METHODS AND APPARATUS FOR REMEDIATING POLICY TEST FAILURES, INCLUDING PROMOTING CHANGES FOR COMPLIANCE REVIEW

• US 20130073704A1
• Filed: 09/16/2011
• Published: 03/21/2013
• Est. Priority Date: 09/16/2011
• Status: Abandoned Application

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Whitlock, David, Gascoigne-Piggford, Guy, Granum, Geoff, Petrie, Mark, Gilroy, Darren
• Application Number:
  US13/235,163
• Publication Number:
  US 20130073704A1
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06F 11/3692 for test results analysis
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 43/50 Testing arrangements

Abstract

Disclosed herein are methods, systems, and articles for promoting changes that result from remediation performed within a computer network, for compliance review. Policy tests may be provided within the computer network, which comprises a number of nodes. The policy tests may relate to configuration parameters and compliance requirements for various nodes within the computer network. At least one pattern relating to nodes within the computer network that may be affected by execution of a remediation script is determined. Nodes within the computer network may be identified, based at least in part on the at least one pattern. Subsequent to execution of the remediation script, a list of nodes whose state has changed may be promoted for compliance review.

Claims

1. A method comprising:

determining, by a computing device, at least one pattern relating to nodes within a computer network that can be affected by execution of a remediation script, wherein the remediation script is to be executed by one or more nodes, in response to a failure of one of a plurality of policy tests performed on the computer network;

identifying, by the computing device, one or more nodes within the computer network, based at least the at least one pattern; and

based upon the at least one pattern, promoting for compliance review, by the computing device, the one or more nodes identified whose state has changed after execution of remediation script.

2. The method of claim 1, further comprising:

determining, by the computing device, a pre-remediation state of each of the one or more nodes identified; and

subsequent to execution of the remediation script, determining, by the computing device, a post-remediation state of each of the one or more nodes identified.

3. The method of claim 2, further comprising:

based upon a result of the determining of a post-remediation state of each of the one or more nodes identified, compiling, by the computing device, a list of the one or more nodes identified whose state has changed.

4. The method of claim 1, wherein the nodes are promoted for compliance review, based upon a remediation approval identification (ID) or an ID of a remediation work order related to execution of the remediation script.

5. The method of claim 1, wherein the at least one pattern that is determined includes a node at which the failure occurred.

6. The method of claim 1, further comprising:

adding to the policy tests, by the computing device, information including operations required after execution of at least one remediation script at one or more nodes

7. The method of claim 6, further comprising:

based upon the information and subsequent to executing the remediation script, executing or causing to be executed the one or more operations within the computer network.

8. The method of claim 6, wherein the information includes one or more services that need to be started subsequent to execution of the remediation script, services that need to be stopped subsequent to execution of the remediation script, services that need to be re-started subsequent to execution of the remediation script, or nodes that need to be re-booted subsequent to execution of the remediation script.

9. The method of claim 6, wherein the information further includes identity of one or more nodes within the computer network that is affected by execution of the remediation script.

10. The method of claim 6, wherein the information includes one or more remediation scripts for execution by one or more nodes.

11. An article of manufacture comprising:

a non-transitory computer-readable storage medium; and

a plurality of programming instructions stored on the storage medium and configured to program one or more computing devices to enable the one or more computing devices, in response to execution of the programming instructions, to perform operations including;

determining at least one pattern of nodes within a computer network that can be affected by a remediation script, wherein the remediation script is to be executed by one or more nodes in response to a failure of one of a plurality of policy tests performed on the computer network;

identifying nodes within the computer network, based at least in part on the at least one pattern; and

based upon the at least one pattern, promoting for compliance review, the one or more nodes identified whose state has changed after execution of remediation script.

12. The article of manufacture of claim 11, wherein the operations further include:

determining a pre-remediation state of each of the one or more nodes identified; and

subsequent to execution of the remediation script, determining a post-remediation state of the nodes identified.

13. The article of manufacture of claim 12, further comprising:

based upon determining a post-remediation state of the nodes identified, compiling a list of the one or more nodes identified whose state has changed.

14. The article of manufacture of claim 11, wherein the nodes are promoted for compliance review, based upon a remediation approval identification of a remediation work order authorizing execution of the remediation script.

15. The article of manufacture of claim 11, wherein the at least one pattern that is determined includes a node at which the failure occurred.

16. The article of manufacture of claim 11, further comprising:

based upon information within the policy tests and subsequent to executing the remediation script, executing or causing to be executed one or more operations within the computer network.

17. The article of manufacture of claim 16, wherein the information includes one or more remediation scripts for execution by the one or more nodes.

18. The article of manufacture of claim 16, wherein the information includes one or more services that need to be started subsequent to execution of the remediation script, services that need to be stopped subsequent to execution of the remediation script, services that need to be re-started subsequent to execution of the remediation script or nodes that need to be re-booted subsequent to execution of the remediation script.

20. The apparatus of claim 11, wherein the programming instructions further enable the apparatus, in response to execution of the programming instructions, to:

determine a pre-remediation state of each of the one or more nodes identified; and

subsequent to execution of the remediation script, determine a post-remediation state of the nodes identified.

19. An apparatus comprising:

one or more processors; and

a non-transitory computer-readable storage medium coupled to the one or more processors, and having stored therein a plurality of programming instructions configured to enable the apparatus, in response to execution of the programming instructions, to;

determine at least one pattern of nodes within a computer network that can be affected by a remediation script, wherein the remediation script is to be executed by one or more nodes in response to a failure of one of a plurality of policy tests performed on the computer network;

identify nodes within the computer network, based at least in part on the at least one pattern; and

based upon the at least one pattern, promote for compliance review, the one or more nodes identified whose state has changed after execution of remediation script.