MSS and SoX compliance

Question

Hi,
when I use Manager Self-Service to display and modify financial data over the Enterprise Portal in an Intranet environment, has the conection between the portal and the desktop to be encrypted (SSL/HTTPS) to be SoX compliant?
br,
Tobias

Answer 1

Hi,
Well, to sum it up:
1. It's up to the auditor. He decides whether my control framework is accurate or not. Worst case: I choose a bad auditor and the SOx compliance won't stand up in the court.
2. What's data integrity and confidentiality is up to the data/process. As all of you are stating:
"data being entered is accurate" [Simon]
"SOx does bother about whether appropriate controls have been defined and are operating effectively" [Vinay]
"The availability,integrity and confidentiality rules will be very much applicable to your context" [Ramesh]
The usage of SSL/encryption depends on the process and on the environment. If the process/data is highly critical, I need all the mechanisms/security necessary to ensure data integrity and confidentiality. These parameters differ from external and internal access and what is already implemented in the organization (SSO, Kerberos, backend system, etc)
3. To ensure point 1+2 I can decide from varios frameworks. If the framework I selected - eg COBIT (PO2.3 & DS5) - and my implementation of this framework mandates security, I have to implement SSL.
Are there any best practices of the varios possibilities available? Like:
1. If the application is available externally, verify at least: Firewall, provide SSL, etc.
2. If the application is available only internally, verify that I&AM is compliant to ISO X, etc?
br,
Tobias