Audit Programs
Sarbanes-Oxley Center
AuditNet Links
AuditNet Library
AuditNet Newsletter
Audit Jobs
Partner Discounts
Search the Site
Sign the Guestbook
Advertise
Our Sponsors
AuditNet Home

	Web www.auditnet.org

Software Compliance Audit News

August 2003 Update 

by Rob Harmer

Some time ago PCProfile wrote an article on Peer 2 Peer networking issues (Have You been Napstered and Under Your Nose) which talked about the risks of and file sharing.

It now seems that the issue of P2P and file sharing will probably become the biggest threat and drain on auditor resources as an issue that all auditors will have to face.

Auditors now need to consider the impact of file sharing/file transfer through wireless technology, and the impact of "war driving" (sniffing out your system using wireless technology and GPS systems and using your bandwidth at your cost),  and continued vulnerabilities in their systems eg; the Cisco/Microsoft recent high risk issues in the last 2 weeks.

On top of this organizations now face the prospect of their assets being interrogated by 3rd party forensic investigators as a result of the music industry and the movie industry (and the anti-piracy software police) obtaining court orders and injunctions that allow them to seize university ISP customer and access records and this may then lead on a path of discovery about tracing a path which ends up running through an organizations systems.

In effect your systems are so widely accessible (despite firewalls) outside your walls it's a wonder you are still surviving in business. The reality is that up until now this has not yet been put together as an issue but in September we will release a provocative article on P2P, war driving, espionage issues that are looming as a result of the "open and wireless and P2P way" we are all doing business and being driven down this path by vendors.

Its time for the auditor community to take a stand, and shape the future by getting some clear "control messages" to key stakeholders.

In the meantime all auditors can register at our website at and obtain FREE audit software at http://www.pcprofile.com

If they really want to lower their cost of doing software compliance audits and treat software as an asset then they should have a good look at http://www.pcprofile.com/take_control.htm Key stakeholders love this approach as resets the baseline about who is on control when it comes to a PC/notebook and has, on many sites lowered the impact of the risk of getting caught with illegal software and fined, lowered the impact of virus attack through software downloads, and lowered the rate of in-appropriate use of PC's for non-work related activities ie; it gives management control but with some degrees of freedom and flexibility so it doesn't restrict legitimate use.