INFORMATION TECHNOLOGY GOVERNANCE AND CONTROLS METHODS AND APPARATUSES

• US 20070043674A1
• Filed: 08/09/2006
• Published: 02/22/2007
• Est. Priority Date: 08/09/2005
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: DiFalco, Robert, Keeler, Kenneth, Warmack, Robert
• Granted Patent: US 8,176,158 B2
• Time in Patent Office: Days
• US Class Current: 705/51
• CPC Class Codes: G06F 16/128 Details of file system snapshots on the file-level, e.g. snapshot creation, administration, deletion use of snapshots for error detection or correction G06F11/14, G06F11/16
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 10/0637 Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Embodiments of the present invention provide methods and systems for automated change audit of an enterprise'"'"'s IT infrastructure, including independent detection of changes, reconciliation of detected changes and independent reporting, to effectuate a triad of controls on managing changes within the IT infrastructure, preventive controls, detective controls and corrective controls.

Claims

1. A method comprising:

independently detecting changes in an enterprise'"'"'s information technology (IT) infrastructure, regardless of source or intent of the changes;

reconciling the detected changes with intended and authorized changes; and

independently reporting all change activities across at least all production systems of the enterprise'"'"'s IT infrastructure.

2. The method of claim 1, wherein the independently detecting comprises independently detecting a change of state of at least one of a plurality of data within the enterprise'"'"'s IT infrastructure.

3. The method of claim 1, wherein the reconciling comprises determining whether a detected change of state of at least one of a plurality of data within the enterprise'"'"'s IT infrastructure is authorized.

4. The method of claim 3, wherein the determining whether the detected change of state is authorized comprises determining whether the detected change of state is at least one of planned or requested.

5. The method of claim 1, wherein the reconciling comprises determining whether a detected change of state of at least one of a plurality of data within the enterprise'"'"'s IT infrastructure is intended, including determining whether the detected change of state is known.

6. The method of claim 1, wherein the reconciling comprises determining whether a detected change of state of at least one of a plurality of data with the enterprise'"'"'s IT infrastructure is conforming, including determining whether the detected change of state is desirable.

7. The method of claim 6, wherein the reconciling further comprises changing a baseline state for the at least one data, if the detected change of state is conforming.

8. The method of claim 6, wherein the reconciling further comprises determining at least one of a level of severity or non-conformance for the detected change of state, if the detected change of state is not conforming.

9. The method of claim 1, further comprising memorializing a detected change of state of at least one of a plurality of data with the enterprise'"'"'s IT infrastructure.

10. The method of claim 9, wherein memorializing the detected change of state comprises taking a snapshot of a current state of the at least one data and comparing the snapshot to another snapshot, the another snapshot representing a baseline state for the at least one data.

11. The method of claim 9, wherein memorializing the detected change of state comprises logging one or more events in an event log.

12. The method of claim 11, wherein the one or more events comprise at least one of when a file comprising the at least one data is accessed or when a file comprising the at least one data is modified.

13. An article of manufacture comprising:

a storage medium; and

a plurality of instructions therein;

wherein the plurality of instructions are adapted to enable one or more control modules within an enterprise'"'"'s information technology (IT) infrastructure to perform a plurality of operations comprising;

independently detecting changes in the IT infrastructure, regardless of source or intent of the changes;

reconciling the detected changes with intended and authorized changes; and

independently reporting all change activities across at least all production systems of the enterprise'"'"'s IT infrastructure.

14. An apparatus comprising:

a processor; and

a control module adapted to be operated by the processor to perform, or to collaborate with at least one other control module operated by at least one other processor of at least one other apparatus to perform;

independent detection changes in an enterprise'"'"'s information technology (IT) infrastructure, regardless of source or intent of the changes;

reconciliation of the detected changes with intended and authorized changes; and

independent reporting all change activities across at least all production systems of the enterprise'"'"'s IT infrastructure;

wherein the apparatuses are of a common information technology infrastructure of an enterprise.