[Nottingham] Sarbannes Oxley experiences

[Matt Bunter]

Robert Postill wrote:

>Hi,
>Ages ago an e-mail from Matt Bunter landed about this, as it happens
>I've recently started a contract for a bank and have had to talk a deal
>of Sarbanes Oxley with other folk while trying to get an LMS (Learning
>Management System) up and running...I can't say too much as I'm under
>NDA but some things I have noticed are:
>* It seems that SOX compliance for a system is based on the following:
>	+Auditing: nothing should happen without it being logged.
>	+Encryption: No more telnet for you :)
>	+Verification: You can't authenticate too many times...sigh.
>  
>
I'm seeing pretty much the same sorts of things.

One of the biggest problems is the use of 'system' accounts for stuff 
like Oracle, or batch jobs, or sys admins on servers.
Telnet (along with rlogin and the like) went a while ago, yet those that 
have 'closed' PCs and laptops can't install Putty for ssh - fun, fun, fun.
Our storage guys are happy - they get an extra couple of tera just to 
store all the logging data on.

One of the areas that I see as un-workable is the separation of duties. 
That is unless you clone people very quickly or start hiring. There is 
also the request, accept, approve issue for change management. We are 
having all sorts of fun with this at the moment - people starting to 
play too much politics.

>*Training turns out to be a massive piece, you need to be able to prove
>no-one is ignorant (hence the LMS).
>
I'm finding it difficult to understand how that is going to be measured.

>  This turns out to be time consuming
>and tricky, because of both the amount of training to be delivered and
>the number of people you need to give it to (pretty much everyone).
>*This is one of those areas where the big firms (PWC,CGEY, Accenture,
>KPMG et al) are raking it in, frankly the stench of consultancy overload
>hangs heavy in the air at most places (I'll hasten to add that I'm
>possibly part of that stench) and I can't see it getting better for a
>while yet.  It's likely that people will be taken to the cleaners for a
>few years yet.
>  
>
Plus ça change.

Matt