So the world has changed after this whole Sarbanes-Oxley thing in the U.S. and it’s soon to be twin in Canada. Basically the ruling is that companies can’t get away with the kind of crap that they have in the past and if they try it the executives are accountable. In practical terms part of the “solution” seems to go nuts with security and auditing to make sure they can say who is allowed to do what in their company. I’m sure some of it is for the best. Executives should be responsible for what goes on within their company and proper reporting and controls help with that… to a point.
Unfortunately this whole thing seems to be very confusing for everyone involved (including myself) and companies are scrambling to hire auditors to tell them if they are SOX compliant. My theory is these auditors don’t understand it any better than the rest of us but they have a check list and they go through a company with their checklist and make recommendations, whether they make sense or not, just to be safe. Which explains some of the things are clients are telling us.
This whole process reminds me of the big Y2K scare. Some people were lazy, which they shouldn’t have been, and made some mistakes that needed to be fixed. Yehaa. But it got blown out of proportion and people were predicting the end of the world. Obviously the world didn’t end and Y2K was rather uneventful. But the point was that management everywhere was frightened they might be held accountable for anything that went wrong if they didn’t do their best to ensure everything they relied on was Y2K complaint. I had the good fortune of being one of the grunts tasked with going from electronic device to electronic device recording the specifics, contacting the vendor, and ensuring it was indeed compliant. Now for things like servers and PCs I have no problem with this but it didn’t stop there. People were really paranoid and wanted assurance that pretty much every device that could conceivable keep track of time was compliant whether it mattered or not. A specific example of how dumb this was. I actually had to phone Toshiba to inquire as to whether the specific model of microwave the company I was “auditing” was Y2K friendly. My thoughts are who cares. Sure it shows the time but it definitely doesn’t show they year and even if it was wrong would anybody care? Seriously.
Anyways SOX definitely wreaks of Y2K. Our clients are large oil and gas companies and they are very worried about SOX compliance (whatever that is). They’ve had their auditors look at their company and for some strange reason the universal recommendation for our software is that it should enforce complex passwords for user accounts. What exactly a complex password is seems to be up for debate. It seems to converge on N characters consisting of some upper case and lower case letters, digits and symbols. In some cases complex also means time expiring and limiting the reuse of passwords. I am extremely opposed to this for a whole bunch of reasons. But in the end we’ll probably cave because it’s something the auditors demand.
It’s pretty much universally known that passwords are a lousy authentication mechanism. People can’t remember passwords and usually pick weak passwords given the opportunity. If we take away that opportunity (by enforcing strong passwords) they will resort to writing their password on a post-it-note and sticking it on their monitor. If we require them to change their password every N-days they’ll just add a counter on the end and use “myP@ss1″ and “myP@ass2″…. And they’ll still write that on their monitor. So really what have we gained. Not much in terms of security and a coworker brought up and interesting point that we as a vendor might loose a great deal. Users will come to know our software as hard to use and annoying if these policies are enforced and eventually that will impact sales.
I’m not really sure our app needs such high security. The app exists in a networked environment and requires access to network resources. You don’t get access to those resources unless you are authenticated on the network. So that at least leaves it up to Windows to keep foreigners out of the network and similarly our app. But I can see the point that they are worried about abuse within their company. Currently have of our users seem to stick with the password ’1′. So I guess pretty much anyone can get in and do stuff under anyone else’s account which is probably bad and we should do something. But maybe the solution isn’t to go overboard on the auth scheme in our app and build in all these password checks and controls.
Given that our app exists in a network environment I am of the opinion that we shouldn’t provide any password mechanism at all. Instead of having accounts in our system with passwords we could instead map user accounts to Windows system accounts. If we make the assumption that the machines on the corporate network are sufficiently locked down that the “logged in user” is who they say they are, and that the network will not allow foreign machines onto their network, we can simply rely on the Windows login user and map that to the correct account in our system. It’s simple and it’ll work and as long as the admins are locking down their network sufficiently, which they have to for SOX, it should be secure enough. Then we don’t need to care about password management. Simple for us. And more importantly I bet our users (the people users not the admin users who seem to hate stuff like this) will love it.
The downside is that I imagine networks will not be locked down sufficiently. If it’s not on the auditor checklist then it’s probably not going to be touched. Also I’m not sure the auditors will be happy with that even. From what we’ve been hearing from some they want to see passwords on all apps (which seems really stupid). I can see the auditor saying “Whoa. Back up. I see you’ve got Paintbrush on this computer and it’s not requiring a user-name and password to open. It says here on my fancy checklist that this is bad. If you don’t have this fixed your company isn’t SOX compliant and your board members are doomed.”. Luckily Microsoft is big enough that they can say that’s stupid and just not do it.
I guess we’ll have to see how this pans out. Like I said some of this is good. We are being forced to seriously look at auditing within our application which is something I think is important. Also the user authentication is something we’ve been thinking about for some time. Maybe this will give us the motivation to actually make some changes. I just hope those changes will be in a good direction for us and our users and not something that will make our users hate us.
On a positive note I’m thinking with Sarbanes-Oxley being such a hot topic my little rant here is likely to bring in some pretty hefty google advertising revenue 
