O'Reilly logo

Unauthorised Access: Physical Penetration Testing For IT Security Teams by Wil Allsopp

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

B.1.3. SOX and HIPAA

Aside from the laws directly concerned with privacy, fraud and computer abuse you may have to consider the more recent legal complexities introduced by two sets of legislation: Sarbanes–Oxley (SOX) and the Health Insurance Portability and Accountability Act (HIPAA). These acts fall more into the category of things you should be aware of as testers rather than laws that will have much direct bearing on how you conduct testing itself, other than the fact that the scope of a test may be to determine an organization's compliance to these standards.

SOX was introduced in 2002 following accounting scandals at Enron, WorldCom and elsewhere. It is federal legislation that is officially known as the Public Company Accounting Reform and Investor Protection Act of 2002; it is commonly known as Sarbanes–Oxley after its sponsors, the US Senators Paul Sarbanes (Democrat, Maryland) and Michael G. Oxley (Republican, Ohio). Broadly, the purpose of SOX is to enhance accounting standards for all US public companies and accounting firms (it has no bearing on privately held firms of any kind). Despite criticisms from various quarters that SOX was intrusive and unnecessary, it has been largely successful and other countries have developed equivalent legislation such as J-SOX in Japan and Bill 198 in Canada.

The aspects of SOX most applicable to security consultants are Section 302 (Internal Controls) and Section 404 (Assessment of Internal Control). Section 404 requires annual ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required