1. Risk: Unauthorized access attempts go unnoticed.
- a. SOX.184.108.40.206 WINDOWS authentication attempts are limited to attempts specified by the Corporate IT standard.
2. Risk: Unauthorized execution of privileged system commands may disrupt business processes, and corrupt critical business data stores.
- a. SOX.220.127.116.11 WINDOWS administrator level access is password restricted and is limited to the designated WINDOWS administrators only.
3. Risk: Unscheduled access by support vendors may result in business process interruptions or loss of production data.
- a. SOX.18.104.22.168 WINDOWS access by support vendors is granted through a service request.
4. Risk: Unauthorized users might exploit unauthorized access to critical business processes and data.
- a. SOX.22.214.171.124 The WINDOWS operating application has a session "Time-Out" function enabled.
5. Risk: Unnecessary disruptions to business processes or data corruption may occur.
- a. SOX.126.96.36.199 WINDOWS rule changes are scheduled during maintenance windows.
6. Risk: Unidentifiable users may compromise critical business processes and data.
- a. SOX.188.8.131.52 The WINDOWS system will not allow identical administrator IDs.
7. Risk: Insufficient security standards may allow unauthorized access to production systems and business data stores.
- a. SOX.184.108.40.206 WINDOWS passwords are required for each administrator ID. Password configuration is based on Corporate IT standards.
8. Risk: Inappropriate administrative actions are executed without accountability measures.
- a. SOX.220.127.116.11 The WINDOWS operating application has the functionality to monitor administrator access related events.
9. Risk: Reactive security monitoring results in data compromise and financial loss or liability.
- a. SOX.18.104.22.168 WINDOWS administration team is notified when security violations occur.
10. Risk: Forensic evidence is not available to resolve malfunctions, compromises or other security compromising incidents.
- a. SOX.22.214.171.124 The WINDOWS administration team reviews security logs looking for security violations.
11. Risk: Unauthorized access is granted to business systems or data stores.
- a. SOX.126.96.36.199 WINDOWS access is granted through a service request.
12. Risk: Unauthorized access may occur resulting in business data compromise or destruction.
- a. SOX.188.8.131.52 Terminations are sent through the HR process. An Email is sent from HR with all terminations to the WINDOWS system administrators.
13. Risk: Insufficient security standards may allow unauthorized access to production systems and business data stores.
- a. SOX.184.108.40.206 WINDOWS password expiration is set to Corporate IT standards.
14. Risk: Security violations or data corruption may occur with no forensic evidence available to resolve the situation.
- a. SOX.220.127.116.11 WINDOWS rules and logging is applied to everyone equally including system administrators.
15. Risk: Unauthorized access (i.e. terminated employees) may occur.
- a. SOX.18.104.22.168 A semi-annual revalidation of WINDOWS administrator accounts are performed by security administration.
16. Risk: Unauthorized execution of privileged system commands may disrupt business processes, and corrupt critical business data stores.
- a. SOX.22.214.171.124 Root level access is password restricted. This password is know only by system the administrators.
17. Risk: Controls provide reasonable assurance that the systems are appropriately tested and validated prior to being placed into production processes, and associated controls operate as intended and support financial reporting requirements.
- a. SOX.5.4 A testing strategy is developed and followed for all significant changes in applications and infrastructure technology, which addresses unit, system, integration and user-acceptance-level testing so that deployed systems operate as intended.
--Mdpeters 09:45, 23 June 2006 (EDT)