The Top 5 Compliance Issues That Smolder Beneath The Surface

By Dan Wilhelms

When firefighters arrive at a burning building, their first priority (of course) is to knock down the visible flames. Yet experienced firefighters know that when those flames are extinguished, the job isn’t done yet. That’s the time they go in and start looking for the hidden flames – the smoldering materials in a ceiling or behind a wall that could suddenly erupt and engulf them when they’re not expecting it. They know those hidden fires can be the most dangerous of all simply because they can’t be seen until it’s too late.

For the past few years, IT and compliance managers have been like those firefighters first arriving on the scene. You’ve been putting out the compliance fires – the big issues that have been burning brightly since SOX legislation was passed in the early part of the millennium. You’ve done a good job too, creating a new compliance structure where roles are defined, segregation of duties (SOD) is the standard and transactions are well-documented.

Yet just like those firefighters, the job isn’t finished yet. There are still all kinds of compliance issues that, while not as visible as the first ones you tackled, can still create a back-draft that will burn your organization if you’re not careful. Following are five of the most pressing (and potentially dangerous).

Excessive access – With the complexity of the security architecture that is part of modern ERP systems, it’s easier than you might think to accidentally give some users access to potentially sensitive transactions that might be far outside their job descriptions. Access is usually assigned by the help desk, and in the heat of battle, with many pressing issues, they may not be as careful about assigning or double-checking authorizations as they should be. When that occurs, it can lead to all types of dangers.

Imagine a parts picker in the warehouse being given access to every SAP transaction in the organization (which has happened, by the way). In that instance, the warehouse worker started running and looking at transactions (including financial transactions) just out of curiosity. But what if he’d had a different agenda? He could have changed the data, either accidentally or maliciously, or executed a fraudulent transaction, creating a serious compliance breech.

Even if he didn’t change anything, there’s still a productivity issue. After all, if he’s busy running a myriad of SAP transactions, he’s not busy picking orders.

Excessive access is not the type of issue that will show up in a SOD report. The best way to address it is by installing governance, risk and compliance (GRC) software that makes managing security and authorization easier. The software should also provide you with tools that help you measure and monitor actual system usage so you can see whether the things users are doing and the places they’re going within the system are appropriate to their job requirements. Having automated systems in place is particularly important in smaller enterprises that usually do not have the resources for a lot of manual inspection.

Access to sensitive data – Users don’t necessarily need access to a broad variety of data to pose a risk; they just need access to particular data. For example who can open and close posting periods. Who can view HR salary and benefits information? Again, this is nothing that is likely to show up on a SOD report, yet it’s a very real risk.

We’ve all heard the stories about how a certain soft drink manufacturer’s formula is better-guarded than the launch codes for nuclear weapons. Imagine if the formula was sitting on the ERP system and the wrong person was given access to it – or given access to payroll, HIPAA or other sensitive information.

One key to controlling access to sensitive data, of course, is to exercise more care when assigning authorizations. This is called preventative controls. It’s also important to use reverse business engineering tools to see who does have access to sensitive transactions, whether that access is appropriate, and what they did with the information once they had it. This is called detective controls. It’s like following the smoke to discover where the hidden fire is.

Poor segregation of duties – Although SOD has already been mentioned, some organizations are not familiar with what it is and its purpose. Let’s look at the nuclear missiles analogy again. In order to launch, there are two keys controlled by two different people. Two keys are used to assure that no one person has control of the missiles in case someone decides to “go rogue.”

It’s the same with financial transactions in an enterprise. You don’t want one person to be able to create a vendor in your SAP system and then initiate payment of that same vendor; you’re just asking people to steal from you.

That’s why it’s important to have value-added tools that analyze user access against the enterprise’s SOD rulebook and flag any conflicting functions. An ongoing analysis will point out any areas of risk so they can be remediated, and keep you informed should the situation change.

Of course, in a smaller organization, conflicting duties may not be avoidable. Everyone is expected to wear multiple hats, and sometimes those hats do not allow for proper segregation. In those instances, you need to have tools that can monitor actual transactions and report against them so you can see if a compliance violation is occurring. In other words, if someone has to carry both keys, you know when they’ve inserted them both into the control panel through mitigating controls.

Even with the proper tools, it’s unlikely you’ll ever bring SOD conflicts down to zero. But you can get awfully darned close, and keep an eye on what happens from there.

Introduction of malicious programs into production systems – The modern reality is that ERP systems are rarely steady state. Often enterprises have multiple initiatives going on that introduce new data, configuration and programs into the production systems.

With lean staffing and urgent deadlines, often changes are not properly tested or audited. In other words, they don’t use proper change management. A developer who has the means to do it, the motive to do it and knows whether he/she can get away with it can wreak all kinds of havoc by including malicious code along with legitimate code when new applications are moved into production. Malicious code can download sensitive data, create fraudulent transactions, delete data or crash the systems.

It is critical to have a second person reviewing any changes at every step of the way. What that means is the person who requests the change can’t be the person who develops it; the developer can’t be the person who tests it; the person who tests it can’t be the same person who migrates it into production. In other words, transport development and approvals cannot be given by a single person – instead, an independent approver or even a committee must be controlling the entire process.

Change management duties need to be segregated and managed throughout the entire process. Even if not malicious, poorly coded, untested programs can result in a catastrophic outage. Given that in a large enterprise an hour of downtime can cost $1 million, it’s easy to see why proper change management is worth the investment.

Emergency access – In large ERP environments, there’s always the chance that emergency maintenance of production systems will need to be performed. When it does, and the enterprise is dialing 9-1-1, someone needs to be given emergency “super user” access to everything in the system. Such emergency maintenance is often by outside parties (e.g. the software vender or 3rd party consultants).

The problem is these emergency all-access passes aren’t always tracked very well. Everyone is so fixed on putting out the fire – for example unlocking a sales order that has frozen the entire system – that they never think about documenting what transactions were performed or what data was changed. The risk is increased by the widespread use of generic “firefighter” user IDs whereby the individual performing the actions isn’t definitively known.

You’d like to think that the person you give super user access to can be trusted. But blind trust is what has gotten other enterprises into trouble in the past. The person with full access may make other changes while he/she is in there – either accidentally or on purpose. You need to be able to monitor who has all-access and what they do while they have it.

It is critical to have tools that allow you to track what these super-users do while they’re in the system. Not just for the day-to-day operation of the business, but for the auditors as well. When auditors see someone has been given this additional emergency access, their job is to immediately assume the person did something nefarious. It will be your job to prove they didn’t. You’ll need to show why access was granted, what was done while the person was in there, when/how long the person was in the system, what changes were made and when the person exited.

While it’s important to put out the big compliance blazes, keep in mind those are the ones that are also easy to see. Once they’re under control, take a tip from the professional firefighters and be sure to check for the smaller, smoldering flashpoints. It’s your best insurance against getting burned.

Dan Wilhelms is President and CEO of SymSoft Corporation (www.controlpanelGRC.com, the makers of ControlPanelGRC, professional solutions for compliance automation. He can be reached at dwilhelms@sym-corp.com.

Economic risks of data overload

By Ed Pearce (epearce@egisticsinc.com) of eGistics (www.eGisticsinc.com)

When data pours in by the millisecond and the mountain of information builds continuously, professionals inevitably cut corners and go with their 'gut' when making decisions that can impact financial markets, medical treatments or any number of time sensitive matters, according to a new study from Thomson Reuters. The study indicates that when faced with unsorted, unverified "raw" data, 60 percent of decision-makers will make "intuitive" decisions that can lead to poor outcomes.

Many government regulators have flagged increased financial risk-taking, which can be traced in some degree to imperfectly managed data, as a contributor to the recent financial crisis. Moreover, the world is awash with data -- roughly 800 exabytes -- and the velocity of information is increasing, Thomson Reuters says.

The challenge is that the staffing and investment needed to ensure that information and information channels are trusted, reliable and useful is not keeping pace. In fact, it is estimated that the information universe will increase by a factor of 44; the number of managed files by a factor of 67; storage by a factor of 30 but staffing and investment in careful management by a factor of 1.4.

"The solution to data overload is to provide decision makers with what Thomson Reuters calls Intelligent Information: better organized and structured information, rapidly conveyed to the users preferred device," says David Craig, executive vice president and chief strategy officer.

Fortunately, as the Thomson Reuters study notes, the same technological revolution that has resulted in the explosion of information also opens the way to new and improved tools for providing intelligent information: better organized and structured information, rapidly conveyed to the user's preferred device.

"We must use the benefits of the information technology revolution to minimize its risks. This is a joint task that the private sector and governments must closely focus on if we are to avoid systemic crises, in the future, whether we speak of finance, healthcare delivery, international security and a myriad of other areas," comments Craig.

How is your organization managing information overload?

Putting the kibosh on the soaring software maintenance and upgrade costs

By Randy Davis (rdavis@egisticsinc.com)

Finextra reports that in a recent speech to the Committee for Economic Development in Australia (CEDA), CBA Chief Information Officer Michael Harte lambasted legacy technology vendors for their slow embrace of cloud-based computing and their apparent preference for solutions that lock-in users to a "never-ending spiral" of costly maintenance and upgrades.

"We're saying that we will never buy another data center. We will never buy another rack or server or storage device or network device again," Harte said. "I will never let any organization that I work for get locked into proprietary hardware or software again. I'll never tell my teams in the business that it will be weeks to get them hardware provision. I'll never pay upfront for any infrastructure and certainly would never pay for any, or rent any, infrastructure that I would never use."

Harte concluded: "I will never implement an internal solution for a common problem that I could procure on subscription across the Web."

With increasing demand for cloud-based solutions, combined with a general reluctance to pay hefty upfront capital costs, Harte's comments would seem to reflect growing dissatisfaction with the traditional licensed software model -- and its “never-ending spiral” of ongoing expenses.

Are you as fed-up as Harte?

The state of storage

Randy Davis (rdavis@egisticsinc.com) of eGistics, Inc. (www.egisticsinc.com) finds several interesting trends in The 2010 State of Storage Report from Networking Computing.

1. The top planned storage project for 2010 is improved allocation
2. Forty-seven percent of respondents say insufficient storage resources for mission-critical applications is their No. 1 concern
3. Storage area network (SAN) vendors are responding to demands for lower-cost storage
4. Storage virtualization is growing
5. Thin provisioning is catching on
6. There is a significant increase in interest in cloud-based storage

How do these trends reflect your storage strategy?

A welcome cloud during the economic recovery

By Ed Pearce (epearce@egisticsinc.com)

In spite of hopeful signs that the economy is on the mend, the 2010 State of Storage report from Network Computing finds that the fallout from the recession has left IT execs without the resources necessary to store the rising volume of information required to support their business applications.

Nearly half (47 percent) of the respondents to the survey say they have insufficient storage resources for their mission-critical applications, while 30 percent say they have insufficient tools for storage management. Another 30 percent of respondents say they have insufficient storage resources for departmental/individual use. Nineteen percent say they lack staff for their storage requirements.

And -- regardless of economic "green shoots" -- the situation isn't likely to change any time soon: 34 percent of respondents say they have an insufficient storage budget to meet their business demands.

Against this backdrop, it's little wonder that survey respondents are showing increased interest in cloud storage services (34 percent in 2010 versus 19 percent in the 2009 State of Storage report).

With a hosted variable cost storage model, if your business struggles, and your volumes drop, your operations costs will be aligned with your usage, and you won’t pay for a “just-in-case” capital investment. The variable cost model also eliminates the need for capital investment (software licenses and hardware) or maintenance contracts; customers typically are charged a one-time load fee to archive documents. And when an array fills up, or a server must be replaced, it’s your service provider’s problem. Using a thin-client interface, there may not even be software to install, manage or maintain. In addition, variably priced storage solutions can facilitate more effective operations by providing scalability that would be very cost prohibitive in a traditional, licensed in-house system.

CBA Chief Information Officer Michael Harte spoke for many users when he recently told the Committee for Economic Development in Australia that, "I will never implement an internal solution for a common problem that I could procure on subscription across the Web."

With the economic recovery still gaining strength, the trend for 2010 will be the more efficient use of existing IT resources. That should make hosted solutions a welcome cloud during the turnaround.

The Economy and Storage

By Mark Brousseau

The economic slowdown will be a reality through 2009, with overall IT spending growth falling from 5.1 percent growth in 2008 to 2.6 percent growth in 2009, according to IDC analysts who participated on a webinar today titled, “Worldwide Storage Top 10 Predictions.” IT spending will begin to slowly recover in 2010, with growth climbing to 4.5 percent, the analysts said, but a full recovery is not likely until 2011.

While the economy’s long-term impact on IT sectors will vary widely, all of them will struggle in the short run, the IDC analysts predicted. The worst hit will be the internal storage, tape, and high-end and mid-range server markets. The markets that will be least effected include security, systems software, and volume servers. IDC warns that some markets may never return to positive growth.

Against this backdrop, IDC believes users will demand greater storage efficiency, including:

… Block virtualization and thin provisioning (“must-haves,” according to IDC)
… Expanded use of data de-duplication
… Tiers for content with file virtualization
… “Greening” of storage
… Modularity/serverization for universal storage
… SAS as the standard interconnect used within external storage systems

Overall, IDC recommends that users “buckle up” as the industry is in the path of an economic hurricane. CIOs and line of business managers understand that money needs to be spent, IDC says, but are slowing purchases and need to do more with less budget. Controlling CAPEX expenditures will be a key requirement for our changing times, IDC says. For this reason, IDC predicts financing and leasing will emerge as a critical sales tool.

Similarly, storage promises to be a relatively stable segment during the economic downturn, but selling more efficient solutions will be critical. Showing quick return on investment is critical for selling solutions, and opens up additional services opportunities, IDC notes.

What do you think? Post your comment below.

Green Information Management

By Mark Brousseau

Reduce, reuse, recycle is the green mantra that gained a lot of currency in the 1980s. Today, a large number of enterprises are aggressively pursuing 3R policies, covering everything from paper usage and disposal practices to energy usage and water consumption.

As Green IT moves from the notion of a paperless office into a mainstream corporate social responsibility, CIOs are now also identifying ways in which to minimize the corporate carbon footprint and at the same time achieve their strategic business objectives.

Stuart Butts, a founding member and director of Xenos Group, Inc., says there is, however, one other area that demands equal consideration by organizations: managing structured and unstructured data and documents. Very often enterprises will hold the same information in a variety of different electronic formats and in different physical locations to meet different requirements, Butts notes. Multiple silos of information in technologically incompatible systems mean that information cannot be shared in real time. In addition, this approach consumes inordinate amounts of storage space and the associated costs that go with that.

With the explosive growth in data and documents, Butts says the time has come to apply reduce, reuse and recycle thinking to electronic business information. Embracing a more strategic, ‘green’ approach to information management will deliver a number of benefits, not the least of which is a dramatic reduction in the cost and complexity of power-consuming storage requirements, he believes.

Butts says there are a number of specific offerings that can help to reduce storage demands by eliminating redundancy and simplifying access to business critical information in real time. These include archiving, content migration and consolidation tools that enable real-time, on-demand transformation of customer statements and other key documents contained in electronic print files to PDFs for ePresentment.

By eliminating the constraints imposed by incompatible hardware or software platforms and disparate data and document archives, Xenos has helped organizations to reduce, reuse and recycle their data and documents to lower costs and improve information flow, Butts notes.

On-demand transformation to PDF format allows organizations to eliminate the unnecessary storage of large, graphically rich files, while streamlining version control with a technique known as “document resource optimization”. For some, this approach has effectively reduced storage requirements by as much as 90 percent, Butts says. Given that many large enterprises are spending as much as 70 percent of their IT budgets on their storage infrastructures, it’s time to apply reduce, reuse, and recycle thinking to data and storage needs, he adds.