Report: Sarbanes-Oxley could threaten security

TalkBack 7 of 13:: Next »; « Previous

Thread View
Flat View

michael, michael....: please. I am sorry if you got the impression that I thought I was being 'profound'.

Lets not forget your statements/questions to which I was responding...they were so 'silly' sounding and utterly rediculous, that I thought those responses must be profound to whomever wrote them.

Now, having said that, you must know, in your infinite wisdom you seem to feel you have, that MOST companies, unfortunately, do not plan well for security threats and DO NOT have the PROPER, as you put it, infrastructure in place.

This article is not referring to the 'Ideal situation' it is in reference to the real world...and in the real world, companies have piss-poor security organizations and weak to non-existent infrastratures.
So, do REAL WORLD companies live day-to-day responding to the latest "Microsoft Security patch" or to the latest SASSER worm variation? Yup, they sure do!
...or are you too young to remember the Mellisa Virus or the I Love You virus that took out almost all of the Fortune 500 companies email services?

Ok, enough of that. Truth is, I know security (the way it should be) and I know security (the way it really is). I also know SOX and what it is requiring of companies (especially Fortune 50 banks like mine).

The REAL security problem is not that funds are being diverted....the problem is that SOX compliance issues are being handled in a non-secure way.
The SOX auditor asks, "Who has access to that folder?" or "Who has access to the data?".
In response most companies (unfortunately) don't re-evaluate the security model being used for that specific situation...they just slap a half-arsed solution in place to get that next check-mark on the auditor's report.

Thanks for your witty banter!
Critique (CISSP, SCNP and Security+); Posted by: critique Posted on: 07/12/05 You are currently: a Guest | Members login | Terms of Use