Re: AS400 Automatic Sending of New Password?

["John Earl" <johntearl@xxxxxxxxxxxxx>]

Mark,

There is no prohibition of emailing passwords in the Sarbanes-Oxley legislation (as a matter of fact, I don't even think the word "computer" is even referenced in the bill). 

E-mailing passwords does contain some risk, but it is certainly a risk that can be mitigated with a wide assortment of compensating controls. 

jte 

Sent via BlackBerry from T-Mobile

-----Original Message-----
From: "Mark S. Waterbury" <mark.s.waterbury@xxxxxxx>

Date: Wed, 17 Jun 2009 13:33:57 
To: Midrange Systems Technical Discussion<midrange-l@xxxxxxxxxxxx>
Subject: Re: AS400 Automatic Sending of New Password?


The whole idea of "automatically e-mailing passwords" seems flawed, and 
depending on what industry your business is in, it may even be illegal.

This certainly won't fly with most auditors, especially if you work for 
a company that must comply with the Sarbanes-Oxley Act or similar 
legislation.