PROVIDING CLOUD SECURITY POLICY FOR ERP-SYSTEMS

Abstract

The article is devoted to the analysis of the possibilities of ensuring the security policy of an enterprise with modern cloud-based ERP-systems. Th e information security technologies that are available in the cloud ERP-systems from the list of top10 are considered. It is shown that these technologies are aimed at protecting the information resources of the enterprise from external threats and include the management of access rights, ensuring the security of the transport level and protection against network attacks. Technologies for detecting incidents of security policy and alarm generation are not used, although there is a possibility to access logs and data fi les in cloud ERP-systems. Information leakage protection from the enterprise by cloud ERP-systems is not provided. Also, the possibility of transferring to the cloud of systems that prevent information leaks from the enterprise, the so-called DLP-systems are considered. Th e services of specifi c DLP-systems presented on the Ukrainian market have been analyzed. It is proved that there are no full-fl edged cloud analogs to local DLP-systems. The local system must be transformed to transfer the DLP-system to the cloud and create “DLP as a service”. Th e part of the system that provides verifi cation of actions on work computers must remain at the local level. The part of the system that records information leaks through communication channels (Internet, Skype and others), as well as the database of indexed data, the security policy setting service and the alarm generation center can be transferred to the cloud. All this will lead to new technical requirements for communication channels, the need to use the services of a cloud broker with appropriate security certificates, as well as a signifi cant increase in the cost of operating cloud services. The assessment of the cost of services of existing cloud DLP-systems showed that the company cannot fully control the entire fl ow of information due to the very high price. In addition, continuous updating of the security policy verification rules is necessary, which can only be carried out by an enterprise security offi cer. Thus, the continued active participation of information security officers is necessary for the effective operation of cloud DLP-systems. Providing the enterprise by the capacity to store indexed data and advanced technologies to search for incidents of security policy are advantages of future cloud DLP-systems.