SECURITY CONTROLS FOR SARBANES-OXLEY SECTION 404 IT COMPLIANCE
CHAPTER THE ROLE OF INFORMATION TECHNOLOGY ARCHITECTURE IN INFORMATION SYSTEMS DESIGN MEETING THE SOX CHALLENGE UNDERSTANDING THE NEW DEFINITION OF ADEQUATE HIGH STAKES FOR COMPLIANCE FAILURES EXAMINING THE ROLE OF ARCHITECTURE LOOKING FORWARD BLENDING SCIENCE AND ART SEEING THE WHOLE PICTURE DOCUMENT, DOCUMENT, DOCUMENT SEEING CAUTION FLAGS INCREASED TECHNICAL COMPLEXITY ARCHITECTURE BASICS STEPPING BACK STEPPING FORWARD PROCESS AND RESULT APPLYING ARCHITECTURE TO LEGACY SYSTEMS STAFFING THE IT ARCHITECTURE DESIGN TEAM CONTENTS CREATING, DOCUMENTING, AND ENFORCING ARCHITECTURAL DESIGN CREATING VALUE WITH ARCHITECTURE DOCUMENTING FOR THE DESIRED DESIGN ENFORCING DESIGN VISION THROUGH DOCUMENTATION NO LEGAL ENFORCEMENT SECURITY ISSUES ALWAYS IN SIGHT SUMMARY UNDERSTANDING BASIC CONCEPTS OF PRIVACY AND DATA PROTECTION CLASSIFYING DATA UNDERSTANDING PUBLIC DOMAIN OR OPEN INFORMATION UNDERSTANDING PROTECTED INFORMATION UNDERSTANDING RESTRICTED INFORMATION KEEPING IT SIMPLE ESSENTIAL ELEMENTS OF PRIVACY AND DATA PROTECTION PROTECTING AGAINST DISCLOSURE CONTROLLING WHAT IS DISCLOSED CONTROLLING TO WHOM DETAILS ARE EXPOSED CONTROLLING HOW DETAILS ARE USED ONCE SHARED CONTROLLING THE CONDITION OF DISCLOSURE CONTROLLING WHEN DATA IS DISCLOSED CONTROLLING WHERE TO SHARE, STORE, AND MOVE DATA CONTROLLING WHY DATA IS DISCLOSED CONTROLLING COMPENSATION FOR DISCLOSURE DEFINING AND ENFORCING ARCHITECTURE EXAMINING DOCUMENTATION FOR IT ARCHITECTURE SUBSTANTIATING BUSINESS OBJECTIVES SUBSTANTIATING GUIDING PRINCIPLES SUBSTANTIATING POLICIES SUBSTANTIATING STANDARDS SUBSTANTIATING PROCEDURES SUBSTANTIATING BEST PRACTICES SUBSTANTIATING REFERENCE LISTS SUBSTANTIATING GUIDELINES SUBSTANTIATING SECURITY POLICY DOMAIN DEFINITIONS EXAMINING DIAGRAMS FOR IT ARCHITECTURE DIAGRAMMING LOCATIONS DIAGRAMMING HIERARCHICAL INFRASTRUCTURE DIAGRAMMING NETWORKS DIAGRAMMING LOGICAL GROUPING N-TIERS DIAGRAMMING DEVICE INTERFACES DIAGRAMMING APPLICATION LOGIC DIAGRAMMING HOST-TO-HOST DATA FLOW DIAGRAMMING CONTAINED PROCESS FLOW DIAGRAMMING WEB SITES DIAGRAMMING SECURITY SECTORS DIAGRAMMING SECURITY POLICY DOMAINS COMBINING EXTERNAL FORCES, INTERNAL INFLUENCES, AND IT ASSETS EXAMINING FRAMEWORK INFLUENCES EVALUATING THE PUBLIC FOR-PROFIT ENVIRONMENT EVALUATING THE PRIVATELY HELD FOR-PROFIT SETTING EVALUATING THE GOVERNMENT SECTOR EVALUATING THE NONPROFIT SECTOR IT’S ALL IN THE DETAILS SIZING UP THE FRAMEWORK UNDERSTANDING BUSINESS DRIVERS USING SECURITY CONTROLS AS BUSINESS DRIVERS USING INCREASED EFFICIENCY AS A BUSINESS DRIVER USING PROFIT AS A BUSINESS DRIVER USING COMPETITIVE ADVANTAGE AS A BUSINESS DRIVER USING RISK REDUCTION AS A BUSINESS DRIVER USING VALUES AS DRIVERS AND BOUNDARIES UNDERSTANDING INFRASTRUCTURE ASSESSING DEVICE LIFE CYCLES APPLYING SECURITY POLICIES EVALUATING PHYSICAL ACCESS CONTROLS EXPLORING INFRASTRUCTURE CATEGORIES ASSESSING HANDHELD DEVICES ASSESSING NOTEBOOKS AND PORTABLES OF ALL SIZES ASSESSING DESKTOP AND TOWER COMPUTERS ASSESSING HOST SYSTEMS ASSESSING NETWORKING COMPONENTS SIMPLIFYING THE SECURITY MATRIX UNDERSTANDING IDENTIFICATION A CASE OF MISTAKEN IDENTITY EXPLORING PAPER CREDENTIALS VETTING ALL NEW USERS EXPLORING DIGITAL IDENTITY IDENTIFYING DEVICES UNDERSTANDING AUTHENTICATION USING USERNAME, PASSWORD, AND PIN USING TOKEN CARD AND PIN USING SOFTWARE TOKENS USING BIOLOGICAL SCANS USING DIGITAL CERTIFICATES UNDERSTANDING AUTHORIZATION UNDERSTANDING ACCESS CONTROL UNDERSTANDING ADMINISTRATION UNDERSTANDING AUDITING USING LOGGING USING MONITORS USING DETECTION USING REPORTING UNDERSTANDING ASSESSMENT DEVELOPING DIRECTORY-BASED ACCESS CONTROL STRATEGIES EXPLORING MULTIPLE- VERSUS SINGLE-DIRECTORY PARADIGMS EXAMINING DIRECTORY SERVICES USING HARD-COPY DIRECTORIES USING DIGITAL DIRECTORIES EXAMINING THE INTEROPERABILITY CHALLENGE UNDERSTANDING THE META-DIRECTORY (META-FUNCTIONALITY) USING THE AGGREGATED VIEW OF MULTIPLE DIRECTORIES USING THE INFORMATION EXCHANGE POINT REVISITING SECURITY POLICY DOMAINS USING A CHECKLIST FICTIONAL CASE STUDY: GOVERNOR’S BREW COFFEE SHOP EXPLORING SOLUTION OPTIONS LOOKING FOR PATTERNS INTEGRATING THE CRITICAL ELEMENTS PUTTING SECURITY FIRST EVALUATING SECURITY FEATURES INCREASING REGULATIONS CONTROLLING BY DATA ELEMENT IMPROVING ACCOUNTABILITY UNDERSTANDING IDENTITY MANAGEMENT UNDERSTANDING AUTHORITATIVE SOURCES USING UNIQUE POPULATION INFORMATION EXPLORING THE RISKS OF SELF-ENROLLMENT IDENTITIES UNDERSTANDING IDENTITY VAULTS UNDERSTANDING SERVICE DIRECTORIES UNDERSTANDING IDENTITY PROVISIONING ENGINEERING PRIVACY PROTECTION INTO SYSTEMS AND APPLICATIONS BASING DESIGNS ON ASSET VALUES PROTECTING OPEN PUBLIC INFORMATION SHIELDING PROTECTED INFORMATION AND DATA DEFENDING RESTRICTED INFORMATION SECURING LEGACY APPLICATIONS CORRECTING CURRENT APPLICATION DEVELOPMENT EFFORTS SECURING NEW APPLICATIONS SEEKING MANAGEMENT SUPPORT AND FUNDING PROFILING HACKERS BUILDING A CASE FOR SECURITY SEEKING A BENCHMARK THE VALUE OF DATA INVENTORY AND DATA LABELING COMPARING VALUE PROTECTION RATIOS UNDERSTANDING DATA INVENTORY EXAMINING THE BASIC DATA INVENTORY MODEL LABELING (TAGGING) DATA PUTTING IT ALL TOGETHER IN THE WEB APPLICATIONS ENVIRONMENT USING DEALS FOILING OS ATTACKS WITH WEB PROXY APPLIANCES CHOOSING AND USING AUTHORITATIVE SOURCES LINKING TO AN EXISTING IDENTITY DATA SOURCE ALLOWING DISTRIBUTED ADMINISTRATIVE ENTRY AS A IDENTITY DATA SOURCE AVOIDING SELF-ENROLLMENT AS AN IDENTITY DATA SOURCE UNLOCKING IDENTITY VAULTS SERVING UP APPLICATIONS WITH SERVICE DIRECTORIES EXPLORING HOW IT WORKS LOOKING AT AN ACCESS CONTROL SEQUENCE EXAMINING OTHER CAPABILITIES UNDERSTANDING KEY DESIGN CONSIDERATIONS WHY FEDERATED IDENTITY SCHEMES FAIL UNDERSTANDING FEDERATED IDENTITY SCHEMES AFFORDING CONVENIENCE TO CUSTOMERS RISKS ARE COMPLEX ACKNOWLEDGING BENEFITS EXPLORING THE FIVE STARS OF FEDERATED IDENTITY LOOKING AT THE IDENTIFIED USER LOOKING AT THE IDENTITY AND AUTHENTICATION PROVIDER LOOKING AT THE SERVICE PROVIDER LOOKING AT TRANSFER OF TRUST LOOKING AT THE CIRCLE OF TRUST SEEING THE FUNDAMENTAL FLAWS EXPLORING OPTIONS CREATING A NATIONAL STANDARD MOVING FORWARD EXAMINING THIRD-PARTY CERTIFICATION OF STANDARDS OF PRACTICE A PATHWAY TO UNIVERSAL TWO-FACTOR AUTHENTICATION HEADING TOWARD A SINGLE IDENTITY CREDENTIAL FINDING THE MAGIC KEY LOOKING FOR A VISION EXAMINING THE CHALLENGES IN A GLOBAL ACCESS CONTROLS STRATEGY SEEKING COMMON GOALS SEEKING COOPERATION UNDERSTANDING THE CONSUMERS’ PART UNDERSTANDING THE GOVERNMENT’S PART NEEDING GOVERNMENT TO CONTRIBUTE FINDING EVERYONE UNDERSTANDING THE PRIVATE AND NONPROFIT SECTOR’S PART UNDERSTANDING THE TECHNOLOGY VENDORS’ PART UNDERSTANDING THE STANDARDS BODIES’ PART UNDERSTANDING THE TOKEN CARD MANUFACTURERS’ PART EXPLORING A FUTURE WITH GLOBAL ACCESS CONTROLS GOING WITH BIOLOGY CHECKING OUT THE PARACENTRIC APPROACH CHECKING OUT THE ENDOCENTRIC APPROACH LOOKING AT PROSPECTIVE NEW ROLES FOR DIRECTORIES EXAMINING A STANDARD APPROACH AND TERMS FOR DATA ACCESS RIGHTS UNDERSTANDING STANDARD DATA-RELATED ACCESS RIGHTS EXPLORING FIRST-PERSON ACCESS ROLES AND RIGHTS EXPLORING SECOND-PERSON ACCESS ROLES AND RIGHTS EXPLORING THIRD-PERSON ACCESS ROLES EXPLORING SUBORDINATE ROLES LOOKING AT INTERIM STEPS RECOGNIZING RESPONSIBILITIES USING THIRD-PARTY SECURITY REVIEW HOW MANY LAWS AND REGULATIONS AFFECT YOUR BUSINESS? HOW MANY OF THEM AFFECT YOUR ORGANIZATION’S COMPUTER APPLICATIONS? DO YOUR COMPUTER SYSTEMS COMPLY WITH ALL OF THEM? ALL ARE GOOD QUESTIONS WITH TRANSITIVE ANSWERS SARBANES- OXLEY (SOX) IS ONE OF MANY NEW REGULATIONS MAKING ITS MARK ON HOW BUSINESS IS CONDUCTED THERE WILL MORE NEW ONES NOT TOO FAR DOWN THE ROAD BY TAKING ACTION NOW IN CONFORMING TO THE MANDATE FOR ADEQUATE CONTROLS ON INFORMATION TECHNOLOGY SYSTEMS AND APPLICATIONS REQUIRED BY SOX, YOU ALSO POSITION YOUR ORGANIZATION TO MEET PRIVACY PROTECTION MANDATES, DISCLOSURE REQUIREMENTS, AND WHAT MAY BE NEEDED FOR THE NEXT ROUND OF REGULATION THAT COULD AFFECT YOUR DATA SYSTEMS MEETING THE SOX CHALLENGE THE SARBANES-OXLEY SECTION 404 REQUIREMENTS TO MAINTAIN ADEQUATE SECURITY CONTROLS OVER INFORMATION TECHNOLOGY SYSTEMS FORGE A CHALLENGING AND PERHAPS SOMEWHAT INTIMIDATING TASK ADD TO THEM A MULTITUDE OF REGULATORY AGENCIES AT ALL LEVELS OF GOVERNMENT THAT ARE ENDLESSLY GENERATING REQUIREMENTS (FEDERAL HIPAA STATUTES AND CALIFORNIA’S PRIVACY PROTECTION INITIATIVE THAT REQUIRES THE ROLE OF INFORMATION TECHNOLOGY ARCHITECTURE IN INFORMATION SYSTEMS DESIGN C HAPTE R