Try to turn SOX into an opportunity

摘要

Conventional wisdom suggests that regulation is good for security. But unless the security professional can adapt in five key ways, I see more risk than reward. The problem with laws such as SOX is that they don't tell you what you need to do to be compliant. Section 404 of SOX is around 165 words, and in summary requires attestations by management and a third party that a firm has in place an "adequate internal control structure" to safeguard the financial data.