Is ISACA's WebSphere IT Controls Literature Lacking?
Last night, I was doing research on
segregation of duties controls for WebSphere
Commerce on the Information
System Audit and Control Association (ISACA) website
last night. They have a knowledge repository of literature and tools for
a wide range of specific technologies in a section called KNet.
At first I was stunned that there was not one single document addressing
WebSphere. But then I started to wonder, could that be because IBM got
into the habit of branding everything WebSphere? In doing so, was there
was never a core functionality that people felt they could get their hands
around to address IT Control Issues? Is WebSphere Commerce not a specific
enough technology for a body of controls and/or IT audit literature to
develop? What would it take to develop such a body. One thing that ISACA
should do, at the very least, is link to the IBM
Redbooks Website, and I will
recommend to them today that they do this. I am also going to recommend
that they review their existing body of knowledge for IBM
Lotus Notes and Domino, as many
of the references they list no longer exist, and one has not been updated
since 1991.