Moving ERP Systems to the Cloud - Data Security Issues

This paper brings to light data security issues and concerns for organizations by moving their Enterprise Resource Planning (ERP) systems to the cloud. Cloud computing has become the new trend of how organizations conduct business and has enabled them to innovate and compete in a dynamic environment through new and innovative business models. The growing popularity and success of the cloud has led to the emergence of cloud-based Software-as-a-Service (SaaS) ERP systems, a new alternative approach to traditional on-premise ERP systems. Cloud-based ERP has a myriad of benefits for organizations. However, infrastructure engineers need to address data security issues before moving their enterprise applications to the cloud. Cloud-based ERP raises specific concerns about the confidentiality and integrity of the data stored in the cloud. Such concerns that affect the adoption of cloud-based ERP are based on the size of the organization. Small to medium enterprises (SMEs) gain the maximum benefits from cloud-based ERP as many of the concerns around data security are not relevant to them. On the contrary, larger organizations are more cautious in moving their mission critical enterprise applications to the cloud. A hybrid solution where organizations can choose to keep their sensitive applications on-premise while leveraging the benefits of the cloud is proposed in this paper as an effective solution that is gaining momentum and popularity for large organizations.


INTRODUCTION
Nowadays, "the cloud" has been a buzzword in the last few years and has caused a revolution in the Information and Communication Technologies (ICT) industry.As IBM states "Cloud computing, often referred to as simply 'the cloud,' is the delivery of on-demand computing resources, everything from applications to data centers over the Internet on a pay-for-use basis" (IBM, 2015).This new trend changes the way organizations deploy services, platforms and infrastructure of Information Technologies (IT).The variety of applications and services offered by this new concept affect on one hand organizations and individuals who notice the benefits of cloud services in terms of efficiency, flexibility and reduced investment effort while on the other hand, technology companies and traditional operators see an opportunity to expand their businesses (Lin and Chen, 2012).
According to Gartner, cloud-based services can be defined as "massively scalable system capabilities delivered as a service to external users using Internet technologies" (Gartner, 2015).A study about cloud computing models describes that based on the completeness and abstraction levels of services delivered to the end user, there are infrastructure (software as well as hardware and network connection) adopts a pay-per-use model or in other words, ERP is delivered as a service (Johansson, et al., 2014).The ERP in a SaaS model is accessed over the Internet while the application and data is controlled by the cloud service provider and offered as a "ready-to-use" product to the end client for a monthly subscription fee (Johansson and Ruivo, 2013).

Traditional ERP vs Cloud ERP
A cloud-based ERP system uses the advantages of cloud computing to offer a new and more flexible approach to host and use ERP systems.A widespread shift from traditional ERP system architecture towards cloud-based SaaS ERP systems is ongoing (Lenart, 2011).The advantages of cloud computing are for example easy usage and accessibility, virtualized resources, scalability, affordability and availability, guaranteed through service level agreements (SLA) (Vaquero et al., 2008).Cloud computing, and in particular the SaaS technology, enables ERP systems to invert some of their typical weaknesses which are inflexibility, no scalability and consummation of massive local resources (hardware, man power as well as financial expenditures) into advantages.Although, significant concerns remain: limited functionality, the potential loss of internal control, performance reliability, and security among them, cloud-based models continue to gain traction (Utzig et al., 2013).
Figure 1 shows a clear understanding about the differences on operating costs, solution complexity, and implementation time of a traditional on-premise ERP system in comparison to cloud-based ERP systems.
The advantages of cloud-based ERPs in comparison to traditional ERPs (Johansson and Ruivo, 2013) are:  Enables smaller clients who are not able to setup a complete, complex ERP system on-premise to use ERP. Saves infrastructure expenditures (no large upfront capital investment necessary), software, maintenance and updating costs (Elragal and Kommos, 2012). Reduces the staff needed for support and maintenance. Enables faster implementation of a cloud-based ERP with less effort needed due to their agile design (Elragal and Kommos, 2012). Offers better scalability (hardware/performance/user accounts can be increased quickly when needed but can also be easily reduced as well when resources are not needed anymore). Enables mobility (It does not matter where the employees work, the server in the cloud is always accessible).In the other hand, there are possible disadvantages as:  Organizational data is stored in the cloud and not on-premise. Possible integrity and security issues due to loss of control over data storage and system. Dependency on the cloud provider.

Data Security Issues in Cloud ERP
As discussed in the previous sections, there is a clear tendency to move enterprise services and systems to the cloud.However, it is important for organizations that want to implement or use an ERP in the cloud (SaaS, PaaS or IaaS) that they address the possible issues and risks of migration.Some of the main drawbacks in any cloudbased ERP are related to data security, performance and availability (Dillon et al., 2010).Dillon et al. (2010) have  (Utzig et al., 2013) categorized security of data as the primary concern for organizations.Accordingly, this paper is focused on data security issues for cloud (SaaS) ERP.Bishop (2005) states that computer security relies on the confidentiality, integrity and availability of data.From that context, cloud computing and ERP systems directly influence the required level of security.For example, as mentioned in the previous sections, ERP systems manage organizational data for essential business operations.Therefore, it is crucial for organizations to ensure data confidentiality and integrity in a cloud environment.

Confidentiality
Weng and Hung (2014) explain that when organizations adopt cloud-based ERP systems, they should be prepared to mitigate the risks around cloud technologies and prevent unauthorized usage of data.In addition, Johansson (2015) discover that organizations might feel insecure storing their data at external providers without having a direct control over the data.Another problem that might affect the confidentially of data is the lack of control over the staff from the cloud provider, who could access and retrieve data for dishonest or even criminal activities.For instance, Hashizume et al. (2013) argues that providers might not perform detailed background checks on their staff which has unlimited access to the cloud data.Consequently, the key challenges to adopting cloud-based ERP are: 1) Uncertainty around data storage arrangements In the SaaS model the client does not have any control over the IT infrastructure (Kumar et al., 2012).Moreover, Puthal et al. (2015) mention that the same provider often hosts data from several clients in the same data center.This type of hosting increases the risk of data leakage or corporate espionage.On the contrary, with on-premise ERP systems, organizations have absolute control over their data and infrastructure.Consequently, the way in which providers ensure the security and confidentiality of the client's data is one of the key challenges in the implementation of cloud-based ERP.Furthermore, in cases where the provider also offers public access to specific cloud services, the security challenges are even higher.
2) Lack of control over the security protocols and standards Even though the number of security reported incidents from the industry in cloud-based ERPs is still small, its fast adoption increasingly raises security concerns for organizations, much more than traditional on-premise ERPs did (Castellina, 2011).Furthermore, the clients do not have full control or monitoring capabilities about who accesses their data from the provider side (Hashizume et al., 2013).The same applies to the protocols and standards used by providers to hire personnel, to implement or to monitor their security infrastructure.Consequently, as these factors are dependent from the provider itself, a high level of uncertainty must be considered when implementing ERP on the cloud.

Integrity
The second main concern of securing enterprise data in the cloud is the need to ensure uniformity of the stored data.As mentioned by Puthal et al. (2015), the integrity of data can easily be lost or affected because of cloud providers' errors and failures.The same authors also argue that the traditional enterprise methods to validate the correctness of data are outside the enterprises' control, they are the responsibility of the cloud provider.As a consequence, a common method used to ensure data integrity in cloud environments is public auditing.This method uses a third-party verifier that provides expert integrity checking services (Puthal et al., 2015).Even though the method we mention is commonly used by cloud providers, it raises additional issues like the risk of sensitive information leakage from organizations using cloud providers.From a similar perspective, Akande et al. claim that the methods of authentication and the levels of authorization to manipulate data are crucial concerns for the overall data integrity (Akande et al. 2013).Finally, the process of selecting and adopting a cloud provider should also take into consideration the following challenges: 1) Relationship of trust between the cloud provider and client Assuring the integrity of data is mainly the responsibility of the provider.Therefore, clients must trust the providers to comply with the agreed-on security measures and protocols to achieve integrity of data.As mentioned by several authors (Peng and Gala, 2014;Subashini and Kavitha, 2011), the relationship of trust is based not only on the provider's reputation but also on the specifications of the SLAs between them.
2) Provider's transaction management standards Subashini and Kavitha (2011) argue that in complex settings like cloud computing, there is a high degree of difficulty to assure data integrity.They discuss that the HTTP transaction protocol does not provide guaranteed delivery of data.Additionally, the study shows that SaaS applications should be based on standardized application program interfaces (APIs) as a technological basis for inter organizational systems communication.Standardized APIs ensure that only intended data read and write access is allowed.However, this best practice to manage data integrity is often not considered by cloud services provider.
Based on the literature review, Table 1 resumes major data security concerns that IT leaders should consider in order to move their ERP systems into the cloud.

FINDINGS
Cloud technologies provide a disruptive alternative to traditional on-premise ERP solutions and are offering innovative ways to generate business value and maintain competitive advantage (Weng and Hung, 2014).In addition to the myriad of benefits that cloud-based ERP offers like flexibility, scalability, ease of implementation and cost savings (Utzig et al., 2013), one of the biggest impediments to adopt cloud-based ERP is the risk around data security, namely integrity and confidentiality of the organizations data.In a recent survey conducted by the IDC group, of the 1,100 organizations surveyed on the top inhibitors for cloud-based ERP solutions, 50% of the organizations responded saying security and confidentiality of the data is their primary concern when thinking about moving their enterprise systems to the cloud (Fauscette, 2013) as is stated on Figure 2.
SaaS is gaining popularity and is changing the way organizations deploy and use ERP systems.However, the concerns around data integrity and confidentiality need to be addressed before organizations can successfully implement SaaS based ERP solutions.Additionally, existing literature also shows that adoption rates for cloudbased ERP are highly dependent on the industry type and functions (Clarke et al., 2014).Given the important role that ERP systems play in the functioning of an organization, having to move mission critical applications to a third-party cloud vendor and the security issues associated could negatively impact the SaaS based ERP adoption rates (Johansson et al., 2013).
It can be gathered from literature that due to the low capital expenditure and accelerated time to market, Small to Medium Enterprises (SMEs) benefit from cloud-based ERPs more easily since many of the issues and challenges spin prevalently around data security, confidentiality and concerns regarding relocating mission critical applications to the cloud, which are often no primary concerns to SMEs (Johansson et al., 2014;Wailgum, 2008).The risks  associated with storing an organization's sensitive data on the cloud and its associated data confidentiality and integrity issues are less of an inhibitor for SMEs while adopting cloud-based ERP, as they do not possess the financial resources to build and implement an on-premise ERP solution in the first place (Johansson et al., 2014).SMEs also believe that due to their lack of IT expertise, the security measures that the cloud-based ERP vendors provide are more sophisticated than those that they could implement on-premise.In the long run, the operational expenditure of a cloud-based ERP solution is far less for SMEs, thereby, enabling them to reduce their overall IT expenditure but at the same time allowing them to gain access to state of the art IT infrastructure and expertise through a pay-per-use model (Johansson et al., 2014).A SaaS ERP solution also gives SMEs the opportunity to effectively channelize their resources to focus on the important aspects of their business, enabling them to maintain their competitive advantage (Johansson et al., 2014).
On the other hand, for larger organizations cloud-based ERP implementations raise a lot of security concerns, as they feel insecure to store their confidential and sensitive information on the cloud, as they have to handover the control to the provider to process the information.Larger organizations are heavily concerned about the probability and impact from a potential security breach that could for example damage their reputation, result in financial losses and in some cases, even stand for industrial espionage (Johansson et al., 2014).As a result of these concerns, larger organizations are not motivated to move their mission critical applications to the cloud and since they have normally highly skilled internal IT teams, they prefer to implement on-premise ERP systems with high security standards.Another factor that influences larger organizations to continue with their on-premise ERP solutions is the subscription model associated with SaaS based solutions.Due to the large user base and the number of ERP modules of these organizations, in the long run the subscription fees for cloud-based ERPs are higher than the cost of implementing and maintaining an on-premise solution (Johansson et al., 2014).Thus, Utzig et al. (2013) states that "the total cost of ownership for a cloud-based solution can be 50% to 60% less than for traditional solutions over a 10-year period".In other words, moving their on-premise ERP systems for large organizations cannot be engaged or related with cost savings.A previous study from Utzig et al. (2013) shows on Figure 3 the cost comparison between on-premise and cloud-based solutions.

RECOMMENDATIONS AND POSSIBLE SOLUTIONS
Given the existing concerns about data security in cloud-based ERPs, organizations should take proactive measures to ensure that sufficient data security policies and procedures are in place and negotiated with the cloud vendor in order to secure the confidentiality and integrity of the sensitive corporate data (Clarke et al., 2014).Following are some recommendations that organizations, specifically large enterprises should follow before moving their ERP applications to the cloud (Weng and Hung, 2014): sharing confidential and sensitive information to cloud vendors. Organizations should evaluate which applications are critical to their business to maintain their competitive advantage and thereby, define strict policies for the information and applications that could be moved to the cloud. Cloud vendors should be transparent about their network security infrastructure and should provide this information to the client. Organizations should educate their employees, by conducting employee education training programs and campaigns about data security risks that are possible in cloud-based ERPs and the necessary actions to mitigate those risks to ensure sensitive corporate information is not compromised (Clarke et al., 2014).In addition to the above recommendations, organizations should also ensure that a comprehensive security strategy is defined before migrating their enterprise applications to the cloud.Specific security standards need to be enforced at all levels by incorporating a framework that addresses security at the physical, network, data and application level (Binu and Meenakumari, 2012).A security framework should include components relating to the physical security, data storage security, access security, application security and transmission security.Physical security policies should include rules of conduct for employees and mechanisms to ensure those rules are being followed.
Strict access security policies to prevent unauthorized access from internal and external sources should be enforced as well.Application security should include authentication mechanisms to verify the identity of the end users.Data security should always include strong encryption techniques to prevent any possible data leakage (Kumbhar et al., 2012).Furthermore, the authentication module should exactly define what level of access each user has.
Additionally, mechanisms to ensure integrity of data and to safeguard its uniformity across multiple locations should be put in place.In order to assure confidentiality and integrity of data, its transmission to the provider should be secured by the application of encryption mechanisms.The recommended measurement should be applied in both the provider and the client sides (Binu and Meenakumari, 2012).This should include a contingency plan that allow the organization to have the capability and resources to move to a new cloud provider in case of an emergency in the shortest possible time with less impact.
SMEs are more open to move the entirety of their applications to the cloud whereas larger organizations are still more conservative in their approach due to the risks associated with potential security breaches and their ability to implement high security standards for their on-premise solutions themselves (Johansson et al., 2014).Thus, SMEs adopt cloud-based ERP solutions at a faster rate than larger organizations.However, a recent development that is gaining popularity and momentum among larger organizations is that of a two-tier ERP strategy also known as hybrid cloud-based ERP.Accordingly, Ruivo et al. (2015) argue that more than 77% of IT firms will implement hybrid ERP solutions, however only over 20% currently have structured plans to implement this technology.In addition, Peng and Gala (2014) also consider a hybrid ERP as an effective solution for organizations to keep onpremise ERP core functions combined with business cloud services, before moving to full cloud-based ERP solution.
Hybrid cloud-based ERP provides organizations with the best of both worlds.Organizations can choose to keep their mission critical applications on-premise while migrating the other modules of the ERP into the cloud.A report from PwC (Clarke et al., 2014) suggests that one of the key aspects of hybrid ERP is allowing organizations to take out functions from on-premise ERP to the cloud.Therefore, providing organizations with a higher degree of flexibility to support business operations with the use of cloud technology.For instance, the same report shows that the core operations related to inventory, financials or employee master management, could remain as part of the on-premise ERP.This agile and highly flexible approach allows them to implement more sophisticated, customer driven business models (Columbus, 2015).It enables organizations to take advantage of the cloud-based ERP benefits while minimizing the risks for storing sensitive corporate data on the cloud (Peng and Gala, 2014).

CONCLUSION
Several benefit drives of cloud computing encourage organizations to evaluate and implement an ERP system in the cloud, based on the distribution model SaaS.This new approach to ERPs turns some of the weaknesses of traditional ERPs into benefits.The main benefits of cloud-based ERPs are its scalability and lower investment costs, creating opportunities for SMEs.
However, the main weaknesses and threats to this new approach are the security and integrity risks to the data stored in the system, which have been discussed in this paper.Especially large organizations adopt cloud-based ERP systems only very slowly due to concerns in regards to storing sensitive information on third-party servers.The risk of breaches in security and integrity as well as possible misuse of confidential information by the service providers are further drawbacks.
Nevertheless, a new type of solution has begun to take hold in large organizations in order of combining the best of both worlds (cloud and traditional ERPs): Hybrid cloud-based ERPs or two tiered ERPs.Hybrid cloudbased ERPs allow organizations to store their most sensitive data on-premise solutions while migrating the other modules into a cloud solution.This enables them to benefit from the agility and scalability of cloud-based ERP solutions while still keeping the security advantages from on-premise solutions for their mission critical data.Another benefit inhered from cloud-based solutions is the ability to deploy services on-demand, reducing the risk associated with the implementation of an entire module for a core on-premise ERP.Moreover, the ability to enhance mobility, system performance and customization are some of the remarked benefits why organizations are moving to hybrid ERP solutions (Peng and Gala, 2014).Therefore, hybrid cloud-based ERPs they are especially suitable for larger optimizations which have been hesitating to move into the cloud with their ERPs so far.

Table 1 .
Data security issues