Sarbanes-Oxley IT Compliance Using Open Source Tools, 2Nd Ed..Pdf
Total Page:16
File Type:pdf, Size:1020Kb
www.dbebooks.com - Free Books & magazines Christian B. Lahti Roderick Peterson This page intentionally left blank Elsevier, Inc., the author(s), and any person or fi rm involved in the writing, editing, or production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents. The Work is sold AS IS and WITHOUT WARRANTY. You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profi ts, lost savings, or other incidental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable care, including backup and other appropriate precautions, when working with computers, networks, data, and fi les. Syngress Media®, Syngress®, “Career Advancement Through Skill Enhancement®,” “Ask the Author UPDATE®,” and “Hack Proofi ng®,” are registered trademarks of Elsevier, Inc. “Syngress: The Defi nition of a Serious Security Library”™, “Mission Critical™,” and “The Only Way to Stop a Hacker is to Think Like One™” are trademarks of Elsevier, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. PUBLISHED BY Syngress Publishing, Inc. Elsevier, Inc. 30 Corporate Drive Burlington, MA 01803 Sarbanes-Oxley IT Compliance Using Open Source Tools, 2E Copyright © 2007 by Elsevier, Inc. All rights reserved. Printed in the United States of America. Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication. Printed in the United States of America 1 2 3 4 5 6 7 8 9 0 ISBN 13: 978-1-59749-216-4 Publisher: Amorette Pedersen Page Layout and Art: SPi Acquisitions Editor: Patrice Rapalus Copy Editor: Judy Eby Project Manager: Greg deZarn-O’Hare Indexer: SPi Cover Designer: Michael Kavish For information on rights, translations, and bulk sales, contact Matt Pedersen, Commercial Sales Director and Rights, at Syngress Publishing; email [email protected]. This page intentionally left blank Lead Authors Christian B. Lahti is a computer services consultant with more than 18 years experience in the IT industry. He is an expert and evangelist in the fi eld of Open Source technologies in the IT enterprise and has successfully implemented global IT infrastructures. His focus and expertise lies in cross-platform integration and interoperability, security, database, and web development. Christian currently holds the position of Director of IT at a technology startup in Mountain View, CA and is a frequent speaker at both LinuxWorld and O’Reilly’s OSCON on a wide variety of topics such as Enterprise authentication and infrastructure monitoring and has contributed to several Open Source projects. Christian has a degree in Audio Engineering and has several certifi cations. He is an original co-author of the fi rst edition of this book and served as technical editor and contributing author to Windows to Linux Migration Toolkit (Syngress Publishing, ISBN: 1-931836-39-6). Roderick Peterson has more than 20 years’ experience in the IT industry. He has held various positions with both Fortune 500 public companies and small private companies. Roderick currently holds the position of IT Director at a public technology company in the Silicon Valley. His diverse background includes knowledge of mainframe operations, LAN, Internet, IT infrastructure, business applications, and the integration of emerging technologies. He has successfully led the development and deployment of major appli- cations at several global companies. Roderick also successfully owned and operated his own IT consulting business for more than fi ve years. Along with being original co-author of the fi rst edition of this book, Roderick has lectured on Sarbanes-Oxley IT Compliance and Governance at the SANS Institute Executive Track. v Contributing Authors Steve Lanza has more than 20 years of business experience ranging from fortune 500 enterprises to small private and pubic companies. He has held executive positions of Chief Financial Offi cer at various companies responsible for global business operations, sales, marketing, manufacturing, fi nance and administration, business development and engineering. His current position is Executive Vice President, Business Development and Chief Financial Offi cer at a privately held technology company headquartered in Silicon Valley. Steve has a Bachelors of Science degree in Finance from Cal Poly in San Luis Obispo, an MBA from GGU, and a Certifi cate of Engineering Management from Cal Tech (IRC). He also holds the title of Certifi ed Management Accountant (CMA). Bill Haag, William K. Haag (Retired) has over 43 years in Information Technology. During his career he has held various senior management positions, the most recent being the worldwide position of Senior Director of Information Management Services for the Applied Materials Corporation. Previous to Applied Materials he was the CIO of Racal-Datacom, Vice President of Technology and Systems services for the Healthshare Group, and held senior management positions in ATT Paradyne Corporation, Paramount Communication Corporation and Allied Signal Corporation. His accomplishments with these fi rms include: the development and implementation of both domestic and international information systems to achieve business objectives; signifi cant budget and staff realignments to align MIS with the corporate strategies. His achievements have been recognized in trade and business publications including CIO, CFO, Information Week, LAN World, and Florida Business. He has also been a guest speaker for Bell Atlantic, Information Builders and the Technical Symposium. Bill received his bachelor’s degree in Business Administration from Indiana University and has attended the University of South Florida’s Masters program. vi Rod Beckström is a serial entrepreneur and catalyst. He is the chairman and chief catalyst at TWIKI.NET, an enterprise Wiki company. He recently co-authored the bestseller “The Starfi sh and the Spider: The Unstoppable Power of Leaderless Organizations.” After working as a trader at Morgan Stanley in London, Rod started his fi rst company when he was 24 and grew it into a global enterprise with offi ces in New York, London, Tokyo, Geneva, Sydney, Palo Alto, Los Angeles and Hong Kong. That company, CATS Software, went public and was later sold successfully. He has helped start other fi rms including Mergent Systems and American Legal Net. He has helped launch more than a half dozen non-profi t groups and initiatives including Global Peace Networks which supported the group of CEO’s who helped open the border and trade between India and Pakistan, SV2, and the Environmental Markets Network. Rod serves as a Trustee of Environmental Defense and Director of Jamii Bora Africa Ltd., a micro- lending group with 140,000 members. A Stanford BA and MBA, Rod served as President of the graduate/undergraduate student body and was a Fulbright Scholar in Switzerland. His personal website is www.beckstrom.com. Peter Thoeny is the founder of TWiki and has managed the open-sourced TWiki.org project for the last nine years. Peter invented the concept of structured Wiki’s, where free form Wiki content can be structured with tailored Wiki applications. He is now the CTO of TWIKI.NET, a company offering services and support for TWiki. He is a recognized thought-leader in Wiki’s and social software, featured in numerous articles and technology conferences including Linux World, Business Week, The Wall Street Journal and more. A software developer with over 20 years experience, Peter specializes in software architecture, user interface design and web technology. Peter graduated from the Swiss Federal Institute of Technology in Zurich, lived in Japan for 8 years working as an engineering manager for Denso building CASE tools, and managed the Knowledge Engineering group at Wind River for several years. He co-authored the Wiki’s for Dummies book, and is currently working on a Wiki’s for the Workplace book. Matt Evans has had a long career in various software development and software quality assurance positions, most of these positions were in early vii stage startups. Matt graduated from University of Oregon with a Bachelor of Science degree in Computer Science. Currently he holds the position of Senior Director of Engineering Services at a software development startup that specializes in automated test generation tools for the Java Enterprise. Matt has taken advantage of Open Source tools and technologies over the years and is a fi rm believer in their value and effectiveness for software development and IT infrastructure. Erik Kennedy has 15 years of experience in the IT industry. His background is in the areas of UNIX/Linux architecture and deployment and IT Security. He has held various positions at Fortune 500 public companies and is currently a Senior Systems Engineer at a public technology company in the Silicon Valley. John T. Scott has 15 years experience in IT. His background includes end-to-end infrastructure design, implementation and support for PC platforms, IP networks and the security of both for all business models of all sizes. He currently leads an information security incident response team for a global fortune 50 company. He holds CISSP and GIAC certifi cations and has a bachelor’s degree in IT. viii Contents Chapter 1 Overview – The Goals of This Book.