Methods and apparatus for remediation workflow

• US 10,235,236 B1
• Filed: 04/04/2016
• Issued: 03/19/2019
• Est. Priority Date: 09/16/2011
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Whitlock, David, Gascoigne-Piggford, Guy, Granum, Geoff, Petrie, Mark
• Primary Examiner(s): Kudirka, Joseph R
• Application Number:
  US15/090,114
• Time in Patent Office: 1,079 Days
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/26 Functional testing
• CPC Class Codes: G06Q 10/0631 Resource planning, allocation, distributing or scheduling for enterprises or organisations

Abstract

Disclosed herein are methods, systems, and articles associated with remediation workflow. A method may include determining one or more test failures related to a policy test within a computer network, and reviewing the one or more test failures. The method may further include, based upon a result of the reviewing, creating a remediation work order that includes at least one of the one or more test failures. Each test failure within the remediation work order may be approved or denied. For each test failure that is approved for remediation, a remediation process may be executed.

Claims

1. A method comprising:

analyzing or facilitating analyzing, by a computing device, one or more test failures related to one or more policy tests within a computer network;

based upon a result of the analyzing of the one or more test failures, creating or facilitating creating, by the computing device, a remediation work order that specifies at least one of the one or more test failures;

reviewing or facilitating reviewing, by the computing device, each test failure specified within the remediation work order to approve or deny remediation for each test failure;

wherein the reviewing or facilitating reviewing comprises approving remediation for at least one of the test failures specified within the remediation work order;

wherein the reviewing or facilitating reviewing further comprises denying remediation for at least one of the test failures specified within the remediation work order and associated with a target host because the remediation would disable security applications or needed business applications on the target host;

executing or facilitating executing, by the computing device, for each test failure that is approved for remediation, a remediation process that corresponds to a particular test failure that is approved for remediation; and

remediating, for each test failure that is approved for remediation, the particular test failure.

2. The method of claim 1, further comprising:

determining or facilitating determining, by the computing device, the one or more test failures as being related to the one or more policy tests within the computer network.

3. The method of claim 1, wherein facilitating analyzing comprises facilitating a compliance entity, facilitating reviewing comprises facilitating a change approval entity, and facilitating executing comprises facilitating a remediation entity.

4. The method of claim 3, wherein the change approval entity comprises a change approval board that comprises two or more persons.

5. The method of claim 1, wherein the remediation process comprises one or more remediation scripts.

6. The method of claim 1, further comprising:

commenting or facilitating commenting, by the computing device, as to why a test failure should be remediated.

7. The method of claim 1, further comprising:

excluding or facilitating excluding, by the computing device, a test failure from the remediation work order.

8. The method of claim 1, further comprising:

commenting or facilitating commenting, by the computing device, as to why a test failure is approved or denied.

9. The method of claim 1, further comprising:

assigning or facilitating assigning, by the computing device, a remedial approval identification (ID) to a remediation work order.

10. The method of claim 1, further comprising:

upon completion of all remediation processes within a work order, transitioning or facilitating transitioning, by the computing device, the remediation work order to a complete state.

11. The method of claim 10, further comprising:

based upon transitioning the remediation work order to a complete state, closing or facilitating closing, by the computing device, the remediation work order.

12. The method of claim 11, further comprising:

storing, by the computing device, the remediation work order after closing the remediation work order so that the remediation work order is available for future reference.

13. The method of claim 12, further comprising:

retrieving or facilitating retrieving, by the computing device, a stored remediation work order for future review.

14. The method of claim 1, further comprising:

upon approving or denying each test failure within the remediation work order, deferring or facilitating deferring, by the computing device, to be remediated later, at least one test failure that is approved for remediation;

wherein upon completion of all remediation processes within a work order, transitioning or facilitating transitioning, by the computing device, the remediation work order to a complete state.

15. An article of manufacture comprising:

a non-transitory computer-readable storage medium; and

a plurality of programming instructions stored on the computer readable storage medium and configured to enable one or more computing devices, in response to execution of one or more of the plurality of programming instructions, to perform operations including;

obtaining or facilitating obtaining, one or more test failures related to one or more policy tests within a computer network;

creating or facilitating creating, a remediation work order that includes at least one of the one or more test failures;

approving or facilitating approving, at least one of the one or more test failures of the remediation order, for remediation;

executing, for each test failure that is approved for remediation, a remediation process that corresponds to a particular test failure that is approved for remediation, the remediation process remediating the particular test failure; and

denying remediation for at least one of the test failures specified within the remediation work order and associated with a target host because the remediation would affect one or more applications at the target host that are either being upgraded or are subject to a change order.

16. The article of manufacture of claim 15, wherein facilitating obtaining comprises facilitating obtaining by a compliance entity, facilitating approving comprises facilitating approval by a change approval entity, and executing comprises facilitating executing by a remediation entity.

17. The article of manufacture of claim 16, wherein the change approval entity comprises a change approval board that comprises two or more persons.

18. The article of manufacture of claim 15, wherein the remediation process comprises one or more remediation scripts.

19. The article of manufacture of claim 15, wherein the operations further comprise:

excluding or facilitating excluding a test failure from the remediation work order.

20. The article of manufacture of claim 15, wherein the operations further comprise:

assigning or facilitating assigning a remediation approval identification (ID) to the remediation work order.

21. The article of manufacture of claim 20, wherein the operations further comprise:

upon completion of all the remediation processes within a work order, transitioning or facilitating transitioning the remediation work order to a complete state.

22. The article of manufacture of claim 21, wherein the operations further comprise:

based upon transitioning the remediation work order to a complete state, closing or facilitating closing the remediation work order.

23. The article of manufacture of claim 22, wherein the operations further comprise:

storing or facilitating storing the remediation work order after closing the remediation work order so that the remediation work order is available for future reference.

24. An apparatus comprising:

one or more processors;

a non-transitory computer-readable storage medium coupled to the one or more processors, and having stored therein a plurality of programming instructions configured to enable the apparatus, in response to execution of one or more of the plurality of programming instructions, to;

obtain or facilitate obtaining of, one or more test failures related to one or more policy tests within a computer network;

create or facilitate creation of, a remediation work order that includes at least one of the one or more test failures;

deny or facilitate denying remediation of at least one of the one or more test failures of the remediation order based on an application type for an application associated with the at least one test failure, wherein the denying comprises denying remediation of a respective test failure because it is associated with an application being upgraded or that is subject to a change order;

approve or facilitate approval of, at least one of the one or more test failures of the remediation order, for remediation;

execute or facilitate executing, for each test failure that is approved for remediation, a remediation process that corresponds to a particular test failure that is approved for remediation; and

remediate, for each test failure that is approved for remediation, the particular test failure.

25. The apparatus of claim 24, wherein the apparatus is further enabled to:

exclude or facilitating exclusion of a test failure from the remediation work order.