Page 334 -

292 Chapter 10 • Global, Ethics, and Security Management

An IDS is composed of several components: sensors that generate security events, a console to
monitor events and alerts and control the sensors, and a central engine that records events logged by
the sensors in a database and uses a system of rules to generate alerts from security events received.
There are several ways to categorize IDS, depending on the type and location of the sensors and the
methodology used by the engine to generate alerts. In many simple IDS implementations, all three
components are combined in a single device or appliance.
From Wikipedia, the free encyclopedia.

All intrusions must be taken seriously and investigated. Hackers are very sophisticated and
can sometimes access systems without it being noticed. Real-time monitoring and after-the-fact
reporting of anomalies and misuse of network and server activities will assist in spotting intru-
sions and safeguarding systems from inappropriate access to information stored in the ERP.
Infrastructure implementation planning should address intrusion detection during an ERP imple-
mentation. It may be that the IT organization has this capability and is trained adequately, but
validation of their capabilities is needed along with a thorough test plan.

Sample List of Intrusion Detection Systems
VCC/TripwireTM
Computer Misuse and Detection System (CMDS) by SAIC
Kane Security Analyst by Intrusion Detection, Inc
NetRanger by Cisco Systems
Symantec Intruder Alert by Symantec
Real Secure by ISS now IBM
G-Server by Gilian Technologies

PORTABLE DEVICES It may not be easy to steal desktop PCs, and thieves are finding that stealing
laptops and PDAs is much easier. Society is demanding more and more portability. PDAs and even
mobile phones can store large amounts of data. The theft of laptops and PDAs that have stored
identity information is common. Safeguarding against stealing of portable devices is difficult.
Society wants the convenience of portability, but it comes at a cost of less security. Laptops can be
stolen from offices, cars, trains, airplanes, and homes. Once stolen, the storage media can be mined
for information that can be used to gain access to confidential data. Use of passwords and data
encryption is important in securing a portable device, but the key is for the users to be very aware
of what is being stored and to ensure its safety from hackers and thieves.

AWARENESS Users often do not understand the vulnerabilities of Web-based ERP systems to
unauthorized access. Even though it may be difficult to convey these vulnerabilities to end users,
making them aware of the possible issues is key to a successful security plan and program. There
should be two facets to awareness. First, ensure that users are aware of security risks (e.g., writing
down or choosing simple passwords). Second, enforce policies and procedures related to access.
Security violations must be enforced or all system security plans will be compromised. It is often
said that system security is only as good as the weakest link. Those seeking to gain access illegally
will find it and expose that weakness.