Security Assessment for Aircraft Solutions: ERP & MRP Risks

Company Overview

Aircraft Solutions (AS) is a globally recognized leader in the design and fabrication of component products and services for companies in the electronics, commercial, defense, and aerospace industries. Their manufacturing plants are located in San Diego, California and Santa Ana, California. At present, these plants' manufacturing systems are linked entirely over the public Internet, with firewalls protecting the headquarters systems in San Diego, which house IT, Finance, and Sales & Marketing. Production facilities in Chula Vista, California and Santa Ana, California are located behind the same firewall that protects headquarters.

This configuration presents a wide range of security challenges for the company. The most significant is the exposure of manufacturing planning data within their Manufacturing Resource Planning (MRP) and Enterprise Resource Planning (ERP) systems. AS has a second weakness in having no proxy server protection from incoming data across the public Internet. If a competitor or even a foreign nation were able to gain access to just one server, they could feasibly hack into the core MRP and ERP systems, penetrating both divisions.

The software and hardware aspects of the company's security strategy are highly ineffective for protecting the assets critical to running a project-based business in the industries it competes in. All aerospace and defense manufacturers competing in project-based manufacturing programs rely on MRP and ERP systems to optimize materials, production instructions, and costs. Today, these systems are vulnerable to outside hacks and intrusion over the public Internet — only a single firewall separates the company's core operational data from the outside world. In addition, there is no fail-over firewall strategy in place at the hardware level, with even the most elementary measure — proxy servers — absent from the current configuration (Leong, Yu, & Lee, 2003).

Two Security Vulnerabilities

MRP and ERP System Vulnerability

The most strategically important systems that AS relies on to run its business are also the most vulnerable, given the company's current enterprise-wide network and telecommunications configuration. Aircraft Solutions primarily relies on project-based manufacturing, with Direct Computer Numerical Control (DCNC) machine data essential for completing individual projects. Without this data, the company cannot finish projects on time or collect payment from customers. The DCNC and project-based manufacturing data housed in their MRP and ERP systems are the lifeblood of the business.

The vulnerability is clear: projects could completely stop if the data is corrupted. The threat is that competitors could steal the data and undercut AS with its own customers. The risk and consequences include a potential rapid drop in revenue and, ultimately, the company going out of business. The assets involved include DCNC machines and their associated data, the Business Process Management (BPM) system, and — as the network configuration makes evident — the MRP and ERP systems as well.

Lack of Proxy Servers and Redundant Firewall Protection

The second vulnerability is the absence of proxy servers and sufficient fail-over firewall protection. Anyone skilled enough to breach the single firewall would immediately gain access to all data at headquarters and throughout the Defense and Commercial divisions. Further, the network infrastructure is protected at its outermost layer by only a router — an arrangement entirely insufficient for safeguarding the confidentiality of data the company handles daily.

If Department of Defense (DoD) customers were made aware of this network configuration, AS would likely face an immediate security audit and possible suspension of contracts. The threats created by this absence of proxy servers include the immediate disruption of production and order fulfillment capabilities. The broader vulnerability is that the company's most critical enterprise-level information could be quickly compromised and exploited by competitors or foreign governments seeking to identify which DoD-related projects AS is working on. The consequences would include immediate financial penalties from government contractors and a significant loss of revenue. If hackers from a nation hostile to the United States were to gain access, the risk of the company ceasing operations entirely becomes a real possibility.

Recommended Solutions

Enterprise Resource Planning (ERP) and Manufacturing Resource Planning (MRP) systems are the most vital of all IT platforms, as they unite a manufacturer's business operations around customer demands (Marnewick & Labuschagne, 2005). Today, Aircraft Solutions relies on a single-instance BPM system and DCNC, and given the project-centric nature of its business, a comprehensive ERP and MRP system as well. This concentration of systems into a single, enterprise-wide platform represents the greatest security risk AS faces. The recommendation is to redefine its monolithic approach to managing manufacturing and create a more stratified, separate system architecture to support headquarters, the Defense division (DD), and the Commercial division (CD) independently.

Empirical studies of distributed manufacturing systems demonstrate greater performance and, most importantly, greater levels of security, stability, and redundancy (Brehm & Jorge, 2005). This approach — defining stratified systems by location — is commonly referred to as a two-tier ERP strategy (Marnewick & Labuschagne, 2005). Adopting this architecture will significantly reduce risks and harden the entire enterprise system infrastructure of the company.

The absence of proxy servers and redundant security at the hardware level, if discovered by defense agency customers, would place existing contracts at risk. The inclusion of a corporate-wide proxy server strategy would not only protect enterprise systems but would also improve the performance of web-based ERP and MRP applications (Brehm & Jorge, 2005).