Impregnable Security Strategy for 2BizBox ERP

Data security is a big issue to any ERP software. When your 2BizBox ERP is implemented and ready for daily business, have you figure out a sound security strategy to protect and manage your system? In this article, we would like to discuss with you about the basic security settings for 2BizBox.

1. Security in operation system level.

It’s okay for you to download 2BizBox and install it on local host for testing. However, when you decide to implement 2BizBox and run it for daily business, a clean and independent server is indispensable.

We’ve received many enquiries like: “my company is implementing 2BizBox ERP. May I install it on a 512MB RAM computer with Window 2000 system?” Or “is it possible to install 2BizBox on my boss’ notebook?” Here’s our advice: at present, if you fail to provide a clean, independent and well-performed server for 2BizBox implementation, just prepare to welcome dozens of tortures in the future. We understand that 2BizBox saves you a big amount of money for ERP Implementation, so why not spend several hundred bucks on a new computer as server?

2BizBox ERP is able to run in windows and Linux system. After your server’s in place, we recommend you to install Windows Server or Linux CentOS 5. Don’t forget to set a proper account for the server and make sure there’s no extra account left. Any safety strategy on 2BizBox is useless if you leave your door open.

2. 2BizBox security setting

The first thing after you install 2BizBox on the server is to set Username and Password for the admin account. For official operation, you must use “Default Company” instead of “Test Company”. The Admin account owns the highest permission in system, therefore, you have to set a secure password and memorize it.

The second step is to strengthen safeness for other users. For example:

Encrypt and store all users’ password, this is a default setting;

Enforce all users to use password over certain length, generally set 6 byte and at least set 4

byte;

Set other password strategies, e.g. enforce users to change password regularly, like a 30

days period

Find settings for password management in:

 2BizBox ERP -> Control Panel -> General Setting -> Security Policy

By finishing the above security settings, you will definitely receive complains from all departments, e.g. for this troublesome and timed task to change password. Every day someone will forget his password but even admin cannot regain it. The only way is to reset the password by admin and revise it by user again. We have to say, the seemingly inconveniency do brings safety to your system. “Hey buddy, do me a favor. Login into the system and help me to approve an order. My password is ******”. Doesn’t it sound familiar after you’ve been a senior staff in the company? Any password will lose its safety as time passes. Think about the loss caused by information leak, your elaborate drawings, product prices and staff salaries, doesn’t it deserve a bit attention on security maintenance?

The following image shows that an attempt login with unsatisfied length password will be forced to change password or exit after you set the password minimum length.

3. Assign permissions for each user in 2BizBox.

About the relationship among user, role and permission, you can read the article:

Understanding relationship among “permission”, “role” and “user”

Permission is complicated and different from company to company. In 2BizBox, we define permission to each function. With such small granularity, you are able to assign very fine-grained permissions to each user. Though it is operable, in practical cases, there’s no necessary to make such permission assignment because we’ve preset a few roles according to the module distribution. With these roles integrated by certain permissions, you can flexibly assign roles to a user in a very short time.

We would like to kindly remind you a few special and sensitive functions like: download drawings, check system diaries, add users, check financial reports, adjust warehouse costs, etc. In case information leaks out due to imprecise definition, check system diaries at the first time and make adjustment so as to obtain a safe ERP for your enterprise.

Finally, if you have certain knowledge in database, you can revise username and password in default database. Create a new account, set password and revise the mysql-ds.xml configuration files under deploy category, then 2BizBox is able to obtain your information.