INFORMATION TECHNOLOGY GOVERNANCE AND CONTROLS METHODS AND APPARATUSES

• US 20120222112A1
• Filed: 05/07/2012
• Published: 08/30/2012
• Est. Priority Date: 08/09/2005
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: DiFalco, Robert A., Keeler, Kenneth L., Warmack, Robert L.
• Granted Patent: US 9,256,841 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 16/128 Details of file system snapshots on the file-level, e.g. snapshot creation, administration, deletion use of snapshots for error detection or correction G06F11/14, G06F11/16
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 10/0637 Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Embodiments of the present invention provide methods and systems for automated change audit of an enterprise'"'"'s IT infrastructure, including independent detection of changes, reconciliation of detected changes and independent reporting, to effectuate a triad of controls on managing changes within the IT infrastructure, preventive controls, detective controls and corrective controls.

Claims

1-14. -14. (canceled)

15. A computer-readable storage device storing computer-executable instructions, which when executed by a computer cause the computer to perform a method, the method comprising:

detecting a change to an element at a data processing node by comparing a current state of the element to a baseline state of the element, the data processing node being a data processing node within an information technology (IT) infrastructure, the change being a change to a configuration of the data processing node or a change to a file at the data processing node;

determining whether the change conforms to a conformance authority, the conformance authority comprising guidelines that define changes as conforming or nonconforming;

if the change is a conforming change, updating the baseline state of the element to the current state; and

if the change is a non-conforming change, generating an alert reporting the change.

16. The computer-readable storage device of claim 15, wherein the conformance authority defines changes as conforming or nonconforming according to a government regulation or law.

17. The computer-readable storage device of claim 15, wherein the conformance authority defines changes as conforming or nonconforming according to a standard established by a standards organization.

18. The computer-readable storage device of claim 17, wherein the standard is a payment card industry data security standard.

19. The computer-readable storage device of claim 15, wherein the detecting the change is performed by a change detection agent at the data processing node.

20. The computer-readable storage device of claim 15, wherein the method further comprises, if the change is a non-conforming change, reverting the element of the data processing node back to a baseline state.

21. The computer-readable storage device of claim 15, wherein the method further comprises, if the change is a non-conforming change, associating a severity state with the change, and wherein the alert includes the severity state.

22. The computer-readable storage device of claim 15, wherein the alert includes one or more of an identification of a user who made the change or an identification of a guideline that was violated by the change.

23. The computer-readable storage device of claim 15, wherein the method further comprises adding the change to an event log storing changes detected throughout the information technology (IT) infrastructure.

24. The computer-readable storage device of claim 15, wherein the method further comprises generating a change report reporting changes detected in the information technology (IT) infrastructure, including the change at the data processing node.

25. The computer-readable storage device of claim 15, wherein the method further comprises generating a change report reporting changes detected in the information technology (IT) infrastructure, including the change at the data processing node.

26. The computer-readable storage device of claim 25, wherein the change report includes an identification of one or more of a number of changes detected, dates of the changes detected, times of the changes detected, operators associated with the changes detected, or permissions related to the operators associated with the changes detected.

27. A method, comprising:

detecting a change to an element at a data processing node by comparing a current state of the element to a baseline state of the element, the data processing node being a data processing node within an information technology (IT) infrastructure, the change being a change to a configuration of the data processing node or a change to a file at the data processing node;

determining whether the change conforms to a conformance authority, the conformance authority comprising guidelines that define changes as conforming or nonconforming;

if the change is a conforming change, updating the baseline state of the element to the current state; and

if the change is a non-conforming change, generating an alert reporting the change.

28. The method of claim 27, wherein the conformance authority defines changes as conforming or nonconforming according to a government regulation or law, or according to a standard established by a standards organization.

29. The method of claim 27, wherein the method further comprises, if the change is a non-conforming change, reverting the element of the data processing node back to a baseline state.

30. The method of claim 27, wherein the method further comprises, if the change is a non-conforming change, associating a severity state with the change, and wherein the alert includes the severity state.

31. The method of claim 27, wherein the alert includes one or more of an identification of a user who made the change or an identification of a guideline that was violated by the change.

32. The method of claim 27, wherein the method further comprises adding the change to an event log storing changes detected throughout the information technology (IT) infrastructure.

33. The method of claim 27, wherein the method further comprises generating a change report for changes detected in the information technology (IT) infrastructure, including the change at the data processing node, the change report including one or more of an identification of one or more of a number of changes detected, dates of the changes detected, times of the changes detected, operators associated with the changes detected, or permissions related to the operators associated with the changes detected.

34. A system, comprising:

means for detecting a change to an element at a data processing node by comparing a current state of the element to a baseline state of the element, the data processing node being a data processing node within an information technology (IT) infrastructure, the change being a change to a configuration of the data processing node or a change to a file at the data processing node;

means for determining whether the change conforms to a conformance authority, the conformance authority comprising guidelines for defining changes as conforming or nonconforming, and, if the change is a conforming change, updating the baseline state of the element to the current state if the change, but, if the change is a non-conforming change, generating an alert reporting the change.