Jordan
Tue May 06 08:05:54 PDT 2008
Thank you for your input. Unfortunately SOX regulations are still very
subjective and it depends on who your auditing company is (KPMG for us), who
the auditor is, and who their supervisor is. This is why SOX SUX.
Generally we must make a reasonable policy and SOX mostly makes sure you are
following your own policies.
But SOX is not a system like ISO9000 where you can say that you make crappy
stuff and you make sure you follow the instructions to the letter on that
crappy stuff you make. Reasonable efforts must be made to secure the
company's security and data. But what is reasonable in whose eyes?
For example, I could create a policy that says I only backup once a week,
but is it very reasonable for them to conclude that it is deficient because
if the server crashed it would cost $X in either lost productivity or
revenue or whatever? This is to much exposure in their opinion no matter if
I thing that $X is reasonabl (I do backup daily).
On passwords I can easily argue that simply having a 3 attempt lockout in
itself is more than ample protection against any possible password hack.
There is no difference in Joe telling someone or writing under his keyboard
that his password is "9732" or "L+26h!q".
Although a lot of people can get hacked one way or another it is very rare
that a password cracker is the means by which they gain access so complex
passwords and regular changes are most a "feel good" way of inaffectively
contering the most common security threats to IT. Most of the time it
deliberate like a current or former employee selling secrets. Sometimes it
is a trojan that can just as easily monitor you typing "9732" or "L+26h!q".
And a lot of times it is just someone calling up on the phone and your
employees are chatter boxes.
"Phillip Windell" <philwindell@hotmail.com> wrote in message
news:efpsEcsrIHA.4560@TK2MSFTNGP03.phx.gbl...
> Here's an example of a set of Password Policies that you can "promise" to
> the SOX auditors.
>
> Policy #1: We will force a password change of Accounts that represent
> employees every 60 days
>
> Policy #2: We will force a password change of maintanence accounts that do
> not represent employees (eg. Administrator accounts) every 120 days. (or
> whatever you choose).
>
> Policy #3: We will enforce stronger password complexity for Service
> Accounts not used for employee logins. Accounts will not have a forced
> password change policy (or you could force an Annual change every 365
> days).
>
> Then SOX auditors would expect you to follow these policies.
>
> In other words be more specific in your "promises" and be careful not to
> shoot yourself in the foot. If you feel it will take an "act of
> congress" to alter the policies that have been set then,...that is no
> excuse to not do it,...it just means "congress" needs to get busy and do a
> better job on the second try.
>
> --
> Phillip Windell
> www.wandtv.com
>
> The views expressed, are my own and not those of my employer, or
> Microsoft,
> or anyone else associated with me, including my cats.
> -----------------------------------------------------
>
>
>