Sarbanes-Oxley Act (SOX) Audit Requirements

Sarbanes-Oxley Act (SOX), passed in 2002, spells out requirements for internal controls.  Some organizations have turned to the standards published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). These do not, however, provide specific guidelines for organizations that deal with databases, a key area of concern for SOX compliance, but instead provide an excellent conceptual architecture for organizations to build a compliant IT Control framework for the enterprise.  Others are relying upon the best practices set forth by COBIT (Control Objectives for Information and related Technology) and ITIL (Information Technology Infrastructure Library). However, these frameworks are incomplete with regards to the concerns set forth under SOX relating to databases. Databases are at the center of SOX control issue. Ensuring effective controls over database activity—writes, deletes, changes, and administration—is absolutely crucial to maintaining data integrity.  Control must also extend to server and mainframe applications and unstructured data. Meeting SOX compliance centers on four areas:  audit trails, segregation of duties, change control, and patch management.  

Audit Trails

Companies need to answer who changed a record, who deleted a record, changes to a schema, with particular detailed attention to privileged users.  These audit logs are usually a normal by-product of most database and application tools.  There needs to be a process to regularly review patterns and to store the logs for at least 5 years. 

Segregation of Duties

The Information Systems Audit and Control Association (ISACA) has issued guidelines calling for IT organizations to assign clear job roles and functions, and to assign database and system permissions according to those roles and functions. Please refer to www.isaca.org and the publication titled Control Objectives for Sarbanes-Oxley 2^nd Edition for additional detail.   

Change Control

Organizations need to document changes to their technical environment and adoption of ITIL’s Change and Release Management play a crucial role in satisfying this area.

Patch Management

Applications and associated databases should be patched on a predefined schedule that takes into account the peak usage periods for these systems, while providing substantial review of the patches with adequate testing. There are some other internal controls over financial reporting (ICoFR) that relate to database auditing and include:

• Network access should be limited only to certain defined systems (via strong firewall and IP restrictions).

• Unnecessary service access should be blocked at the network access device.  This would be satisfied by “hardened” proxy servers.

• Frequent review of user accounts and passwords should regularly verify that all permissions reflect actual user roles and responsibilities.  This has given rise to a number of products associated with Identity Management (IM) and Network Access Control (NAC).

These should be performed several times a year, in alignment with HR systems and general identity management solutions.

• Financial transactions are properly recorded by authorized users
• Data has not been compromised by unauthorized or authorized means
• All changes to the financial data are monitored

Achieving these controls presents IT managers with the challenge of auditing (and maintaining an audit history) for a variety of SOX-related activity, including all:

• privileged user activity
• changes to user privileges
• failed login attempts
• logical access failures
• database schema changes
• direct data access events

Technorati

What is ITIL?

The IT Infrastructure Library (ITIL) is a series of eight books and is referred to as the only consistent and comprehensive best practice for IT service management to deliver high-quality IT services. Although produced and published by a single governmental body, ITIL is not a standard and is generally referred to as a framework.  There is a lot of work involved in tailoring an implementation to any organization. The published books (subject to change my mid-2007) are:

• Software Asset Management
• Service Support
• Service Delivery
• Planning to Implement Service Management
• ICT Infrastructure Management
• Application Management
• Security Management
• Business Perspective, Volume II

There are two main operational components or logical groupings within ITIL, with Security Management completing the underpinning for both groups are:

• Service Support (activities that are more or less performed daily)
• Service Delivery (activities that tend to take place monthly or quarterly, but at a minimum annually)

ITIL Process Overview

 

BUSINESS DRIVERS FOR IMPLEMENTING

ITIL is usually implemented subject to one or more of the following business cases:

• Defining of service processes within the IT organization
• Defining and improving the quality of services
• Need to focus on the customer of the IT
• Implementation of a central help desk function

There are several methods in approaching an implementation of ITIL and having done several operations assessments, I can attest that the two main building blocks that have to be solid are Configuration Management and Change Management.  Both gear their activities off a Configuration Management Data Base (CMDB).  If the CMDB does not exist or if Change Management is a haphazard process, then the other processes within ITIL tend to fail on a regular basis.  Recently more and more vendors are creating products geared specifically towards CMDB (e.g., HP, CA, BMC, etc.) that address a method to collect all of the configuration specifics of your environment.  If you don’t know what you have, it will be problematic when implementing any change, but you can never been certain of the effect of the change.Two principal concepts characterize the basic thinking of ITIL:

• Service management—IT service managers:
  • Assure the consideration of requirements for operations and maintenance
  • Develop test plans
  • Identify the effects on existing infrastructure caused by new or modified systems
  • Define future requirements
• Customer orientation—IT services are to be provided at a level of quality that allows permanent reliance on them. To assure this quality, responsibility is assigned to individuals who:
  • Consult the users and help them use the services in an optimal approach
  • Collect and forward opinions and recommendations of users
  • Track complaints
  • Monitor the users’ appraisals of the services delivered
  • Support internal user groups

  Technorati