IT Controls for Sarbanes-Oxley and Beyond

Tim Cuny

Novell, Inc.

Clark Schenz

Novell, Inc.

Compliance Landscape

The View

Privacy Act

HIPAA

FERC

SEC Regulation S-P

Network Advising Initiative

European Data

Protection Directive

Family Educational Rights and Privacy Act

Cyber Security Research and Development Act

New mandates, ongoing changes in accounting standards, and information transparency demand a new approach

Graham-Leach-Bliley

Child Internet Protection Act

Government Information

Security Reform Act

Insurance Information and Privacy Protection Model Act

Homeland Security Act

Compliance Momentum is Building

The View

Implementation Complexity

Business Benefit

Sarbames-Oxley

Section 302:

CEO and CFO must personally certify their financial statements

Section 404:

Auditors must certify internal controls and processes

Section 409:

Real-time disclosure of material business events

Driver: Insufficient Risk Controls

Driver: Insufficient Business Controls

Basel II (Standardized Approach)

Enforces Basel I guidelines

Capitol Accord (Basel I)

Sets Standards For Credit Risk Management

Basel II (Foundation IRB)

Provides Capital Relief for Advanced Risk Management

Basel II

(Advanced IRB)

Maximum Capital Relief for Advanced Risk Management

New Capital Accord

(Base II)

Benefit: Reduced Capital Allocations

Benefit: Improved Business Processes

Sarbanes Oxley is the Tipping Point

Financial reporting accuracy is a top priority

Significant efforts to identify, document and verify relevant business processes

Organizations face an on-going struggle with integrating the multiple financial reporting systems required to consolidate financial data

Management of compliance in relevant time

Global 2000 are increasingly recognizing the shortcomings of the IT Controls for their existing financial systems

Centralized system controls for authentication, authorization, administration and audit are required

The Issue

Sarbanes-Oxley Priority 1: Accuracy

CEOs and CFOs legally responsible for the integrity of their company’s financial statements

Boardrooms want every assurance from COOs and CIOs that the data in company financial systems are accurate

The results of the IT auditing teams are bubbling up to the boardroom — and they can be pretty ugly

The Priority

Sarbanes-Oxley is a relatively blunt instrument that requires CIOs to focus on making sure that they are reporting accurate information and that they know where it’s coming from.

Sarbanes-Oxley Priority 2: Control

Companies linking their systems with partners and suppliers up and down the supply chain

Continuing exposure to internal tampering with 64% of companies facing insider attacks*

Growing incidence of various forms of malicious attack, including viruses, pfishing and forms of identity theft.

* Source: Computer Security Institute and FBI joint survey 2002

Adding to these challenges are IT organizations with an expanding array of information-based interfaces to support and defend, within a commitment to “do more with less.”

The Priority

IT Control Landscape is Enterprise-Wide

The Scope

Source: IT Governance Institute, IT Control Objectives for Sarbanes Oxley

General Controls

Program development

Program changes

Computer operations

Access to programs and data

Control environment

Application Controls

Completeness

Accuracy

Validity

Authorization

Segregation of duties

Significant Accounts in the Financial Statements

Balance Sheets

Other

Notes

SCFP

Income Statement

Business Processes/Classes of Transactions

Process A

Process C

Process B

Financial Applications

Application A

Application C

Application B

IT Infrastructure Services

Database

Network

Operating System

7 of Top 10 Control Deficiencies
Focus on Secure Identity Management

Unidentified or unresolved segregation of duties issues

Operating System (e.g. Unix) access controls supporting financial applications or Portal not secure

Database (e.g. Oracle) access controls supporting financial applications (e.g. SAP, Oracle, Peoplesoft, JDE) not secure

Development staff can run business transactions in production

Large number of users with access to “super user" transactions in production

Terminated employees or departed consultants still have access

Posting periods not restricted within GL application

Custom programs, tables & interfaces are not secured

Procedures for manual processes do not exist or are not followed

System documentation does not match actual process

Source: Ken Vander Wal, Partner, National Quality Leader, E&YISACA Sarbanes Conference, 4/6/04

The Scope

IT Control Landscape

The Scope

10-Q

10-K

Corporate

Business Unit 1

Business Unit 2

Corporate

Corporate

Policies and Procedures, Process Flows, Narratives and Control Matrices

Disclosure Committee Review (302) / Management Evaluation

Business Unit 1

Business Unit 2

Corporate

Business Unit 1

Business Unit 2

Corporate

Business Unit 1

Business Unit 2

Systems/General Computer Controls

Information and Communication

Environmental

Investor Relations

Revenue & Receivables

Purchasing & Payables

Legal

Compliance

Treasury

Payroll & Benefits

Management & Financial Reporting/

Accounting

Manufacturing

Financial Statement Mapped to Key Business Cycles

Non-Financial Disclosures Mapped to Business Units and Processes

Review and Interview

Performed by CEO/CFO

Performed by CEO/CFO

Review and Interview

Perform Certification

Meet w/Audit Committee

Financial Report

COSO Internal Control Framework

Consists of four objectives:

Goals, aligned with and supporting its mission

Effectiveness and efficiency of operations

Reliability of financial reporting

Compliance with applicable laws and regulations

Consists of eight components:

Sets the basis for how risk is addressed

Support and align with the entity’s mission and are consistent with its risk appetite

Events affecting achievement of objectives identified, distinguishing risks and opportunities

Analyzed, considering likelihood and impact

Avoiding, accepting, reducing, or sharing risk

Policies/procedures ensuring proper risk responses

Identified, captured, and communicated that enable people to carry out their responsibilities

Risk is monitored - modifications made as required

The Framework

Monitoring

Information & Communication

Control Activities

Risk Response

Risk Assessment

Event Identification

Objective Setting

Internal Environment

COMPLIANCE

REPORTING

OPERATIONS

STRAGTEGIC

ENTRY-LEVEL

DIVISION

BUSINESS UNIT

SUBSIDIARY

Today’s Enterprise

The Challenge

The average large corporation maintains 181 directories, each containing user and/or resource identities. In a survey of 50 companies, 50 percent synchronize the data among these directories manually

As a Result

Difficult to extend access within enterprise and beyond

Complex and frustrating user experience

Time delays in making identity changes

High costs to manage directories, identities and passwords

High probability of inaccurate data

Complex security environment with inherent risks

The Challenge

Costs of Compliance

AMR Research Estimates SOX Spending Will Reach $5.8 Billion in 2005

Despite initial thoughts that Sarbanes-Oxley spending would be a one time expenditure

36% of companies plan to increase spending

52% will maintain current levels and

12% will decrease SOX spending

The average large U.S. corporation will spend up to 35,000 work hours and $4.6 million in 2004 alone to achieve first-year compliance with Section 404 PeopleSoft 2004

A recent survey of corporate boards by RHR International reveals annual Sarbanes-Oxley compliance costs average $16 million--a jump of 77 percent from last year Nov. 16, 2004

…the costs of implementing Sarbanes-Oxley are high -- upwards of $35 million on average for large companies this year alone. Business Week Jan. 2005

44 percent of the senior executives who took part in the PWC survey admitted their companies don't have a clear view of their total compliance spending

The Challenge

Compliance With Identity-Driven Controls

Solution Approach

Authentication, Authorization, Administration and Audit

Identity as a Unifying Principle for IT Controls

Role Engineering as the operational agent

Governance as strategic guidance and oversight

Governance

Role Engineering

Audit Reporting

Access Control

Identity

Account Management

Personalization

Security

Work Flow

Web Services

Provisioning

Centralized Management For Identity

H/R

Financials / ERP

PBX

Directory

Mail

Operating
System

Database

Secure Identity Manager

Solution Approach

Managing the Lifecycle

Efficiently Manage:

People

Systems

Services

Software

Hardware

Access Points

Resources

Solution Approach

Relationship Begins

Promotion

Password Expires

Relationship Ends

USER LIFECYCLE

New Project

Move Locations

Forgot Password

De-Provisioning

Provisioning and Application Access

Password Management

Routine User Administration

The Solution:
Powerful Combination of SIM and SOA

Users and Devices

Existing Systems

Identity-based Solution

Associating Services With Identities

Users and Devices

Secure Identity Management

Identity-based Solution

Identity

Store

Existing Systems

Services

Web

service

Web

service

Authenticate

Validate your identity

Determine your role

Authorize

Verify access rights

Associating Services With Identities

Users and Devices

Secure Identity Management

Identity-based Solution

Identity

Store

Existing Systems

Services

Web

service

Web

service

Authenticate

Validate your identity

Determine your role

Authorize

Verify access rights

Associating Services With Identities

Users and Devices

Secure Identity Management

Authenticate

Validate your identity

Determine your role

Authorize

Verify access rights

Identity-based Solution

Existing Systems

Services

Web

service

Web

service

Web

service

Identity

Store

Provisioning Services Based on Identity

Services

Users and Devices

Secure Identity Management

Operating
Environments

Provisioning services by role

Authorize access with single sign-on

Audit & Monitor

Identity-based Solution

Provisioning BP Based on Identities

Services

Users and Devices

Secure Identity Management

Operating
Environments

Provision business processes (BP) across identities

Identity-based Solution

Supporting Federated Identities

Services

Users and Devices

Secure Identity Management

Provision services across organizations

Identity-based Solution

Identity

Store

Identity

Store

Operating
Environments

Enabling End-User Self Service

Services

Users and Devices

Secure Identity Management

Operating
Environments

Allow end-user customization to further personalize services

Identity-based Solution

Employees

Partners

Customers

Finance

Marketing

Sales

Customer service

A world without information boundaries means:

Provision IT services and Information assets

To anyone, from anywhere

In a secure and relevant way, based on identity

Your business

exteNd

&

Nsure

Identity-based Solution

Novell Solution

Identity Solution Provides Foundation

Identity Vault - Customers, Suppliers, Employees, Contractors

(LDAP, Metadirectory)

System Account
Provisioning

Equipment
Requisitioning

Employee Hire &

Terminate

Zero-Day
Start & Stop

Workflow
Automation

Role-Based Portal

White Pages

Single Sign-on

Self-Service

Customer History &

Personalization

Solution Approach

Nsure® Solution Stack

Identity Vault - Customers, Suppliers, Employees, Contractors

(LDAP, Metadirectory, Management Tools)

System Account
Provisioning

Equipment
Requisitioning

Employee Hire &

Terminate

Zero-Day
Start & Stop

Workflow
Automation

White Pages

Single Sign-on

Self-Service

Customer History &

Personalization

Audit

Solution Approach

Role-Based Portal

Solution Stack Product Mapping

Novell Nsure Identity Manager
Novell Nsure Identity Manager is a comprehensive identity management solution that delivers key capabilities including provisioning, self-service, metadirectory, and password management.

Novell eDirectory™
eDirectory is a centralized identity management system that unifies and enables the management and control of user identities, access privileges and other resources across technology and enterprise boundaries. eDirectory, as the infrastructure and foundation for Novell's Net services software.

Solution Approach

Solution Stack Product Mapping

Novell iChain®
iChain provides identity-based web security services that control access to application and network resources across technical and organizational boundaries. iChain separates security from individual applications and web servers, enabling single-point, policy-based management of authentication and access privileges throughout the network.

Novell Nsure Audit

Novell Nsure Audit is a secure logging and auditing product that helps reduce organizational liability and risk by ensuring compliance with governmental regulations and business-driven security policies. This product collects data about security, system and application events that occur across an organization’s network.

Solution Approach

Solution Stack Product Mapping

Novell exteNd™ 5
Novell exteNd 5 is a comprehensive suite for the rapid development and deployment of service-oriented Web applications. Combine identity, integration and portal services to securely deliver relevant business information, at the appropriate time, to the right people.

Solution Approach

Compliance Trend

Forward-looking executives would rather address multiple business drivers in total rather than just one at a time

Business Facilitation

Service Level

Cost Reduction & Productivity

Regulatory Compliance

Security

Point solutions are giving way to frameworks and foundations that fully integrate core capabilities required for a secure, adaptable, process-driven enterprise

The Advantage

Compliance-Aware Architecture

309

whistle blower

302

workflow signoff

409

real-time notification

404 control standards

404

audit trails

Solution Approach

Novell is Helping Clients Meet SOX

Review current internal systems and controls

Implement Secure Identity Management program

Assist in testing and verification

Section #404: Annual Management report of internal controls over financial reporting attested by auditors

Immediate

Section #409: Real-time disclosure of material events

Next Steps

Integrate relevant business systems

Provide framework for compliance reporting

Develop personalized compliance reporting dashboards

Looking Forward

Novell SOX Scorecard
Overview

Method for evaluating the valuable opportunities for a client based on their current operating and technical environment

Scorecard is made up of 4 Components

Current State Scoring

Current State versus Future State Analysis

Opportunity Identification and Scoring

Opportunity Analysis

Evaluates the client’s current environment against the desired state, and identifies the opportunities to address the gaps

Opportunities are scored based on both standard metrics and those most appropriate for the client

Graphical analysis compares the different opportunities enabling focused discussion around short and long term actions

Evaluation

Novell SOX Scorecard
Current State Vs. Future State Analysis

Sarbanes Oxley Ratings Scorecard

SOX Scorecard Data

Summary

Current

State

Future

State

Business

Procedures

1.88

4.00

Provisioning

2.78

4.00

Password Mgt

2.86

3.00

Technical

Authentication

3.00

3.00

Authorization

1.25

4.00

Administration

3.33

3.00

Audit

3.08

3.00

Industry and Client-based metrics

Evaluation

Novell SOX Scorecard
Current State Sample Scored Questions

Business

Answer

Score

Normed

Score

Procedures

1

Does your organization have a procedure for regular security testing?

yes

1

0.625

Provisioning

9

Do any SOX applications store data by leveraging tools such as directories or databases?

yes

1

0.56

10

Is a centralized meta-directory used to maintain identities, roles, and policies for SOX

related applications?

yes

1

0.56

Password Management

24

Has your organization assessed the implementation of your password policy?

yes

1

0.71

25

Can users manage their own passwords without intervention from system custodians?

no

0

0.00

Technical

Authentication

28

Are there documented policies in place to enforce authentication standards for SOX

applications?

no

0

0.00

Authorization

31

Do all the applications support access control based on role, or by an individual account?

no

0

0

32

Are roles defined by documented policies?

yes

1

1.25

Administration

38

Are the applications accessible remotely (external to your organization's IT infrastructure)?

yes

1

0.42

43

Has your organization identified your SOX-related business practices and mapped them to

specific applications and data stores?

yes

1

0.42

Audit

47

How long to create reports on SOX applications? (days)

2

1

0.38

52

Is there a policy in place for periodic security audits?

no

0

0.00

Evaluation

Novell SOX Scorecard
Current State vs. Future State Analysis

Evaluation

0.00

0.50

1.00

1.50

2.00

2.50

3.00

3.50

4.00

4.50

5.00

Procedures

Provisioning

Password Mgt

Authentication

Authorization

Administration

Audit

Future State

Current State

Novell SOX Scorecard
Opportunity Scoring Summary example

Workstream

Opportunity

Complexity

Benefit

Cost

Evaluation

Process	Procedure 1	6.3	5.8	16

Process	Procedure 2	4.7	6.0	16

Process	Provisioning 1	5.0	5.5	4

Process	Provisioning 2	3.0	3.3	1

Process	Password Mgt 1	4.7	4.3	4

Process	Password Mgt 2	4.3	4.3	1

Technology	Authentication 1	4.7	5.3	1

Technology	Authentication 2	4.3	4.3	1

Technology	Authorization 1	6.0	4.7	32

Technology	Authorization 2	6.0	5.5	1

Technology	Administration 1	2.3	5.0	1

Technology	Administration 2	4.0	4.2	16

Technology	Audit 1	5.7	4.7	16

Technology	Audit 2	3.7	8.0	4

Novell SOX Scorecard
Opportunity Scoring – Sample of Complexity

Evaluation

Novell SOX Scorecard
Opportunity Scoring Analysis

Process Initiative Priortity Chart

0.0

5.0

10.0

0.0

5.0

10.0

Complexity

Benefit

Procedure 1

Procedure 2

Provisioning 1

Provisioning 2

Password Mgt 1

Password Mgt 2

Evaluation

The Novell Compliance Experience

Scott & White

One of the largest multi-specialty group practices in the United States. Healthcare regulatory requirements, such as HIPAA, make it imperative to boost security by giving only the right people access to sensitive patient information.

"Everything we do in healthcare is important, but security is imperative. By ensuring proper access to resources, Novell gives us the ability to better comply with regulations by protecting the confidentiality of patient information." Michael Kramer, Assistant Executive Director of Information Systems, Scott & White

Bank Mutual

One of Wisconsin’s largest federally-chartered savings banks. Today’s banks are held to stringent IT auditing standards. Recent federal mandates require precise system event logging. Security breaches are often highly publicized and can jeopardize the reputation of any financial institution.

"As banks are held more accountable, we have to be able to prove that our logs are intact, otherwise all our records are suspect. We must have verification ability in our databases or we would be vulnerable in a lawsuit.“ Frank Green, Vice President, Network Administration, Bank Mutual

State of Nebraska

The State is located in the heart of the United States and is home to 1.8 million residents. Secure access is particularly important for the Health Alert Network (HAN) application and needed to comply with federal requirements from the Center for Disease Control (CDC).

"A secure identity management solution provides the maximum security to prevent the unauthorized access of data on all our platforms," said Jerry Hielen, IT Security Officer at IMServices. "With this solution, we can provide a security umbrella for all our agencies, helping reduce the costs for the individual agencies."

Case Studies

Identity

The Bigger Opportunity?

Integration

Compliance, Privacy

and Security

Administrative Simplification,

Process Automation

Competitive Dominance

and Growth

Business

Objective

IT

Initiatives

Manageable IT Controls

Cross Platform Services

Resource & Access Mgt

Auditable

IT Directory Services

Desktop Management

Secure Identity Management (SIM)

Provisioning

Personalization

White-page Directory Services

Transactional Services

Content Management

Workflow Automation

Aggregation/Integration

Master Directory

Federated Directory

Collaborative Portal Services

Role-Based Identity Management

Interaction

The Advantage

Identity-Based Solution Benefits

Secure, adaptable, process-driven information systems that produce highly accurate, real-time business and financial data are fundamental to the success of any organization

Capture value from the investment in compliance

Improves user productivity

Lowers recurring costs of manual processes

Create a reusable infrastructure that supports future regulatory and business demands

Enhance the decision making process by:

Secure and personalized information management

Increased accuracy of data

Bottom Line

Processes and data

Integration of different software systems has always been a challenge

Now the pressure is one to more tightly couple these systems

Four A’s of access control

Transforming business best practices to legal mandates

SOX is broad and deep and we are just now learning the full ramifications of this legislation

Clearly IT has a substantial role in the process of compliance

Concerns of how to become compliant within organization and the compliancy of your partners

Security is number one area of spend for 2005 – CIO Insight (Ziff Davis)

IT Governance Institute is leading the challenge for Section 404 and IT Controls

Control at Network level, Application level, and Business Process level

Places IT Controls and Access Control squarely on Identity Driven Computing

With all the separate business units using systems that are good on their own, but could be better if there was the ability to quickly and easily to access data from other sources – there is an opportunity to gain more from the IT investment with the applications being used by the company today.

The proliferation of disparate client-server environments has created a complexity that doesn’t serve the current demands and opportunity within the market today.

This environment can be costly to manage, inflexible and non-responsible to the timelines expected in today’s economy.

Too many applications, too many systems and servers, and a need to simplify access and security to enhance productivity.

This is to stress the mishmash of information that just needs to be unraveled so that a foundation of agility can be established. (parachute theory)

$800K to $2.8M annual cost for compliance with 404 for an average $3B company – The Johnson Group/FEI

Obviously expensive and poorly controlled

Clear goal moving forward is to eliminate as many manual tasks and interventions as possible

SIM is a key part of the business solution

Novell exteNd – is a comprehensive suite that assembles integration, portal and identity Services to securely deliver business information to the users that need it

“We don’t implement secure identity management all at once. We always start with a a basic identity management foundation in which we create and synchronize the digital identities that you want to manage, whether they are employee identities, customer identities, partner identities, or supplier identities. Only after this foundation is in place, can we build the other elements of a secure identity management solution.

The order shown here is just an example.

The items on the left relate in some way to workflow

The ones on the right relate in some way to exposing or using identity information via a portal

The main point is that identity management enables many other capabilities – but there’s only one starting point. You have to start with the basic creation and synchronization of digital identities.

A ‘foundation’ identity management implementation typically includes:

Implementation of an integrated directory

Synchronization of identity information across a small set of core systems

Automation of account creation & update in core systems

“We don’t implement secure identity management all at once. We always start with a a basic identity management foundation in which we create and synchronize the digital identities that you want to manage, whether they are employee identities, customer identities, partner identities, or supplier identities. Only after this foundation is in place, can we build the other elements of a secure identity management solution.

The order shown here is just an example.

The items on the left relate in some way to workflow

The ones on the right relate in some way to exposing or using identity information via a portal

The main point is that identity management enables many other capabilities – but there’s only one starting point. You have to start with the basic creation and synchronization of digital identities.

A ‘foundation’ identity management implementation typically includes:

Implementation of an integrated directory

Synchronization of identity information across a small set of core systems

Automation of account creation & update in core systems

IT Directory Services Plan – To secure the foundation for proper implementation of an Enterprise Master Directory. Getting the existing corporate users, applications and desktop controls in place will free up the necessary resources to move the infrastructure to the next Level. Proper deployment of a Directory can ensure Enterprise Security policies are enforced throughout the organizations for intranet and extranet services.

Enterprise Meta-Directory – Understanding and anticipating the needs of the Enterprise and it’s business associates is important to help successfully deploy ERP, BPM and SCM solutions. Knowing who, what and where to deliver personalized services and information can be simplified by utilizing a full service directory with a directory enable enterprise portal. And access can be provided to those on the intranet, extranet or across the Internet from desktop to PDA securely.

Master Healthcare Directory – Now that employees and business associates have the ability to securely interact with the Enterprise Infrastructure, the Health Care Organization is ready to extend the infrastructure out to the population at large. Patients can begin to invoke requests and communicate securely with the provider community, and the HCO can look to providing online services such as patient referrals, scheduling and pre-admission services. CIO’s will know they have the appropriate services in place and the ability to cost effectively scale the system. The Master Healthcare Directory can be viewed as the Digital Identity Management component of an Enterprise Master Person Index (aka Enterprise Master Patient Index (EMPI) or Master Member Patient Index (MMPI)) strategy.

Turn this challenge into the opportunity to create the enterprise performance management and reporting system that you need to operate your business.

TUT 265 IT Controls for Sarbanes-Oxley and Beyond

2003-12-08T12:43:39