{ "article_id": 1445, "public_id": "4fbd831d-9336-4c90-9179-0cee909dc3e5", "internal_identifier": null, "source_identifier": "89:11", "status": "published", "type": "research_article", "title": "Kurumsal Kaynak Planlaması Yazılımlarında Bilgi Güvenliğini Esas Alan Özel Yetkilendirme Yaklaşımı", "title_secondary": null, "abstract": "Dünyada ve ülkemizde yaygın olarak kullanılan ERP (kurumsal kaynak planlaması) yazılımı olan SAP, kullanıcısı olan şirketlerin sistemlerinde kurum özelinde veri tutmasına olanak sağlamaktadır. Kurum verilerinin gizliliği, kurumların ticari sırlarıdır. Ticari sır niteliği taşıyan kritik bilgiler (ürün formülleri, satın alma fiyat bilgileri, stok bilgileri vb.) veri yönetimine ilişkin regülasyonlar ve tutulan bu kritik bilgilerin içerisinde kişisel verilerin korunmasının önem kazanması gibi değişimler, verinin niteliğini değiştirmiş ve hassasiyetini arttırmıştır. Bu kapsamda alan bazlı yetkilendirme yaklaşımları doğmuş ve verinin granüler bazda yönetimi tüm kurumlar için büyük bir ihtiyaç haline gelmiştir. İlgili verilere erişim yetkilendirilmeli ve talep edilmesi halinde bu erişimler yetkili kişi ve kurullara iletilmelidirler. SAP gibi yaygın olarak kullanılan ERP sistemlerinde yetkilendirme fonksiyonel ve organizasyonel bazlı yapılmaktadır. Ticari sır niteliği taşıyan kritik bilgileri ya da kişisel verileri içeren alanlar, diğer verilerin tutulduğu alanlarla aynı fonksiyonun içerisinde yer aldığından, erişimi fonksiyonel ve organizasyonel bazda yetkilendirmek yeterli olamamaktadır. Alan bazlı yetkilendirme yöntemi aracılığıyla ilgili alanlara erişimler denetim altına alınabilecektir.", "language": "tr", "english_title": "A Special Authorization Approach Based on Information Security in Enterprise Resource Planning Software", "english_abstract": "SAP, an ERP (enterprise resource planning) software widely used both globally and in our country, allows companies to store company-specific data in their systems. The confidentiality of corporate data is considered a trade secret. Changes such as regulations regarding data management and the increasing importance of protecting personal data within this critical information (product formulas, purchase price information, inventory information, etc.) have altered the nature of data and increased its sensitivity. In this context, domain-based authorization approaches have emerged, and managing data at a granular level has become a major necessity for all organizations. Access to the relevant data must be authorized, and if requested, these access requests must be communicated to authorized individuals and boards. In widely used ERP systems like SAP, authorization is done on a functional and organizational basis. Since domains containing critical information or personal data, which are considered trade secrets, are located within the same function as other data, authorizing access on a functional and organizational basis is insufficient. Access to relevant areas can be controlled through area-based authorization methods.", "doi": "10.36287/setsci.5.2.011", "doi_url": "https://doi.org/10.36287/setsci.5.2.011", "resource_url": "https://www.set-science.com/a/4fbd831d-9336-4c90-9179-0cee909dc3e5", "pdf_url": "https://www.set-science.com/a/4fbd831d-9336-4c90-9179-0cee909dc3e5/pdf", "og_image": "https://www.set-science.com/assets/img/og-card-v2.png", "authors": [ { "public_id": "4f4ca93f-2937-437a-b177-3d0b6f64e263", "given": "Ozan", "family": "Gelincik", "full": "Ozan Gelincik", "literal": null, "orcid": null, "orcid_url": null, "email": "ozan.gelincik@mbis.com.tr", "corresponding": true, "sequence": "first", "affiliations": [ { "name": "MBIS Ar-Ge Merkezi", "department": null, "country": null, "country_code": null, "ror": null, "ror_url": null } ] }, { "public_id": "1f21a869-a211-4e64-b547-870c9625013b", "given": "Nisa", "family": "Şahinyılmaz", "full": "Nisa Şahinyılmaz", "literal": null, "orcid": null, "orcid_url": null, "email": "nisa.sahinyilmaz@mbis.com.tr", "corresponding": false, "sequence": "additional", "affiliations": [ { "name": "MBIS Ar-Ge Merkezi", "department": null, "country": null, "country_code": null, "ror": null, "ror_url": null } ] } ], "keywords": [ "ERP", "Kurumsal kaynak planlaması", "SAP", "Alan bazlı yetkilendirme", "KVKK", "Bilgi ve Sistem güvenliği", "Veri yapıları ve Veri yönetimi" ], "translations": [ { "language": "en", "title": "A Special Authorization Approach Based on Information Security in Enterprise Resource Planning Software", "abstract": "SAP, an ERP (enterprise resource planning) software widely used both globally and in our country, allows companies to store company-specific data in their systems. The confidentiality of corporate data is considered a trade secret. Changes such as regulations regarding data management and the increasing importance of protecting personal data within this critical information (product formulas, purchase price information, inventory information, etc.) have altered the nature of data and increased its sensitivity. In this context, domain-based authorization approaches have emerged, and managing data at a granular level has become a major necessity for all organizations. Access to the relevant data must be authorized, and if requested, these access requests must be communicated to authorized individuals and boards. In widely used ERP systems like SAP, authorization is done on a functional and organizational basis. Since domains containing critical information or personal data, which are considered trade secrets, are located within the same function as other data, authorizing access on a functional and organizational basis is insufficient. Access to relevant areas can be controlled through area-based authorization methods.", "keywords": [ "ERP", "Enterprise Resource Planning", "SAP", "Domain-based Authorization", "GDPR", "Information and System Security", "Data Structures and Data Management" ] } ], "subjects": [], "subject_names": [], "published_date": "2022-12-22", "published_year": "2022", "received_date": null, "accepted_date": null, "volume": "14", "issue": null, "page_first": "49", "page_last": "52", "article_number": null, "conference": { "short_name": "ISAS-WINTER-2022", "full_title": "6th International Symposium on Innovative Approaches in Smart Technologies", "name": "6th International Symposium on Innovative Approaches in Smart Technologies", "acronym": "ISAS-WINTER-2022", "location": "Online, Türkiye", "start_date": "2022-12-08", "end_date": null, "public_id": "7c4c259f-59cd-42c3-8888-b2bea659eca4" }, "proceedings": { "title": "Proceedings of the 6th International Symposium on Innovative Approaches in Smart Technologies", "series_title": "SETSCI Conference Proceedings", "publisher": "SET Technology", "isbn": "978-625-91379-0-2", "eisbn": "978-625-91379-0-2", "issn": null, "eissn": "2687-5527", "doi": null, "doi_prefix": "10.36287", "slug": "setsci-volume-14-2022-legacy-89", "public_id": "fee303cf-1481-4126-b798-0677ff46f672", "url": "https://www.set-science.com/p/setsci-volume-14-2022-legacy-89" }, "license": { "name": "CC BY 4.0", "url": "https://creativecommons.org/licenses/by/4.0/", "code": "CC-BY-4.0", "open_access": true }, "copyright": { "holder": "SET Technology", "year": "2022" }, "funding_statement": null, "funders": [], "references": [ { "order": 1, "raw": "https://dergipark.org.tr/tr/pub/oybd/issue/16333/170999", "doi": null, "title": null, "authors": null, "source": null, "year": null, "volume": null, "pages": null }, { "order": 2, "raw": "https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/41784a70-2bac-4e4a-830f-35c628468646.PDF", "doi": null, "title": null, "authors": null, "source": null, "year": null, "volume": null, "pages": null }, { "order": 3, "raw": "https://dergipark.org.tr/tr/pub/ifede/issue/4608/62922", "doi": null, "title": null, "authors": null, "source": null, "year": null, "volume": null, "pages": null }, { "order": 4, "raw": "Oğuzhan Atış, Kurumsal Kaynak Planlaması Yazılımlarında Kullanılan Alan Bazlı Yetkilendirme Yöntemlerinin Kişisel Verilerin Korunumu Kanunu Kapsamında Örnek Uygulama Yaklaşımı.", "doi": null, "title": null, "authors": null, "source": null, "year": null, "volume": null, "pages": null }, { "order": 5, "raw": "https://www.mbis.com.tr/aura/", "doi": null, "title": null, "authors": null, "source": null, "year": null, "volume": null, "pages": null }, { "order": 6, "raw": "Volker Lehnert, Iwona Luther, Björn Christoph, Carsten Pluder, Nicole Fernandes, GDPR and SAP-Data Privacy with SAP Business Suite and SAP S/4HANA,2014.", "doi": null, "title": null, "authors": null, "source": null, "year": null, "volume": null, "pages": null } ], "statements": { "acknowledgements": null, "conflict_of_interest": null, "data_availability": null, "ai_disclosure": null }, "credit": [], "history": { "published": "2022-12-22" } }