Blue Lance InfoSec Blog

Supreme Court Case to Determine Future of Sarbanes-Oxley

On December 7, the U.S. Supreme Court will hear arguments in a case which challenges the constitutionality of the Public Company Accounting Oversight Board (PCAOB); the organization responsible for determining policy, and enforcement of the Sarbanes-Oxley Act.

The plaintiffs in the case (Free Enterprise Fund v.Public Company Oversight Board) assert that the PCAOB, while characterized as a private corporation, exercises broad governmental powers including policy creation and compliance enforcement; in effect, making it a government agency subject to Presidential oversight and control.

While the case is not likely to be the downfall of Sarbanes-Oxley, but some form of change seem to be on the horizon for the legislation.  An amendment currently in the House Financial Services Committee would permanently exempt small publicly traded companies from the attestation requirement of Section 404 of the Sarbanes-Oxley Act.

The Rising Risk of Insider Threat, Two Ways

Rick Caccia writes for Computerworld on how to address two types of insider threats:

“‘I read about fraud all the time -- hackers, online gangs, angry employees, etc. It seems like it's on the rise. Why is this so hard to detect and how can we prevent fraud in our organization?’
It is true that fraud is increasing, and it does seem that we read about incidents on an almost daily basis. This is a factor of the rise in the amount of sensitive information that is now online, an increased number of online applications that access this information, and the growing number of users who use online services for financial services. The result is more opportunity for fraud, with less effort, so it's no surprise criminals have moved their activities online and that insider-led fraud is on the rise.”

Read the full article here.

Sarbanes-Oxley Solution Brief Now Available

Blue Lance released its LT Auditor+ Solution Brief today for Sarbanes-Oxley Compliance.  The document illustrates how LT Auditor+ maps to the SOX requirements.  The document is one of several solution briefs being released including HIPAA, and PCI-DSS.

Summary
LT Auditor+ is an important step on the path to compliance with Sarbanes-Oxley.  The tools provide detailed audit trails for Novell NetWare and eDirectory as well as Microsoft Windows file systems, Active Directory and Group Policy.  It allows security and compliance teams to monitor, report and alert on access and changes to sensitive files and configuration settings.

The Sarbanes-Oxley Solution Brief is available now through the LT Auditor+ User Center.