Sarbanes-Oxley Compliance 1

[fs483]

Hello,

Not exactly a problem of Windows but didn't know which forum to post message. The CFO of one of my clients asked that we prepare the network to be Sarbox compliant. I'm totally lost. First off, I'm from Canada and I manage the IT system of a company that has their HQ in Canada. I have been "googgling" for 5 hours on what are the requirements to be Sarbox compliant. I have printed well over 100 pages of documents that I intend to read. I have parsed quickly most of the documents but haven't exactly found the requirements in a concise format. So far, I have determined that a secure backup system must be in place for all data and data must be kept for a period of 5 years (one doc said 7 years). Now, the data changes daily which is normal but am I expected to keep a different tape for each day for 5 years ? I currently have 2 week rotation of tapes and 4 monthly tapes... I'm also using NTBackup. Is it sufficient ? That's seems reasonable but I don't think it's compliant. Data must be protected from hackers (includes having firewalls, anti-virus, anti-spyware...) thats ok but do certain firewalls don't qualify. For example, I have a Cisco Pix but if I had a linksys, does it make a difference. Does the configuration of the firewall render it or not compliant ? There's also mention that monitoring any and all data transfert ie : instant messaging, emails, copied data through the network, WiFi. Do I need a data sniffer ? It mentions about keeping all emails so I need some sort of real time archiving because if an email is received and deleted the same day before it's backed up to tape, then I'm screwed ? I also saw something about patch management. I do it manually now (every second tuesday of the month). Does it qualify or do I need Shavlik or WUS. I've got bits and pieces of info. For those of you who managed to get your networks compliant, where and how did you get it to that point ? Is there a book that I can buy that has all this info just for the IT systems or some document I can download. Should I hire an outside company to do the checking (just for the IT system). I know that Price Waterhouse Coopers is the accounting firm that does the accounting audits but that's about it. The CFO wants the report by September and we have 3 months to apply the corrections needed for a deadline of December. Am I approaching this the wrong way ? I'm sure this will give me plenty of experience because very little time, similar laws will be passed in Canada and I will be doing this same process for 3 or 4 more companies.

Thanks
akwong

 

[rvnguy]

akwong,

Have alook at this software that is specifically for Sarbanes-Oxley network management/reporting. There are probably many other packages available.

Open Pages SOX Express

http://www.openpages.com/solutions/sarbanes-oxley/sarbanes-oxley_express.asp

rvnguy

"I know everything..I just can't remember it all

 

[fs483]

Thanks rvnguy, I actually printed some pages from this website yesterday. So far, that website has more details then the other ones. I'll give a deeper look.

Thanks
akwong

 

[mrdenny]

akwong,
Good luck with getting up to speed on this. Sarbanes-Oxley (also called SOX) is a huge setup. Not only does it involve securing your network, but it also requires setting up division of responsibilitys. For example developers can not have access to production systems.

Your client will also need to setup business processes to ensure that all changes to production systems are reviewed and approved by a change control board, and signed off by managment before being pushed to production.

Not only will there be a lot of network changes to be made, there will also be a lot of business process changes that need to be made to stay SOX complient.

Again, Good luck. It's a brutal change to have to make.

Denny
MCSA (2003) / MCDBA (SQL 2000)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

(Not quite so old any more.)

 

[fs483]

Well it's a small shop but with a lot of money involved. There are only 3 production servers and 0 developers. Actually not true for the developers. There's one that is developing a module for the accounting system but he's working on a test database on the production server. Wonder if that is OK. If not, I doubt the CFO is ready to dishout 80K$ for a second copy of the program + 5K$ for a server just to do his tests. The customer uses Great Plains on a dedicated SQL server. All remote access is allowed through Citrix. A third server is for Files and Mail. Local users have the GP client installed and connects straight to the SQL server through an OBDC link. All other files used in the process is Excel sheets all protected by NTFS permissions... I think one thing I can recommend is putting a full time bouncer in front of the server room because the door must be left open (it's also the electrical and telecom room). I've read a few documents today and did manage to get more info but boy is this complicated... I call it "sucks" instead of SOX or Sarbox.

Thanks
akwong

 

[mrdenny]

Your definetly not the first people to call it sucks. It's a major pain. Doing dev work on a production server is a major violation. More so because it's the accounting system. Check with your Great Plains vendor. Tell that that you need a copy stricktly for development work. They will probably cut you a deal on the license.

You are going to need to move his dev work off the production server to be compliant. Everything else sounds good at the high level. What's the approval process for moving his changes from dev to production?

That server room door is going to need to be closed and locked at all times. There isn't any way around that one.

What's the backup policy for the SQL Server. What's the DR plan for the SQL Server?

Denny
MCSA (2003) / MCDBA (SQL 2000)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

(Not quite so old any more.)

 

[anawrocki]

I am living through this hell myself. At the end of the day, you need the CIO/CFO to tell you what they need to be compliant, and if they do not know, then they should be hiring a consultant that knows and can tell you what technology needs to be implimented to be compliant.

 

[fs483]

Thanks MrDenny for the pointers. I'll need to find a way to have AC installed for the server room (that's why the door is left open) but also because I think there some law that prevents having the door to the circuit breakers room locked (in case of emergency power cutoff)... One good thing in all of this is that they have NO CHOICE but to do all that is requested (which is for the best) and get budgets approved. I'll be happy to see BackupExec installed (mostly for the mail) and more tapes for monthly backup. This company when from a simple p3 workstation in workgroup on Win98 as a server to all the above mentionned hardware and more (about 60 000$ worth of computer equipment)in a year and half. Now they will need to spend x more amount of cash. Have a star MrDenny.

thanks
akwong