Asset inventory reconciliation services for use in asset management architectures

• US 10,282,426 B1
• Filed: 03/18/2014
• Issued: 05/07/2019
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Lerner, Aaron, Montville, Adam
• Primary Examiner(s): Trujillo, James
• Assistant Examiner(s): Tessema, Aida Z
• Application Number:
  US14/218,511
• Time in Patent Office: 1,876 Days
• Field of Search: None
• CPC Class Codes: G06F 16/23 Updating
• CPC Class Codes: G06F 16/24564 Applying rules; Deductive queries
• CPC Class Codes: G06F 16/25 Integrating or interfacing systems involving database management systems
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/273 Asynchronous replication or reconciliation

Abstract

Disclosed below are representative embodiments of methods, apparatus, and systems for managing, monitoring, controlling, and/or classifying assets in an information technology (“IT”) environment. Certain embodiments leverage both services oriented architecture concepts and event mechanisms to create a platform with which additional controls can easily integrate.

Claims

1. A system, comprising:

one or more processors; and

one or more computer-readable storage media storing computer-executable instructions, the computer-executable instructions including,

instructions for implementing an asset discovery handler component, the asset discovery handler component being configured to receive asset information from an asset collector component, and to normalize the asset information to a common format, the asset information describing an asset in an IT environment; and

instructions for implementing an asset reconciliation component, the asset reconciliation component being configured to apply defined reconciliation rules to compare information pertaining to a newly discovered asset to information pertaining to previously reconciled assets to determine if a match exists, and, in response to the determination;

if the information pertaining to the newly discovered asset matches the information pertaining to one of the previously reconciled assets, to determine that the newly discovered asset is not a new asset, and associating it with an existing unique reconciliation identifier of the previously reconciled asset; and

if the information pertaining to the newly discovered asset fails to match the information pertaining to at least one of the previously reconciled assets, to determine that the newly discovered asset is a new asset, and, in response to the determination, to assign a new unique reconciliation identifier to the new asset.

2. The system of claim 1, wherein the asset information includes an IP address and a hostname for the asset.

3. The system of claim 1, wherein assets that the system already manages are stored in an asset inventory, and wherein the asset inventory provides asset information across multiple tools in the system.

4. The system of claim 3, wherein the asset inventory provides information to a reporting tool that generates reports describing security controls in the IT environment.

5. The system of claim 3, wherein the asset inventory further stores tag data associated with the assets in the asset inventory.

6. The system of claim 5, wherein the tag data comprises one or more tags, each of which is configured to be associated with multiple of the assets in the asset inventory.

13. The system of claim 1, further comprising instructions for implementing a compliance and configuration tool to discover and assess a configuration of the newly discovered asset and to determine whether the asset complies with at least one of an internal and an external policy.

14. The system of claim 13, wherein the compliance and configuration tool is configured to use one or more software agents that are implemented on the newly discovered asset to monitor and report the configuration.

7. A non-transitory computer readable medium storing program instructions for causing a computer to perform the method of:

implementing an asset discovery handler component, the asset discovery handler component being configured to receive asset information from an asset collector component, and to normalize the asset information to a common format, the asset information describing an asset in an IT environment; and

implementing an asset reconciliation component, the asset reconciliation component being configured to apply defined reconciliation rules to compare information pertaining to a newly discovered asset to information pertaining to previously reconciled assets to determine if a match exists, and, in response to the determination;

if the information pertaining to the newly discovered asset matches the information pertaining to one of the previously reconciled assets, to determine that the newly discovered asset is not a new asset, and associating it with an existing unique reconciliation identifier of the previously reconciled asset; and

if the information pertaining to the newly discovered asset fails to match the information pertaining to at least one of the previously reconciled assets, to determine that the newly discovered asset is a new asset, and, in response to the determination, to assign a new unique reconciliation identifier to the new asset.

8. The non-transitory computer readable medium of claim 7, wherein the asset information includes an IP address and a hostname for the asset.

9. The non-transitory computer readable medium of claim 7, wherein assets that are already managed by the system are stored in an asset inventory, and wherein the asset inventory provides asset information across multiple tools in the system.

10. The non-transitory computer readable medium of claim 9, wherein the asset inventory provides information to a reporting tool that generates reports describing security controls in the IT environment.

11. The non-transitory computer readable medium of claim 9, wherein the asset inventory further stores tag data associated with the assets in the asset inventory.

12. The non-transitory computer readable medium of claim 11, wherein the tag data comprises one or more tags, each of which is configured to be associated with multiple of the assets in the asset inventory.

15. The non-transitory computer readable medium of claim 7, further comprising implementing a compliance and configuration tool to discover and assess a configuration of the newly discovered asset and to determine whether the asset complies with at least one of an internal and an external policy.

16. The non-transitory computer readable medium of claim 15, wherein the compliance and configuration tool is configured to use one or more software agents that are implemented on the newly discovered asset to monitor and report the configuration.

17. The non-transitory computer readable medium of claim 15, wherein assessing the configuration further comprises:

capturing a baseline configuration;

performing one or more integrity checks to compare a subsequent configuration to the baseline configuration to identify at least one change to the baseline configuration; and

confirming that the at least one change is authorized.

18. The non-transitory computer readable medium of claim 17, wherein confirming that the at least one change is authorized comprises:

crosschecking the at least one change with one or more of;

defined IT compliance policies, documented change tickets in a change control management (CCM) system, a list of approved changes, and automatically generated lists created by patch management and software provisioning tools; and

in response to said crosschecking, automatically recognizing whether the at least one change is authorized or unauthorized.

19. The non-transitory computer readable medium of claim 18, further comprising, in response to identifying that the change is authorized, generating a report concerning the asset, the report containing one or more of:

compliance information, configuration information, and usage information.

20. The non-transitory computer readable medium of claim 18, further comprising, in response to identifying that the change is unauthorized, generating a report concerning the asset, the report containing one or more of:

compliance information, configuration information, and usage information.