Enterprise Resource Planning Software Of The Cloud Information Technology Essay
Introduction
ERP on the Cloud is based on Enterprise Resource Planning software and the cloud computing platform, two technologies that have increased in popularity over the last few years. ERP refers to a business management system that comprises integrated sets of comprehensive software that can manage and integrate all the business functions within an organization (Shehab et al.). When implemented correctly, ERP is a high-cost investment but also offers high return as it enables companies to centralize their day-to-day operations in real time. Cloud computing technology enables convenient, on-demand network access to a shared pool of configurable computing resources that can be provisioned and released with minimal management effort or service provider interaction (Mell et al.).
There are three service models in cloud computing: Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). SaaS is capability provided to the consumer to use the software provider's applications running on a cloud infrastructure, with applications accessible from various client devices (Mell et al.). PaaS is capability provided to the consumer to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider (Mell et al.). IaaS is capability provided to the consumer to provision processing, storage, networks, and other fundamental computing resources in which the consumer is able to deploy and run arbitrary software (Mell et al.).
For the purposes of this paper, we will focus on a specific module of ERP running on a specific model in cloud computing. Due to the immense scope of ERP and cloud computing, it is nearly impossible for us to capture the entirety of ERP on all three models of cloud computing. Thus, we will analyze the SAP module on IaaS. SAP software stands for Systems, Applications, and Products in Data Processing. SAP delivers products and services that help accelerate innovation for businesses and shapes business software relating to supply chain management, customer relationship management, product life-cycle management, and supplier relationship management (SAP.com). We will specifically focus on SAP R/3, three-tier client-server architecture, covering an analysis of SAP R/3 on IaaS, its technology, cost factors, and policy/legal issues.
On the cloud computing side, we will focus on IaaS because SAP on IaaS has been an increasingly popular topic with emerging cost-benefit factors and other research information that can provide specific insight into the benefits/risks of implementing SAP on IaaS. Providers such as Amazon, Inc., provide IaaS for the consumer to run SAP software. Specifically, Amazon offers its own Elastic Compute Cloud (Amazon EC2), a web service that provides resizable computing capacity in the cloud. EC2 is a cloud service that the consumer can rent to run its own computer applications, such as SAP software and other ERP modules. Through our analysis of SAP on IaaS, we seek to provide beneficial and valid information on the advantages and disadvantages of SAP on IaaS, using Amazon as an example of a specific provider. Our ultimate goal is to offer an analysis and overview of SAP on IaaS and provide reasons to consumers for why this ERP module should be implemented on the Cloud.
SAP R/3 Technology
SAP R/3 Technology is based on client-server architecture. Client-server architecture provides a framework for technology that separates computers and application software into two categories - clients and servers - to better employ available computing resources and share data processing loads (BusinessDictionary.com). Client machines provide the interface and application processing, whereas the servers provide storage capacity, data crunching, and high-resolution graphics (BusinessDictionary.com). Client machines are connected through networks to servers, with each individual computer acting as a client.
Specifically, SAP R/3 is based on three-tier client-server architecture (Al-Mashari et. al, 156): Presentation Layer, Application Layer, and Database Layer. The Presentation Layer, which is the SAP Graphical User Interface (GUI), is the layer that provides data to end-users, with the necessary components such as windows and buttons, etc. (Al-Mashari et. al, 156). The Presentation Layer provides the interface between the R/3 System and the end-users, sending user inputs to the application servers and displaying the data that it receives (SAP). Thus, the user opens the SAP GUI, clicks on a specific application to use - for instance, Human Resources payroll information. The Presentation Layer updates data on the screen with data it receives from the Application and Database Layers. If the user changes payroll hourly rates for specific employees, the Presentation Layer passes this data to be stored in the Database Layer.
The Application Layer "consists of one or more application servers and a message server" (SAP). The application servers provide the set of services used to run the R/3 System while the message server is responsible for passing messages between the application servers (SAP). When the user logs onto the system, the message server is responsible for selecting the appropriate server to use because the message server contains information about the current loading balance within the R/3 System (SAP).
The Database Layer consists of a central database system that contains all the data in the R/3 System (SAP). The database system has two primary components, the database management system and the database (SAP). Specific administrators have access to the database management system and can update/edit data in the database as necessary. The R/3 System supports many database systems from other suppliers, including, but not limited to ADABAS D, DB2/Common Server, INFORMIX, Microsoft SQL Server, and ORACLE (SAP). It is important to take note that beyond data from business applications with data on Sales & Distribution and Human Resources, etc., the database also "contains the control and Customizing data" that determines how the R/3 System runs (SAP).
For component technologies, kernel and basis provide the runtime environment, including hardware, operating system, and database-specific components (SAP).
Running Application: R/3 applications run on software processers (virtual machines (SAP).
Users: The R/3 System provides a multi-user environment, with each user having the ability to run several independent applications (SAP).
Database Access: Each R/3 System is connected to a database system, consisting of a database management system and the database, as mentioned above. The application uses basis services to communicate with the database (SAP).
Communication: The R/3 System can communicate with other R/3 systems and with non-SAP systems (SAP). The services required for communication belong to the kernel and basis services components (SAP).
System Monitoring and Administration: Users can monitor and control the R/3 System as it is running and change its runtime parameters (SAP).
Cloud Computing Technology: Virtualization
A core enabling technology of cloud computing is the virtualization of servers. In a nutshell, server virtualization allows multiple operating systems to run simultaneously on the same physical machine without having direct access to the machine's hardware (Davis). "Hypervisor" software creates a virtual environment that runs on top of the physical machine's host operating system. In this virtual environment, multiple "virtual machines" can be created and used simultaneously, allowing the user to run various operating systems without having to use multiple physical machines or a multi-boot configuration on one machine (Yegulalp).
The hypervisor acts as an intermediary between the virtualized operating systems and the host operating system, which in turn acts as an intermediary between the hypervisor and the physical hardware. Manufacturers of processing chips have even implemented instruction sets for their chips that aid in the processor's interaction with hypervisor software (Yegulalp). The following figure graphically depicts this hierarchical relationship:
Source: Davis, David. "Server Virtualization, Network Virtualization & Storage Virtualization Explained."Â Petri IT Knowledgebase. 8 Jan. 2009. Web. 12 Nov. 2010. <http://www.petri.co.il/server-virtualization-network-virtualization-storage-virtualization.htm>.
Virtualization has numerous benefits. Virtual machines images, or "snapshots" of the virtualized operating system and its data, can be saved and exported to another system. This is helpful for "sandbox" testing and disaster recovery. Since virtualization allows multiple operating systems to run on one physical machine, it increases the utilization of the machine. Best practice dictates that every server should have one main function; one machine should not be responsible for serving web pages, hosting the payroll database, and monitoring network traffic. However, in a virtualized environment, it is more acceptable for one physical server to host multiple virtual machines and each serve a single purpose. Therefore, there is less waste in processing resources on the physical machine. Furthermore, if one of the virtual machines fails, it does not affect the other virtual machines running on the same host (Singh).
Cloud Computing Technology: Infrastructure as a Service
Infrastructure as a Service, or IaaS, is one of the three models of cloud computing, as mentioned above. Unlike the other two, IaaS strictly offers hardware with virtualized operating systems on top of which a consumer can design and run software. Major IaaS vendors include Amazon, GoGrid, and Joyent. PaaS vendors, like Windows Azure and Google AppEngine, also offers hardware with virtualized operating systems, but add a set of tools and APIs that customers can use to interface with those systems when designing their software (Kaldenbaugh). SaaS is a complete solution; with both hardware and software provided solely by the cloud provider. SaaS offers customers the least amount of customization, but saves them a significant amount of technical preparation that is required from using IaaS or PaaS. Salesforce.com is a very popular SaaS vendor, and its products are even beginning to compete with traditional ERP products (Dignan).
The core business model behind IaaS revolves around the idea of paying for computing resources as a utility; the consumer pays for the amount of resources used in a given period of time, and at any time the consumer can use more or less based on need. This can arguably be a more cost effective computing model than the traditional method of purchasing and maintaining one's own servers and network infrastructure. However, "elastic computing" technology had to be created in order for computing capacity to be instantly scalable and billable. While the technical details of resource provisioning vary from provider to provider, the broad concepts of the technology apply to most.
Earn money as a Freelance Writer!
We’re looking for qualified experts
As we are always expanding we are looking to grow our team of freelance writers. To find out more about writing with us then please check our freelance writing jobs page.
Freelance Writing Jobs
Resource provisioning is an extension of an IaaS provider's virtualization software, and revolves around modifying a virtual machine's proportion of access to the physical machine's hardware. Customers can purchase any number of "instances", or virtual machines, and define the estimated computing power required by each instance. Amazon Web Services allocates computing resources using their proprietary ECU (EC2 Compute Unit), which Amazon defines as the "equivalent CPU capacity of a 1.0-1.2 GHz 2007 Opteron or 2007 Xeon processor". Amazon customers are able to provision more or less ECUs per virtual machine using a web interface. Provisioning is also done automatically by the virtual machine based on current computing needs ("Amazon EC2 Instance Types").
Calculating the costs of computing resources on Amazon's cloud can actually be easier than pricing one's own data center, because pricing is based around three key elements: computing power, storage capacity, and network usage. This utility-based model is beneficial for both technical and financial scalability. Young or growing companies may have a very limited understanding of how quickly and how greatly their IT requirements will change over time. Since the cloud is "scalable", the risk of systems failing from usage bursts or capacity limitations is drastically reduced.
Conversely, if a company experiences periodic downturns in business and uses cloud computing, it is not obligated to maintain computing resources capable of greater demand. For example, a North American retail company that sells sunscreen and bathing suits probably has very different computing requirements in June than it does in November. A traditional data center would require the company to pay for the same number of computing resources (like servers and bandwidth) needed to support their peak sales season all year long. The cloud's utility pricing would allow the company to easily and safely scale down their IT resources at the end of summer and scale them back up again the following spring so that it wouldn't have to waste money paying for underutilized servers during the winter. With the trend of increasing corporate cost-consciousness, the cloud's scalability is a valuable proposition for IT managers.
SAP on Amazon EC2
What exactly would it look like if a consumer decided to install an ERP system on an IaaS provider's cloud? Would it be technically feasible in practice? Companies have actually begun to implement actual SAP systems in Amazon's cloud, so we will attempt to give a brief overview how the two technologies will interact together. Martin English, an SAP implementation consultant, published a detailed step-by-step example installation process in his article "Install SAP on Amazon Web Services". English notes that the advantages of installing SAP software on Amazon Web Services are numerous. Most importantly, he notes the inexpensive nature of Amazon's cloud in comparison to running one's own hosted hardware, as well as the time saved from not having to find, purchase, and configure complex server hardware before beginning the installation.
This provides demonstrable proof that installing SAP on Amazon's cloud is not only possible, but as English points out, something in which he has helped several of his clients. While his demonstration can take under an hour to install, the article claims that a secure, fully functioning installation of a basic ERP system is expected to take at least a few weeks. However, he does note that Amazon's powerful cloud infrastructure does help reduce the implementation time in comparison to a typical installation. Our description of a simple SAP environment on Amazon's cloud is a fundamental summarization of the concepts described by English, as well as other relevant sources.
After a company has created a formal account on Amazon's Web Services, which is the aggregate of Amazon's cloud services like EC2 and Simple Storage Service (S3), it can begin to define its hardware needs for the operating systems on which its SAP software will be running. The staff performing the installation will need to choose an appropriate server-grade operating system images, such as a compatible 64-bit version of Ubuntu Server or Windows Server 2008 operating system, as well as the Java Runtime Environment (JRE). To help reduce costs, it will be wise for the operating system to be Linux-based, since the pricing for Linux-based cloud instances is cheaper. Amazon's S3 (Simple Storage Service) system will be used to store the virtual machine's 'image'; it will act as the hard disk on which the configured operating system will be saved.
Using Amazon's Elastic Block Storage (EBS) service, the image can be configured with mounted virtual drives that act as persistent storage drives. These drives can be allocated anywhere from 1 GB to 1 TB, and up to twenty of them can be mounted to any given instance ("Elastic Block Storage"). This means that a single SAP server running on Amazon's EC2 could have upwards of 20 TB of persistent storage space, which is certainly enough space for most databases. Furthermore, EBS facilitates simple and effective full-drive backups.
Further configuration involves setting appropriate storage drive mappings, changing network and firewall settings as required by standard SAP installations, and configuring user accounts for administering the server. One thing of particular note would be compensating for having a server with a dynamic IP; since Amazon's virtual machine instances receive a new IP address each time they are restarted, the company will need to register a dynamic domain name for the server. This allows for the instance to constantly associate itself with the same domain name, regardless of what its IP is. Once these configurations are done, the SAP software can be installed as it normally would on a physical machine in a company's data center.
The client configuration is the most trivial. The SAP GUI client is installed just as usual on the user's workstation. The only configuration necessary is specifying the dynamic domain name of the SAP server.
This architecture is obviously a simple, demonstration-level scenario, but shows the fundamental concepts revolving around SAP's installation on an IaaS cloud provider like Amazon. Installing a functioning, operation-level SAP system on Amazon Web Services will inevitably be a long and complicated process, but not terribly different than installing it in an in-house data center. And as English points out, implementation time and cost can be dramatically reduced when performing a cloud installation.
Cost Analysis
There are enormous costs involved in implementing and maintaining ERP software in-house and a typical implementation in a company can take up to several years. Companies need to undergo many changes in their operations and business processes in order to extract maximum value from ERP. The different costs incurred by the company for in-house ERP are described briefly below:
ERP Licensing: The cost of purchasing ERP software is huge. It could run into millions of dollars based on the size of the organization and the number of technical modules of ERP such as Finance, Sales & Distribution, HR, etc.
Implementation: The cost of implementing ERP in a company runs 1 to 5 times the cost of the license. Generally, the company hires an outside consulting firm to carry out the implementation. Also, the time taken for implementing ERP takes 1 to 3 years depending on the size of the organization. If the implementation is in-house, business is affected during the implementation period. This is primarily because virtually every person in the company is involved in the process whether or not he/she is a technical or end user. Thus, ERP implementation costs not only money but valuable time as well.
Computing Infrastructure: The cost of computing infrastructure includes server and storage costs. The amount of investment made in the data centers and the user desktops to accommodate ERP software.
Network: These costs include the investments made in the network resources such as LAN, switch ports (both the number and speed required), wireless LAN infrastructure capacity, WAN router ports and sizes, and WAN service bandwidth.
IT Personnel: Companies incur costs in IT personnel to carry out the installation and configuration of ERP software. This cost depends on the scale of ERP implementation, which further depends on the size and complexity of the business processes of the organization.
Training: Companies often underestimate training costs. Training does not include just the technical training of employees on the interface and tools of ERP; it also includes the training of new business processes that the companies set up in order to effectively utilize the ERP software.
Upgrades and Fixes: This includes the costs of purchasing the license of the new upgrade and cost of hiring a third party consultant to carry out such upgrades and fixes.
Maintenance: This is a recurring cost as companies need to maintain their ERP software. This includes the cost of maintaining computing infrastructure and IT personnel. Generally, maintenance costs can be as high as 15% of the purchase price. This lets us take into consideration the Total Cost of Ownership (TCO) of ERP software. A study of TCO of ERP was conducted by Meta Group in 2002 and the study accounted for hardware, software, professional services, and internal staff costs. Costs included initial installation and the two-year period that followed, which is when the real costs of maintenance, upgrades, and optimizations incur. A total of 63 companies were surveyed, including small, medium, and large companies n a range industries. Overall, the average TCO was $15 million (highest was $300 million and lowest was $400,000).
These costs can be drastically reduced if the ERP is moved onto the cloud. Companies can cut costs in significant areas such as Computing Infrastructure, IT Personnel, and Maintenance. More importantly, companies can concentrate on their business by leaving the IT operations to the provider and instead focus on the more important business process changes induced by ERP.
In the IaaS cloud delivery option, the ERP software is licensed and owned by the company (consumer). The licensed software (SAP) is hosted by a third party provider (Amazon) on a separate piece of infrastructure/hardware that is dedicated to the company or on infrastructure/hardware shared by multiple companies. Below is a chart depicting the three options of cloud computing:
Figure 1 - Cloud Delivery Options (http://erpcloudnews.com/2010/05/different-types-of-cloud-erp/)3
In this paper, we will focus on the cost/benefit analysis of IaaS, and specifically for SAP on Amazon EC2 platform. When ERP is hosted on the cloud, the capital cost of the company is virtually zero as it need not invest in the infrastructure. The incremental expense of launching applications is low and is much more convenient than the in-house ERP in which case companies need to purchase additional infrastructure to run software. IaaS enables companies to scale the infrastructure at a low cost. No costs in incurred in running and maintaining the system. Also, procurement of additional infrastructure requires planning, budgeting, and additional IT resources. Thus, companies can cut significant costs and concentrate on their business as the Cloud provider manages the infrastructure needs and requirements.
Hardware Utilization with System Landscapes - SAP in-house
Utilization < 10%
As indicated in the above figure, most the small and mid-size companies end up wasting Computing Infrastructure resources when they implement SAP in-house . If companies host SAP on the cloud infrastructure (eg: Amazon EC2), they pay only for the infrastructure that they use in contrast to in-house implementation where they bear the costs for the entire infrastructure in terms of initial investment and maintenance. This is one of the major factors that creates appeal for IaaS model.
Amazon Cloud EC2 Hosting Costs: The graph given below indicates the costs of hosting SAP on Amazon's cloud infrastructure as opposed to hosting SAP in-house. It clearly indicates how much companies can save on computing infrastructure if they host ERPs on Amazon EC2.
Source - SAP-Cloud Computing @ SAP
For this analysis we will focus on the pricing that Amazon offers. Amazon has different payment types with different rates to match the needs of their customers. We will talk about the two main options. The first type of payment offered is the "On-Demand Instances." This pricing schema allows the customers to pay for the capacity used by the hour without long-term commitments. The details of these prices are shown below. Prices may vary depending on the location.
5Amazon.com Pricing
The data transfer fees are as followed.
Amazon.com Pricing
Below we will show a business case analysis done comparing two scenarios. The first hosts ERP in-house and the second one hosts ERP on IaaS. This model has many assumptions (e.g. personnel salaries) but it will show where the main cost reductions can be achieved by having ERP on IaaS. We will assume that the cost related to the ERP software will be part of the On-premises group (Figure 2). Additionally for the bandwidth fee we will use the one offered by Amazon (for 600 TB a year => $ 0.11 per GB).
By using these variables the cost analysis goes as followed:
Through this cost analysis, we can see that implementing SAP on IaaS will lead to significant cost savings over implementing SAP in-house.
Security:
ERP systems changed the way in which system administrators had to approach security, because while it may be easier to consolidate user authentication among systems, consolidating systems can increase the risk of data leakage and exfiltration. In the article, "Security in an ERP World", Van Holsbeck and Johnson claim that ERP systems merely increase the motivation for digital criminals to attack a company's systems, because the larger the system, the larger the potential gain. They make particular note for the increased threat of insider fraud and exploitation. Only half of the organizations that do utilize ERP systems actually configure them to sufficiently log activities due to the extra resources required for logging (Source?). So in essence, if not properly addressed, an organization's security can actually degrade with the implementation of ERP systems.
The fact that 3 to 6 percent of a business's revenues are stolen on average due to fraud, coupled with an average additional .2% overpayment on accounts payable, shows that information system integration in an ERP setting has the potential to help account for company funds if implemented correctly (Source?). Conversely, a poor ERP implementation could help to lose even more funds (Van Holsbeck et. al). Many ERP systems are implemented in a way that directly or indirectly connects them to the Internet, and if proper security rules are not put into place that account for Internet access, data exfiltration has a much higher chance of occurring.
Just as with ERP, one of the greatest obstacles in the adoption of Cloud Computing is ensuring the security of data and managing the risk inherent with the technology. Since Cloud Computing requires an organization to transfer information over the Internet and store it on a vendor's infrastructure, the organization must modify its approach to managing security to ensure the confidentiality, integrity, and availability of the information. It is debatable as to what extent working "in the cloud" changes an organizations' risk of a security breach. While some could argue that information security can be managed better by a Cloud Computing provider with a dedicated team of security professionals and uniform security package management, others may argue that the risk is inherently greater with any technology that includes the Internet and a third party as critical parts of an information system.
There are currently numerous IaaS (Infrastructure as a Service) cloud providers, such as Amazon Web Services, Rackspace, Terremark, GoGrid, and Joyent, each with their own proprietary infrastructure architecture. Furthermore, each vendor's infrastructure could approach security in different ways, so an ERP system's implementation on Amazon Web Services could have different security vulnerabilities to address than if it were implemented on Joyent's servers.
Therefore, implementing ERP in a Cloud Computing setting improperly could have severe implications for the security of an organizations' data. How does an organization combine two technologies with inherent security issues and mitigate those issues to an acceptable level of risk? Furthermore, what if the security issues of each technology, when combined, compound to create an even greater risk? Bruce Schneier, a renowned expert and author on computer security, has said that "complexity is the worst enemy of security," so it seems intuitive that putting ERP services into "the cloud" would have serious security faults. However, there are tangible ways that organizations can mitigate risks inherent with ERP in the cloud to better determine if the concept is feasible from a risk management perspective. When considering SAP on the cloud, there are three specific sides of the system that must be secured. These three sides are the server-side security, the client-side security, and the cloud-side security.
Server-side Security: As is summarized in the whitepaper created by the SAP Community Network on SAP Netweaver Identity Management, the vendor has done an extensive amount of work to ensure that its software can be secured properly. Two of the most fundamental issues of security are authentication and access control. SAP has created a proprietary identity management system called SAP Netweaver Identity Management. This management system is a comprehensive set of tools to ensure that the users accessing the system are authorized to do so in the manner specified by the company's policy.
Authorization, authentication, and access controls (and consequently logging) are a critical part of security for any complex information system, especially when put into the cloud. Since the cloud is inherently more exposed to the Internet, it would be much easier for an attacker with a compromised username and password to start accessing the system. Depending on the level of privilege of the compromised account, the attacker could modify files or change configuration settings within the system and create enormous amounts of damage.
Cloud-side security: The risk inherent with the cloud's exposure to the Internet means that the cloud provider must be extra vigilant. Amazon outlines its security measures in the whitepaper titled "Amazon Web Services: Overview of Security Processes."
Not only does Amazon utilize software and hardware tools to autonomously monitor its data centers, it employs an incident response team that works every minute of every day to detect and respond to incident. Typically, an ERP system hosted on a company's own data center affords the company a much higher amount of control; the company can monitor the traffic flowing through its network, implement custom routing decisions, employ packet-filtering firewalls, and implement IDS (Intrusion Detection Systems). With a cloud provider, such as Amazon EC2, the company does not have access to the physical network that its system is running on. The act of properly architecting its network and implementing both software and hardware controls like firewalls, IDS, and a DMZ is sometimes lost depending on the level of service purchased by the client company. The client company can take advantage of the Amazon Virtual Private Cloud service, which enables it to link its existing network and infrastructure to its Amazon-hosted servers via a VPN connection. With this kind of architecture, a company can choose to manage its Amazon EC2 virtual servers with its own IDS, firewalls, proxy servers, etc. ("Overview of Security Processes" 12). Either way, the cloud provider must assume the responsibility of tending to network security issues to an extent; if a company opts into the Amazon Virtual Private Cloud, Amazon must still manage the VPN and physical connections, and if not, then Amazon is responsible for managing all of the typical functions of network security.
Regardless of the network's architecture, the cloud providers are solely responsible for the integrity of the hardware being used to host a company's ERP system. The provider must anticipate and account for hardware failure, specifically in regards to data storage. Amazon and many other cloud providers implement redundant systems in the case of storage failure. Depending on the level of service purchased by the consuming company, Amazon offers up to 99.999999999% storage reliability, which is much higher than what most companies are able to afford to implement in their own data centers ("Overview of Security Processes" 16). Furthermore, when this hardware is decommissioned, it is erased according Department of Defense and NIST standards. In regards to mitigating the risk of storage hardware failure, the advantages of hosting an ERP system in the cloud are enormously apparent.
Client-side security: Users connecting to an ERP system in the cloud perhaps pose the greatest security risk. If a user does not protect his or her account authentication information, either through storing it in an insecure place or choosing poor passwords, they could make it trivial for an attacker to gain access to the system using their compromised account. The user's workstation must be properly secured in obvious ways, such as having up-to-date security patches and virus definitions. However, the user should also utilize encrypted connections when accessing the ERP system. By default, SAP clients talk to SAP servers without using encryption; something that would be especially unwise if these clients were talking to SAP servers over the public Internet (Woitass 5).
Luckily, cloud providers like Amazon usually encourage SSL connections when users connect to their virtual machines, so even if an SAP client did not encrypt its communications, data would not necessarily be sent "in the clear" over the Internet ("Overview of Security Processes" 15). However, best practice would suggest that it's best to still utilize SAP's encryption under Amazon's SSL connection. SAP allows for SSL connections, but also provides the proprietary application-layer SNC protocol. The SNC protocol is considered to be secure and is recommended by SAP for system communications from clients to servers (Woitass 25).
Initially, we believed that our research would show us inherent gaps in the security of ERP on the cloud. However, our initial analysis shows that the security of an ERP system may not be at any higher risk of being compromised by residing in a cloud provider's data center than in a company's own data center. Major cloud providers like Amazon have put substantial measures in place to ensure the security of their customer's systems, because their reputation depends on it. If a cloud provider cannot guarantee a high-level of security, it will almost certainly fail. In fact, companies may even improve the security of their data by moving to a cloud provider if their current security measures are not up to standard due to lack of funding or adequate personnel. Many security tools and measures can be costly, so smaller businesses may especially benefit from utilizing the cloud.
That being said, it should be stated once again that entrusting information with a third party would always pose inherent security risks. An organization must seriously consider the confidentiality and importance of its information before ever entrusting it with another organization.
Policies/Risks
In implementing SAP on the Cloud, it is important to evaluate the risks and policies that the company should follow. By considering the factors listed below, the company can plan ahead to implement the most optimal policies to work closely with the vendor to develop the most suitable cloud computing infrastructure system.
Data Privacy: This is a critical issue for the company to closely evaluate when implementing SAP on the Cloud. As opposed to implementing SAP internally, SAP on the Cloud dictates that functional modules such as Financials and Controlling, Human Resources, Sales & Distribution, etc., will be kept on external storage servers, with the data stored and processed remotely (Pearson, 45).
Privacy is a very important issue because it has a legal entity as well as a trust component. For example, the Family Educational Rights and Privacy Act (FERPA), a Federal law that protects the privacy of student education records, means that certain data regarding students and educational records can only be outsourced to a vendor that is willing to accept designation, as "legitimate educational interests" in the data (McDonald). Otherwise, this data cannot be outsourced to the vendor, since it would be a violation of Federal law, which is a serious breach that can have major consequences.
In terms of trust, a breach of data privacy would cause many stakeholders to lose trust in the company, the cloud computing infrastructure, and the vendor. For instance, if Human Resources data was breached and hackers obtained personal information such as Social Security numbers, home addresses, direct deposit bank account numbers, etc., not only would the individuals affected lose trust in the cloud computing system, but the Board of Directors, shareholders, the company's customers, and even the vendor's customers would lose trust in the system. Once that trust is lost, it is very difficult to gain back.
Based on Siani Pearson's analysis, there are specific key requirements needed in the system to mitigate the loss of privacy, which include (Pearson, 46-47):
Transparency - Vendor must notify company of any changes/updates to the data; vendor must also notify company if any data will be passed on to a third party.
Control - In terms of control, the company should have full access to the data and full control of the information, with little or minimal control on the vendor's side; since the company best knows and understands its own data, it should be mostly responsible for the data use; the vendor's primary purpose is to provide the infrastructure for the data
Scope - Only the necessary information needs to be stored on the vendor's servers.
Access - Company employees should be able to safely and securely access information regarding the modules of SAP.
Compliance - Transactions should comply with legislation.
Limiting use - Access needs to be balanced with limited use; only employees with the proper access rights can access specific data.
Accountability - Someone either in the company or on the vendor's side needs to be responsible for ensuring that privacy policies are followed.
Following these key requirements, the system should address the issues of the legal entity and trust component. As long as both the company and vendor take privacy into serious consideration, both can do their best to mitigate breaches in privacy.
Malicious Activity: In terms of malicious activity, the company and vendor need to be very careful in this domain, especially since the rate of malicious attacks is on the rise. Based on research from Paul Archer et. al at Cloud Security Alliance, Infrastructure as a Service (IaaS), which the company will use to implement SAP on the Cloud, is prone to several different types of attacks:
Because IaaS will often offer the company the illusion of "unlimited compute, network, and storage capacity," criminals have been able to abuse the relative anonymity behind the usage models (Archer et. al, 8). Abuse of the cloud computing network must be closely guarded against, and this requires that the company and vendor work closely together to implement preventative measures. Please see the Security section for more information on how this works.
When company employees access SAP information such as Financials and Controlling, they can only do so through a user interface. Thus, the interface itself must protect against accidental and malicious attempts (Archer et. al, 9). For example, the interface must gracefully handle exceptions and error catching, whilst providing employees a flexible and easy-to-use process.
There "is often little or no visibility into the hiring standards and practices for cloud employees" (Archer et. al, 10). Thus, it is difficult to gauge the security of selecting one vendor over the others. This, unfortunately, is outside the company's control. However, the company can closely screen vendors before selecting one, and also base its decision on the vendor's reputation and past record of integrity and honesty.
The IaaS vendor delivers its services in a scalable way by sharing infrastructure (Archer et. al, 11). Since the underlying hardware was not designed to offer strong isolation properties between multiple customers, there is a chance that the company may be able to access another company's data, or fix risk of having its own data accessed. Thus, it is very important for the company to realize this issue and work closely with the vendor to ensure that its data is closely protected and only accessible by its own employees.
Data loss or leakage is another critical concern since there are many ways to compromise data (Archer et. al, 12). The company and vendor must collaborate to ensure that the chance of this happening is decreased to as small as possible.
By considering these types of attacks, the company and vendor can be prepared well ahead of time for malicious activities by criminals and other hackers. They can implement policies within their separate organizations and in their contracts to come up with the best strategies for mitigation.
Ownership of Data: For policy regarding the ownership of data, the company needs to establish with the vendor that all SAP data regarding Human Resources, Sales & Distribution, etc., all belong to the company and that the "vendor acquires no rights or licenses…including…intellectual property rights or licenses, to use the data for its own purposes by virtue of the transaction" (McDonald). For example, the vendor cannot perform a transaction on the SAP data and then extract a component for its own use - this goes against the ownership of data principle.
Location of Data: Location that the data is kept is very important to the cloud computing system. Since some vendors reserve the right to store customer data in any country in which they do business, since it may beneficial from a data protection and backup perspective (McDonald). However, it may raise export control issues in the context of research data (McDonald).
Besides the remote storing and processing of data, most people lose sight that the location of data centers is important for other reasons. Apparently, if the data centers are situated in a location prone to natural disasters or other types of damage, there is high risk that the company may lose data. In order to mitigate this risk, it is necessary for the company to set policies on finding a vendor with data centers in less risky locations (McDonald).
Moreover, the locations of the data centers may have significant impact on the performance of applications delivered. Suppose company employees need to quickly access SAP data in order to perform their daily functions, if the IaaS performs poorly, this will lead to a disruption of work flow and waste time and resources. In addition, if the data servers are located in India instead of the United States, company employees working on the domestic domain may also be adversely impacted due to the time it takes to retrieve the data from India. Thus, it is important for the company to take this into account when selecting a vendor and working out issues based on location of data centers.
Legal jurisdiction is also an important issue related to the location of data centers (McDonald). Jurisdiction is an important issue when a legal dispute arrives. In order to avoid the dispute, the company should clearly state jurisdiction provisions in the contract with the vendor. There are typically three options - 1) Specify the law and jurisdiction of the company's own state and 2) Provide that disputes should be brought in the defendant's jurisdiction, which is impartial and 3) Simply delete the jurisdiction provision from the contract and leave this question for when the situation arises (McDonald).
In conclusion, it is important for the company to carefully consider the location in which data will be kept, because this could have positive or adverse effects on processing. Ultimately, it is important for the company to set standards and policies with vendors to overcome this barrier, and to consider jurisdiction when evaluating location of data centers.
Automatic Renewal: Vendors typically renew contracts automatically for the company unless the latter gives specific prior notice (McDonald). However, changes may have occurred, either within the company, or within the vendor's organization, so that the company should closely reexamine the contract and decide if changes need to be documented in order to better suit its business needs and the needs of its employees. Thus, before the contract renewal date, the vendor, or company, has responsibility to contact the other party to change the terms of the contract or renegotiate as necessary.