Hard-Boiled Compliance

When Prevention Fails, What's Next?

NOTE: This originally appeared on this date at Quest Software's ToadWorld, on the expert blog "John Weathington's Quest for Compliance". The link to the actual ToadWorld article is at the bottom.

A couple of weeks ago in Prevention over Intervention, we talked about the different kinds of controls, and discussed the reasons why preventive controls are always the best route. In fact, as a reminder, here’s my sage wisdom again on controls:

John Weathington’s Golden Gem of Controls: One effective preventative control is worth a thousand non-preventative controls.

What Control Options are Left?

Okay, now that we have that straight I’d like to pose this question. If preventive controls are not feasible, then what do you do? Well, according to the Golden Gem above, you’re left with the lesser of all evils. Let’s take a look at your options again:

1. Corrective Controls are controls that deal with the cause of a risk that has already happened.
2. Adaptive Controls are controls that deal with the impact of a risk that has already happened.
3. Contingent Controls are controls that deal with the impact of a risk that may happen in the future.

Of course, our preferred control, the preventive control deals with the cause of a risk that may happen in the future. Given that, you might say the diametric opposite to that would be the adaptive control. In the previously referenced article, we used the fraud example to illustrate the different controls, and the adaptive control was some sort of settlement to the shareholders impacted by the fraud. As you might expect, this is not the best route to go.

So that only leaves corrective and contingent controls. Which leads to the question – What is it about preventive controls that makes it the obvious and attractive best option? Is it because they deal with the cause of a risk, or is it because they kick in before the risk event happens?

That’s a good question.

In my view, it’s more important to be proactive than reactive, so my vote is for the contingent control. If you can’t deal with the cause up front, then deal with the impact up front. In our fraud example, the contingent control was to setup a Fraud Fund to compensate impacted stakeholders just in case fraud happened.

Catastrophic Database Failure - An Illustrative Example

You may not immediately see the value of this generalization based on this example, so let’s use another example that might hit closer to home. Let’s say your risk is a catastrophic database failure at your facility. Of course, databases can fail for a number of reasons, but let’s focus on causation being hardware failure. What’s the impact of a catastrophic database failure? Users can’t access time-sensitive data that is mission critical to the operation of your business ( e.g. an order processing system ).

We can get this under control in a number of ways. As is already established, the best way is a preventive control, which would be anything to keep the hardware alive. RAID and advanced monitoring would be examples. An adaptive control would be to have an emergency meeting after the fact, to figure out how to manually process the orders. Do you now see why this is such a bad idea?

A corrective control would be to have an emergency meeting after the fact, to figure out how to get the database back up and running. This actually isn’t that bad of an idea, and if you’ve been doing this a while, you may have even attended one or two of these meetings!

As stated earlier however, my recommended course of consideration, after the preventive control has been ruled out, is the contingent control. While developing the contingent control, you would be answering the question, “How can we still process orders, even if there is a catastrophic database failure at our facility?” Some of you may already be ahead of me, but a perfect example of a contingent control, is a disaster recovery site that is not at your facility – perhaps another city. The disaster recovery site would of course mirror the data in your mission critical database and upon a catastrophe in the main system, failover would happen instantly and automatically. The order processors shouldn’t even know that anything happened.

You should lock this example in your head, and when the time arises, superimpose the scenario on your compliance objectives. As another example, your auditors may need to control for financial misstatements caused by inexperienced processors. Once it’s determined that educating and training the inexperienced processors ( preventive control ) is not effective, you could suggest the contingent control of having an automated system-wide reconciliation to make sure all the numbers tie out ( contingent control ).

Three Ideas for Contingency Control Architecture

For architectural considerations, you can leverage last week’s blog entry on Automated Process Auditing. Contingent controls are generally events that will be executed “in case of.” In most cases, a series of events is necessary – or a process needs to be controlled. With this in mind, you can use some of the techniques for automated process control to not only document your contingent process, but to also demonstrate that the contingent process was followed, in the unfortunate event of the risk showing up.

To add to the idea of process control, I would also emphasize the importance of the trigger that sets off the contingent plan. This needs to be carefully tracked so that you can demonstrate when the risk event occurred, and when your contingent plan went into place.

Finally, in consideration of contingent controls, you should setup a repository to store your contingent plans. Your auditors will absolutely love this, as it clearly demonstrates that you have the impact of your high probability and / or impact risks controlled by well thought out contingency plans.

In Summary

Although the best case controls to use are preventive, sometimes we can’t engage them. Either it’s physically not possible (for instance, you cannot prevent an earthquake) or the preventive controls that you have in place are not effective (think Columbine). In these cases, the next best thing is the contingent control – deal with the impact of the risk before it happens. With the correct data architecture in place, such as a contingency plan repository, and contingency process control, you will have no problem demonstrating to auditors that you once again – have things well under control.

...read the article on ToadWorld

Sleeping Soundly

I had a follow up doctor's visit today to talk about my sleeping habits. Apparently I snore too loud for my wife's taste, and that turns out to be a good thing!

I brought the issue up to my doctor, and he recommended a sleep study. It turns out that snoring is a precursor to sleep apnea -- a condition where you temporarily stop breathing during the night. For the interested, the operational definition of sleep apnea is a span of 10 continuous seconds or more of non-breathing.

The entire process started a few weeks ago. I was contacted by an administrator that promptly sent me a thick packet of paperwork to fill out before the actual study. They asked me a whole host of questions about my sleeping patterns like; how many times I wake up during the night, how long it takes me to fall asleep, and if I take naps during the day.

The next step is going to a sleep study location, where they wire you up with sensors from head to toe and hook you up to a computer. You then sleep while they record all your information. Of course prior to hooking you up however, you need to fill out some paperwork. Only a couple of pages this time where I have to answer some questions about my sleeping patterns like; how many times I wake up during the night, how long it takes me to fall asleep, and if I take naps during the day.

After the first study, you're invited back to the sleep study location for a follow up study. This time, in addition to being wired up like a science experiment, you are also connected to an oxygen mask. You see, the popularly accepted control for sleep apnea, is forcing oxygen down your windpipe. To do this, you need to dress up like a starship trooper every night, dawning an oxygen mask that's connected to an oxygen supply by a huge hose. It's not very attractive, but makes for a pretty quiet sleep night, so it's definitely worth it. Of course, before you dawn the oxygen mask you need to fill out some more paperwork. They wanted to collect some data about my sleeping patterns like; how many times I wake up during the night, how long it takes me to fall asleep, and if I take naps during the day.

At the doctor's visit today, I was informed that I have a severe case of sleep apnea. On average, in a one hour period of time, I stop breathing 57 times! That's right, about once every minute, I stop breathing for 10 seconds or more. It gets worse. When I'm in dream sleep, I stop breathing 71 times per hour. Just to illustrate the severity, they start getting concerned when you stop breathing more than 10 times per hour.

Of course, before he shared the results with me he had to ask me a few questions about my sleeping patterns like; how many times I wake up during the night, how long it takes me to fall asleep, and if I take naps during the day.

Although I'm very happy I did the sleep study, you may have noticed that there are some efficiency problems with their data collection techniques. In this day and age, why on earth do I have to keep repeating this information? Duplication like this represents waste in your process, and usually results in unnecessary bloating in audit costs.

Periodically, analyze your processes and controls for duplication, and take proactive measures for consolidation. A one-time consolidation effort will pay you back perpetually with cost savings.

Top Players are Noticeable

I took some time this weekend to watch the 2008 Olympic tryouts in Indianapolis. It's fun to watch the top American athletes compete for a spot to compete against the world's top athletes.

I caught the 10m women's platform diving competition. For those of you who don't know, the winner ( top scorer ) of the competition gets an automatic ticket to compete in Beijing this year, and the remaining 5 of the top 6 need to compete again to see who else is going. This year the winner was 30-year old Laura Wilkinson. She held a decisive 74 point lead against the 2nd place finisher, and her roommate, Haley Ishimatsu.

Not all of Laura's dives were great. However when she setup for a reverse 3 1/2 somersault from the tuck position, she nailed it! When she came up from the water to look at here scores, she saw nothing but 10's -- clear across the board.

It was so exciting, when she hit the water, even coaches for the other competitors cheered in elation! That's what happens when you witness a great execution, for something you care about.

Throughout the competitions, I noticed a pattern that I also notice in Corporate America. Laura wasn't the only one that had a strong lead over 2nd place. In the 3m diving competition Christina Loukas won so handily, she didn't even need to take her last dive. She had already lapped the competition. She ended up crushing the 2nd place finisher Nancilia Foster by 90 points! And little Shawn Johnson obliterated the competition in the gymnastics tryouts, being heralded by the Detroit News as the Tiger Woods of her sport. Speaking of Tiger, how amazing was that game!

Greatness sticks out. I know, that even if you only win by a head, it's still a win. And I've been to my share of horse races where that happened. However in Corporate America, I've noticed that the winners stick out by a mile, just like the Olympic tryouts.

Top players in compliance aren't just good -- they're great. The best companies just seem to get it all right. There's a strong GRC message that flows from the top down. They are in control of their processes, and are constantly improving. Their audits are consistently clean, and their cost of compliance is low because they've taken measures to integrate and consolidate various compliance efforts, including their own internal policy. They are not afraid to spend money, because they know their money is well directed, and will payoff in dividends.

Even when it seems unlikely, and the odds are against them, they set the bar. Just like Laura Wilkinson at 30 years old taking all those teenie-boppers to school. Or Tiger Woods taking the US Open with broken bones -- c'mon give me a break!

Top players just get it right, because they get it. Do you?

Automated Process Auditing

NOTE: This originally appeared on this date at Quest Software's ToadWorld, on the expert blog "John Weathington's Quest for Compliance". The link to the actual ToadWorld article is at the bottom.

Are you doing what you say you’re doing?

In my survey of different compliance guidelines and best practices, a common theme always seems to emerge. It sounds like common sense, and it is ( like most compliance issues ), but there is a basic requirement for your documented process to match your actual process. You would be surprised ( or maybe not ) of how off base companies tend to be, when it comes to comparing there “As-Is” process with their “Really As-Is” process.

The biggest problem I find in companies when it comes to process control is their lack thereof. That is, they don’t have a documented process. The second biggest problem I see in companies is a documented process that doesn’t reflect what’s really going on.  In my view, this is much worse than the first problem.

So, you might ask yourself, “How can this happen? How can all this effort be expended, just to end up with a worthless pile of fire kindle?” Usually, this is a result of a bad approach taken to assemble the process documentation. What I’ve seen companies do, is build their process maps solely by interviewing people. They map out a process by asking people what happens, but they never bother to test or validate what is being said! As crazy as that might sound, this actually happens! Worse yet, I’ve seen companies pay accounting firms huge amounts of money to do the same thing. It’s a shame.

In almost all cases, interviewing people to build a process document will yield inaccurate documents. People tend to tell you the way things are “supposed” to happen, and represent that as what is actually happening.
First of all, anything that is said needs to be validated, and assertions need to be challenged. For instance, if you’re trying to document the process of building an order, and the interviewee says, “A quote is always created first, the configuration is validated, then the order is created,” I would look for orders that have no quotes. Or if the interviewee says, “Any order over $100,000 needs to be approved by a Regional Manager,” then I would look for orders over $100,000 that have no approval. You get the idea.

Secondly, the best companies will have a way to monitor this process, so that it doesn’t fall prey to what I call progressive dissonance. Entropy tends to erode the quality of a process over time, especially when people are involved. People can get complacent and reckless, or just lose interest after the “newness effect” wears off.
This is where you come in, as a database guru. Leveraging technology, your company can not only monitor their processes, but they can monitor it in an automated fashion that doesn’t draw on resources other than bits and bytes. Here’s one way to model an automated process auditing system.

Step # 1: Model the Process

After interviewing the appropriate people, and validating the process by testing assertions, have the “Really As-Is” process documented. Don’t get too crazy with detailed process flows. Just try to keep it as simple as possible, while still being effective for control. Your process will have two basic components:

•    Activities – These are actions that are taken as process steps. Examples are “approve order” or “validate configuration.”

•    Edges – These are connectors between activities. Edges may have conditions or “guards.” If two activities are connected together, and there are no guards, then when one activity is completed it immediately flows into the next activity. If a guard exists, it will prevent the activity flow, usually based on a condition of the payload ( see below for explanation of payload ).

To model this, we can simply create three tables:

•    ACTIVITIES – Contains all the activities in the process

o    ACTIVITY_ID – Internal identifier
o    ACTIVITY_CODE – Business process identifier, used in documentation
o    ACTIVITY_DESCRIPTION – Description of the activity ( i.e. “Approve order” )

•    ACTIVITY_EDGES – Contains the activity edges

o    ACTIVITY_EDGE_ID – Internal identifier
o    ACTIVITY_CODE_FROM – From activity
o    ACTIVITY_CODE_TO – To activity
o    GUARD_ID  ( nullable ) – Guard, if one exists

•    GUARDS – Contains all the guards on the activity edges

o    GUARD_ID – Internal identifier
o    GUARD_DESCRIPTION – Description of the guard

After the tables are created, populate them with data that represent the “Really As-Is” process.

Step # 2: Capture the Process Activities

Now that the process is modeled, you need a way to capture when activities happen. As the process executes ( i.e. an order is being processed ), a process instance is created, and a payload is attached. A payload is the collective artifact that flows through the process. Conceptually, it could be the order, the invoice, or the receipt. Logically, it’s just a collection of data. Some of the data may be purely informative, but if there are conditional guards on the activity edges, that data needs to be present in the payload.

To model this, create three tables:

•    PROCESS_INSTANCE S – All the process instances

o    PROCESS_INSTANCE_ID – Internal identifier
o    PROCESS_INSTANCE_DATE – Date / time process instance started

•    PROCESS_INSTANCE_ACTIVITIES – Records activities as the process is executed

o    PROCESS_INSTANCE_ACTIVITY_ID
o    PROCESS_INSTANCE_ACTIVITY_DATE
o    PROCESS_INSTANCE_ID
o    ACTIVITY_ID
o    PAYLOAD_ID

•    PAYLOAD – Payload data ( i.e. invoice, order, etc. )

o    PAYLOAD_ID
o    ( varies depending on data that needs to be collected )

It’s okay to violate normalization rules by putting PAYLOAD_ID at the INSTANCE_ACTIVITIES level. I find it’s more convenient that way.

A key thing to remember is that process activities are captured in the PROCESS_INSTANCE_ACTIVITIES table, without regard for the documented process model created in Step 1.

Step # 3: Validate the Process During Execution

As the process is executing, compare the PROCESS_INSTANCE_ACTIVITIES data with the documented process from Step 1. You want to make sure that subsequent rows in the PROCESS_INSTANCE_ACTIVITIES table are in alignment with the data in the ACTIVITY_EDGES table. Guards may get a little tricky, but only a little. For instance, if there’s a guard that says, “Go this way only if order amount is greater than $100,000,” then you need to check the payload’s order amount to make sure the navigated path is compliant.

Step # 4: Highlight Process Activity Violations

If something in the PROCESS_INSTANCE_ACTIVITIES table doesn’t line up with the ACTIVITY_EDGES table, you have a process activity violation. The final table in our model, is the table that highlights this situation:

•    PROCESS_VIOLATIONS – Process violation table

o    PROCESS_VIOLATION_ID
o    PROCESS_VIOLATION_DATE
o    PROCESS_INSTANCE_ACTIVITY_ID

In this way, a simple query against this table will highlight all process activity violations. You can even design an event trigger that notifies somebody when a process activity violation occurs.

Keeping grounded in how your important processes are flowing, is a critical component of most compliance programs. Building an automated auditing system for your process is an effort worth considering. Building the architecture for such a system can be broken down into four simple stages: Model, Capture, Validate, and Highlight Exceptions. Talk to your auditing team today about how this architecture might add value to their operation.

...read the article on ToadWorld

Prevention over Intervention

NOTE: This originally appeared on this date at Quest Software's ToadWorld, on the expert blog "John Weathington's Quest for Compliance". The link to the actual ToadWorld article is at the bottom.

What’s the best kind of problem to deal with?

A problem that never happens.

Earlier, when I was training to be a facilitator, my instructor emphasized something that you’ve probably heard before. She kept saying, “Prevention over Intervention.” The context was of course, in facilitating through a meeting. She taught us that, if you setup ground rules at the beginning of a meeting, and get everyone to agree to them, the rest of the meeting will go much smoother. In practice, I’ve found she was absolutely accurate. Another popular locution that has been popularized over the years is, “An ounce of prevention is worth a pound of cures.” Phrases like this resonate well with me, so I’d like to present to you my golden gem of controls:

John Weathington’s Golden Gem of Controls: One effective preventative control is worth a thousand non-preventative controls.

Keep this in mind as you and your team are navigating the landscape of risk control. In my perspective, there are only four types of controls, and they deal in two different dimensions; timing of the risk event, and risk property. For timing, you’re either dealing with a risk that will occur, or a risk that has occurred. For risk property, you’re either dealing with the cause of the risk, or the impact of the risk. It’s really that simple. So, if you look at all the permutations of the referenced dimensions, you have the following four types of controls:

1. Corrective Controls are controls that deal with the cause of a risk that has already happened.
2. Adaptive Controls are controls that deal with the impact of a risk that has already happened.
3. Preventive Controls are controls that deal with the cause of a risk that may happen in the future.
4. Contingent Controls are controls that deal with the impact of a risk that may happen in the future.

Since fraud is a hot topic these days, let’s use that as an example. Let’s say we’re trying to control the risk that corporate executives will fraudulently back-date options, so that they can cash in big ( not such a far stretch ). One cause of this might be too much collusion in the upper ranks. Usually these kinds of activities are pulled off because the CEO, CFO, and other high ranking officials in a company are all working together. The key impact that the SEC is worried about, is the misrepresentation of financial data ( i.e. executive compensation ), that has now just occurred due to the fraudulent activity.

We can control this in a number of ways. A corrective control would be huge fines and jail time for the guilty senior management. Remember, they caused it, and the fraud has already happened.

An adaptive control would be some sort of settlement to the shareholders that were impacted. Executive compensation will have to be restated, and that will probably cause the company’s stock to suffer. A settlement to all the shareholders would be an adaptive way to handle this, as the fraud has already happened, and you’re taking care of the impacted parties.

An example of a contingent control would be to setup a Fraud Fund, in the anticipation that something like this might happen. The fraud hasn’t happened, and might not ever happen, but if it does, a fund is available to compensate impacted shareholders.

Of course, I’m saving the best for last. A preventive control is always the best choice. An example of a preventive control would be to setup an independent agency that audits the option issuing process, before it can be authorized for execution. You are taking measures to treat the cause of the problem ( collusion ) before the fraud actually occurs.

Of course all controls need to be effective. An ineffective control, isn’t really a control, it’s just a drain on resources.
So, since preventive controls are the ideal situation, let’s talk about some architectural considerations for supporting them. Here are three areas of your company’s data system infrastructure, where preventative controls can be realized:

Tap into the Transactional System

This is the most effective, and obviously the most challenging. If you’ve followed my work, you know I advocate the construction of a Compliance Data System ( CDS ). Although the CDS can be leveraged, what we’re talking about here is outside the scope of any downstream system. Since transactional systems come in all shapes, sizes, and forms, I can’t advise you on any specifics; however I can leave you with some goals. You need to be able to prevent an action from happening, based on a recognized condition. For instance, to control for data privacy, you may need to block an unauthorized request to view sensitive personal data. If your transactional system centralizes it’s action processing ( popular design consideration in web applications ), this is a good place to inject these rules.

To leverage the CDS, make sure the rules are documented, and the violations are captured. Develop a log that records all violations, and make it tamper proof. This information can then be downstreamed by the CDS for compliance related analytics.

Build a Compliance Operational Data Store

Leverage the Operational Data Store ( ODS ) concept from the data warehousing community, to build a compliance operational data store. This will be a part of your comprehensive compliance data system. To create any kind of preventive control outside of the transactional system, you will need leading indicators, and a fast response system. An example of a leading indicator, might be an inappropriate approval, since an inappropriate approval could lead to fraud down the line. Your compliance operational data store should catch this, and flag it as a potential problem, before it becomes a real one.

Leverage your Compliance Data Warehouse

Just because your data warehouse is downstream and strategic, doesn’t mean that it can’t be used for preventative controls. Fair-Issac has made an extremely profitable business purely around this concept, and the adoption of the FICO score. You can use your strategic data and advanced data mining techniques to identify trends that will attack the cause for future negative impact, in the same way Fair-Issac uses its proprietary data to deny credit to high risk borrowers.

Controlling risk is important and necessary. Any effective control is a good control, however a preventive control is by far the best choice. Effectively leveraging your transactional systems, and intelligent use of the operational and strategic components of your compliance data system to support effective preventive controls, is the smartest way to control risk at your company.

...read the article on ToadWorld

Flawless Compliance Newsletter - June 2008

The June 2008 issue of Flawless Compliance is available, with Center Stage article, Adding Privacy to Your Control Program, An Introduction to GAPP and How to Leverage in Privacy Control. Also, Heathrow security threatened by a cartoon, how to survive an IT strategy audit, Broadcom Co-Found comes down from a great high, and a Silicon Valley Wal-Mart slip-up.

... read the June 2008 issue of Flawless Compliance

Solving for Data Privacy

NOTE: This originally appeared on this date at Quest Software's ToadWorld, on the expert blog "John Weathington's Quest for Compliance". The link to the actual ToadWorld article is at the bottom.

In a recent independent poll of people attending a data privacy seminar, almost 50% of the respondents claimed that their company had experienced a data breach in the past 2 years. This is quite alarming, don’t you think? It’s no secret that the concern for data privacy has grown exponentially in the last few years.

This growing concern has spawned a number of privacy regulations, including but not limited to HIPPA, GLBA, FTC, Safe Harbor, PIPEDA ( in Canada ), and the Australian Privacy Act. In fact, the FTC ( Federal Trade Commission ) has recently pursued a number of companies, because of their insufficient practices around protecting sensitive consumer data ( i.e. credit card numbers ). In almost all cases, when the dust settles, these companies involuntarily signed themselves up for a 10 – 20 year sentence of mandatory bi-annual security audits!

Another byproduct of the growing data privacy concern, is the creation of the Generally Accepted Privacy Principles ( GAPP – sometimes pronounced “gap-p” ). You may already be familiar with the Generally Accepted Accounting Principles ( GAAP – sometimes pronounced “gap” ) that accountants use when building and auditing financial records. Although the new Privacy Principles come out of the same group ( American Institute of Certified Public Accountants or AICPA ), they should not be confused with their more familiar accounting based rules. These principles were created specifically for the purpose of helping companies keep their data privacy practices under control.

GAPP is quickly becoming the de-facto standard framework for privacy control, so I’d like to use this framework to discuss how we might architect some compliance data system solutions to support the framework, and reduce your company’s risk of data privacy violations.

GAPP has a total of 66 principles split across 10 categories:

1. Management
2. Notice
3. Choice and Consent
4. Collection
5. Use and Retention
6. Access
7. Disclosure to 3rd Parties
8. Security for Privacy
9. Quality
10. Monitoring and Enforcement

Of particular interest to me today is Principle 8 – Security for Privacy. According to GAPP, “The eighth principle of the Generally Accepted Privacy Principles (GAPP) is Security for Privacy. This principle requires that the entity protect personal information against unauthorized access (both physical and logical).”

I think this is where a lot of companies today are getting into trouble. Private and sensitive information needs to be protected. So let’s think about how we could solution around this.

As usual, our goal for a compliance data system, is to prove that there has been no data privacy violations. So part of our job is to demonstrate that the only people viewing data, are authorized people. To solve for violation, we’ll invert this to say that a violation is an unauthorized viewing of sensitive data. We need to make this a little more operational, so here are some of the things we need to clear up:

What makes a piece of data sensitive?
How do I know who’s authorized to see the data?
How do I know if the data has been viewed?
It’s important to avoid getting ahead of yourself in the solutioning here. Stay focused on the definition of a violation, however you know there’s more thought work right around the corner.

For now, we’ll say that a piece of data is sensitive, when it has a SENSITIVE_FLAG set. Of course, this implies that you have a master data dictionary available in your database, that catalogs all of the data points. This is a good idea anyway, and well serve you well in your data governance efforts.

So, imagine a metadata table that has the following columns:

• DATA_POINTS
• DATA_POINT_ID
• DATA_POINT
• DATA_TYPE
• DATA_LENGTH
• DESCRIPTION
• SENSITIVE_FLAG

As noted above, our SENSITIVE_FLAG was added to aid our data privacy solution, so if this is set to ‘Y’ then we know we need to monitor it for violations. Here’s a sample row in that table:

• DATA_POINT_ID = 101
• DATA_POINT = ‘SOCIAL_SECURITY_NUM’
• DATA_TYPE = ‘VARCHAR’
• DATA_LENGTH = 9
• DESCRIPTION = ‘Employee’s Social Security Number’
• SENSITIVE_FLAG = ‘Y’

Now that we have that solved, what should we do about authorized viewing? In my mind, authorization is determined by the person viewing it. Not just anybody can view sensitive data, so there must be rules around who can see a sensitive piece of data. Although the inclination might be to use roles, I wouldn’t rely solely on them. I would tag the individual in the viewing event, then make a second pass to understand if that individual was authorized to view the data. You can always use role as a justifier, but keep the grain at the individual level.

Which leads us to the viewing event. You will need to capture the fact that this data was viewed. This may be easy, or this may be hard – of course it depends on your transactional system’s architecture. The thought process is pretty straight forward however. Once again, there needs to be a catalog of where each data point lives on each screen that can be viewed, and there needs to be a mechanism that records when each screen is viewed. The catalog can live outside of the transactional system, but the mechanism that records a screen viewing must be embedded in there somehow. If you system does this already, that’s great, just downstream from there. If not, you may have to use a logging or triggering mechanism to store this information in your database. While you’re there, keep in mind that at a minimum, you need to know the screen that was viewed, who was viewing it, and the date and time of the viewing.

Once we have this data, I think we’re in the clear. Although the transactional system is capturing every screen viewing, I would only downstream screen views where sensitive data was involved. Of course, you can do this my leveraging your new SENSITIVE_FLAG column in your metadata table. Here’s the table our first transformation produces:

• SENSITIVE_DATA_VIEWS
• VIEWING_ID
• VIEWING_DATE
• SCREEN
• EMPLOYEE_ID
• DATA_POINT_ID

Then, using our authorization formulas which key on EMPLOYEE_ID, we can build a violations table:

• SENSITIVE_DATA_VIOLATIONS
• VIEWING_ID
• VIEWING_DATE
• EMPLOYEE_ID
• DATA_POINT_ID

This would highlight any violations encountered, due to unauthorized viewing of sensitive data.

I would continue down this line of solutioning until my privacy solution was complete. Of course, this only protects you from application level risks. This does nothing to protect you against a savvy technical person that can simply bypass the application layer. I’ll save that discussion for a later date. That said, it’s still very much worth pursuing, as it will reduce your risk and demonstrate that you are committed to taking measures to control data privacy.

I know this only scratches the surface of data privacy, but I hope it gives you a platform to build from, and highlights the importance of proving your innocence when it comes to data privacy auditing. Data privacy is a huge concern, and if you company isn’t talking about it yet, please urge them to start.

...read the article on ToadWorld

How to Deal with Chronic Weakness

NOTE: This originally appeared on this date at Quest Software's ToadWorld, on the expert blog "John Weathington's Quest for Compliance". The link to the actual ToadWorld article is at the bottom.

Last week, I threw my back out. I don’t even have to try anymore.

It’s allergy season over in this part of California ( East San Francisco Bay Area ), and the prominent allergic symptom that I’ve been dealing with for a number of years now, is an annoying cough.  So, allergies struck over the Memorial Day weekend, which left me with that nasty cough for the week. Thursday morning I was in the shower, coughing my brains out, when one good, deep-diaphragm cough, put just enough strain on my lower back to yield that oh so familiar clench, which almost brought me to my knees.

Here we go again.

By this time, I knew the drill. Fortunately, my wife was in shouting distance, so she rushed in , and escorted me to the bed, where I quickly assumed the horizontal position I would stay in for the next four days. In under a minute, I had two pillows under my knees, an ice pack around my entire lower back, a call into my doctor for a muscle relaxer, and the Food Network channel on the TV. I then proceeded down the frustrating and disappointing route of cancelling all my appointments and commitments for the rest of the week.

This is the drill.

Fortunately, it’s Tuesday now, and I seem to be recovering well. There’s still some pain, and I carry around my back brace just in case, however I can get around without it now.

My doctor explains that I will probably have to deal with this for the rest of my life. In his words, “Once a patient of back pain, always a patient of back pain.” My chiropractor, a Palmer graduate and excellent practitioner, seems to have a different point of view. She says that since my core muscles ( abdomen and surrounding muscles ) are not developed, my lower back has to support all of my weight. There are a number of problems with this:

1. Nobody’s lower back should be responsible for supporting the entire weight of their body. The lower back muscles aren’t built for that.
2. My lower back has already been compromised, so it’s in an even worse position to support my body weight.
3. At 220 lbs, I’m overweight. Even more work for my lower back to do.

As an optimist, and generally positive thinker, I tend to believe my chiropractor. So, this experience has given me a renewed interest in keeping up with my chiropractor, and her methods for strengthening my core muscles.

Of course, any organization – your organization – can fall prey to the same situation. You company can develop a chronic weakness, or “weak spot” when it comes to compliance. This could be in data privacy, network security, segregation of duties … any number of areas.

I’m not necessarily talking about gaps that are identified, and then remedied. I’m talking about violations that are known, that your company is trying to rectify, but they just can’t seem to get their arms around. In fact, in spite of all the money and other resources thrown at the problem, it might just be getting worse! This your company’s Achilles Heel.

So what can you do? How do you deal with your company’s compliance weaknesses?

Well, with the role you probably play, chances are you cannot solve your company’s problem. You do however play a very important role. This is where your company needs you the most, because information is power, and you are the gatekeeper to the information. These are my recommendations for your company, and what you can do to support it.

Step # 1 : Clearly Characterize the Weakness

The more objective data you have about the weakness, the better.  Collect as much data as you can about the weakness. Resist the urge to solve anything at this point, as you will probably jump to spurious conclusions. Collect data in time-series to see if there are any trends you should be aware of. If there are no trends, collect data at random to see if you can characterize the distribution shape, location, and spread. Use your knowledge of data collection and analysis to bring objective, indisputable statistics around your situation.

Step #2 : Encourage Management to Disclose the Situation and Communicate in Precise Terms

It’s dangerous at this point to downplay or exaggerate your problem.  Once you know exactly what you’re dealing with, open and honest communication with everyone involved is the best course of action. Disclosure to management, auditors, and any stakeholders or shareholders is a must. If this weakness is “uncovered” in an audit, without your prior disclosure, things will be 10 times worse. Use your data analysis to keep people honest.

Step #3 : Understand Where You Must Be, and Where You Want To Be

This is your tolerance for non-compliance. When you ask most people what their tolerance for non-compliance is, they will pound their chest and tell you, “Zero Tolerance!” In most cases this is unrealistic, and such bravado, although admirable, should be immediately excused. There’s nothing I can do to get my back to 100% efficiency, and if your company has a chronic weakness, you won’t get to zero tolerance overnight. Your management needs to agree on two metrics; where your company must be ( i.e. absolute minimum number of violations), and where your company would like to be (once again, zero tolerance is not probable, therefore not acceptable).

Step #4 : Accept, Improve, or Explode

If the problem can be accepted for what it is – do that. Do not waste resources on something that just “bothers” you. Accept it, and move on.

If there is a relatively small distance from where you are, to where you need to be, organize an improvement project. You will need to do some more analysis to validate root causes, and then come up with a plan for improvement based on your findings.

If you are a far distance from where you are to where you need to be, you need to blow up the whole process, and design a new one. Sorry, that’s the only answer.

Discovering chronic weaknesses in your company are no fun, and dealing with them is even more enervating. With your help however, your company can hopefully get the situation under control. By clearly understanding the nature of the problem, then communicating the weakness with an attitude of openness and honesty, you’re taking the right first steps. Finally find out where you need to be, then either accept it, improve it, or explode it.

The good news is, organizations are more flexible than humans. Although I will never get my back working like it did when I was 20 years old, your company has hope. That hope, coupled with this information, is your key to total compliance. My hope is that you recognize it, and use it.

... read the article on ToadWorld