Sarbanes-Oxley Compliance Kit

Sarbanes Oxley Compliance News

Government employees continue to breach privacy of individuals

According to Gazette.net, a Maryland Department of Human Resources employee has been fired for posting about 3,000 names, Social Security numbers and other personal information on his personal website.

The information, which belonged to department clients who use food stamps, housing programs and other social services provided by the state, had been posted on the employee's website since April 27. The site has since been removed and there is no indication that the information has been misused.

The Baltimore Sun reports that a DHR spokeswoman, says it is unclear why he used the data in an unauthorized way.

The incident is still under investigation and no decision has been made yet about whether criminal charges will be filed.

Record Management Needs to Include Email

As the importance of IT, the Internet, SmartPhones, and email has grown, its legal status has changed with far-reaching consequences. A variety of laws and regulations have been extended to cover all business records, including email and all communications in both public and private sectors. Sarbanes-Oxley (SOX) and other mandates requirements touch almost every facet of paper and electronic data.

Among other provisions, SOX requires companies to maintain “all audit or review work papers” for at least five years. For registered public accounting firms, the period is at least seven years. Penalties for noncompliance include severe fines and even imprisonment, and intentionally altering or destroying records can bring even more serious consequences.

Consider that most work papers and records are created as emails and may never exist in physical form. An email can be deleted in violation of SOX at the click of a mouse. Key considerations for ensuring your company meets SOX record-keeping requirements include:

• Can employees reliably distinguish ordinary emails from protected business records?
• Are you be certain that employees are  storing the protected emails for the required time period?
• Is there a process in place for storing physical copies of every protected business records and emails?
• Are  you certain that no one is hacking into your email system and maliciously changing records?

Wi-Fi needs to be secure

You can secure your wireless network in little time with these 5 simple rules:

• Secure your access point administration interface: The default passwords of most standard devices are already known to most hackers. So, when you set up your router through the web interface, change the default password and write it down somewhere safe.
• Stop broadcasting your SSID: Your wireless router continuously transmits your SSID (Service Set Identifier). While this is useful in an office where many people are going to connect to your network, at home this is certainly not needed. Turn SSID transmission off as soon as you can. Wireless LAN "sniffers" will still be able to detect your network, but other than that, your network will mostly be shrouded from outsiders.
• Use MAC address filtering: Turn on MAC address filtering on your wireless router configuration utility. By doing so, you can add the MAC addresses of all of your networking devices to the address pool of the router. This way, no one outside your home network will be able to access your network.
• Reduce the power of transmission: Reduce the power of your wireless transmitter to such a degree that the signal does not reach outside your faciltiy or home. This will keep most outsiders at bay.
• Disable remote administration tool: Your remote administration utility is seldom used. So, keeping it on exposes your network to outsiders. Turn it off for enhance your network security.

Feds to spend billion on cybersecurity research

As the Obama administration and Congress propose various measures to improve the nation’s cybersecurity, the Office of the Director of National Intelligence is planning to spend "multiple billions of dollars" on cybersecurity research.

The deputy director of national intelligence for acquisition and technology, said at a recent cybersecurity summit sponsored by Defense Daily that her office, together with the White House Office of Science and Technology, will be sponsoring "innovative" research addressing three areas, the Washington Post reported:

• Multiple security levels for government and non-government organizations.
• Security systems that change constantly to create moving targets for hackers.
• Methods to motivate individuals to improve their cybersecurity practices.
  

Disaster Recovery / Business Continuity is Not the Place to Cut Costs

In today's business environment, many enterprises are looking for way  to reduce their expenses by cutting overhead. Often this takes the form of reducing headcount, particularly in areas that are regarded as ancillary or non-core components of the enterprise.

Disaster Recovery and Business Continuity often are placed in that category and, as a result, can be an early casualty of many cost-cutting programs. Whether it is an internal Disaster Recovery and Business Continuity  team losing staff members, or a part-time Disaster Recovery and Business Continuity manager with less time to spare from the day job, Disaster Recovery and Business Continuity programs can be neglected and will quickly become out of date and ineffective, particularly in a rapidly changing organization. As anyone who has ever had to manage a Disaster Recovery and Business Continuity event knows, there are few things more useless than an out of date Disaster Recovery and Business Continuity plan.

Of course, it is hard to make a case for Disaster Recovery and Business Continuity at a time when core functions are under pressure, but maybe that is just when it should be on the radar even more than usual. With share prices shaky and credit hard to find, the last thing any organization needs right now is the damage to its reputation and credibility that could arise from failing to effectively manage a high profile disruptive incident.

Arguably, during a recession companies are at their most vulnerable, which makes it the worst time to neglect anything, which contributes to resilience or reduces risk. However, if an organization is under financial pressure, how can it square the circle and achieve those reductions in overhead costs while still maintaining the effectiveness of its Disaster Recovery and Business Continuity program.

Disaster Planning and Server Consolidation

The cutting edge of virtualization technology may have set its sights on virtual PCs, unified network fabrics and other esoteric applications, but server consolidation remains the primary driver for most data centers. In fact, only a handful of enterprises have begun the process of virtualizing their server farms, according to most recent surveys, although the pace is likely to pick up as energy costs and competitive pressures drive organizations to increase performance even while paring down their hardware infrastructures. But as those who have already taken the virtual plunge have no doubt realized, consolidating servers is not just a matter of powering up the virtualization layer and then pulling equipment out of racks. There is a long list of factors to consider with any centralization project and a wide range of land mines that need to be avoided to prevent service failures. One of the main concerns is the resiliency of remaining hardware.

NAS a good backup solution

Federal cloud web site hacked

A Department of Treasury Web site hosted by a third party was hacked for a short while redirecting visitors to a malicious site in Ukraine and later tracking IP addresses before the Department of Treasury took the site offline.

The Department of Treasury did not identify the provider that hosted the Bureau of Engraving and Printing Web site, but did acknowledge in a statement that it "entered the cloud computing arena last year."

The attack is bound to raise concerns about federal agencies' abilities to secure data hosted by third-party service providers. Security remains one of the biggest concerns in government circles as the Obama administration makes an aggressive push for federal agencies to begin adopting cloud computing services. The attack may also be used as a tool by legislators and policy makers to demand tighter security requirements.

The main web site of the Treasury division that prints U.S. paper currency, the Bureau of Engraving and Printing presented would-be visitors with a 404 "not found" error at each of the four URLs that point to the page, bep.gov, bep.treas.gov, moneyfactory.gov, and moneyfactory.com.

Cisco's ScanSafe tracked the attack to a Web site that attempts to exploit numerous vulnerabilities in Adobe Reader, Adobe Acrobat, Internet Explorer, Microsoft Office, Symantec AppStream, and other applications, and said that the malicious site has targeted sites hosted by Network Solutions and GoDaddy.

New York City Failed Bomb Highlights Disaster Planning Requirements

The failed Times Square Car bomb shows that there is now a new class of disaster that CIOs need to plan for.The infrastructure may be damaged, communications may be lost, and the building may not be intact. That highlights some things that a disaster plan needs to consider:

• Have a communications plan that doesn’t require the use of cell phones or smartphones.
• Have an alternate form of communications if necessary to save lives or call for help. Your emergency coordinator should have at least one ham radio operator on staff, with a radio available - ham radio is often the only reliable means of emergency communications in a real crisis.
• Define a central assembly point that’s located somewhere besides your office. Pick a place inland, within 50 miles or so, where you can set up a place for employees to check in.
• Assume that some of your employees will not be able to make it to the assembly point and have a plan to have their jobs filled until their status is determined.
• Validate your insurance carrier has you covered for such contingencies.

Intel can not meet chip demand

As companies upgrade to Windows 7 and replace older laptops there is a shortage of the latest Intel laptop PC Core i3 and Core i5 microprocessors.

The shortfall is in Intel's new laptop microprocessors codenamed Arrandale, including some Core i3 and Core i5 chips. The shortage has caused chip buyers to bid the price of the microprocessors up to a 20 percent premium over contract prices on the open market, according to U.S. chip distributor Converge. The shortage hit in March and will last throughout April, the company added in a monthly research report.