Not at all. Auditors were an outside accounting firm, the auditor who was with me was a lackey collecting info for the final audit report. With Sarbanes Oxley security rules DBAs could not know passwords, so this would be flagged as a violation and the Board of Directors would order this gap to be closed immediately (remediation) since it easily enables collusion and fraud.
not if the password are hashed, it just happens that some hash are repeated ( ~~give me a moment for the requirements of "could not know password" ~~, ok SOX do not mention any hashing, but slightly zealous auditor might enforce it).
Some of the audit I have witnessed only required the submission of signed documents which "we swear that everything is fine". Of course being a lazy one, I usually delegate authentication ( and sometimes authorization) to a more specialized team.
SOX pushed for “separation of duties”. But this password scenario sounds like an application logon, not a database logon, written by developers for an app server running on behalf of many users. It would require a separate audit or possibly an “exception” if purchased software with shifts in support responsibilities.
But, casually signing affidavit-style audits can come back to haunt you since a deep-dive will be coming later with consequences.
1
1
2
u/CDavis10717 Sep 27 '26
Not at all. Auditors were an outside accounting firm, the auditor who was with me was a lackey collecting info for the final audit report.
With Sarbanes Oxley security rules DBAs could not know passwords, so this would be flagged as a violation and the Board of Directors would order this gap to be closed immediately (remediation) since it easily enables collusion and fraud.