12 ms·

In my previous job I was involved with IT of large corp and here is explanation I got: Yes it is false but SOX does call for strict internal controls on financ

by tlogan 9y ago

In my previous job I was involved with IT of large corp and here is explanation I got: Yes it is false but SOX does call for strict internal controls on financial information. Which means that password rotation is necessary so that people who are not anymore allowed to access information does not have access to these information any more. Thus password rotation is required. I and my IT friends could be 100% wrong here but this is how these SOX vague requirements will be translated to IT admins.

ubernewb 9y ago
I'm a former Big Four auditor, on the financial side, but I worked pretty closely with our tech folks and I'm now in the tech industry. SOx really does have very strict internal control requirements on financial data and how and where it can pass between systems and people, whether technological systems or physical ones. I've worked with clients who used strict password rotation to fit the law, as well as with clients who didn't do this. As long as the policies are clearly spelled out, do not allow those who are no longer supposed to have access to have access, and are consistent across the organization, it's all good. For example, one company I worked with changed passwords to one system only when someone rolled off the team working on it. That happened infrequently, but more than once a year. The policy was clear, written, and consistent, so it fit the internal control criteria. Really, we'd need to find what are called 'material weaknesses' or 'significant deficiencies' to make us really stop and consider writing up a finding that would be published. 'Material weaknesses' are considered worse, and would likely lead to the possibility of a material misstatement in the financial statements of the firm. Deficiencies are a step below that. If the firm corrects them, we're okay for the most part, unless the weakness was terrible.
FireBeyond 9y ago
> strict internal controls on financial information. Which means that password rotation is necessary so that people who are not anymore allowed to access information does not have access to these information any more How does rotating a password prevent access? That's access control, not authentication. Unless it's a shared password, which is a bigger problem.
- pierrepoutine 9y ago
  privileged accounts may become disabled by system policy if the password is not updated after >180 days of expiry

by tlogan 9y ago

ubernewb 9y ago

I'm a former Big Four auditor, on the financial side, but I worked pretty closely with our tech folks and I'm now in the tech industry. SOx really does have very strict internal control requirements on financial data and how and where it can pass between systems and people, whether technological systems or physical ones. I've worked with clients who used strict password rotation to fit the law, as well as with clients who didn't do this. As long as the policies are clearly spelled out, do not allow those who are no longer supposed to have access to have access, and are consistent across the organization, it's all good. For example, one company I worked with changed passwords to one system only when someone rolled off the team working on it. That happened infrequently, but more than once a year. The policy was clear, written, and consistent, so it fit the internal control criteria. Really, we'd need to find what are called 'material weaknesses' or 'significant deficiencies' to make us really stop and consider writing up a finding that would be published. 'Material weaknesses' are considered worse, and would likely lead to the possibility of a material misstatement in the financial statements of the firm. Deficiencies are a step below that. If the firm corrects them, we're okay for the most part, unless the weakness was terrible.

FireBeyond 9y ago

> strict internal controls on financial information. Which means that password rotation is necessary so that people who are not anymore allowed to access information does not have access to these information any more How does rotating a password prevent access? That's access control, not authentication. Unless it's a shared password, which is a bigger problem.

pierrepoutine 9y ago
privileged accounts may become disabled by system policy if the password is not updated after >180 days of expiry