RE: Sarbanes-Oxley / my opinion

> I suppose my three immediate questions would be:
> 1. What is SOX intended to prevent?

Fraud and theft, no more, no less.  

When you examine it closely, SOX really is an ingeniously crafted piece
of legislation.  Rather than creating long lists of "You Must" clauses
followed by "we will Check on you by..." statements (and a gigantic
federal bureaucracy to match), SOX simply says to the CEO and CFO "You
will sign a letter stating that you have adequate financial controls in
place to prevent fraud and theft.  If you sign that letter and you're
wrong, you could go to jail".  Brilliant!  

(See a nice summary of SOX Section 404 at
http://www.aicpa.org/info/sarbanes_oxley_summary.htm)

Congress simply told the head honcho's that it is their butts that are
on the line.  The head honcho's have always had the where-with-all to
turn the organization towards security and best practices, all Congress
did was give them the motivation. :)

Now the Honcho's have to take a critical eye at the organization and ask
themselves...

"If, under our current operating practices, Rocko on the shipping Dock
can steal a semi truck full of widget's and nobody would even know they
are gone, or Jane in IT could open up a hole for Tom in AP to pay
himself 7 digit's as a phony vendor, and there is no way to capture
that, AND I don't deploy the organizations resources in such a way that
I could stop (or at least detect) those actions, I could go to jail."
All of the sudden, the Honcho's want adequate controls in place.  If you
were in their shoes, you would too.

And I know from personal experience that if you take an average
production iSeries system with, say 800 users on it, somewhere between
25% - 100% of those users could rob the place blind because there are
little, or no, controls deployed to prevent this.  In the old days, we
all used to just wink at each other and say "Aww... Our users are too
{(A) Nice, B) Honest, C) Stupid, D) Busy, E) Select your own adjective
}, they are not going to steal from us".  Today the CEO and CFO look at
those 800 people and say "I guess they probably won't steal from us -
but if I guess wrong, I could face criminal charges".  

And all of the sudden they start viewing system security differently.
They start orientating themselves to the same posture that IT Security
professionals have had all along - "Nobody gets access on less they
absolutely need it."  You, the System Admin, may think this is useless
and wasteful, but get used to it because it is the future of computing.


> 2. How effective is it at actually enforcing what it's
> intended to
> prevent?

As effective as the CEO wants it to be - everyone has a pain tolerance -
at some point the CEO will decide that there are enough controls in
place that he/she stands a high chance of _not_ going to jail, and will
ease up (a bit).  Personally I think SOX already is very, very
effective, because the folks who have the highest ability to influence
the outcomes (Honcho's) have the most skin in the game.  Again, this
part was pure brilliance.

> 3. What are the new methods of circumventing it?

Remember, SOX does not say how to secure your iSeries (or any other
system).  It does not state an opinion on what QSECURITY level you
should be at, or what your Password Change Interval should be.  It just
says that you must have adequate controls in place, and you must get an
external auditor to agree with you (in writing) that there are adequate
controls in place.  All of the auditors are playing this one very
nervously because they remember what happened to Arthur Anderson.

(An Arthur Anderson "Partner" lied, and committed other crimes, in an
effort to cover up Enron's financial misdeeds.  Because he was a
"Partner", the entire corporation was liable for his crimes, and so the
company was convicted of a felony.  Felons are not allowed to hold
corporate charters, and so on the very day that Arthur Anderson was
convicted of a felony, it lost its license to do business as a
corporation.  On that day a 100+ year old icon of American business just
ceased to exist.)

So there is no _one_ way to "circumvent SOX.   You have (or should have)
a security policy, and then you should manage your business according to
that policy.  Your auditors will generally be happy if they can measure
your adherence to your own written policy, and grade you on how well you
are doing what you said you would do.   

That is the essence of SOX.  Do good things.  Manage your company so
that people can not steal from the business without being detected.  If
you do this, you are well on your way to SOX Compliance.   If you don't
do this, maybe you ought not to be the one running the business (or its
IT assets)?

JMHO,

jte




--
John Earl | Chief Technology Officer
The PowerTech Group
19426 68th Ave. S
Seattle, WA 98032
(253) 872-7788 ext. 302
john.earl@xxxxxxxxxxxxx
www.powertech.com 
Celebrating our 10th Anniversary Year!
 

 
This email message and any attachments are intended only for the use of
the intended recipients and may contain information that is privileged
and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message, or by telephone, and delete
the message from your email system.
--