Carol Njama – IT – 5102/Lab 3 Carol Njama IT5102 – Intro to Information Security November 3, 2013 Lab 3 – Sarbanes-Oxley Act 2002 Search online for credible, authoritative information about the Sarbanes-Oxley Act. What provisions does the law make regarding information security? Share your findings with the class. The Sarbanes-Oxley Act, also known as the Public Company Accounting and Investor Protection Act of 2002, was passed in response to the 2001 corporate accounting scandals involving companies such as WorldCom and Enron. The company executives were using company stocks to fund their own businesses and over-inflating their stock prices to attract investors. They not only lied to investors but committed financial fraud. According to the Yahoo article, WorldCom used shady accounting methods to mask its declining financial condition by falsely professing financial growth and profitability to increase the price of WorldCom’s stock (Yahoo Contributor Network, 2007). The Sarbanes-Oxley Act Section 404 deals with internal controls that can be applied to information technology and Information Security. According to Warner, Section 404 of the Sarbanes-Oxley Act requires the executives of publicly traded companies to confirm that they have effective internal controls around financial reporting. An internal control can be a process or procedure that provides reasonable protection that the financial reporting is accurate. Section 404 also requires that the company assess its internal control structure to verify that all controls are effective. The second part of Section 404 deals with evaluation and reporting of the internal control structure by a registered public accounting firm (Information Security and Section 404 of the Sarbanes-Oxley Act, 2004). In the information security and protection aspect of the law, the Sarbanes-Oxley Act ensures compliance and requirements are met on specific process and procedures for public companies internal controls and in this case, information security accepted processes or standard best practices. It holds management accountable that they have reviewed and ensured that the security measures and processes are implemented and are effective. It also ensures that the processes and procedures are accurate and effective in monitoring and preventing fraudulent activity within their organizations and detect unauthorized use of assets as well as securing and protecting investors or shareholder information. It also requires an independent third party evaluation and audit of the effectiveness of those internal controls. According to Warner, effective controls can be included in a number of different things that an information security team is responsible for, from an intrusion detection system to monitor for malicious network activity to reviewing log files on a periodic basis (Information Security and Section 404 of the Sarbanes-Oxley Act, 2004). This means that management is required to support the information security in businesses and securing the systems to prevent unauthorized use or security attacks. The InfoSec professionals are required to comply with these security measures or elements as part of their jobs. In addition, ensuring implementation of policies and procedures and everyone is complying with them to provide good security. InfoSec professionals are required to be knowledgeable, highly trained and certified as required in order to provide monitoring and make security recommendations through the acquired skills. Policies and procedures need to be created, implemented, documented and communicated to all appropriate individuals and enforced accurately for risk analysis and management. Carol Njama – IT – 5102/Lab 3 Due to compliance and requirements of the Sarbanes-Oxley law’s internal controls, InfoSec professionals will need the certifications required by employers in job descriptions to be able to: Support the threat and vulnerability management program effectively. Contribute to the Information Security Assessment and Remediation program. Actively participate in the Security Incident management program. To continuously review and research relevant security policies against existing policies. Support the Information Security Policy and Compliance program. Continuously review and research applicable control frameworks and contribute to maintaining the Information Security control framework. Maintain the monthly Information Security metrics and documentation. Provide general Information Security awareness and guidance to other lines of business and ensure projects comply with and maintain the Information Security corporate framework. Understand the business context in which Information Security functions operate. Maintain up-to-date knowledge of Information Security news, tools, and equipment vendors. Evaluate Information Security tools (hardware and software) to assist in the management and control of information security risks. Evaluate new technologies entering business environment for risks. Contribute to the technical understanding and promotion of new and existing information security standards and solutions. Conduct periodic Information Security audits and assessments in various areas of the company. Understanding of threat and vulnerability management, penetration testing and vulnerability mitigation. Understanding of Information Security compliance frameworks (e.g. ISO 27000 series, DoD 8500.2, NIST 800-53), assessments and remediation strategies. Understanding of incident detection, response, and mitigation. Understanding of SIEM technologies, logging, monitoring, and alerting. Understanding of various network, system, and database platforms. General knowledge of the telecommunications and satellite industry (Intelsat Corporation, 2013). In Information Security, internal controls such as systems and software application development processes, data and internet security procedures and protection, password protection, intrusion prevention and physical security should be effective, applicable and in compliance with the Sarbanes-Oxley Act Section 404. This is important not only to hold Information Security professionals, management and companies’ accountable but as a whole, to maintain standards within these companies and businesses and protect investors, shareholders and users. Carol Njama – IT – 5102/Lab 3 References Career Builder (2013.) Associate Information Security Analyst (3004) retrieved October 22, 2013 from Intelsat Corporation Web site: http://www.careerbuilder.com/JobSeeker/Jobs/JobDetails.aspx?APath=2.21.0.0.0&job_did=JHN3RX 6W2GWG7M2ZK6V&sc_cmp1=js_jrp_jobclick&IPath=QAKV JJ (2007). WorldCom Scandal: A Look Back at One of the Biggest Corporate Scandals in U.S. History retrieved October 30, 2013 from Yahoo Contributor Network Web site http://voices.yahoo.com/worldcom-scandal-look-back-one-biggest-225686.html Warner, Reed (2004). Information Security and Section 404 of the Sarbanes-Oxley Act retrieved October 30, 2013 from SANS Institute InfoSec Reading Room Web site: http://www.sans.org/reading-room/whitepapers/legal/information-security-section-404-sarbanes- oxley-act-1582 Carol Njama – IT – 5102/Lab 4 Carol Njama IT5102 – Intro to Information Security November 10, 2013 Lab 4 – Multics (Multiplexed Information and Computing Service) According to the MIT website, Multics (Multiplexed Information and Computing Service) was a mainframe timesharing operating system that began at MIT as a research project in 1965. It was a joint project with MIT, General Electric and Bell Labs and later taken over by Honeywell now, Bull. What was it used for? Multics was initially used for sharing campus information in the campus between academia and the administration. Later, General Electric (GE) used it as a commercial product for selling time-sharing services. It included: A supervisor program that managed all hardware resources, which used multiprocessing, multiprogramming and paging A segmented memory addressing system supported by hardware A tree structured file system Device support for peripherals and terminals Command programs including language compilers and tools User library routines Operational and support tools User and system documentation (Multics, 2013) How was it different from other operating systems of its time especially concerning security? It was designed similar to a utility service such as telephone services or electricity and it provided high availability and security features, which was a fundamental design requirement, in order to meet the utility goals. Due to its high modular ability for hardware and software, one could add resources that are more appropriate even when the service was running. Most of the users who used the services did not trust each other so therefore security was a major feature with file sharing provided in a hierarchical level system via access controls. Multics was designed to be secure from the beginning. In the 1980’s, the system was awarded the B2 (Orange Book TCSEC - Structured Protection) security rating by the US government National Computer Security Center (NCSC), the first system to get a B2 rating (Multics, 2013). According to Wikipedia, the Pick operating system also of the same year, known as “the Pick system”, is a demand-paged, multiuser, virtual memory time-sharing computer operating system based around a unique multivalued database that was primarily used for business data processing. In comparison to Multics, older versions of Pick stored passwords in plaintext, but later versions encrypt