Petrobras Distributor (Petrobras Distribuidora)

• case

BUSINESS WITH SAFETY

Petrobras Distributor (Petrobras Distribuidora) followed Cobit's model to evaluate its IT processes and meet the Sarbanes-Oxley law requirements

The Adequation of Petrobras Distribuidora (Petrobras Distribuidora), which is responsible for the marketing and distributing petroleum and derivatives allover Brazil, followed Sarbanes-Oxley (SOX) that lead the company to rearrange many processes. The company took the chance to analyze its security policies and implement an enterprise-wide Information Security (IS) project.

In order to meet SOX' requirements, the company decided to adopt Cobit's model (Control Objectives for Information and related Technology). One of those sub-sets was met by implementing ITIL (Information Technology Infrastructure Library) framework.
However, a great part of those which were related to IS required the analysis of the company's existing Information Technology (IT) processes.

In order to perform that evaluation, Petrobras Distributor (Petrobras Distrbuidora) appealed to a market tool. The French American consulting company, Schlumberger, was contracted to perform that work, Schlumberger is specialized on information solutions and project management for the gas and petroleum industry. They have elected Modulo's Compliance and Risk Management system, Risk manager, to audit the company's IS processes.

Modulo's software was used to outline a diagnosis for the company's IT environment: to perform emergency security implementations, policies and analysis' rules publication, as well the adjustment to market regulations. Eliza Hitomi Fukushigue Mihaguti, infrastructure manager for Petrobras Distributor (Petrobras Distribuidora), explains that the Corporate Information Security project started its implementation at the beginning of 2005 and finished at the end of last year, covering the four foundations of that practice, which are: IT, processes, people and environment.

DIAGNOSIS

Eliza says that there were many environments to be analyzed and Risk Manager helped on making that process faster. “We were able to reduce around 50% of the IT environments analysis time, given that, besides the diagnosis the tool performs, it outlines detailed recommendation to solve the identified non-conformities”.

The software also creates a strategic map showing the consolidated risks’ index. Petrobras Distributor's (Petrobras Distribuidora) workforce relies on more than five thousand people allover Brazil. The executive points out that information is one of company's most valuable assets, and therefore it is essential that everybody becomes aware of its preservation.

The company has an IT department completely independent from Petrobras, its holding. Its infrastructure is composed of hundreds of servers, and it grew even more after it has acquired Agip do Brasil, a gas distributor, that now is a Petrobras Distributor's (Petrobras Distribuidora) subsidiary, known as Liquigas. Liquigas observing its controller's guidelines also uses Risk Manager solution. Eliza states that after that project, “we have today an analysis of the entire IT environment, with IS policies implemented. And people are constantly warned about them by corporate trainings”.

To Eliza, the Information Technology environment risks analysis has brought many benefits for the company, one of the main benefits, from her point of view, is to have in hands an action plan aligned with company's business strategies.

She believes that new strategy will bring competitive advantages to Petrobras Distributor (Petrobras Distribuidora), which operates in a very competitive market, gasoline wholesale in gas stations allover the country. (E.S)