Almost two-thirds of companies in a survey conducted by CIO Magazine (2005) had
suffered a security breach in the past year, most commonly a virus or Trojan horse,
unauthorized entry into a computer system or a denial-of-service attack. The attacks
resulted in e-mail and applications being inaccessible more than 50% of running time
or causing network downtime. More than a quarter of the incidents resulted in
employee or customer records being compromised or lost. Many companies use
e-mail to communicate a majority of ordering, inventory, and planning information
to their customers and trading partners. This includes the attaching of customer and
purchasing documents to e-mails. Chronic security breaches and virus disruptions in
e-mail services make it difficult to claim adequate controls.
• Deficiencies related to segregation of duties
• Deficiencies related to configuration changes, authorization for changes, approval of
testing, testing of changes, communication of changes, updates
of control documentation, developer access to production, and emergency changes.