IT Employment

Ask something
Discussion Locked

How do you explain security to a CEO?

0 helpful
22 replies

by deltawally

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am an IT Director for a Healthcare Organization, I was recently requested from the CEO to give Full access to our Network shares and Enterprise Software to our CFO. Who will be performing an internal audit. How do you explain to the CEO that this is not the best practice for internal Security and permissions?

22 replies

by oz_media

Should be able to get through to him in VERY basic sign. Try starting by having him recognize basic shapes and colours, then work your way up to basic sign language. By the time you get to flash cards, you know you're on the path to success,

Hope this helps!

by jennsue

Give him a black and white example of how the CFO could alter files if some of the financial information is not password protected properly. Perhaps you should make his access a real-only situation, you should have that capability. I'll bet anything the CEO himself could not password protect a file so have him create a phony and change it as the example.

Or worse, just change his screensaver to something he would find offensive, that has worked for me.

by psivakumar1

Since you have concerns and there are horror stories with this type of access, you have to provide your unbiased view and document it for records.

by deltawally

Currently, we are using network shares to provide productivity for each department. This information are word docs, excel spreadsheets and so on. I don't have a problem given her access to view these different folder and their information, I have a problem with modifying this information. Also, She (CFO) is not an advanced user in our enterprise system which could lead to other issues in her modifying files? How do you explain to a CEO that this is not the right way of doing things? I tried to ask him why she needs the rights to change information and I didn't understand the response. Let me know what you think. Thanks.

by wilsona12

Tell the CEO that having the CFO with an ability to modify the original documents creates an legal loophole in which any wrong-doers could question the chain of ownership. By complying with that request, the company will be limiting its recourse in the future. In addition, find some best practice documents to back up your claims.

Are you a public company?

Honestly, if you have file access monitoring on and backups, it shouldn't be hard to prove who modified what, though.

by technicalmumbojumbo

Is the CFO trying to do a cost analysis of the value of the disk drives holding the data?
This seems really strange to me. I can't see any reason why they would need access, nor why any CEO with a brain would ask his CIO to allow it.
Tell him we said so. Try speaking very slowly, and enunciate correctly, maybe they'll get the point. You aren't even talking about network security, you're talking file permissions and nobody should be able to altar those settings but the owner.

by imaginetsecurity

What is the purpose of the CFO auditing shares? Is she looking for who has access to what dir/file? Is this because of some recent incident? Why is a CFO interested in effecting such an IT audit? Do you even have Procedures and Policies for your org? If so, one of them hopefully covers this topic and you can refer them to review the appropriate P&P.

If the answer to Q2 above is true, then suggest that you can provide such results without changing access for a user. Use some of the tools suggested in other posts here. You might even preemptively run such a report from such a tool and show them the results. This might stop them in their tracks as it may have what they were looking for?

Why is this audit being done? What is the purpose of a review of productivity from shares?

Unlike another commentor's post, I am in the IT security consulting business and I provide such reviews within a more complete network security audit is performed. What is the business need behind her request to gain such access?

by bubbaonthenet

If you are a NT Shop use the resource kits to provide the information he desires. There are a lot of cool tools at your disposal. Available at: http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techref/en-us/Default.asp?url=/resources/documentation/windowsServ/2003/all/techref/en-us/W2K3TR_tool_ref.asp

Print out the reports he desires and give the CFO Read and Review Permissions to the shares he highlights. Even Arthur Andersen LLP does not get Carte Blanc when auditing. [Mike Dupris]

If it is access to Software then create a secondary backup of the data. Give the CFO access and use some sort of line like "To safeguard the software from unintentional disruption from Viruses or accidents."

Another great tool is TreeSize Report available at: http://www.download.com/TreeSize/3000-2248_4-10278489.html?tag=lst-0-1

You end up looking savvy and they do not have to fumble around seeking resources. [Mike Dupris]

by p3john

I know this posting may be to late, but I thought I'd offer my 2 cents.

I would push for read only access if at all possible. I would sit both of them down and explain your concerns - in a non-aggressive way, without assigning blame. Your points are valid! It IS NOT a good idea for a non-IT administrator to have unrestricted access to everything.

After all, she is going to conduct an audit right? What part of an audit ever involves changing data? Wouldn't you think she would only be interested in seeing (i.e. reading) what is there and drawing conclusions from that? Otherwise, it isn't an audit.

-John

by rturner

Auditing yourself is never a good idea. You have practices and policies and you follow them. That is as much self policing as you should do. For a "real" audit, hire a qualified, outside consultant. And, no, I am not one of them, and yes, I hate paying the money too, but it is the only way to get clear, unbiased, un-manipulated results.

If that isn't a viable solution, you should make sure you have a complete backup before the permissions change and you could always enable auditing or some type of monitoring software before the games begin. Spectorsoft rocks for that!

In the end, make sure you have a game plan to turn the permissions off and keep that backup tape handy for if the sh*t hits the fan.

by pfeldner

Based on the restrictions of HIPPA and SOX a break the glass policy should be in place if someone needs that type of access. The access should be then recorded and reviewed as to changes made and observed. Let your CFO know that there NEEDS to be a separation of duties between those running the books and those auditing the books.

by tektoad

My suggestion would be to find a best compromise. The CFO feel he needs information, correctly so or not. The political reality is probably that he will win a fight so avoid that. Instead, present the risks of having someone with total access to the network and what damage could be inflicted (especially to profits and productivity if you can). If you have a person with time available, suggest assigning him or her as a tech liason for the CFO so the CFO feels he can get what he/she needs and she is not running free in the company's systems.

I hope this helps and if doesn't that it may give you ideas for another suggestion.

Regards,
Chad

by jamesrl

If you allow the CFO more than read access then you potentially screw up the audit trail. And if you screw up the audit trail, you can't use the results - you will get into a he said/she said situation.

If your CFO has a later version of software that some of the files, then they could make changes just by clicking around.

James

by bill.ogle

Check with the CFO what her needs really are.
The internal audit function is intended to check
that adequate controls are in place so that the
risk of error or fraud are minimized. This
includes adequate security and controls that
prohibit the CFO from making arbitrary
changes or violating the audit trail. If the CFO
is a professional accountant she will be well
aware of security concerns. I would think read
only access would be sufficient for files she
doesn't already have read/write access to. For
internal audit she will probably want to test
that the software works as intended and that
the users understand its proper use.

Good luck
Bill

by gaston nusimovich

You should try to expose the oxymoron behind what your CEO pretends.

Just as it makes no sense for law enforcement agencies to break the law to accomplish their duty, it makes no sense to break security rules and provisions for an audit.

IT Security policies include certain allowances for audits, but full access seems like to much of a stretch of the concept.

by admin

Get yourself a folder monitering software... backup files when opened by the CFO

This will provide you with a backup just incase..
You could version these backups as well...

Hope that helps
-Smit
smit@omegasoftinc.com

by mollybigd

Very carefully. My question is why don't you give security permissions just for the actual Network shares he/she needs. Why does he/she need full access. When internal audits are done in my company, permissions are only given to those areas that he/she is auditing. As for the Enterprise software why would the CFO need it? If its financial auditing that is being auditing then he only needs the financial permissions.

by hbagger

Maybe you should reconsider your role in the organization!
In my book the IT department "sell" system availability to its "customers" ? business units and departments. Information (data) is owned by the appropriate business units, and they must decide which levels of security they find suitable for applications and data.
Anyway all information security issues must be part of the senior management governance (CEO and/or board). This is important because data and availability of systems is a important and still growing part of modern company?s assets (how would your business look like if all data and IT disappeared over night?)
So I would recommend you to go to your CEO and purpose that he should appoint a person in your organization responsible for information security (CSO)- this could be a dedicated person or even the CFO). It is important that the person is not from the IT department, because there is a tendency that there will be opposite interest, when it comes down to i.e. availability contra confidentiality. Even more it will be a problem that it-department have to control its own performance on it-security.
Next step should be to make an it-security policy stating responsibilities, system and data ownership, security levels, Service Level Agreement's toward the it-department, audit and control policies etc.
It is very important that senior management actively commit 100% to the policy.
The it-security policy must be followed by practical guidelines and procedures.

I don't know if you got any wiser by this, but my key point is to look at the system ownership and look around in your organization for alliances which also could claim ownership to the systems/data that your CFO wants to tamper with.

Regards
Hans Bagger
Denmark

by attaman123

I think the data access authorization should be up to data owners.

Security specialists can be in IT department. They are mainly responsible for IT security and information security management. Only internal IT auditor need to be independent from IT department.

by jtakiwi

Then the CEO will make the decision, that is what they do. Maybe offer to help the CFO to make sure he/she doesn't do anything stupid.

This discussion is closed to new replies.