The Sarbanes-Oxley Act of 2002 or the Public Company Accounting Reform and Investor Protection Act of 2002 isn’t a security compliance standard or regulation. It is a United States law that introduced major changes to the regulation of financial practice and corporate governance.  The law emphasizes corporate accountability and was in part a response to the corporate scandals of Enron, Tyco Internationl, Adelphia, WorldCom, etc. in which shareholders lost billions of dollars when the share price of these companies collapsed.

The Sarbanes-Oxley Act of 2002, more commonly known as SOX, was named after Senator Paul Sarbanes (D-MD) and Representative Michael G. Oxley (R-OH) who supported the bill.

SOX established new standards for U.S. public companies and has been a source of controversy for international companies wishing to carry out business operations in the U.S.  The Sarbanes-Oxley Act of 2002 primarily focuses on the accuracy of financial reporting data.  It also outlines criminal penalties for companies failing to comply with these standards. The Act is divided into the following eleven titles:

• Title 1: Public Company Accounting Oversight Board (PCAOB)
• Title 2: Auditor Independence
• Title 3: Corporate Responsibility
• Title 4: Enhanced Financial Disclosures
• Title 5: Analyst Conflicts of Interest
• Title 6: Commission Resources and Authority
• Title 7: Studies and Reports
• Title 8: Corporate and Criminal Fraud Accountability
• Title 9: White Collar Crime Penalty Enhancement
• Title 10: Corporate Tax Returns
• Title 11: Corporate Fraud Accountability

How does information and network security play into the Sarbanes-Oxley Act of 2002?  There isn’t one specific direct way that it does but many, if not most, of the fundamental reasons IT security exists within these publicly traded companies is to help protect business assets and information.  An attack on a company’s infrastructure could “yield losses to confidentiality, reliability or integrity of systems or data that would have to be disclosed.“ [2]

The standards provided by SOX outline areas of concern for companies that need to report financial information to shareholders and to the Securities Exchange Commission.  These outlined standards essentially took a highlighter to all financial requirements/standards/regulations and highlighted all of the important standards companies must comply with.  This is key to complying and achieving certification with the standards but also provides critical information to persons wishing to do harm to a company. This critical information cuts the time and effort needed to determine the value of an organization’s data and could lead to increased or better organized attacks on important financial data. If this critical information is attacked it will cause irreparable damage to the company and most likely prompt an investigation from government agencies which could eventually lead to tighter control and more government oversight.

Is the information outlined by SOX important to attackers? No. Not to most. Could it be used in the way I outlined above? Probably but it wouldn’t be a priority resource to most. A well thought out attack could incorporate this information and if an attack on a high profile publicly traded company were to take place the information outlined in SOX could prove worthwhile.  One can never have too much information about a target and knowing how its internal structures are organized is essential to carrying out a successful attack.

References:
1. http://www.law.uc.edu/CCL/SOact/toc.html
2. http://www.securityfocus.com/columnists/322