Tripwire ExpertOps and SOX

The Sarbanes-Oxley Act (SOX) requires all publicly held companies to establish internal controls and procedures for financial reporting to reduce the possibility of corporate fraud. SOX is not specific on the types of controls that are required, but points to the COBIT framework to provide organizations’ guidance on their IT governance.

The Challenge

Change is ever occurring in your systems and you need to know if those changes are impacting your regulated environment. Systems must be properly configured and configurations should not drift out of compliance. Constantly assessing configurations is a time consuming and complicated task, however, and auditors want to see evidence of compliance.

The Goal: Be Prepared for Your Next Audit

Having the right controls in place is only part of the compliance challenge. Ensuring all systems remain in a known good state, and assessing changes that impact the integrity of your environment are critical for both data safety and compliance. When an audit occurs, proving that controls are effective, configurations align with IT and COBIT policies, and that change is properly managed can be a daunting task. Having audit ready reporting reduces the time IT and Security teams need to spend gathering evidence, and means these teams are prepared whenever the auditor calls. Tripwire® ExpertOpsSM adds valuable resources and expertise to your team to help ensure audit success.

Your Solution: Tripwire ExpertOps

Tripwire ExpertOps combines managed services with the industry’s best File Integrity Monitoring (FIM) and Security Configuration Management (SCM), providing many of the security controls auditors are looking for. The solution provides personalized consulting, audit support and cloud based infrastructure to help you achieve and maintain compliance. The solution is easy to deploy and use, with simple subscription pricing and a low total cost of ownership.

Tripwire ExpertOps enables you to rapidly achieve SOX compliance by reducing the attack surface, increasing system integrity and delivering continuous controls. Plus, because Tripwire ExpertOps includes personalized consulting, you receive ongoing support from a designated Tripwire Expert.

Benefits

• SOX audit support
• 24/7 compliance visibility via a customized dashboard
• Alerts and reports in your inbox
• Waivers and change requests made easy
• No more awkward or incomplete hand offs when your staff changes

How It Works

Tripwire ExpertOps provides you with continuous staffing to operate and manage Tripwire provided SOX controls at peak efficiency. The solution adapts to your unique environment—reports and profiling tasks are customized to meet your specific needs. You will receive expert guidance to configure your system and policy configurations to best align with your requirements, and gain visibility via 24/7 access to compliance information via a tailored dashboard and management console.

A Tripwire Expert will act as an extension of your team by prioritizing work efforts and managing critical escalations. Together you will jointly develop a Service Plan that outlines communication practices, escalation procedures and any specialized requests.

The Tripwire Expert will then tune and operate your Tripwire provided SOX controls to provide:

• Prescriptive policy and content guidance to enable SOX compliance for your specific network or system security requirements
• Recommendations for maximizing automation capabilities for compliance and event alerting practices, change management process integrations, and audit prep activities
• Prioritized remediation to identify opportunities to efficiently improve compliance posture
• Organizational grading for each accountable department to provide visibility into groups needing additional resources and attention

Get 24/7 visibility without deploying additional hardware, databases and back end software. Tripwire ExpertOps is built on a cloud computing platform, allowing the service to quickly scale to meet your needs while maintaining high levels of security. The service uses a single tenancy model to ensure that data remains segregated between customer accounts. Tripwire applies multiple controls for security and privacy of your data, including secure configurations, vulnerability scanning, data encryption, malware defenses, access control, log management, multi-factor authentication, VPN and much more.