Slashdot Mirror
SarBox Lawsuit Could Rewrite IT Compliance Rules
dasButcher notes that the Supreme Court will hear arguments next week brought by a Nevada accounting firm that asserts the oversight board for the Sarbanes-Oxley Act is unconstitutional. If the plaintiffs are successful, it could force Congress to rewrite or abandon the law used by many companies to validate tech investments for security and compliance. "Many auditing firms have used [Sarbanes-Oxley Section] 404 as a lever for imposing stringent security technology requirements on publicly traded companies regulated by SOX and their business partners. SOX security compliance has proven effective for vendors and solution providers, as it forces regulated enterprises to spend billions of dollars on technology that, many times, doesn’t prevent security incidents but does make them compliant with the law."
How about rewriting the law so that every request to my IT department doesn't result in "This functionality would break SarBox compliance", regardless of how related to SarBox the request actually is?
And to do that, they'll need a definition of "secure". One that everyone can agree on. A standard definition, on might say. And to ensure everyone who says they're secure actual is, it might be a good idea to draft a formal document that explicitly lays out those standards, as well as methods for one company to ensure another company meets those standards. Heck, if it's that important, it might be worth thinking about turning that document into a law...
UTF-8: There and Back Again
I have worked for large companies in the past, and SOX is seriously undermining the ability to make changes, or indeed for rational process to take place in the daily operation of IT.
SOX was meant to prevent another ENRON, but those things will happen regardless of rules - look at the collapse of organizations like FannieMae, well after SOX was in place. Instead we are harming all large businesses just to prevent a one-off case that we are not really preventing anyway!
Kill SOX and let companies get back to what they do best, instead of spending a lot of time simply deciding what compliance means and using the rules to build (even more) fiefdoms within giant companies.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I don't know. Unions have brought us a couple nice things here in the US until recently:
8 hour workdays.
5 hour work weeks.
Our 8 year old kids out of the coal mines.
Worker's comp for injuries.
Unemployment.
Labor laws.
Banning of blacklists.
Minimum wage.
Vacation leave.
Sick leave.
Liability.
Basic safety.
With all the bellyaching about unions, I think people would love it if they would have to work 12-16 hour days, 7 days a week with their kids doing 12 hour days right by them. Of course, if anyone complained about it, they would be flagged in a database, and guarenteed to never have a job again, just like a felon. Get sick? Work, or have unlimited time off when fired for missing a single day. Also, I guess people don't mind working all this for $100 a month, which is what would be paid without the min wage laws.
No, unions may not be perfect, but the workaday life would be a lot different and a lot worse. But they are the same people who brought you the weekend.
I want to know so I can never do business which such a shoddy shop. My company has strict SOD and we enforce it through tooling. We have three groups: Development, Test, Operations. I'm on development side so I check builds and docs into the source code control system. Test pulls it out, applies it to the test environment, runs tests. Test then passes the code and documentation to operations who updates any configuration parameters that differ between test and production systems and installs it with the rest of us standing by on a chat in case anything goes wrong.
Blar.
I came to see the 404 jokes.
I was not disappointed.
They are a hindrance in the 21st century USA.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
On the other hand, I worked in an office where a small team (three people) of server admins pulled a 10MB cable from a core infrastructure device and swapped it with a 100MB cable, with a similar attitude and the ensuing routing loop of some sort brought down an entire Fortune 100 company, costing an estimated $25 million in downtime and creating a late-night fire drill of pretty epic proportions as consultants and network admins scurried around their respective offices in 15 different cities trying to figure out why their packets were all cratering while about two dozen server admins were busy rebooting their systems, not knowing it was a network issue.
In the process, several network admins at different properties were busy trying to create custom routes to bypass the issue, which caused months of intermittent network issues once the original link was restored properly.
Overall, $1200 to check out the issues before hand would have seemed like a real cheap alternative, even if it was only a 1% fix.