’s important to emphasize the different ways organizations run their JD Edwards system, whether in the cloud or on-prem. While some might think that having one scenario or the other is safer, the reality is that it is not so difficult to gain access to critical data in either of them, and it’s important to be vigilant across all setups.
Some internal risk factors may go unnoticed, like segregation of duties and access management. Being vigilant in these is also crucial to prevent fines and legal actions due to inadequate financial reporting controls.
Risk Planning Strategies
There is an increasing need in many companies for a balance between asset protection and fostering growth and innovation. And while this might seem like a complicated goal at first, there are ways to accomplish both.
Some of the suggestions range from taking the time to monitor and report, to advocating for regular security assessments to identify vulnerabilities and ensure compliance with the latest security measures.
Digital infrastructure also plays a key role in risk management. As new threats arise, continous updates are essential.
To develop a comprehensive risk management plan, organizations must address various aspects such as:
1. Comprehensive Monitoring and Reporting
Security risk assessments should cover internal and external threats, and target areas such as system access, regulatory compliance, and change controls. Determining the appropriate scope is essential to reduce costs by resolving vulnerabilities.
A task that should be done more often but sometimes goes unnoticed is to regularly check the system’s security to ensure nothing changes without authorization and everything functions properly.
Conducting audits to identify weaknesses and recommend improvements, ensuring compliance with the latest fixes, patches, and updates, and verifying correct user role setup are critical steps.
It is also important to document change requests to keep track of accountability, as well as monitor the system for unauthorized access.
2. Cyber Security Layers
Implementing multiple layers of cybersecurity addresses some of the most common security concerns. Here are some of the most common ones to take into account:
- Physical Security: Involves access control systems, Intrusion Detection System (IDS), security lighting, biometric identification, and GPS tracking.
- Network Security: Includes firewall, VPN, security gateway, and DDOS protection.
- Perimeter Security: Encompasses log management, threat hunting, pen testing, vulnerability scanning, and bug boundaries.
- Cloud Security: Addresses data encryption, identity and access management, security compliance, data loss prevention, incident response and forensics, and vendor security.
- Endpoint Security: Involves anti-virus, anti-malware, app whitelisting, and HIDC.
- Application Security: Encompasses threat modelling, design review, secure coding, and static analysis.
- Data Security: Involves encryption, data loss prevention, email security, cloud access security, and user behaviour analytics.
Contingency Measures for Incidents
While incidents can happen at any moment, having a comprehensive communication plan for both internal and external stakeholders is part of the upfront planning we can do.
If a system is breached, organizations must follow a structured process:
- Containment and Isolation: Isolate the compromised system from the network.
- Investigation: Determine the scope and nature of the breach.
- Forensics Analysis: Gather evidence to understand the attacker’s methods and motives.
- Remediation: Address vulnerabilities exploited by an attacker, involving patching software, updating systems, and closing security holes.
- Password Changes: Force all users to change passwords and enforce multi-factor authentication.
- Review Access Control: Tighten access controls and permissions.
- Security Software Updates: Keep security software up to date.
- Security Training and Awareness: Train employees on security best practices, including phishing.
- Data Backup and Recovery: Restore affected systems and data from clean backups.
- Patch Management: Ensure all systems are up to date.
- Intrusion Detection and Prevention: Implement measures to detect and prevent intrusions.
- Incident Response Plan: Develop and follow an incident response plan.
- External Communication: Notify stakeholders, customers, and law enforcement.
- Continuous Monitoring: Implement continuous monitoring to detect and mitigate future attacks.
- Post-Incident Review: Conduct a review to analyze the effectiveness of the response and areas for improvement.
- Regular Security Audits: Run regular audits and assessments to identify potential vulnerabilities.
After an incident, it is crucial to conduct a root cause analysis to understand incidents fully and improve cybersecurity measures.
“Security risk assessments should cover internal and external threats, and target areas such as system access, regulatory compliance, and change controls”
Integration of AI in ERP
While everyone is aware of the AI tools we have available, it’s important to remember that nothing comes for free.
Some companies are already thinking of integrating AI into their ERP systems, which is fantastic, but security measures should always be on top of the agenda, especially in such a new approach.
Linking AI into ERP systems might have potential risks associated with external AI interacting with sensitive data.
JD Edwards Security
Oracle’s efforts have been thorough with JD Edwards EnterpriseOne and its latest security features in Releases 23 and 24 such as an enhanced scheduler password encryption and AES-256 encryption.
The panel discussion provided valuable insights into securing JD Edwards ERP effectively. From understanding external threats to developing robust risk planning strategies and leveraging the latest security updates, organizations can proactively safeguard their ERP systems, ensuring a secure and resilient future.
