View source for 3.2.1.4: Managed Switches

<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''1.	Risk: Unauthorized access attempts go unnoticed.'''<br>
:a.	[[SOX.2.1.4.1:|'''SOX.2.1.4.1''']] SWITCH authentication attempts are limited to attempts specified by the Corporate IT standard.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''2.	Risk: Unauthorized execution of privileged system commands may disrupt business processes, and corrupt critical business data stores.'''<br>
:a.	[[SOX.2.1.4.2:|'''SOX.2.1.4.2''']] SWITCH administrator level access is password restricted and is limited to the designated SWITCH administrators only.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''3.	Risk: Unscheduled access by support vendors may result in business process interruptions or loss of production data.'''<br>
:a.	[[SOX.2.1.4.3:|'''SOX.2.1.4.3''']] SWITCH access by support vendors is granted through a service request.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''4.	Risk: Unauthorized users might exploit privileged access to critical business processes and data.'''<br>
:a.	[[SOX.2.1.4.4:|'''SOX.2.1.4.4''']] New SWITCH user accounts are pre-expired.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''5.	Risk: Unauthorized users might exploit unauthorized access to critical business processes and data.'''<br>
:a.	[[SOX.2.1.4.5:|'''SOX.2.1.4.5''']] The SWITCH operating application has a session "Time-Out" function enabled.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''6.	Risk: Unnecessary disruptions to business processes or data corruption may occur.'''<br>
:a.	[[SOX.2.1.4.6:|'''SOX.2.1.4.6''']] SWITCH rule changes are scheduled during maintenance windows.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''7.	Risk: Unidentifiable users may compromise critical business processes and data.'''<br>
:a.	[[SOX.2.1.4.7:|'''SOX.2.1.4.7''']] The SWITCH system will not allow identical administrator IDs.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''8.	Risk: Insufficient security standards may allow unauthorized access to production systems and business data stores.'''<br>
:a.	[[SOX.2.1.4.8:|'''SOX.2.1.4.8''']] SWITCH passwords are required for each administrator ID. Password configuration is based on Corporate IT standards.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''9.	Risk: Inappropriate administrative actions are executed without accountability measures.'''<br>
:a.	[[SOX.2.1.4.9:|'''SOX.2.1.4.9''']] The SWITCH operating application has the functionality to monitor administrator access related events.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''10.	Risk: Reactive security monitoring results in data compromise and financial loss or liability.'''<br>
:a.	[[SOX.2.1.4.10:|'''SOX.2.1.4.10''']] SWITCH administration team is notified when security violations occur.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''11.	Risk: Forensic evidence is not available to resolve malfunctions, compromises or other security compromising incidents.'''<br>
:a.	[[SOX.2.1.4.11:|'''SOX.2.1.4.11''']] The SWITCH administration team reviews security logs looking for security violations.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''12.	Risk: Unauthorized access is granted to business systems or data stores.'''<br>
:a.	[[SOX.2.1.4.12:|'''SOX.2.1.4.12''']] SWITCH access is granted through a service request.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''13.	Risk: Unauthorized access may occur resulting in business data compromise or destruction.'''<br>
:a.	[[SOX.2.1.4.13:|'''SOX.2.1.4.13''']] Terminations are sent through the HR process. An Email is sent from HR with all terminations to the SWITCH system administrators.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''14.	Risk: Insufficient security standards may allow unauthorized access to production systems and business data stores.'''<br>
:a.	[[SOX.2.1.4.14:|'''SOX.2.1.4.14''']] SWITCH password expiration is set to Corporate IT standards.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''15.	Risk: Security violations or data corruption may occur with no forensic evidence available to resolve the situation.'''<br>
:a.	[[SOX.2.1.4.15:|'''SOX.2.1.4.15''']] SWITCH rules and logging is applied to everyone equally including system administrators.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''16.	Risk: Unauthorized access (i.e. terminated employees) may occur.'''<br>
:a.	[[SOX.2.1.4.16:|'''SOX.2.1.4.16''']] A semi-annual revalidation of SWITCH administrator accounts are performed by security administration.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''17.	Risk: Unauthorized execution of privileged system commands may disrupt business processes, and corrupt critical business data stores.'''<br>
:a.	[[SOX.2.1.4.17:|'''SOX.2.1.4.17''']] Privileged level access is password restricted. This password is known only by the system administrators.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''18.	Risk: Unauthorized routing parameters or virtual LAN connections established may disrupt business capabilities or bypass security controls causing business data loss and confidentiality loss.'''<br>
:a.	[[SOX.2.1.4.18:|'''SOX.2.1.4.18''']] Routing protocols are approved by management.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''19.	Risk: Confidentiality and or privacy may be compromised.'''<br>
:a.	[[SOX.2.1.5.19:|'''SOX.2.1.5.19''']] Unauthorized network tapping does not occur without the approval of management.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
[[Image:Key-control.jpg]]<br>
<br>
'''20.	Risk: Controls provide reasonable assurance that the systems are appropriately tested and validated prior to being placed into production processes, and associated controls operate as intended and support financial reporting requirements.'''<br>
:a.	[[SOX.5.4:|'''SOX.5.4''']] A testing strategy is developed and followed for all significant changes in applications and infrastructure technology, which addresses unit, system, integration and user-acceptance-level testing so that deployed systems operate as intended.<br>
</blockquote>

--[[User:Mdpeters|Mdpeters]] 09:43, 23 June 2006 (EDT)