|
IPLocks forensic audit and analysis capabilities provide a transactional
analysis of events by sessions, users, or objects that can be critical in
investigating negligent, suspicious, or malicious activity. A single select, insert, or update statement may not provide enough information to gauge a
user's intent. A transactional analysis of sessions, user accounts, or access to database objects
is therefore applied to determine if a transaction was likely illegitimate, negligent, or malicious.
 Transactional analysis provides a complete picture of all activities in context to the operation. For
example, if corrupted information were found in the database, transactional auditing can help determine
the cause of the error. If an auditor asks a company to prove the validity of their financial
tables, forensic reports can prove to auditors or regulators that all inserts, updates, and deletes
in the database are accurate.
Transactional analysis is also beneficial to information security. If an employee gives her two week
resignation notice, a transactional audit will identify activities related to sensitive information
the employee previously had access to and warn of possible information leak. The IPLocks Auditing
supports regulatory compliance requirements, ensuring data integrity and providing the necessary
transactional history needed to validate database changes.
With the growing number of governmental regulations, enterprises are discovering it nearly impossible
to interpret and implement all of the regulations. Regulatory compliance validates information through
controls and process, regardless if the regulation is for SOX, GLBA, HIPAA, or any other
regulation. Securing and validating the integrity of the data is important to organizations. By
combining assessment, monitoring, and auditing, the IPLocks solution automates database specific
internal compliance controls.
SOX Section 404 and 302 outline management's responsibilities to effectively establish controls to
financial data, and to certify financial statements.
SOX Section 404 outlines management's responsibility for:
- Building effective internal controls over financial reporting
- Detecting unauthorized acquisition
- Using or allocating assets
- Disclosing any associated material weaknesses potentially effecting financial statements
SOX Section 302 describes management's responsibility to certify all financial statements.
Specific CobiT recommendations for IT Services include:
- Controlling and verifying access
- Enforcing system maintenance
- Providing physical and logical security
- Ensuring data management
- Providing incident response
To meet these requirements, IPLocks assesses the basic security and configuration to ensure that
industry best practices are being followed. The IPLocks Solution provides a gap analysis of all
major relational database platforms used by financial, accounting, and business applications and
illustrates specific areas of weakness prior to an audit. It provides a list of current patches
that need to be applied for both system maintenance and security.
IPLocks works with database vendors, security organizations, and auditors to compile a list of known
best practices to ensure the database meets the minimum recommended guidelines.
|
