×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

SarBox Lawsuit Could Rewrite IT Compliance Rules

kdawson posted more than 4 years ago | from the sluice-gate-to-security-spending dept.

Security 124

dasButcher notes that the Supreme Court will hear arguments next week brought by a Nevada accounting firm that asserts the oversight board for the Sarbanes-Oxley Act is unconstitutional. If the plaintiffs are successful, it could force Congress to rewrite or abandon the law used by many companies to validate tech investments for security and compliance. "Many auditing firms have used [Sarbanes-Oxley Section] 404 as a lever for imposing stringent security technology requirements on publicly traded companies regulated by SOX and their business partners. SOX security compliance has proven effective for vendors and solution providers, as it forces regulated enterprises to spend billions of dollars on technology that, many times, doesn’t prevent security incidents but does make them compliant with the law."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

124 comments

not found (5, Funny)

Anonymous Coward | more than 4 years ago | (#30288564)

I tried to look up this 404 thing, but I couldn't find it anywhere.

Re:not found (2, Funny)

sbeckstead (555647) | more than 4 years ago | (#30288956)

I tried to look up this 404 thing, but I couldn't find it anywhere.

That's funny I found it all over the web. But I couldn't find anything else...

Fuck you government niggers (-1, Troll)

Anonymous Coward | more than 4 years ago | (#30288590)

every last one of you kike zionist jew fags.

Re:Fuck you government niggers (0)

Anonymous Coward | more than 4 years ago | (#30289258)

Shh, Adolph, Shh They think you are dead.

Budgest re-adjustment... (1)

bluesatin (1350681) | more than 4 years ago | (#30288592)

Well at least now they'll spend all that money on making sure things are actually secure!

Re:Budgest re-adjustment... (2, Insightful)

halcyon1234 (834388) | more than 4 years ago | (#30288666)

And to do that, they'll need a definition of "secure". One that everyone can agree on. A standard definition, on might say. And to ensure everyone who says they're secure actual is, it might be a good idea to draft a formal document that explicitly lays out those standards, as well as methods for one company to ensure another company meets those standards. Heck, if it's that important, it might be worth thinking about turning that document into a law...

I Know! (4, Funny)

fuzzyfuzzyfungus (1223518) | more than 4 years ago | (#30288904)

In order to ensure security against DOS attacks, I think it would be reasonable to mandate that all vendors be required to prove that their programs will halt in finite time, given an arbitrary input.

That seems like a wholly reasonable request, not too burdensome, and should improve security.

Re:I Know! (1)

ThatMegathronDude (1189203) | more than 4 years ago | (#30289010)

Easy enough.

You heard the man, noone use the Internet until this is done.

Re:I Know! (3, Funny)

Bigjeff5 (1143585) | more than 4 years ago | (#30289150)

You heard the man, noone use the Internet until this is done.

I don't see why the Noones [wikipedia.org] weren't allowed to use the internet before, or why they'll have to stop when this is over, but it's nice that you're willing to let them use it a little bit, I guess.

Or perhaps you meant "no one"?

Re:I Know! (1)

maxume (22995) | more than 4 years ago | (#30289528)

Is it okay if sometimes the program doesn't do anything useful with the input?

Re:I Know! (3, Funny)

Obfuscant (592200) | more than 4 years ago | (#30289672)

Is it okay if sometimes the program doesn't do anything useful with the input?

Slashdot is already patented, isn't it?

Re:I Know! (0)

Anonymous Coward | more than 4 years ago | (#30292752)

You joke, but I suspect a lot of vendors would be able to do everything they need to with Deciders.

Re:Budgest re-adjustment... (1)

Red Alastor (742410) | more than 4 years ago | (#30288998)

What about realizing that it's impossible to define security for the vast diversity of setups we all use and forget about compliance but instead draft a list of bad stuff that shouldn't happen (leaking customer info for instance) and make a law that says that companies have to do whatever they have to to avoid the things on that list. Incident would be interpreted as negligence and heavily fined.

Re:Budgest re-adjustment... (1)

ThatMegathronDude (1189203) | more than 4 years ago | (#30289060)

You may as well make it a requirement to spend X funds on security, because requirements like that guarantee that it will be cheaper to pay the fines than to "do whatever they have to".

Re:Budgest re-adjustment... (2, Interesting)

Bigjeff5 (1143585) | more than 4 years ago | (#30289430)

Not if the fines scale in relation to the amount of information that was lost, and compensatory damages are included requiring payment of the estimated damages for each individual person's data loss (not an average spread to everyone). Of course the individual data evaluations must be done by a firm chosen by the courts, and paid in full by company that lost the data.

It's pretty easy to structure the law such that almost any company will be bankrupted by failing to secure data. That would also be silly, because no company can guarantee that no data will ever be stolen, so if you place the requirements too heavily on the fact that the data went missing, and disregard the amount of effort the company put into keeping the data safe, you could be destroying companies that do not desearve to be destroyed.

Generally, the best way to handle these things is to keep the language of the law vague enough that it can be decided on a case by case basis - i.e. the company did their best to protect their data, and so should recieve little or no punishment.

SarBox is the worst possible solution - it mandates security measures that are ineffective (because in the real world, the mandated measures were obsolete after a few months time) that are expensive to impliment and yield little or no added security.

One visible example is banking - you now have an image tied to your account login to prevent phishing. However, most people don't pay too much attention to it, and wouldn't care if it were different. Or, they'll use it that one time, it doesn't work like it is supposed to (because it's actually at a phishing site), they try again later and now it works (because it is now actualy at the bank website). Since it works, it must have just been some minor hiccup, and all is right with the world. Right? No, they just got their account access stolen, and if a person is smart they'll slowly siphon the money off instead of withdrawing large chunks of cash.

It's also easy to harass someone now, because of the strict regulations if you manage to find someone's account (or at a big bank, just randomly choose numbers) but can't access it, just plug a bunch of gibberish in a few times and they don't have access to their own money. That can be devastating, and it's untraceable if the harasser is using a public terminal.

SarBox aught to have been more vague, and focused on the good faith effort to secure a client's data. People get into trouble when they aren't handling data using the industry's best practices that way, for if the institution never bothered to check what the latest best practices were, they obviously weren't too interested in data security.

Setting it up that way, instead of with complex rules and regulations, give it the flexibility to adapt and apply to each situation, and there is no risk of it ever going obsolete, unlike the current SarBox law.

Re:Budgest re-adjustment... (2, Interesting)

Fulcrum of Evil (560260) | more than 4 years ago | (#30289572)

One visible example is banking

My banking site decided that 2 factor auth meant that I had to type my info into a flash widget that analyses the typing style - I sort of doubt this is even half a factor. The CC sites I use demand I have 2 passwords - 1.1 factor auth. Basically, I'm saying that it's crap.

Re:Budgest re-adjustment... (2, Interesting)

Bigjeff5 (1143585) | more than 4 years ago | (#30291484)

Exactly.

Really, two factor authentication only offers meager protection from a subset of attacks, yet I can tell you that implimenting it at each company was probably a $50k project, or, for the less efficient companies, a $200k project.

ROI for Sar-Box is shit. We've got a hell of a lot more expenses for a teeny bit more security.

Re:Budgest re-adjustment... (1, Offtopic)

Red Flayer (890720) | more than 4 years ago | (#30289164)

OT, but re your sig:

Slashdot anagrams to "Sad Sloth"

You do know that Red Alastor anagrams to "Retard Also", right?

It also anagrams to "Trades Oral".

Re:Budgest re-adjustment... (1)

omnichad (1198475) | more than 4 years ago | (#30289522)

That sounds so logical and reasonable. Too bad that fact prevents it from being included in a law.

Re:Budgest re-adjustment... (1)

DarkOx (621550) | more than 4 years ago | (#30289776)

Probably because nobody really wants that. The point of most polices is ultimately to ensure that there is no responsibility for acts of GOD. Bad stuff is always going to happen. You can have good policies in place and generally do a good job of administration and still get hacked; its possible. Someone you thought you could trust could walk away with sensitive data.

I think most people agree that if you can show that you did your due diligence and complied with a good solid set of requirements and something still happens that its not your fault its just something that happened. That lets you keep your job; otherwise someone has to take the fall for political reasons if nothing else; and that person is probably some sysadmin who may or may not have been doing a good job. You can't prevent every emergency, but you can take and show that you took reasonable precautions; its actually a good thing when what those precautions entail is formalized.

Re:Budgest re-adjustment... (1)

guruevi (827432) | more than 4 years ago | (#30289180)

Or they'll be able to invest that money somewhere else and become a better business. The things SOX 'protects' against are 1) outdated and 2) remotely plausible which doesn't actually protect anything. So business will still not protect anything however they won't have to invest in lawyers and consultants to implement rules that only bother the sysadmins and general productivity.

Re:Budgest re-adjustment... (1)

turbidostato (878842) | more than 4 years ago | (#30292376)

"Well at least now they'll spend all that money on making sure things are actually secure!"

Why, oh why!!!???

No sir: they'll spend all that money on making sure they earn even *more* money. What else?

SarBox is always the excuse (2, Insightful)

blitzkrieg3 (995849) | more than 4 years ago | (#30288634)

How about rewriting the law so that every request to my IT department doesn't result in "This functionality would break SarBox compliance", regardless of how related to SarBox the request actually is?

Re:SarBox is always the excuse (0)

Anonymous Coward | more than 4 years ago | (#30288738)

What type of requests are you talking about? Without such details, you sound like a typical grousing user who doesn't understand the hell that our knee-jerk Congress has forced us into.

Re:SarBox is always the excuse (1)

b4dc0d3r (1268512) | more than 4 years ago | (#30293034)

http://it.slashdot.org/comments.pl?sid=1462988&cid=30289812 [slashdot.org]

Yeah, but you need to look at the bright side of SOX for us (educated security geeks). When someone wants to do something really dumb like put a web app into production with no logging and no security, you can just tell them to fuck off, because of SOX. Also, if you're a security consultant with half a brain and know how to setup auditing on *nix related systems you can make a lot of money consulting.

SOX is worth it just for being able to tell a stupid developer that he can't do something that puts the security of my systems in jeopardy.

The circle is complete.

Re:SarBox is always the excuse (1)

mujadaddy (1238164) | more than 4 years ago | (#30290134)

How about rewriting the law so that every request to my IT department does result in "This functionality would break SarBox compliance", regardless of how related to SarBox the request actually is?

T,FTFY

Re:SarBox is always the excuse (3, Informative)

IrquiM (471313) | more than 4 years ago | (#30290272)

How about rewriting the structure of the management as they clearly do not understand what 404 is all about?

404 doesn't tell you to do anything. It only ask you to show that you have internal controls and that they are deemed sufficient for a company of the type/size you're working for, and that you actually is following your controls. The auditors only task (related to 404) is to check that you do what you are saying and make a judgment on their observations.

Re:SarBox is always the excuse (3, Informative)

Bigjeff5 (1143585) | more than 4 years ago | (#30291604)

404 doesn't tell you to do anything. It only ask you to show that you have internal controls and that they are deemed sufficient for a company of the type/size you're working for, and that you actually is following your controls.

That's the rub, and that's why this guy is suing. He owned a small accounting firm because, no matter what he did, the SarBox auditor's board determined what he was doing wasn't good enough, and the only changes they would accept would prevent him from turning a profit.

The SarBox board killed a legitimate business that was operating in good-faith compliance.

That's far, far too much power for a bunch of nameless beureaucrats.

Re:SarBox is always the excuse (1)

Bigjeff5 (1143585) | more than 4 years ago | (#30291930)

He owned a small accounting firm that went out of business, damnit.

Preview is my friend.

Re:SarBox is always the excuse (2, Informative)

Bigjeff5 (1143585) | more than 4 years ago | (#30290776)

The sad fact is, it probably WOULD break SarBox compliance, it's frickin retarded.

Just about everything a company does relates to SarBox either directly or indirectly, so often an IT department will become terrified to make the smallest change to avoid inadvertantly breaking compliance, or making a change while staying compliance will require more money than the change is worth.

I.e. if you request a change to save $2000 a month in productivity losses, but maintaining the change will cost $4000 a month, it does not make sense to make the change. Period. SarBox has significantly raised the cost of even minor IT changes that have anything to do with private data (even indirectly).

Rule #1 of government.... (2, Informative)

croftj (2359) | more than 4 years ago | (#30288664)

The primary purpose of every law passed has the creating 1 or more jobs, whether they are productive jobs or not.

Re:Rule #1 of government.... (1)

BitHive (578094) | more than 4 years ago | (#30288782)

Wow, thanks for that keen insight into government! Maybe next you can give us a one-line treatise on the irrelevance of unions.

Re:Rule #1 of government.... (3, Informative)

gandhi_2 (1108023) | more than 4 years ago | (#30288848)

I'll field that one:

Unions are irrelevant.

Re:Rule #1 of government.... (1)

daveatneowindotnet (1309197) | more than 4 years ago | (#30289134)

It'd be nice if they were irrelevant, unfortunately all they are managing to do is drive up the cost of everything the government pays for and shield incompetent and even dangerous employees working for the government while providing no protection for the american worker from big business. Or at least that is how they work in America, that and they bury Jimmy Hoffa in Giants Stadium.

Re:Rule #1 of government.... (2, Insightful)

Anonymous Coward | more than 4 years ago | (#30290168)

I don't know. Unions have brought us a couple nice things here in the US until recently:

8 hour workdays.
5 hour work weeks.
Our 8 year old kids out of the coal mines.
Worker's comp for injuries.
Unemployment.
Labor laws.
Banning of blacklists.
Minimum wage.
Vacation leave.
Sick leave.
Liability.
Basic safety.

With all the bellyaching about unions, I think people would love it if they would have to work 12-16 hour days, 7 days a week with their kids doing 12 hour days right by them. Of course, if anyone complained about it, they would be flagged in a database, and guarenteed to never have a job again, just like a felon. Get sick? Work, or have unlimited time off when fired for missing a single day. Also, I guess people don't mind working all this for $100 a month, which is what would be paid without the min wage laws.

No, unions may not be perfect, but the workaday life would be a lot different and a lot worse. But they are the same people who brought you the weekend.

Re:Rule #1 of government.... (1)

dgatwood (11270) | more than 4 years ago | (#30290358)

8 hour workdays.
5 hour work weeks.

Really? So you work a single 8-hour shift every second week that spans from Saturday night to Sunday morning? How odd.

Re:Rule #1 of government.... (2, Insightful)

cayenne8 (626475) | more than 4 years ago | (#30292672)

True, the unions served their function in the early days of their existance, but, they are an anachronism today, and serve more to hurt workers and business than they do good in this day.

They are a hindrance in the 21st century USA.

Re:Rule #1 of government.... (2, Funny)

Gudeldar (705128) | more than 4 years ago | (#30288926)

A comment critical of government that isn't +5?

This is Slashdot I'm reading right?

Re:Rule #1 of government.... (1, Funny)

Anonymous Coward | more than 4 years ago | (#30289056)

As part of a prank, we have replaced Slashdot with the Daily Kos. Let's see what happens!

Re:Rule #1 of government.... (1)

megamerican (1073936) | more than 4 years ago | (#30289278)

Wrong.

The primary function of government is to pretend to fail.

That way they get more money and power to correct the failure. If the purpose was to "fail" then it is no longer a failure and should be considered an accomplishment.

Anytime you hear "failure of..." anything involved with government replace it with accomplishment.

SarBox? (4, Informative)

omnichad (1198475) | more than 4 years ago | (#30288772)

I've seen SOX, but never SarBox. If you're going to CamelCase, do it right: SarbOx.

Re:SarBox? (0)

Anonymous Coward | more than 4 years ago | (#30288996)

"SarBox" is frequently used in marketing publications.

At a previous job I had a marketing idiot come up to me and ask about our compliance. He kept using that term, and I had no idea what he meant at first.

But like you mentioned, most auditors, techs and engineers prefer "SOX".

Re:SarBox? (1)

stefanlasiewski (63134) | more than 4 years ago | (#30289266)

No no no, you have it all wrong. You didn't need to go through all that effort, and all that detail.

All I meant was that I wanted to monitor a Unix box using Sar [wikipedia.org] .

That should have been easy, and I guess it's my fault for not being clear. But look at all this paperwork you generated... wow you guys sure did work hard didn't you. Sorry for the misunderstanding...

SOX is choking our companies, kill it. (4, Insightful)

SuperKendall (25149) | more than 4 years ago | (#30288880)

I have worked for large companies in the past, and SOX is seriously undermining the ability to make changes, or indeed for rational process to take place in the daily operation of IT.

SOX was meant to prevent another ENRON, but those things will happen regardless of rules - look at the collapse of organizations like FannieMae, well after SOX was in place. Instead we are harming all large businesses just to prevent a one-off case that we are not really preventing anyway!

Kill SOX and let companies get back to what they do best, instead of spending a lot of time simply deciding what compliance means and using the rules to build (even more) fiefdoms within giant companies.

Re:SOX is choking our companies, kill it. (2, Insightful)

Knara (9377) | more than 4 years ago | (#30288916)

There's a large deal of truth to this. If you want to do (or not) do something in a large company these days, the way to justify it is to write up a proposal that uses SOX or HIPAA (preferably both) a few dozen times. Your chance of getting money for it increases exponentially.

Re:SOX is choking our companies, kill it. (0)

Anonymous Coward | more than 4 years ago | (#30288988)

I've worked in companies where SOX was used to make processes more stringent and intelligent. And I work in a company where SOX has allowed the accounting/finance department to dictate all manner of corporate and IT policy. In order to survive SOX, companies need keen leadership -- one that will prevent the sort of "SOX run amok" mentality and provide solid guidance to the company as a whole.

You can only lead on so many topics (1)

SuperKendall (25149) | more than 4 years ago | (#30289588)

I've worked in companies where SOX was used to make processes more stringent and intelligent. And I work in a company where SOX has allowed the accounting/finance department to dictate all manner of corporate and IT policy.

Yes it is POSSIBLE to have rational adherence to SOX. But that seems far rather the exception than the rule.

In order to survive SOX, companies need keen leadership -- one that will prevent the sort of "SOX run amok" mentality and provide solid guidance to the company as a whole.

The problem is that even if they do succeed at that, it's a huge drain to provide truly effective leadership - and all that energy and manpower that goes into smart adherence to a loose standard, could have gone instead into leadership in product development or marketing or anything that actually provided an iota of real value to the world.

Step back and think about the big picture, do we really want brilliant leaders across the nation focused simply on regulatory compliance? What a waste of human potential!

Re:You can only lead on so many topics (1)

wtbname (926051) | more than 4 years ago | (#30289870)

Step back and think about the big picture, do we really want brilliant leaders across the nation focused simply on regulatory compliance? What a waste of human potential!

Hi, you've met reality right? 99% of what goes on in this world is a waste of human potential.

Including this post!

Re:SOX is choking our companies, kill it. (3, Interesting)

Archangel Michael (180766) | more than 4 years ago | (#30289128)

You can usually make the case for MOST government regulations of businesses. Laws aren't for the lawful, but for the unlawful. Wherever the line is drawn, there will always be people who skirt around at that edge.

If laws and regulations move too far away from the edge, the laws themselves become the end of, not the means of, compliance. Everyone becomes a lawbreaker, and there is no room for discretion.

You can see this in all the zero tolerance laws in place. Zero tolerance laws do not stop anything, and just make more people criminals, like little boys coming to kindergarten with a camping fork, knife, spoon gadget getting expelled because he brought a knife to school. Zero Tolerance! No excuses! He Broke the LAW!!!!

I've written on this before. I call it the "There ought to be a law" syndrome. Everytime someone says "there ought to be a law", someone needs to ask a simple question "WHY?". WHY is it that the existing laws aren't applicable? How will this new law break the necessary shades of gray around the edges? Asshats live there, we all agree. Changing this isn't going to change the asshats.

Sometimes the only thing that will change the asshats is a good old fashion asswhooping.

Re:SOX is choking our companies, kill it. (1)

BlueBoxSW.com (745855) | more than 4 years ago | (#30289376)

Also look at HealthSouth, which never would have been found out if it weren't for SOX.

I think we need to keep it around, but a better breed of companies need to come around to take the pain out of it.

Re:SOX is choking our companies, kill it. (3, Insightful)

Zalbik (308903) | more than 4 years ago | (#30289384)

SOX was meant to prevent another ENRON, but those things will happen regardless of rules - look at the collapse of organizations like FannieMae, well after SOX was in place.

Huh? Do you even have a clue what caused the collapse of Enron vs. what caused the collapse of Fannie Mae?

To use the mandatory car analogy, your argument is something like:
I put winter tires on my car, but then I was t-boned at an intersection when I ran a red light. See, winter tires don't help prevent accidents!

The two scenarios were completely different. Most of what SOX requires for IT should fall under good IT practice anyways. It basically requires controls to be implemented on financial systems in order to prevent fraudulent changes to financial data.

Now I realize people at some corporations have used SOX as a big bat to force in their own pet IT projects. Or as a way of preventing any IT changes that they don't agree with, but that isn't the fault of SOX.

If people are building personal fiefdom's within corporations, they'll do so with or without some legislation to use as an excuse.

Re:SOX is choking our companies, kill it. (2, Insightful)

SuperKendall (25149) | more than 4 years ago | (#30289794)

Huh? Do you even have a clue what caused the collapse of Enron vs. what caused the collapse of Fannie Mae?

It's a loose analogy to be sure, but think about it - in both cases shareholders (or stakeholders if you like in the case of FM) were lied to about financial stability. Fannie Mae claimed there were "no issues" just months before the collapse, while hiding the true extent they were in peril with the huge number of sub-prime loans they were carrying.

If you think about it there are way more parallels than it seems at first glance. They were manipulating the output of supposed financial stability, in the end the OUTPUT is what matters here.

It basically requires controls to be implemented on financial systems in order to prevent fraudulent changes to financial data.

But in requiring this, it also mandates the companies be audited. Which means the companies performing the audit dictate what practices you follow to pass the audit. Which means that instead of rational processes meant to actually prevent fraudulent changes to financial data, you are making the changes required simply to pass the audit - just like many schools "teach to the test" when the only metric is standardized tests meant to measure school performance.

Instead we should have devastating fines or other punishment for companies that are found to have problems preventing fraudulent changes to data, so that companies could build in meaningful safeguards around ACTUAL financial data (with the ROI being the prevention of said fines so security groups could get funding), as opposed to safeguarding anything that smells like financial data to auditors (with the auditors of course paid more the more systems they have to audit). Let auditors audit crooks, not the innocent. Then we could also document the real bypasses to processes instead of having them but having to pretend they do not exist because auditors and high-level execs Cannot Know.

Re:SOX is choking our companies, kill it. (4, Interesting)

illumin8 (148082) | more than 4 years ago | (#30289812)

I have worked for large companies in the past, and SOX is seriously undermining the ability to make changes, or indeed for rational process to take place in the daily operation of IT.

Yeah, but you need to look at the bright side of SOX for us (educated security geeks). When someone wants to do something really dumb like put a web app into production with no logging and no security, you can just tell them to fuck off, because of SOX. Also, if you're a security consultant with half a brain and know how to setup auditing on *nix related systems you can make a lot of money consulting.

SOX is worth it just for being able to tell a stupid developer that he can't do something that puts the security of my systems in jeopardy.

Re:SOX is choking our companies, kill it. (1)

blitzkrieg3 (995849) | more than 4 years ago | (#30290622)

You're exactly the type of person I was talking about. [slashdot.org]

Re:SOX is choking our companies, kill it. (3, Insightful)

FatSean (18753) | more than 4 years ago | (#30290952)

So you're the developer who doesn't think about logging, security or any other kind of operational issue when you develop? Sounds like your company has you in the right box.

Re:SOX is choking our companies, kill it. (2, Insightful)

Bigjeff5 (1143585) | more than 4 years ago | (#30293016)

It sounds like you're a dumbass who doesn't give a shit about your clients' data if you think you don't need authentication and logging for a web app. You're about the only type of idiot SOX actually protects us from. If IT guys didn't need to SOX to tell dumbasses like you to fuck off, we wouldn't be stuck with SOX in the first place.

I hope you don't do work for any systems that hold my data, that's all I'm saying.

Re:SOX is choking our companies, kill it. (4, Interesting)

pauls2272 (580109) | more than 4 years ago | (#30289832)

>I have worked for large companies in the past, and SOX is seriously undermining the ability to make changes, >or indeed for rational process to take place in the daily operation of IT.

Absolutely agree. Although the smart companies are now just giving SOX lip service and ignoring it pretty much entirely. The company I work for now, has all kinds of memos issued saying they support SOX, hotlines, etc but it doesn’t impact real work.

When SOX hit, the company I worked at, the Accounting dept came out with the required SOX doc and it was non negotiable. They had worked with an auditor that knew nothing of IT and it showed. I had to attend a week long class on how to fill out the dozens of new SOX forms (all manual paper forms) that were to be kept in notebooks!

    I was told that ALL CHANGES had to go on the CEO change calendar and that we would become very familiar with the assistant that scheduled the CEO change meetings. All changes had to have the 10 pounds of forms and 10+ signatures before you could implement. There also had to be “separation of duty” which meant if you were making the change, someone else had to implement it I said “great, your gonna hire another IT group – one to implement and another to install and test”. Of course, they never did this and this “separation of duty” was never followed.

It was COMPLETE AND TOTAL NONSENSE designed by people who had no clue what they were doing or what the real world was like. Yeah, I need to put a hotfix on a server to fix a problem – I’m gonna wait 2-3 months to get on the CEO change calendar and have a meeting with the CEO But trying to talk to the accounting morons was useless – they insisted every change had to follow their written in stone procedure

After a few weeks of complaining, the process was “refined” by having Small, Medium and Large changes and Large changes were only the changes had to go thru the above process. The difference being the number of “elements” in the change – but “element” wasn’t defined by the accounting/auditing people. The solution became that all IT changes were SMALL since there was only 1 datacenter so 1 element changing!

The fact is that SOX was doomed to fail because you can’t impose rigorous rules on US companies if foreign companies don’t have to follow the same rules – it is a Global world out there and adding huge overhead to your domestic companies just mean more outsourcing and more domestic bankruptcies as they can’t compete with slimmer/trimmer overseas companies.

Re:SOX is choking our companies, kill it. (2, Insightful)

hemp (36945) | more than 4 years ago | (#30290128)

I think you don't understand segregation of duties. It doesn't mean having a separate IT group, it means splitting duties between more than one person. For example, the person coding the change and the person implementing the change would be two separate people. Testing should also be separated out from the person who implemented the change.

This does wonders for the midnight-cowboy coder who sticks in changes at 2 am and doesn't tell anyone or bother to test.

In the case of a true emergency change, they can be done and documented after the fact (but should still be documented).

Its not that hard and really has little to do with SOX and more to do with running a class operation.

Re:SOX is choking our companies, kill it. (1)

pauls2272 (580109) | more than 4 years ago | (#30290324)

I understand it completely and it doesn't happen in the real world in real IT depts. First, we aren't coding anything - we are implementing PTFS, hotfixes, new software releases, etc. And every place I've worked, the guy that gets the fix, tests it and implements it himself. There is no Change Control group for the sysadmins/sysprogs.

To do that you would need to have 2 separate groups - one that downloads, installs and tests on test servers and another that just implements changes into production.

  Duplication of effort and just pure overhead. Also when dealing with complex products -DB2, SQL Server, IMS, CICS etc, companies can not afford to have multiple people with that knowledge not doing real work. Small companies have 1 guy with many, many hats. Larger companies are lucky if they have multiple people that can back each other up - but they don't have time to do each others work.

You deal with the midnight cowboy dude by firing him.

Who do you work for? (2, Insightful)

FatSean (18753) | more than 4 years ago | (#30291002)

I want to know so I can never do business which such a shoddy shop. My company has strict SOD and we enforce it through tooling. We have three groups: Development, Test, Operations. I'm on development side so I check builds and docs into the source code control system. Test pulls it out, applies it to the test environment, runs tests. Test then passes the code and documentation to operations who updates any configuration parameters that differ between test and production systems and installs it with the rest of us standing by on a chat in case anything goes wrong.

Re:Who do you work for? (1)

pauls2272 (580109) | more than 4 years ago | (#30291452)

>Development, Test, Operations. I'm on development >side so I check builds and docs into the source >code control system.

Sounds like your an application dude and not a sysadmin/sysprog. You get source from Vendors and log that into your "source code control system"? Microsoft gives you the source to Windows so you can log the changes Microsoft makes to Windows? Who maintains this "source code control system" and who implements changes into that? Another source code control system to manage the 1st source code control system?

The vendor fixes I get are all object code and need special software to install them - SMP/E For IBM PTFS, Smitty for AIX, etc.

I've worked for Fortune 100 companies and I've never seen a set of "development" sysadmins/sysprogs and another set for Test and another set for Operations. Way too expensive to spend all that money paying people to do the exact same work.

Re:Who do you work for? (1)

Bigjeff5 (1143585) | more than 4 years ago | (#30293142)

What about operations where 3 people is overkill?

Didn't think about that one eh?

There is no reason one person can't do all of it, from developement to operations, if he follows best practices in each case. Anything more than a one-man shop should always have another person checking the work at each stage, but that does not make separation of duties necessary. It also very rarely makes sense in an IT support environment, but often the rules are made to apply to the support guys anyway.

The easiest way to prevent midnight coders is to impliment a source control system and a daily build (or weekly or monthly, depending on the type of project, but you probably want daily builds) policy and require all new code to be in the daily build by noon each day. Your change must build and run correctly, or you can't update the build. If the code doesn't work, then the last person to update it must fix it. If a coder refuses to follow these guidlines, fire them. No matter how brilliant they may be, they will almost certainly cost you more more money than they make for you because of their disrespect for your organization.

Re:SOX is choking our companies, kill it. (1)

hemp (36945) | more than 4 years ago | (#30291430)

I sure hope you don't work at NASA or a nuclear power plant.

Re:SOX is choking our companies, kill it. (1)

aynoknman (1071612) | more than 4 years ago | (#30290540)

The fact is that SOX was doomed to fail because you can’t impose rigorous rules on US companies if foreign companies don’t have to follow the same rules – it is a Global world out there and adding huge overhead to your domestic companies just mean more outsourcing and more domestic bankruptcies as they can’t compete with slimmer/trimmer overseas companies.

This is also known as 'race to the bottom.' It happens with corporate governance as well as taxes and wages.

Re:SOX is choking our companies, kill it. (1)

techno-vampire (666512) | more than 4 years ago | (#30292194)

I was told that ALL CHANGES had to go on the CEO change calendar and that we would become very familiar with the assistant that scheduled the CEO change meetings.

Sounds to me like somebody in your company has a micro-management fetish. BTDTGTTS. You have my sympathy!

Re:SOX is choking our companies, kill it. (0)

Anonymous Coward | more than 4 years ago | (#30292558)

10+ signatures just means that 9 more people are required to approve the stuff that Enron got up to. For example the Risk group could cancel a programme but a senior executive could override this.

Re:SOX is choking our companies, kill it. (1)

Nausea (772152) | more than 4 years ago | (#30290528)

AMEN! To rub salt in the wounds, SOX implementation in an existing company doing an IPO is, to say the least, horrifically *painful*! Nevermind all the 'wasted' money and time on compliance audits. "Oh, you have put in a ticket to make that little change" results in a ticket that several others have to touch/test/verify - thus even menial changes to systems can potentially rot for weeks. While I'm not saying it isn't good to have a paper trail / change log and verification of work, SOX adds a whole new level of idiocy to what would otherwise be 10 minutes of actual work. I can see some parts of it remaining viable, such as accounting practices - but most of the IT portions need to be trashed. One of my big beefs with SOX compliance is that it doesn't really mean better _anything_ to the company (though it *might* bring about a handful of better practices here & there). Instead, it saddles most of the staff with a bunch of inefficient 'busywork' - and in many cases extra software and other crap the company never really needed in the 1st place - all for the mere illusion of a better business 'machine' (one that honestly worked great before SOX came along). I'd love to see some real examples of how SOX has actually _improved_ companies that are forced to implement it...

Re:SOX is choking our companies, kill it. (3, Informative)

dstar (34869) | more than 4 years ago | (#30290762)

I have worked for large companies in the past, and SOX is seriously undermining the ability to make changes, or indeed for rational process to take place in the daily operation of IT.

It's doing no such thing. People may be using it as an excuse to build an empire or do stupid things, but that's not the fault of SOX. I worked for a *VERY* large financial company (the overall IT budget, across all branches, businesses, etc, was measured in the *billions* of dollars), and not once were we stopped from doing anything because of SOX. Not once was it even an issue, either.

Put the blame where it belongs, on stupid people. Then fire them.

Silver Lining. (4, Interesting)

FatSean (18753) | more than 4 years ago | (#30288932)

I inherited a bunch of apps that had atrocious logging practices. They were inter-twined and when a problem arose, it was very difficult to PD. Management didn't care to spend money adding some log statements, it was good enough. SOX forced us to place logging statements at system boundries. This wasn't a complete logging overhaul but it really did help with future PD.

Re:Silver Lining. (1)

Fractal Dice (696349) | more than 4 years ago | (#30289470)

That was my experience as well ... although I was not directly involved in any SOX work, I saw it dredging up all sorts of atrociously bad practices all around that were time bombs waiting to go off (application interfaces open to the world, critical servers never being backed up, root accounts still active for people laid off years ago). Outsourcing, entropy plus plausible deniability is a dangerous cocktail in IT.

Can the Supreme Court efficiently rule here? (1)

Tanks*Guns (587234) | more than 4 years ago | (#30288958)

From TFA "Now, here’s where things get interesting. Beckstead decided to sue PCOAB not over the deficiencies found, but rather the oversight board’s very right to existence."
As a disclaimer I have to say I have worked for Financials IT for quite a while and SOX was quite literally the bane of our existence for over 3 years. Whether SOX is a true measure of compliance is still an open question on my mind ...
The implication here is that if the Justices do rule in favor of Beckstead, what does that say about other government organizations that "audit" citizen's affairs?
In other words, you are told that all your servers must be 1U, you know this for a long time and make an effort to make sure every server is 1U, you go as far as dedicating an entire year in ensuring that servers must be 1U, then you get audited and they happen to find that 4U box your support guys used to launch all that crap that no other box was capable of handling, simultaneously, so you fail that portion of the audit.
You just SUE the people who enforce these efforts in the hopes that the very laws you knew about and made a concise effort to abide to get disregarded or amended in the course of a hearing? that's it?

Re:Can the Supreme Court efficiently rule here? (1)

CorSci81 (1007499) | more than 4 years ago | (#30289494)

The implication here is that if the Justices do rule in favor of Beckstead, what does that say about other government organizations that "audit" citizen's affairs?

If you had read the full article you might also have noticed that the crux of the argument is that the PCOAB is set up as an independent organization independent of the executive or legislative branches. So, if the ruling goes for Beckstead nothing happens to most other "auditing" agencies. I can't think of any off the top of my head that have been granted some manner of legal authority and are not subject to some manner of appointment process by congress or the executive branch (although some of them arguably might be better off if they were).

Electrical Code -- National Fire Protection Assoc (0)

Anonymous Coward | more than 4 years ago | (#30290838)

The National Fire Protection Association is another organization independent of the executive or legislative branches which has been granted legal authority to specify how you may wire a building, including your own house.

NFPA 70, aka the National Electrical Code http://en.wikipedia.org/wiki/National_Electrical_Code [wikipedia.org] , "is commonly mandated by state or local law".

And did you miss all the outraged slashdot discussions spurred by private organizations claiming copyright over specifice state and local laws?

sox isn't all about IT. (2, Informative)

L3370 (1421413) | more than 4 years ago | (#30289162)

SOX compliance itself has more to do with accounting practices than it does with IT. IT related affairs only come into play when it goes hand in hand with the accounting/financial requirements. If you are relying entirely on SOX compliance laws and regulations to fulfill IT requirements and security standards, you are ill-prepared for IT compliance.

For example... per SOX, business documents and financial reports must be kept for 7 years. If you're documents and records just happen to be in digital format, then your are mandated to to have digital backup retention for 7 years...otherwise sox has nothing to do with your computers. SOX doesn't have enough meat on IT specific matters to be used as your sole baseline for IT requirements.

I don't think SOX needs to be rewritten or abandoned...we just need a different solution to solve the IT problems.

Re:sox isn't all about IT. (1)

WRX SKy (1118003) | more than 4 years ago | (#30289556)

I disagree. I work in the IT dept. for a F100 company, and SOX is a complete barrier to getting anything done in a reasonable time-frame. It needs to be abandoned and reworked from ground zero.

For example, we are slowly phasing out an old mainframe system that used to "do it all" for the organization. To support each new sub-system we must create interfaces into and out of the mainframe to access legacy functions it may still retain.

If I make a change to one of the compartmentalized systems (say... the shipping ETA generator for example), my change must pass through multiple SOX audits before it can be released because that "Shipping ETA" interfaces to the mainframe, which in turn interfaces to the accounting system. There is no way my Shipping ETA system could access or modify anything about the accounting system... yet I'm blocked by the SOX controls surrounding it.

Re:sox isn't all about IT. (0)

Anonymous Coward | more than 4 years ago | (#30290826)

I have a feeling that a lot of those problems are caused by management, your company's lawyers, or auditors that don't understand what you're doing, rather than the law itself.

Re:sox isn't all about IT. (1)

turbidostato (878842) | more than 4 years ago | (#30292600)

"I have a feeling that a lot of those problems are caused by management, your company's lawyers, or auditors that don't understand what you're doing, rather than the law itself."

Don't understand or don't *want* to understand? As the old Latin motto goes, 'Qui prodes?' who is benefited by all that papertrail? Those managers and lawyers that get empowered by the very paper mess they create, I say.

Re:sox isn't all about IT. (0)

Anonymous Coward | more than 4 years ago | (#30291906)

I disagree. I work in the IT dept. for a F100 company, and SOX is a complete barrier to getting anything done in a reasonable time-frame. It needs to be abandoned and reworked from ground zero.

It is unfortunate. It is unfortunate that the management's signature on every SEC filing is legally binding, and that management is responsible for the accuracy and fairness of the results presented therein, and that several high profile managers have decided to skirt the rules and lie. It makes life much harder for the good ones.

But even the good ones might not know that there's a ticking time bomb under their noses. All it takes is a VP with an ambitious plan and enough stones to lie to your face.

You might not realize this, but SOX -- as a law -- is mostly related to accounting. The point of SOX is to ensure that the signature your officers put on their documents is properly validated. Your managers are being overly cautious, as managers are prone to be.

It's not a kind of box (1)

jfengel (409917) | more than 4 years ago | (#30289440)

Nitpicky, I know, but the title of the Slashdot article (not the underlying article) uses "SarBox", as if it were some brand name for a kind of box.

It's the "Sarbanes-Oxley" Act, sometimes "Sarbox" or "SARBOX" (for those who feel compelled to treat every new word they don't know as an initialism) but "SarBox" is right out.

"SOx" or "SOX" are much more common.

SarBox? (1)

Lord Ender (156273) | more than 4 years ago | (#30289476)

Who refers to Sarbanes Oxley asn SarBox? I've only ever heard of it as "SOX." I can't imagine why the "b" would be stressed, anyway.

I know this is the internet, but we really shouldn't just go around inventing acronyms for headlines.

SOX and IT is Poorly Understood (2, Informative)

Anonymous Coward | more than 4 years ago | (#30289936)

I am a SOX IT auditor, so here are a few thoughts. Yes, I'm posting as an Anonymous Coward because I don't want my name tied to this in case someone from my firm sees this.

1. SOX is not about information security and security events. It's about determining if sufficient controls are present to prevent or detect material misstatement in the financial statements. For example, you have crappy network security. A hacker breaks in and steals customer information. While very damaging, there is no impact on the financial statements from a reporting standpoint (assuming that your accounting department properly books the entries for any fines and penalties - and this is assuming the hacker only copied data and didn't submit anything falsely). If a hacker did submit something falsely, the auditors would fall back on manual review controls, in the business processes (e.g., reconciliations) to try to identify anything major.

2. If your IT auditor's told you that to be SOX compliant you had to log everything, then you were told incorrectly. We only want to look at logs when we find major problems elsewhere, and we are only wanting to look at the logs to try to determine the level of risk associated with the issues we have identified. Logging of failed login attempts is useless, for SOX, since the account wasn't used (hence FAILED login attempts). Obviously, many of these things are good to look at for overall security, but they have no impact for SOX.

3. Here are the basics for IT SOX compliance:
    a. Basic segregation of duties. The major problem here is that many companies let their developers have full access to production environments or let end users be system administrators.
    b. Have a decent change management process. Again, don't let your developers have update access to the production environments. Make sure you keep documentation showing that changes are tested and approved. This doesn't have to be anything fancy.
    c. Have a decent process to document new system implementations and major system upgrades. I can't begin to tell you how many times I've had clients implement new systems and give everyone full access just because it was easier or didn't check to see that they converted their data from the legacy application to the new application completely and accurately.
    d. Have a process to follow-up on production processing errors / major events. If you have tons of job / batch processing abends and can't show that they were resolved in a timely manner, we can't be sure that transactions didn't get dropped.

Obviously, SOX can be very complex, especially if you have a very complex environment. However, if you actually read Section 404, there is nothing there that calls out specifics (i.e., like the specifics listed to be PCI compliant). It should be all about risk management.

Re:SOX and IT is Poorly Understood (1)

afidel (530433) | more than 4 years ago | (#30290196)

While that is all true, having rigorous IT compliance to SOX means that our auditors don't feel it necessary to do as deep a dive into our financial statements saving us about as much in auditing fees as our entire IT budget (which is not small for our company size). They have set a threshold for audit failures on the IT side and if we were to fail enough high priority controls they would have to do some serious forensic accounting which would be extremely labor intensive since it would have to be completed before our next SEC statement..

Re:SOX and IT is Poorly Understood (0)

Anonymous Coward | more than 4 years ago | (#30291066)

Yes, pretty much the entire point of SOX is to prevent the CEO from claiming

1) I never saw any documents regarding X and I'm a clueless fucktard who does very important things for my company but I have no idea what those things are or what my company does.
2) Yes, I signed a document, but I clearly recall the document I signed was regarding the rescue of cute fluffy kittens from trees. Clearly some evil hacker altered the document to make it appear that I endorsed X without my knowledge.
3) No, we don't have an income stream from X and the auditor has the complete financial record of our company.

SOX has absolutely nothing to do with actual security, except where failure of that security may allow scenario #2 to happen.

SOX SUX (0)

Anonymous Coward | more than 4 years ago | (#30290052)

I agree with the article: it is something that auditing firms are using to scare the bejeesus out of everyone at the C-level.

It slows companies down in myriad ways. Without preventing another Enron. Evil people will do what evil people do, and SOX aint gonna stop them.

One other way it is abused: internal IT stonewalling. Now our IT group has an easy deflection for any new project: SOX. it's like a bell rings when the say it, straight out of groucho marx. I've given up even trying to fight. When they play the SOX card, I just leave the room. There's no winning the argument.

fuC4? (-1, Troll)

Anonymous Coward | more than 4 years ago | (#30290252)

serves to reinfo8ce session and join in any parting shot,

It's about time. (0)

rickb928 (945187) | more than 4 years ago | (#30290392)

We need a good Article 10 [usconstitution.net] fight. Now.

Washington is out of control, and has been for a while. As good a time as any to make a stand.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...