3 ms·
In the financial industry part of SOX is segregation of duty. As a developer I'm not allowed to have write access to any production system, except in an emerge
by CaptainZapp 8y ago
In the financial industry part of SOX is segregation of duty.
As a developer I'm not allowed to have write access to any production system, except in an emergency via a break-glass mechanism, which is audited to the hilt and back.
It also means we're not allowed to deploy software to production systems. This has to happen via a specific chain development > regression / user acceptance testing > production.
All those environments need to be physically seperated with very specific access requirements.
The deployment process needed to be signed off by outr auditors.
I can't speak for other banks, but they probably need to implement the same -, or a similar system.
Neither can I speak for SOX requirements regarding software fo car manufacturing.
- _Codemonkeyism 8y agoNot only banks, every company listed in the US. It was the same where I've worked, and it wasn't a bank (Enron was no bank either).
- alanfranzoni 8y ago> As a developer What if the employee were a sysadmin-level person that sidestepped the normal process?
- falsedan 8y agoThe you say in your compliance policy that you run regular audits for these kinds of actions and remediate them on a case-by-case basis. E.g. run quarterly reports for changes to prod that didn't go through the regular release pipeline and note down which P0 they corresponded to.
- XorNot 8y agoWhich would then be roughly why this happened and is coming out now.