How ERP system helps the organisation to grow & what are the benefits of using ERP System?

What IS ERP?

ERP Enterprise Resource Planning is business software that integrates every part of your business from raw materials, inventory, production, scheduling, and finance to sales. It enables businesses to identify waste, eliminate inefficiencies, improves customer relations and real-time collaboration in the organization.

How will it help your business?

ERP systems can help businesses to become more time efficient and enhance productivity by eliminating duplication and manual work. It helps the managers to make critical decision and maintain a competitive edge over competitors. An ERP system can help you have a 360 degree visibility to all your operations and hence it becomes easy to identify problems at an early stage and one can make informed decisions efficiently. The real time integration between finance, human resource, manufacturing, sales, marketing, production etc will help the organization to keep track of entire business hand in hand.

ERP vendors like custom ERP software development companies in india can maintain close ties to the industries they serve, and respond quickly to the emerging needs of their customers. This provides the customer with the long-term assurance that as their mid-market businesses continue to grow, their ERP systems will grow with them to in response to future needs.

The integration of Supply chain management and ERP system allows distribution and manufacturing organizations the capability to gain greater visibility of its operations. Also it increases speed, efficiency and overall customer satisfaction.

For further details about the integration of ERP and SCM follow the link http://www.ifourtechnolab.com/category/erp

What are the top 10 Indian mobile applications available?

Not only private companies, Indian government is also taking great initiatives to make country digital. Let’s have some introduction about some of the fantastic apps developed by India government.

(1) My clean India
This is an application which assists government to make ‘Swachh Bharat’ more effective. People need to take photos of areas before and after cleaning.

(2) Sanskrit App
It focuses to promote Indian culture by introducing some songs, exhibition, drama, etc

(3) Digital India
It helps to reach to each person on remote area for good governance.

(4) UpOne

It helps people to check the status of various application submitted to government by them.

(5) Aadhaar Enrollment Status:
This mobile application assists you to track your status of ‘Aadhaar’ application.

(6) Voter Information Search:

You can find out the polling station you are allocated to.

(7) Vaccination Alerts:
Under this program, notifications are sent to the parents of the children’s whose vaccination date is due.

(8) mPassport Seva:
Under this initiative GOI has developed a mobile app- mPassport Seva and has establishedPassport Seva Kendras (PSK) across India.
You can track your passport status, can apply for a new passport, info about renewal of passport, and can locate nearest PSK.

(9) Indian Income tax Refund Status:
This app is intended to help you getting the updates of your Income Tax Refund Status.
Without face to face visit the Income tax office every time to track your status, this app helps to track it online.

Safeguards for a data center

Going by the trend, data centers turn out to be a long term beneficial asset for almost any software company in India. Data center is a facility to house an organization’s critical systems. These critical systems are made up of computer hardware, an operating system, tape drives, servers, applications and many more.

Major threats are to all such data centers are:

• Natural threats
• Man-made (Terrorist incidents, riots, theft etc.)
• Environmental (extreme temperatures or humidity)
• Loss of utilities such as electrical power or telecommunications

As a part of safeguarding the data center possessed by any ASP DOT NET software company in India, many actions are proposed over the time. Some of them include

• Installation of physical authentication devices such as card-key readers, biometric devices, traditional key locks, device logs management which holds important information such as user identification, time and place of the access attempt and success or failure of the access attempt.
• Review exterior doors and walls to determine if they protect data centers facilities adequately. Raised floors and drop ceilings (ventilation ducts and power and network cables) Man Traps (Two locking doors with a corridor) are preventive measures that can be applied to data centers.
• Heating, ventilations and air conditioning systems can be install to maintain constant temperatures within the data center.
• Power Continuity checks such as two or more power stations, ground to earth, battery backup system (UPS) and generators can be kept as a backup plans.
• Detective measures and safeguards can be exercised by c# software companies in India such as physical intrusion, risk of fire, water alarm, humidity alarm and surveillance Systems, fire suppression systems.
• Logical measure such as adherence to licensing requirements, version maintenance, application of patches, network security, user account maintenance, access controls and maintenance of sensitive user accounts can prove to be an integral part of a data center.
• Review of data center building orientation, neighborhood characteristics and exterior lighting to identify facility related risks. Reviewing building orientation comprises how far from the boundary, are there barriers and how is the flooring of data center. Neighborhood characteristics consist of who are the neighbors, are they in close proximity and what sort of business they do. Exterior Lighting is vital because proper lighting deters crime and loitering around the facility.
• Research the data center location for natural and environmental hazards and to determine the distance to emergency services. Floods, severe weather and transportation related accidents can destroy or severely damage a data center. A common safeguard is flood elevations – Single story data center that is 5ft or so above ground. However there are some weather and earth movement threats that are not controllable by humans. Transportation related Hazards – Planes (do crash), trains (derail), automobiles must are also some unavoidable accidents. Yet, local crime rate – (High crime area there is higher risk of theft and other crimes) proximity to emergency services – police stations, hospitals and fire-stations could be measured and appropriate reactive actions plans can be prepared for such unwanted accidental scenarios.

IT operations are a fundamental aspect of most software companies in India. One of the key concerns is business continuity; companies depend on their information systems to run their operations. If a system becomes inaccessible, company operations may be compromised or stopped entirely. It is crucial to provide a reliable infrastructure for IT operations, in order to diminish any chance of disruption. Information security is also a concern, and for this purpose a data center has to propose a secure environment which decreases the chances of a security breach. A data center must therefore keep great standards for convincing the integrity and functionality of its hosted computer environment.

ITIL Continual Service Improvement

The ITIL Continual Service Improvement process focuses on quality management. The continual improvement process intends to continually improving the efficiency of IT processes and IT services, carried out in custom software development companies, in an effective way , as per the standard adopted of continual improvement adopted in ISO 20000

The objective of the ITIL Continual Service Improvement includes :

• To review and analyze improvement opportunities in each phase of the continuous lifecycle
• To review and analyze results of the Service Level achievement
• To improve cost of delivering IT services effectively without sacrificing the satisfaction of  customer
• To identify and implement individual activities to improve the quality of IT services
• To ensures that the appropriate quality management processes and methods are used to support the activities carried out for the continual improvement in a software development organization.

The activities of ITIL Continual Service Improvement includes :

• Reviewing that the ITSM processes achieve the desired and qualitative results
• Periodically demonstrate areas of improvement
• Conducting internal audits verifying employees and process compliance
• Reviewing existing deliverables for relevance
• Conducting external and internal service to identify CSI opportunities
• Review management information and trend to ensure services are meeting the SLAs.
• Periodically proposing recommendations for improvement opportunities
• Periodically conducting customer satisfaction surveys
• Conducting service reviews i.e both internal as well as external ,to identify CSI opportunities

There are 7 steps followed in the ITIL Continual Service Improvement process.

They are as follows :

• To define what data you should measure
• To define what data you can measure
• To gather the relevant data need for the continuous improvement
• To process and filter the appropriate data
• Analyze the data by choosing the relevant methods
• To present/assess the data
• To implement corrective actions for getting the quality information and improved data

The processes of ITIL Continual Service Improvement  includes :

• Service Review
• Process Evaluation
• Definition of CSI Initiatives
• Monitoring of CSI Initiatives

Service Review

• The objective of service review includes :
• To review business and IT services and infrastructure services on a regular basis.
• To improve the quality of the IT services where necessary
• To identify more efficient and economical ways of providing IT service where possible.

Process Evaluation

• The objective of Process Evaluation includes :
• To evaluate processes on a regular basis.
• To identify those areas where the targeted process metrics are not reached,
• Holding regular benchmarking, audits, maturity assessments and reviews.

Definition of CSI Initiatives

The objective of Definition of CSI Initiatives includes :

• To define specific initiatives which focuses on improving services and processes, based on the results of service reviews and process evaluations.

Monitoring of CSI Initiatives

The objective of Monitoring of CSI Initiatives includes :

• To verify and monitor improvement initiatives whether they are proceeding according to plan or not
• To introduce and take corrective measures where necessary during the lifecycle.

TARGET AUDIENCE

ITIL Continual Service Improvement is relevant to organizations involved in the development, delivery or support of services, including:

• Various Service providers – Internal providers and External providers
• Software development Organizations that target to improve services through the effective application of service management to improve their service quality
• Software development Organizations that require a consistent managed approach across all service providers in a supply chain or value network
• Software development Organizations that are going out to tender for their services.

Conclusion :Thus, the IT software development companies should use and implement the Continuous Service Improvement to improve and monitor IT service as a part of ITIL processes for increasing quality of the services and thereby increasing the value plus customer satisfaction.

References:http://wiki.en.it-processmaps.com/index.php/ITIL_CSI_-_Continual_Service_Improvement

Session Hijacking

Session hijacking, also well-known as TCP session hijacking, is a technique of taking over a Web user session by secretly obtaining the session ID and masquerading as the legal user. Once the user's session ID has been retrieved (through session calculation), the attacker can masquerade as that user and do whatever the user is authorized to do on the network.

SPOOFING VERSUS HIJACKING spoofing and hijacking are measured to be same thing. Actually they are completely different from each other.

Spoofing: A hacker will imitate himself to gain access. Unlike hijacking, it actually creates a new session using target pinched credentials rather than using present session.

Hijacking: Unlike spoofing, it takes over current active session. It will depend on some legitimate user to establish a linking and even authentication.

Techniques of session Hijacking:

It may include any of the following techniques:

• Stealing: It refers to all those methods accepted in order to steal session IDs.  
• Brute Force: It is totally hit and trial. An attacker will try various IDs until get success. 
• Calculation: An attacker will try to compute the session Ids with use of non-randomly twisted IDs.

Application level session hijacking

Session Hijacking in OSI model can be attained at both application as well as network level. Here, in this article, application level session hijacking is explained in much detail.

1. Sniffing: An attacker to sniff a valid session IDs on the network can make use of a sniffer like a popular one is Wireshark. It keeps its eye on network traffic and from this usefulness we can use valid token session to get authorized access in an unauthorized way.
2. Session Token Prediction: It is commonly used to forecast a session ID or for impersonation task. It helps an attacker to use compromised user privileges to ping the websites with them.
3. MITM attack:  The MITM attack is a Man in the Middle attack. It is used to interrupt into an existing connection between machines to know traded messages between them.

Process:
i. First divide the TCP connection into two: Client to Attacker, An Attacker to Server.
ii. On being completely interrupted, an attacker can read, inject and even modify data into this connection

4. MIB attack: The MIB attack is a Man in the Browser attack. It makes use of the Trojan horse to interrupt the calls between the browser and its security model. It is mainly used for triggering financial deceptions by adjusting transactions of Net Banking mechanism.

Process:
 i. The Trojan horse first tries to infect computer application or its OS.
ii. Malevolent code installation and saved to configuration of the browser.
iii. When user restarts the infested browser, Trojan is being loaded and a handler is listed for every visit.
iv. While web page is loaded, extensions make use of URL and equate it with list of targeted sites.
 v. User then log in.
vi. When a specific page load is noticed, button event handler is enumerated and then compared to targeted list. vii. Finally, browser directs the form and manipulated values to the server.

5. Client Side Attacks: They are kind of an attack, in which the malevolent scripts are then injected into websites. This destructive code can be embedded in a web page and even does not alert any kind of notice.

EFFECTIVE COUNTERMEASURES:

•  Use SSL to have protected communication channel. 
•  There must be logout utility for session termination. 
•  Trust HTTPS connection for transient authentication cookies. 
•  Always allow encrypted data between user and webservers. 
•  Accept a secure protocol. 
•  Regeneration of Session ID after user log in. 
•  Lessen having remote access. 
•  Importance on Encryption. 
•  Decrease incoming connections. 
•  Decrease the life span of session or cookie.
•  Create session keys with lengthy strings or random numbers. 
•  Try stopping Eavesdropping. 
•  Expire the session when user logs out. 
•  Do not access links received via mails. 
•  Use firewall and browser settings to limit cookies. 
•  Make sure website which we are retrieving is certified by certified authority.  Clear history, offline contents and cookies from browser after each secret or sensitive transaction.

Information safeguards in organization operations

Securing information of an organization ultimately means:

• Making sure that information remains confidential and only those who have access to that information, can use them. ( Confidentiality )
• Knowing that no one has been able to modify information, so one can depend on its correctness .(Information Integrity)
• Ensuring that information is available when one requires it (by creating back-up copies and, if appropriate, archiving the back-up replicas off-shore).( Availability )

Access control is one of the most common way applied by software companies in India.

Access to information must be limited to people who are authorized to access. This needs that mechanisms must be in place to control the access to information. The level of the access control mechanisms should be at par with the worth of the information being secured – the more delicate or valued the information the stronger the control mechanisms need to be. The basis on which access control mechanisms are constructed start with identification, authentication and authorization.

Identification is assertion of who someone is or what something is.

Authentication is the act of proving a claim of identity.

Authorization is, program or user has successfully been identified and authenticated then it must be determined what information assets they are allowed to access and what activities they will be permitted to perform.

Need-to-know principle is a newly adopted concept by software companies India as an extension of access control concept. Within the need-to-know principle, network administrators provide the employees minimum amount of rights to prevent employees’ access and performing more than what they are supposed to.

Even though the security architect or engineer assists in setting up security standards and procedures, operations security is the genuine procedure for implementing, maintaining, and monitoring safeguards and controls on a regular basis to avoid security incidents. Software companies in India can use numerous safeguards and controls to protect their operations, such as executing:

• Preventive controls: reduce the threat of unintended faults or unauthorized users gaining access to the system and altering information.
• Detective controls: help detect when an error has happened.
• Separation of duties: Also known as SoD, assigning tasks to various personnel, avoiding one person from having total control of the security procedures 
• Back-ups: in the event of a crash, restore systems using routine back-ups.
• Strict policies: Measures for tracking and agreement of modifications or reconfiguration to the system (Note: This is stereotypically addressed in a formal alteration control process and through configuration management that comprises an updated catalogue of hardware, operating system, and software and patches)
• BGC: Employee background checks and screening for roles that have access to extremely sensitive information or one who is in control of security procedures 
• Retention: Suitable retention policies as defined by organization policies, standards, legal and business guidelines 
• Documentation: Proper documentation, such as organizational security policy and procedures, security, incident, and disaster recovery tactics 
• Proper protection: Safeguards for hardware, software, and information assets 

In addition to controls, comprehensive security operations include suitable monitoring and auditing. 

Three common techniques used to monitor security include:

  

Intrusion prevention/detection:

A procedure to monitor network traffic or host audit journals for such security violations as interferences that have gone around or passed through the firewall or intrusions happening within the local area network behind the firewall. 

Vulnerability scanning/penetration testing:

A dynamic test run on systems or devices associated to a network to verify the existing configurations of systems with respect to widely recognized vulnerabilities and evaluating the level of exposure and determining the total effectiveness of the existing controls. 

Violation analysis:

A dynamic monitoring software package or tool that lets organization recognize areas of concerns. For example, a user continually forgets to log out of a critical application and the application automatically logs the user off after a preset period of inactivity. This slip-up (time out instead of log off) generates an error message or audit record entry. The analysis of the records can point out the necessity for user awareness with respect to reminders to log off when they are done using a system.

Auditing is the assessment of audit trails on a regular basis, which can help alert a firm to unlawful practices.

Thus safeguards allows software companies in India to protect sensitive information and eventually allows them to escape un-necessary costs and time and utilization of other resources. Along with tangible assets, they can avoid loss in intangible assets such as brand image, customers, suppliers and employees faith.

Handling Security Issues in SDLC

ASP.NET software companies in India must take special care while developing internal web applications that are accessed from outside with the help of world wide web. Moreover the increase in personally-owned mobile devices (e.g., watch gear, smartphones, tablets, and laptops) as well as the vast variety of vulnerable mobile apps results into a higher risk of revealing highly confidential and business-related information in the workplace. This is possible when such information is stored on personally-owned devices. Cyber-attacks often exploit such vulnerabilities inherent in applications and operating systems. Hence The software code must be developed following a secure coding guidelines and frequent updates and patches to software are necessary.

Security is unquestionably mandatory and no-one can overlook that. It may take longer and including security into SDLC may result into a more complicated practice.  Nevertheless, the alternatives are not that satisfactory as there are always hackers only too eager to disrupt into systems.

The consequences of not including security within the SDLC process can be catastrophic and could cause distressing concerns for companies' status and earnings. By safeguarding SDLC, unnecessary& un-planned costs can be evaded and security matters can be tackled as there is no need to wait for threats to emerge and then having to spend money in fitting current or probable matters that could have been dodged.

Software companies in India use secure-SDLC thatfocuses on enforcing security into the Software Development Life Cycle. Every phase of SDLC will emphasize the enforcement of security – over and above the present set of events. Incorporating S-SDLC into an organization’s structure has many benefits that guarantees a secure product.

The focus of asp .net software companies in India, with respect to security domain,ison phases of SDLC such as design, implementation, delivery, operation, maintenance, and retirement. Information security and privacy experts must be involved in all phases of SDLC so that the overall effectiveness of security controls with respect to privacy concerns are taken care of. 

The subsequent list recognizes key security guidelines at each stage in the development life cycle for asp .net software companies in India:

• System feasibility: Pinpoint security requirements, including governing requirements, in-house policies and standards that must be looked at. 
• Software plans and requirements: Recognize the vulnerabilities, threats, and risks to software. Outline the desired level of protection. Conduct a cost-benefit analysis. 
• Product design: Proposefor the security criteria in product design (e.g., access controls or encryption). 
• Detailed design: Determine business requirements and legal obligations within the design of security controls in a product or system. 
• Coding: Develop the security-related software code, comments and citations. 
• Integration product: Investigate security measures and make alterations. 
• Implementation: Implement any additional safetydealings prior to go-live. 
• Operations and maintenance: Observe the software and system for variations in security controls. Assess current controls against newly-discovered threats and vulnerabilities. Implement proper updates and patches, when essential. Certify the complete effectiveness of application and system security.
• Product retirement: Safeguard information that was used and warehoused (i.e., archived), relocated to another database or system, or sterilized (i.e., erased) from the system.

Thus asp .net software companies in India can identify, reduce, mitigate and eliminate various security threats and adverse impacts that could be present in each stage of SDLC. It ultimately results into reduction in overall cost, efforts and time of delivering the final product or service in IT industry.