Automated Validation of Configuration and Compliance in Cloud Servers

• US 20130247136A1
• Filed: 03/14/2012
• Published: 09/19/2013
• Est. Priority Date: 03/14/2012
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chieu, Trieu C., Shaikh, Anees A., Tang, Chunqiang, Viswanathan, Mahesh, Dutta, Shantanu, Gupta, Ashu, McKay, Angela, Prysock, Bob, Ramaratnam, Ratnasagar, Singh, Manas
• Application Number:
  US13/419,591
• Publication Number:
  US 20130247136A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 9/5072 Grid computing

Abstract

A method, an apparatus and an article of manufacture for automated validation of compliance in a cloud server. The method includes remotely accessing a target cloud server to discover at least one configuration setting of the target cloud server, integrating the at least one configuration setting from the target cloud server with information from at least one back-end tool to produce compliance evidence, and automatically answering a set of at least one checklist question for activation compliance validation of the target cloud server based on the compliance evidence.

Claims

1. A method for automated validation of compliance in a cloud server, wherein the method comprises:

remotely accessing a target cloud server to discover at least one configuration setting of the target cloud server, wherein said accessing comprises utilizing at least one set of executable scripts to discover the at least one configuration setting in the target cloud server, and wherein each set of executable scripts corresponds to one of a given operating system and a given set of software;

integrating the at least one configuration setting from the target cloud server with information from at least one back-end tool to produce compliance evidence; and

automatically answering a set of at least one checklist question for activation compliance validation of the target cloud server based on the compliance evidence;

wherein at least one of the steps is carried out by a computer device.

2. The method of claim 1, further comprising:

eliminating an interference between independent operating and middleware scripts at runtime based on one or more identified exceptions.

3. The method of claim 1, further comprising:

receiving a server activation request from a user.

4. The method of claim 1, further comprising:

storing the at least one checklist question for activation compliance validation of the target cloud server with corresponding supporting evidence in a checklist repository.

6. The method of claim 1, wherein the at least one set of executable scripts are managed in a local database and can be retrieved and packaged on-demand to be remotely executed in the target cloud server.

7. The method of claim 1, wherein the at least one set of executable scripts are executed in a managed server to discover the at least one configuration setting for a required security policy.

8. The method of claim 1, wherein the at least one set of executable scripts are used to discover the at least one configuration setting for multiple platforms.

9. The method of claim 1, wherein the at least one set of executable scripts comprise at least one set of standardized middleware scripts, and the at least one set of standardized middleware scripts are used to discover the at least one configuration setting for different middleware software.

10. The method of claim 1, wherein remotely accessing a target cloud server comprises retrieving a public key string of an automation engine and installing the public key into a virtual machine to allow shared access to the virtual machine.

11. The method of claim 1, wherein the at least one back-end tool comprises at least one of a provisioning component, an issue and risk management database, an asset management database, an identity management database, a security management database, and an incident management database.

5. (canceled)

12. An article of manufacture comprising a computer readable storage medium having computer readable instructions tangibly embodied thereon which, when implemented, cause a computer to carry out a plurality of method steps comprising:

remotely accessing a target cloud server to discover at least one configuration setting of the target cloud server, wherein said accessing comprises utilizing at least one set of executable scripts to discover the at least one configuration setting in the target cloud server, and wherein each set of executable scripts corresponds to one of a given operating system and a given set of software;

integrating the at least one configuration setting from the target cloud server with information from at least one back-end tool to produce compliance evidence; and

automatically answering a set of at least one checklist question for activation compliance validation of the target cloud server based on the compliance evidence.

13. The article of manufacture of claim 12, wherein the computer readable instructions which, when implemented, further cause a computer to carry out a method step comprising:

eliminating an interference between independent operating and middleware scripts at runtime based on one or more identified exceptions.

15. The article of manufacture of claim 12, wherein the at least one set of executable scripts are managed in a local database and can be retrieved and packaged on-demand to be remotely executed in the target cloud server.

16. The article of manufacture of claim 12, wherein the at least one set of executable scripts are executed in a managed server to discover the at least one configuration setting for a required security policy.

17. The article of manufacture of claim 12, wherein the at least one set of executable scripts comprise at least one set of standardized middleware scripts, and the at least one set of standardized middleware scripts are used to discover the at least one configuration setting for different middleware software.

18. The article of manufacture of claim 12, wherein the at least one back-end tool comprises at least one of a provisioning component, an issue and risk management database, an asset management database, an identity management database, a security management database, and an incident management database.

14. (canceled)

19. A system for automated validation of compliance in a cloud server, comprising:

at least one distinct software module, each distinct software module being embodied on a tangible computer-readable medium;

a memory; and

at least one processor coupled to the memory and operative for;

remotely accessing a target cloud server to discover at least one configuration setting of the target cloud server, wherein said accessing comprises utilizing at least one set of executable scripts to discover the at least one configuration setting in the target cloud server, and wherein each set of executable scripts corresponds to one of a given operating system and a given set of software;

integrating the at least one configuration setting from the target cloud server with information from at least one back-end tool to produce compliance evidence; and

automatically answering a set of at least one checklist question for activation compliance validation of the target cloud server based on the compliance evidence.

20. The system of claim 19, wherein the at least one processor coupled to the memory is further operative for:

eliminating an interference between independent operating and middleware scripts at runtime based on one or more identified exceptions.

22. The system of claim 19, wherein the at least one set of executable scripts are managed in a local database and can be retrieved and packaged on-demand to be remotely executed in the target cloud server.

23. The system of claim 19, wherein the at least one set of executable scripts are executed in a managed server to discover the at least one configuration setting for a required security policy.

24. The system of claim 19, wherein the at least one set of executable scripts comprise at least one set of standardized middleware scripts, and the at least one set of standardized middleware scripts are used to discover the at least one configuration setting for different middleware software.

25. The system of claim 19, wherein the at least one back-end tool comprises at least one of a provisioning component, an issue and risk management database, an asset management database, an identity management database, a security management database, and an incident management database.

21. (canceled)