Erp Security — Bảo Mật Dữ Liệu Business

Intro

Bạn có dữ liệu business quan trọng:

• Khách hàng (tên, address, spend history)
• Nhân viên (salary, personal info)
• Sản phẩm (cost, margin, formula)
• Tài chính (revenue, expense, plan)

Nếu ERP bị hack, dữ liệu này lộ → business die.

Bài này sẽ explain 5 security aspects của ERP — để anh chị yên tâm.

5 Security Aspects

#1: User Access Control

Vấn đề:

• Employee A không nên see salary data
• Employee B (kho) không nên edit price
• Employee C (sales) không nên see customer cost

Solution:

• ERP có role-based access control
• Admin assign role (Sales, Kho, Kế toán, etc.)
• Each role have specific permissions
• Employee A see only their scope

Implementation:

• Define roles (Sales = can view order, invoice | Kế toán = can view GL)
• Assign role to user
• Monitor access (audit log)

#2: Data Encryption

Vấn đề:

• Data transmitted internet (from office → cloud)
• Hacker intercept = read data?

Solution:

• ERP encrypt data in transit (SSL/TLS)
• ERP encrypt data at rest (database level)
• Even if hacker get data, can't read (encrypted)

How it work:

• HTTPS (secure browser → server)
• AES-256 (database encryption)

#3: Backup & Disaster Recovery

Vấn đề:

• Server down, data lost?
• Ransomware attack, data deleted?

Solution:

• ERP auto backup (daily)
• Multiple location (not 1 server)
• Disaster recovery plan (restore in X hours)

Typical:

• Cloud ERP: backup automatic (vendor responsibility)
• On-premise ERP: customer responsibility (need backup strategy)

#4: Audit Trail

Vấn đề:

• Who changed price last week?
• Who deleted order?
• Who access customer data?
• Can't track (no history)

Solution:

• ERP log every action (who, what, when)
• Cannot delete log (immutable)
• Audit team can check history

Example log:

2025-05-31 10:30:15 | User: John | Action: Edit product price from 100K → 90K | IP: 192.168.1.5
2025-05-31 10:45:22 | User: Sarah | Action: View customer #123 (Acme Corp) | IP: 10.0.0.8

#5: Compliance & Standards

Vấn đề:

• Vietnam law require data protection?
• Data stored outside Vietnam, legal?

Solution:

• ERP comply with GDPR (Europe), CCPA (US), PDPA (Vietnam)
• Data stored in Vietnam (or compliant location)
• Regular security audit (3rd party check)

Check before choose ERP:

• Where data stored? (Vietnam = better for Vietnam business)
• What certifications? (ISO 27001, SOC 2, v.v.)
• What SLA? (uptime 99.9%+)

Real Example: Bảo vệ customer data

Scenario:

• Customer data: tên, phone, email, address, purchase history
• Hacker try to access

ERP bảo vệ:

→ Hacker cần break 5 layer = very hard

FAQ

Q1: Cloud ERP vs On-premise, mana safer?

A: Cloud safer (usually).

Cloud provider (AWS, Google, Microsoft):

• Have dedicated security team
• Invest millions in security
• Regular audit
• Multiple data center backup

On-premise:

• You responsible
• Unless company have IT team (expensive)

Q2: Có thể 100% secure không?

A: Không. 100% impossible. But 99%+ achievable.

Trade-off:

• More security = more cost
• More security = slower performance
• Need balance

Q3: Nếu ERP bị hack, ai chịu trách nhiệm?

A: Tùy contract:

• Cloud ERP: Vendor chịu (SLA liability)
• On-premise: Customer chịu (you responsible)

Read contract carefully!

Kết luận

ERP security = multiple layers

5 aspects:

1. Access control (who can see)
2. Encryption (data unreadable if stolen)
3. Backup (restore if disaster)
4. Audit trail (log everything)
5. Compliance (follow law)

Most ERP (cloud): Already secure. Choose reputable vendor, follow best practice = safe.

---

CTA

Lo lắng về security?

→ Book security assessment

---

---