ENFORCING ALIGNMENT OF APPROVED CHANGES AND DEPLOYED CHANGES IN THE SOFTWARE CHANGE LIFE-CYCLE

• US 20100100970A1
• Filed: 12/17/2009
• Published: 04/22/2010
• Est. Priority Date: 02/02/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Roy-Chowdhury, Rahul, Vaishnav, Jay, Sebes, E. John
• Granted Patent: US 8,234,713 B2
• Time in Patent Office: Days
• US Class Current: 726/30
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/70 Software maintenance or management
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/55 Push-based network services

Abstract

On a host, host content change requests are intercepted in real-time. In a tracking mode, the change requests are logged and allowed to take effect on the host. In an enforcement mode, the change requests are logged and additionally compared against authorized change policies and a determination is made whether to allow the change to take effect or to block the changes, thereby enforcing the authorized change policies on the host. Tracking and enforcement can be done in real-time. In either mode and at any time, the logged changes can be reconciled against a set of approved change orders in order to identify classes of changes, including changes that were deployed but not approved and changes that were approved but not deployed.

Claims

1-24. -24. (canceled)

25. A method, comprising:

intercepting a host content change request indicating a change to a persistent object on a host;

determining whether the change is authorized, as indicated by a set of change authorization policies;

allowing the change to take effect when the change is authorized; and

blocking the change from taking effect when the change is not authorized,

wherein the set of change authorization policies is configurable to define whether the persistent object can be changed.

26. The method of claim 25, wherein at least one policy of the set of change authorization policies is selected from the group consisting of:

a set of persistent objects that can be changed without restriction;

a set of users, programs or entities that can make changes to a specified set of persistent objects; and

a set of users, programs or entities that can make changes to the specified set of persistent objects during one or more specified time windows.

27. The method of claim 25, wherein the determining, the allowing and the blocking are performed in real-time.

28. The method of claim 25, further comprising:

logging information about the host content change request.

29. The method of claim 28, further comprising:

filtering the host content change request to prevent logging the host content change request if the host content change request is non-material.

30. The method of claim 29, wherein the host content change request is non-material if the host content change request includes one or more of:

creation of specified registry entries;

modification of specified registry entries; and

creation, deletion, or modification of temporary objects.

31. The method of claim 28, further comprising:

obtaining a log representing a set of host content change requests;

comparing the log to a set of approved change orders for any one or more of a plurality of persistent objects on the host;

identifying at least one correlation between the set of host content change requests and the set of approved change orders; and

providing user-readable data representing the at least one correlation.

32. Logic encoded in one or more computer readable media having computer-executable instructions and when executed by a processor is operable to perform operations comprising:

intercepting a host content change request indicating a change to a persistent object on a host;

determining whether the change is authorized, as indicated by a set of change authorization policies;

allowing the change to take effect when the change is authorized; and

blocking the change from taking effect when the change is not authorized,

wherein the set of change authorization policies is configurable to define whether the persistent object can be changed.

33. The logic of claim 32, wherein at least one policy of the set of change authorization policies is selected from the group consisting of:

a set of persistent objects that can be changed without restriction;

a set of users, programs or entities that can make changes to a specified set of persistent objects; and

a set of users, programs or entities that can make changes to the specified set of persistent objects during one or more specified time windows.

34. The logic of claim 32, wherein the determining, the allowing and the blocking are performed in real-time.

35. The logic of claim 32, wherein the operations further comprise:

logging information about the host content change request.

36. The logic of claim 35, wherein the operations further comprise:

filtering the host content change request to prevent logging the host content change request if the host content change request is non-material.

37. The logic of claim 36, wherein the host content change request is non-material if the host content change request includes one or more of:

creation of specified registry entries;

modification of specified registry entries; and

creation, deletion, or modification of temporary objects.

38. The logic of claim 35, wherein the operations further comprise:

obtaining a log representing a set of host content change requests;

comparing the log to a set of approved change orders for any one or more of a plurality of persistent objects on the host;

identifying at least one correlation between the set of host content change requests and the set of approved change orders; and

providing user-readable data representing the at least one correlation.

39. A host, comprising:

a memory element for storing a set of change authorization policies; and

a processor operable to execute instructions associated with a management module, including;

intercepting a host content change request indicating a change to a persistent object on the host;

determining whether the change is authorized, as indicated by the set of change authorization policies;

allowing the change to take effect when the change is authorized; and

blocking the change from taking effect when the change is not authorized,

wherein the set of change authorization policies is configurable to define whether the persistent object can be changed.

40. The host of claim 39, wherein at least one policy of the set of change authorization policies is selected from the group consisting of:

a set of persistent objects that can be changed without restriction;

a set of users, programs or entities that can make changes to a specified set of persistent objects; and

a set of users, programs or entities that can make changes to the specified set of persistent objects during one or more specified time windows.

41. The host of claim 39, wherein the instructions associated with the management module further include:

logging information about the host content change request.

42. The host of claim 41, wherein the instructions associated with the management module further include:

filtering the host content change request to prevent logging the host content change request if the host content change request is non-material.

43. The host of claim 42, wherein the host content change request is non-material if the host content change request includes one or more of:

creation of specified registry entries;

modification of specified registry entries; and

creation, deletion, or modification of temporary objects.

44. A method, comprising:

obtaining a log representing a set of change requests for at least one persistent object of a plurality of persistent objects on a host;

comparing the log to a set of approved change orders for any one or more of the plurality of persistent objects;

identifying one or more correlations between the set of change requests and the set of approved change orders; and

providing user-readable data representing the one or more correlations.

45. The method of claim 44, wherein at least one of the one or more correlations is selected from a group of correlations, the group consisting of:

a change request that corresponds to one or more approved change orders;

a change request that does not correspond to any approved change orders;

an approved change order that corresponds to one or more change requests; and

an approved change order that does not correspond to any change requests.

46. The method of claim 44, wherein at least one change request was blocked in response to a set of authorization policies indicating that the at least one change request was not authorized.

47. The method of claim 44, wherein at least one change request was executed resulting in a deployed change to the at least one persistent object, wherein the execution occurred in response to a set of authorization policies indicating that the at least one change request was authorized.

48. The method of claim 44, wherein the user-readable data indicates whether the one or more correlations include a change request that was executed resulting in a deployed change to one of the persistent objects.

49. The method of claim 44, wherein the user-readable data is a display generated on a display device.

50. Logic encoded in one or more computer readable media that includes code for execution and when executed by a processor is operable to perform operations comprising:

obtaining a log representing a set of change requests for at least one persistent object of a plurality of persistent objects on a host;

comparing the log to a set of approved change orders for any one or more of the plurality of persistent objects;

identifying one or more correlations between the set of change requests and the set of approved change orders; and

providing user-readable data representing the one or more correlations.

51. The logic of claim 50, wherein at least one of the one or more correlations is selected from a group of correlations, the group consisting of:

a change request that corresponds to one or more approved change orders;

a change request that does not correspond to any approved change orders;

an approved change order that corresponds to one or more change requests; and

an approved change order that does not correspond to any change requests.

52. The logic of claim 50, wherein at least one change request was blocked in response to a set of change authorization policies indicating that the at least one change request was not authorized.

53. The logic of claim 50, wherein at least one change request was executed resulting in a deployed change to the at least one persistent object, wherein the execution occurred in response to a set of change authorization policies indicating that the at least one change request was authorized.

54. The logic of claim 50, wherein the user-readable data indicates whether the one or more correlations include a change request that was executed resulting in a deployed change to one of the persistent objects.

55. A host, comprising:

a memory element configured to store a log representing a set of change requests for at least one persistent object of a plurality of persistent objects on a host; and

a processor operable to execute instructions associated with a reconciliation module, including;

obtaining the log representing the set of change requests;

comparing the log to a set of approved change orders for any one or more of the plurality of persistent objects;

identifying one or more correlations between the set of change requests and the set of approved change orders; and

providing user-readable data representing the one or more identified correlations.

56. The host of claim 55, wherein at least one of the one or more correlations is selected from a group of correlations, the group consisting of:

a change request that corresponds to one or more approved change orders;

a change request that does not correspond to any approved change orders;

an approved change order that corresponds to one or more change requests; and

an approved change order that does not correspond to any change requests.

57. The host of claim 55, wherein at least one change request was blocked in response to a set of change authorization policies indicating that the at least one change request was not authorized.

58. The host of claim 55, wherein at least one change request was executed resulting in a deployed change to the at least one persistent object, wherein the execution occurred in response to a set of change authorization policies indicating that the at least one change request was authorized.

59. The host of claim 55, wherein the user-readable data indicates whether the one or more correlations include a change request that was executed resulting in a deployed change to one of the persistent objects.