Sarbanes-Oxley Compliance (Was DB2 Users) -- BPCS-L

Jim

 

Because our compliance product is being used by several companies for SOX
remediation, I have been involved with addressing gaps identified by many
different auditing companies. This is the first time I have encountered a
concern raised about users/programmers ability to see data. More often, it
is ability to change data, which I realize can also be done through the
tools you mention. Are you being asked to limit read access?

 

As you probably know, the SOX exposure is not only through non-BPCS
capabilities. For example using legitimate programs and authorized access an
errant employee can change, customer addresses, place an order, and change
the customer address back. Using this technique they can have material
shipped to their own homes.  How about making inappropriate G/L entries
using standard BPCS programs, or giving a buddy a real deep discount?

 

The first line of defense for most companies has been to rely on printing
out huge reports which someone supposedly checks monthly and signs off. We
all know how inefficient and impractical this can be.  

 

I appreciate that triggers and journals raise concerns around system impact,
but we have found that if implemented correctly, the impact is minimal. An
alternative, then, is to monitor for database changes using some external
and electronic facility which captures database changes regardless of the
vehicle for change; DBU, SQL, BPCS, ODBC etc. One could then configure
special exception conditions to escalate notifications to supervisory
personnel, eliminating the need to review thousands of database changes for
that one possible inappropriate change. Additionally, only relevant audit
records can be siphoned off and kept in a historical database which
eliminates the need to keep journal receivers around. 

 

Good luck with your project.

 

Cheers

Ardi

 

 

-----Original Message-----
From: bpcs-l-bounces@xxxxxxxxxxxx [mailto:bpcs-l-bounces@xxxxxxxxxxxx] On
Behalf Of Reinardy, James
Sent: Wednesday, June 09, 2004 4:18 PM
To: bpcs-l@xxxxxxxxxxxx
Subject: DB2 Users

 

Hello All,

 

We are running BPCS 6.04 on iSeries.  I am trying to understand the

relationship between iSeries users, BPCS users and DB2 file access.  The

concern is arising because of Sarbanes-Oxley.  Our auditors are

suggesting that we need to lock down file privileges against the BPCS

database, but we are a little unclear about what user BPCS uses for data

access against DB2.  Is it the individual user that is logged into BPCS,

that user with a changed profile(SSA perhaps vs. *PUBLIC), or some other

generic user?  

 

The idea here is to restrict access on a file by file basis for

AS400Query, SQL queries, ODBC connections, etc.  However, we want to be

sure if we lock things down that we don't break BPCS screens and batch

jobs.  Any suggestions on how to improve our understanding in this area

would be appreciated.

 

Regards,

 

Jim Reinardy

Director-IS

Badger Meter, Inc.

Milwaukee, WI

_______________________________________________

This is the SSA's BPCS ERP System (BPCS-L) mailing list

To post a message email: BPCS-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/bpcs-l

or email: BPCS-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/bpcs-l.