There are regulatory rules that must be met as well as organizational policy directives from management to be implemented. Additionally, there are also directives from outsiders (such as hackers) or from insiders (such as those with particular departmental or personal priorities that conflict with management’s objectives) that must be avoided. As a result, compliance can be considered to fall into three general categories: 1. Regulatory: Mandated actions from outside governmental/regulatory agencies 2. Procedural/Policy: Mandated actions from (inside) management 3. Security: Prevention of the actions of outsiders and insiders attempting to enhance personal interests that are in conflict with owners’ (stockholders’ or the public’s) best interests In some cases, categories 2 and 3 may overlap, such as when the actions of management are not in the best interests of the organization. An example of this would be a CEO who treats the company’s funds as her own personal piggy bank or a government official who uses public funds for personal gain. For example, consider the actions of former CEO Dennis Kozlowski at Tyco, who threw lavish parties (costing over $200 million) with company funds, and the actions of former Maryland governor Spiro Agnew, who took kickbacks on government contracts.  REGULATORY COMPLIANCE The IT department—since it is primarily a service department—has very few direct governmental rules that apply to its own operations. However, IT management does have to concern itself with any area that relies on data integrity or information process quality. Five areas that fall into this category are: 1. The finance department, which is concerned with taxes, internal control over financial statements, and proper recording of costs and revenue recognition 2. The human resources department, which must protect confidential personal information, such as Social Security numbers and health information, and which must safeguard fingerprint or security clearance data 3. The engineering department, which must protect new patents or innovative technology 4. The manufacturing department, which must protect secrets regarding proprietary processes for manufacturing and/or establishing high-level quality products that exceed competitors’ capabilities 5. The legal department, which may be involved in high-stakes negotiations or lawsuits In most cases, IT regulatory compliance involves solely data protection. However, it may, in rare cases, involve establishing the processes that ensure such data protection is afforded to the appropriate other departments. One example of this is the recent IT audit requirements that exist as part of the Sarbanes-Oxley Act of 2002. Sarbanes-Oxley Act of 2002 The Sarbanes-Oxley Act of 2002 (also known as SOX) was implemented by Congress in response to the fraudulent financial reporting at both Enron and WorldCom at the end of the dot-com boom period of 1999 to 2001. The collapse of these two firms led to a law requiring tha.

1. There are regulatory rules that must be met as well as
organizational policy directives from management to be
implemented. Additionally, there are also directives from
outsiders (such as hackers) or from insiders (such as those with
particular departmental or personal priorities that conflict with
management’s objectives) that must be avoided.
As a result, compliance can be considered to fall into three
general categories:
1. Regulatory: Mandated actions from outside
governmental/regulatory agencies
2. Procedural/Policy: Mandated actions from (inside)
management
3. Security: Prevention of the actions of outsiders and insiders
attempting to enhance personal interests that are in conflict with
owners’ (stockholders’ or the public’s) best interests
In some cases, categories 2 and 3 may overlap, such as when the
actions of management are not in the best interests of the
organization. An example of this would be a CEO who treats the
company’s funds as her own personal piggy bank or a
government official who uses public funds for personal gain.
For example, consider the actions of former CEO Dennis
Kozlowski at Tyco, who threw lavish parties (costing over $200
million) with company funds, and the actions of former
Maryland governor Spiro Agnew, who took kickbacks on
government contracts.
REGULATORY COMPLIANCE
The IT department—since it is primarily a service department—
has very few direct governmental rules that apply to its own
operations. However, IT management does have to concern
itself with any area that relies on data integrity or information
process quality.
Five areas that fall into this category are:
1. The finance department, which is concerned with taxes,
internal control over financial statements, and proper recording

2. of costs and revenue recognition
2. The human resources department, which must protect
confidential personal information, such as Social Security
numbers and health information, and which must safeguard
fingerprint or security clearance data
3. The engineering department, which must protect new patents
or innovative technology
4. The manufacturing department, which must protect secrets
regarding proprietary processes for manufacturing and/or
establishing high-level quality products that exceed
competitors’ capabilities
5. The legal department, which may be involved in high-stakes
negotiations or lawsuits
In most cases, IT regulatory compliance involves solely data
protection. However, it may, in rare cases, involve establishing
the processes that ensure such data protection is afforded to the
appropriate other departments. One example of this is the recent
IT audit requirements that exist as part of the Sarbanes-Oxley
Act of 2002.
Sarbanes-Oxley Act of 2002
The Sarbanes-Oxley Act of 2002 (also known as SOX) was
implemented by Congress in response to the fraudulent financial
reporting at both Enron and WorldCom at the end of the dot-
com boom period of 1999 to 2001. The collapse of these two
firms led to a law requiring that large businesses enact very
detailed processes to ensure that the financial reporting
processes, including the IT processes surrounding financial
reporting, were designed such that top management would be
directly responsible for any irregularities and could not blame
such irregularities on the actions of lower-level management or
staff-level positions.
The actions of this law were quite successful and led to a major
overhaul and improvement in the integrity of firms’ financial
statements. Unfortunately, SOX regulations were designed to
apply specifically to manufacturing and service firms, but
exempted financial firms and brokerages if they were already

3. subject to the restrictive covenants of banking and securities
laws. As we now know, these banking and securities laws
seemed very conservative, restrictive, and were continually
monitored—but in reality, they ignored many of the exact same
problems (such as the creation of exotic derivatives and
overextension of debt leverage) that had led to the problems at
Enron and WorldCom. As a result, in late 2008 and on through
2009, the world suffered a major economic downturn that was
largely the result of financial firms (and their clients) being
overextended in the credit and debt markets. One estimate put
the size of this collapse at the equivalent of $66 trillion. Banks
failed at rates not seen since the Great Depression of the 1920s
and 1930s, and, as of the time of the writing, the economic
depression is still very much affecting worldwide economies
negatively.
Many critics state that SOX and any regulatory rules cost
companies money and thus negatively affect the companies’
economic activity and profit-making capabilities. This
complaint brings into question the need of any company to do
anything besides make profit. My argument is that even if a
company does not have a requirement to contribute to the
betterment of its community or be fair to its customers, it still
has a commitment to its shareholders to properly report its
operating results—and most regulatory rules, such as Securities
and Exchange Commission reporting requirements and SOX, are
designed primarily with shareholders in mind.
PROCEDURAL/POLICY COMPLIANCE
A second compliance issue for IT is how to help management
achieve its objectives. This is the area referred to as
procedural/policy compliance.
Whether the organization is a for-profit firm, a nonprofit private
entity, or a public governmental entity, the IT department has
three primary purposes as part of procedural/policy compliance.
IT must ensure that:
1. The organization’s assets are used for improving the
organization’s value or the value of its owners (which may

4. include the public when the organization is a governmental
entity).
2. All assets (including those of human capital) are able to
perform at top efficiency.
3. Data are recorded to determine how effective the
organization is at achieving purposes 1 and 2.
In the past, organizations often thought that they were
performing their activities well, without recognizing the many
actions that IT could perform more quickly and the extra data
analysis and overview that IT resources could provide to
determine the true effectiveness of the organization’s activities.
Nowadays, most organizations have used at least some of these
new processes. The automation of the improved processes has
shown the many review and analysis possibilities of IT.
SECURITY
One of today’s key concerns is that modern hardware and
software configurations be designed such that software assets
are maintained intact and not corrupted by inadvertent or
deliberate unauthorized changes. This is one of the primary
reasons why companies use standard frameworks and comply
with suggested regulatory standards such as ISO20000, Control
Objectives for Information and Related Technology (COBiT),
and the Basel Accords. It is also the reason that they use Six
Sigma methodologies in reviewing system designs and/or
system deficiencies.
Most of these technologies are designed not only to detect
unauthorized changes but also to streamline existing processes
and operational methodologies. By so doing, they establish
operational compliance as a by-product, ensuring that the IT
organization is meeting corporate and regulatory requirements
for the protection of the corporation’s valuable information.
Vulnerability assessments are a standard part of such regulatory
standards, and there are systemic programs available for such
assessments as well as standard auditing techniques. Some of
the things that should be considered in a compliance audit of a
web site audit include:

5. Backup Controls
1. Ensure that physical security, including environmental and
life safety controls, is in place at the hardware site running the
Web application.
2. Ensure that network availability and data backup is assured
by using component failure architectures that repair themselves,
such as RAID, tape or compact disc juke boxes, Bernoulli
boxes, or other similar backup media.
3. Review disaster recovery and business interruption plans for
the web site, focusing on whether the alternate plan had been
tested for validity and readiness.
E-Commerce Controls
1. Ensure that IT is using a set of security mechanisms and
procedures, which, taken together, constitute a security
architecture—for example, Internet firewalls, public key
infrastructure, encryption, certificates, and password
management (including nonstatic passwords).
2. Ensure that the firewall mechanisms in place can mediate
between the public network (the Internet) and an organization’s
private network.
3. Ensure that the web site is using a combination of public and
private key encryption to guarantee a unique and positive
identification of the user.
4. Ensure that digital signatures are being used.
5. Ensure that certificates are being used—including certificate
authority, registration authority, certification revocation list,
and a certification practice statement.
6. Ensure that logs of the e-commerce portion of the web site
are being monitored by responsible personnel on a regular basis.
This includes operating system logs, console messages, network
management messages, firewall logs and alerts, router
management messages, intrusion detection alarms, application
and server statistics, and system integrity checks.
7. Ensure that the system has a method, such as SSL (encrypted
secure socket layers), to guarantee confidentiality of data.
System and Transaction Controls

6. 1. Check on the ability of the system to counteract
vulnerabilities, such as instituting countermeasures to
traffic/trend analysis on the part of intruders (e.g., padding
messages, sending noise, and providing covert channel
analysis).
2. Ensure that hardware controls, such as elimination of unused
maintenance accounts, are in place.
3. Test that existing employees have been screened for security
and that measures are in place to ensure that they are not using
data scavenging techniques to piece together information from
bits of data.
4. Check the system logs to ensure that the IT administrators are
not taking advantage of initial program load (IPL)
vulnerabilities by putting the system into a single-user mode
during web site start-up.
5. Review data traffic patterns to ensure that neither existing
personnel nor intruders are using network address hijacking to
reroute data traffic from a server or network device to a
personal machine.
6. Follow sample transactions all the way through the system by
use of audit trails to ensure that all the various security events
relating to the transaction are taking place; to ensure that the
terminal at which the transaction was processed (if internal) is
one that is authorized for such a transaction; to look for
production job reruns and amendments to production jobs; and
to look for computer programmer changes to live production
data.
Data Library Procedures
1. Ensure that utility software (used for data correction of
inconsistencies on an automated basis) is restricted on a need-
to-use basis and that a log is generated whenever this utility is
used.
2. Review the check-in and check-out of standard code for the
web site to ensure that it was not being reviewed by
nonauthorized individuals or those not involved in the web site
code process.

7. System Development Standards
1. Ensure that run-to-run totals of key fields are used and
compared to detect alterations between postings per reports
from the web site, and posting to the general ledger based on
actual sales booked/monies received.
2. Ensure that there is a separation of duties in the upgrade of
Web application software and systems software so no individual
has the capability to perform more than one of these processes:
origination, authorization, verification, or distribution.
3. Review the change management procedure for installing
changes to the Web applications.
4. Use mapping to identify specific logic that has not been
tested, then analyze these programs during execution to
determine whether program statements have been executed, thus
identifying potential exposures.
Data Center Security
1. Ensure that reports, such as critical output reports, are
produced and maintained in a secure area and distributed in an
authorized manner. Access to online output reports should also
be restricted. Online access can be tested through a review of
the access rules or by monitoring user output.
2. Run a set of substantive tests on transactions that examine
the accuracy, completeness, consistency, and authorization of
data currently held in a system in order to see any failures in
input or processing controls. Verify the data against the source
documentation.
Online Auditing
Consider using at least one (and probably more) of these types
of online automated evaluation techniques:
1. System control audit review file and embedded audit modules
(SCARF/EAM)
2. Snapshots (of the steps transactions take from input to
output)
3. Audit hooks (embedding programs within the web site that
act as red flags to indicate when an error or irregularity has
occurred that is escalating in size or severity, so as to prevent it

8. from getting out of control)
4. Integrated test facilities (a duplicate site to simulate the
entire web site operation and verify its validity by comparing
the results at the test site to actual results based on live data
flowing through the system)
5. Continuous and intermittent simulation (a system that
continuously checks while running transactions, and audits a
transaction if certain predetermined criteria are met)
Contingency Items
1. Any other item that has been a serious concern, from business
managers or whistleblower calls to the audit committee, or that
key executives would like to have checked relative to the
operation of the web site
2. Anything unusual relating to the information systems
architecture that covers the web site operations (including
changes to process synchronization, job scheduling software,
data communications software, operating system
changeover/upgrade, or new data modeling/reporting software
implementation)
HACKERS AND OUTSIDE-THE-NETWORK ATTACKS
As you can tell, many problems can be encountered when trying
to protect information in the systems network from outside
attack (either from unauthorized access or unauthorized
modification).
Hackers, internal and external, are constantly trying to bypass
internal controls, both manual and automated, to steal company
funds or to obtain data on customers that will allow them to
steal or modify customer data.
Hackers perform their work in a variety of ways. Some of the
most common methods are shown next.
Looking at Established Automated Diaries
Your company computer faithfully preserves data that most
people are unaware of. Sensitive information is contained in
bits of deleted files, parts of documents created or opened,
cookies from Web pages visited, and chats in instant messenger.
Access to these should be restricted by setting your history time

9. frame to one or two days only or by offloading this history to a
more secure location.
Computers used on the Internet keep track of all your activities.
Every time you give your credit card to a retailer, even a local
restaurant, you run the risk of that data failing into the wrong
hands. Limiting such access—or monitoring its results—is
important to ensure that unauthorized charges are not made.
Verify the data against the source documentation to spot
inconsistencies. Also, be sure not to access such sites from
public locations, such as Internet cafes or local libraries.
Viewing Swap Files
Computer programs require memory to function. While
processing is normally handled by the central RAM (random
access memory) processing unit, the computer is able to perform
its job by creating what is commonly referred to as virtual
memory. Virtual memory is a fabulous thing but a privacy
nightmare. Files or data encrypted in Windows or Linux often
are unencrypted in the virtual memory (usually in the paging or
swap files).
Often this problem can be resolved through the creation of a
permanently allocated swap file of a fixed size that then can be
destroyed periodically by use of a file-wipe utility.
Making Changes to the System Directory
The system registry contains configuration data and tells
programs and device drivers when to start and how to run
properly. As a result, any changes to this area can stop vital
functions or create new programs or tell your computer to go to
a web site and post information there. Unlike other parts of your
computer, the system register cannot be file-wiped or deleted
because its function is vital to the performance of your
computer. Hackers love putting new things in system registries,
because it makes these things almost impossible to delete.
It is almost impossible for the average person or even system
programmer to understand how the system registry functions or
what it is telling the computer to do. As a result, average users
do not know the processes it initiates or deletes. Some IT

10. people consider this an advantage, because they can then track
users’ activities when they are using the computer. This is true,
but I believe that the loss of local user control relative to the
ease of hacker control offsets the advantages gained.
There are many other hacking options, such as stack overrides
or placing Trojan programs, but these are generally easily
defeated if proper security measures, such as firewalls and the
use of proxy servers, are enacted. Other, more advanced
methods include denial-of-service attacks or emanation
eavesdropping, but these are beyond the scope of discussion of
this chapter.
All of the hacker attacks mentioned require the use of network
access, whether the hacker is internal (i.e., he or she works for
the company) or external (outside of the company). But another
possible method to override compliance involves outside-the-
network attacks. Better known as social engineering, these
activities involve convincing others inside the company (who do
have access to the network) to make the changes for them.
Hackers sometimes do this by sending spam e-mails that entice
computer users to give up confidential information, such as
logon IDs and passwords. Other times, “bait” sites are used to
encourage people to visit the site and download “rootkits” that
contain infected programs. Sometimes all that is needed is to
convince people on the other end of a phone to assume that what
the hacker tells them is real. For example, if I call and say that I
work for a bank at which you have an account, you may well
believe that I really do work for that bank.
SUMMARY
IT professionals need to be cognizant of the need for
compliance with many different types of rules. There are actual
laws that need to be complied with and that may require
regulatory reporting to agencies that monitor such compliance.
There are company policies that require compliance in order to
improve the efficiency and effectiveness of the company’s
profit-making efforts. And there are security compliance needs
to protect the company against attempted theft of company

11. assets or confidential information. The IT department plays a
vital role in all of these activities—often, the key role in the
company. Recognizing what these rules are, how others are
attempting to circumvent them, and what the company needs to
do in response are some of the primary roles of the chief
information officer in today’s company.