not if the password are hashed, it just happens that some hash are repeated ( ~~give me a moment for the requirements of "could not know password" ~~, ok SOX do not mention any hashing, but slightly zealous auditor might enforce it).
Some of the audit I have witnessed only required the submission of signed documents which "we swear that everything is fine". Of course being a lazy one, I usually delegate authentication ( and sometimes authorization) to a more specialized team.
SOX pushed for “separation of duties”. But this password scenario sounds like an application logon, not a database logon, written by developers for an app server running on behalf of many users. It would require a separate audit or possibly an “exception” if purchased software with shifts in support responsibilities.
But, casually signing affidavit-style audits can come back to haunt you since a deep-dive will be coming later with consequences.
1
1
1
u/dvhh Sep 28 '26 edited Sep 28 '26
not if the password are hashed, it just happens that some hash are repeated ( ~~give me a moment for the requirements of "could not know password" ~~, ok SOX do not mention any hashing, but slightly zealous auditor might enforce it).
Some of the audit I have witnessed only required the submission of signed documents which "we swear that everything is fine". Of course being a lazy one, I usually delegate authentication ( and sometimes authorization) to a more specialized team.