Why is erp security so difficult