RE: Sarbanes-Oxley Compliance (Was DB2 Users)

Ardi,

The auditors are not necessarily raising concerns about read access,
they are more concerned that we have ways of auditing user access and
obtaining approval of the current scheme from our user data owners.  My
concern is that we are in a position that I will have a hard time
defending, the "security by obscurity" mentioned in one of Milt's
product related emails.  So far, that has been the theme of our Sarbox
implementation, the auditors are not quite as concerned about what is
being done as long as it is approved, documented and audited after the
fact.  I have thought about the read access and decided that it truly is
an internal issue, since a query cannot by definition impact the
financial numbers.

On the BPCS side itself, we are pretty comfortable.  We have good
reporting capabilities for BPCS user profiles that was developed some
years ago.  Using that, I can answer most questions.  We are putting a
policy in place that our owners group will review the matrix yearly and
approve the security granted to the rest of the users for objects that
fall into their area.  The approval step on the front end has been in
place for a while, only the after the fact audit is new. We have also
implemented triggers and some exception reporting for a few key files
identified by our internal auditor for more careful monitoring.  This is
very much in line with the strategy outlined in your last paragraph.

Thanks for the reply,

Jim

-----Original Message-----
From: bpcs-l-bounces@xxxxxxxxxxxx [mailto:bpcs-l-bounces@xxxxxxxxxxxx]
On Behalf Of Ardi Batmanghelidj
Sent: Wednesday, June 09, 2004 6:07 PM
To: 'SSA's BPCS ERP System'
Subject: Sarbanes-Oxley Compliance (Was DB2 Users)

Jim

 

Because our compliance product is being used by several companies for
SOX remediation, I have been involved with addressing gaps identified by
many different auditing companies. This is the first time I have
encountered a concern raised about users/programmers ability to see
data. More often, it is ability to change data, which I realize can also
be done through the tools you mention. Are you being asked to limit read
access?

 

As you probably know, the SOX exposure is not only through non-BPCS
capabilities. For example using legitimate programs and authorized
access an errant employee can change, customer addresses, place an
order, and change the customer address back. Using this technique they
can have material shipped to their own homes.  How about making
inappropriate G/L entries using standard BPCS programs, or giving a
buddy a real deep discount?

 

The first line of defense for most companies has been to rely on
printing out huge reports which someone supposedly checks monthly and
signs off. We all know how inefficient and impractical this can be.  

 

I appreciate that triggers and journals raise concerns around system
impact, but we have found that if implemented correctly, the impact is
minimal. An alternative, then, is to monitor for database changes using
some external and electronic facility which captures database changes
regardless of the vehicle for change; DBU, SQL, BPCS, ODBC etc. One
could then configure special exception conditions to escalate
notifications to supervisory personnel, eliminating the need to review
thousands of database changes for that one possible inappropriate
change. Additionally, only relevant audit records can be siphoned off
and kept in a historical database which eliminates the need to keep
journal receivers around. 

 

Good luck with your project.

 

Cheers

Ardi

 

 

-----Original Message-----
From: bpcs-l-bounces@xxxxxxxxxxxx [mailto:bpcs-l-bounces@xxxxxxxxxxxx]
On Behalf Of Reinardy, James
Sent: Wednesday, June 09, 2004 4:18 PM
To: bpcs-l@xxxxxxxxxxxx
Subject: DB2 Users

 

Hello All,

 

We are running BPCS 6.04 on iSeries.  I am trying to understand the

relationship between iSeries users, BPCS users and DB2 file access.  The

concern is arising because of Sarbanes-Oxley.  Our auditors are

suggesting that we need to lock down file privileges against the BPCS

database, but we are a little unclear about what user BPCS uses for data

access against DB2.  Is it the individual user that is logged into BPCS,

that user with a changed profile(SSA perhaps vs. *PUBLIC), or some other

generic user?  

 

The idea here is to restrict access on a file by file basis for

AS400Query, SQL queries, ODBC connections, etc.  However, we want to be

sure if we lock things down that we don't break BPCS screens and batch

jobs.  Any suggestions on how to improve our understanding in this area

would be appreciated.

 

Regards,

 

Jim Reinardy

Director-IS

Badger Meter, Inc.

Milwaukee, WI

_______________________________________________

This is the SSA's BPCS ERP System (BPCS-L) mailing list

To post a message email: BPCS-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/bpcs-l

or email: BPCS-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/bpcs-l.

 

 

_______________________________________________
This is the SSA's BPCS ERP System (BPCS-L) mailing list To post a
message email: BPCS-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change
list options,
visit: http://lists.midrange.com/mailman/listinfo/bpcs-l
or email: BPCS-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives at
http://archive.midrange.com/bpcs-l.