Out-of-band change detection

• US 7,765,460 B2
• Filed: 06/29/2005
• Issued: 07/27/2010
• Est. Priority Date: 06/29/2005
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: DiFalco, Robert A., Warmack, Robert L., Keeler, Kenneth L.
• Primary Examiner(s): Abraham; Esaw T
• Application Number:
  US11/171,096
• Publication Number:
  US 20070022365A1
• Time in Patent Office: 1,854 Days
• Field of Search: 714/758, 714/799, 714/805, 714/818, 714/819
• US Class Current: 714/799
• CPC Class Codes: G06F 8/60 Software deployment

Abstract

An automated method for facilitating management of a data processing environment is disclosed. In various embodiments, the method may include facilitating creation of a first memorialization, in digital form, of one or more changes detected on a data processing device of the data processing environment. In various embodiments, the method may further included facilitating comparison of the first memorialization to a second memorialization of one or more in-band changes that should have been made to the data processing device to facilitate detection of one or more out-of-band changes to the data processing device. Other embodiments of the present invention may include, but are not limited to, apparatus adapted to facilitate practice of the above-described method.

Claims

1. An automated method for facilitating management of a data processing environment comprising:

creating, by a computer system, a first digital record of one or more changes detected on a data processing device of the data processing environment;

comparing, by the computer system, the first digital record to a second digital record of one or more in-band changes that were intended to have been made to the data processing device, the in-band changes comprising changes which were known by a change agent; and

detecting, by the computer system, one or more out-of-band changes to the data processing device which were not known by the change agent, the detecting based at least in part on the comparing the first and second digital records.

2. The method of claim 1, wherein said detecting one or more out-of-band changes comprises determining a subset of changes of the first digital record not included in the second digital record.

3. The method of claim 1, wherein said creating comprises:

automatically comparing a first state of the data processing device to a second state of the data processing device; and

creating a first file of first one or more records of the one or more detected changes to the data processing device.

4. The method of claim 3, wherein the second state is a current baseline state of the data processing device, and the method further comprises obtaining the first state of the data processing device.

5. The method of claim 3, wherein the second digital record comprises a second file of second one or more records of the one or more in-band changes that were intended to have been made to the data processing device, and said comparing the first digital record to the second digital record comprises automatically comparing the first file of first one or more records to the second file of second one or more records.

6. The method of claim 1, wherein said detecting comprises correlating a first change to a software of the data processing device in the first digital record to one of the one or more in-band changes in the second digital record, the second digital record having been created by a vendor of the software.

7. The method of claim 1, wherein said detecting comprises correlating a first change to data of the data processing device in the first digital record to one of the one or more in-band changes in the second digital record, the second digital record having been created by a vendor owner of the data.

8. The method of claim 1, wherein the method further comprises defining, in digital form, one or more responses to the one or more detected out-of-band changes.

9. The method of claim 8, wherein the one or more responses include an automatic remediation or alert response to at least one of the one or more detected out-of-band changes.

10. The method of claim 8, wherein the one or more responses include a no-action automatic approval response to at least one of the one or more detected out-of-band changes.

11. The method of claim 1, wherein said comparing comprises determining whether all of the in-band changes have been made to the data processing device.

12. The method of claim 11, wherein the method further comprises updating a baseline state of the data processing device to include in-band changes that indeed have been made to the data processing device.

13. The method of claim 1, wherein the change agent comprises a software distribution or updating agent.

14. The method of claim 1, where the change agent comprises a data change agent.

15. The method of claim 1, where the change agent comprises an access rights management agent.

16. The method of claim 1, wherein the creating and the comparing are first performed at a first point in time, and the method further comprises repeating the creating and the comparing at least once, at a second later point in time.

17. The method of claim 16, further comprising scheduling the repeating of the creating and the comparing at the second later point in time.

18. The method of claim 1, wherein the data processing device is a device selected from the group consisting of a networking device, a server, a desktop computer, a laptop computer, a tablet computer, a personal digital assistant, a cellular phone, a set top box, and a media player.

19. The method of claim 1, further comprising using the detected one or more out-of-band changes to maintain or demonstrate control of an enterprise'"'"'s information technology infrastructure.

20. The method of claim 1, further comprising using the detected one or more out-of-band changes to maintain or demonstrate control of an enterprise'"'"'s financial systems or data.

21. The method of claim 1, further comprising using the detected one or more out-of-band changes to maintain or demonstrate control of an enterprise'"'"'s business processes.

22. The method of claim 1, further comprising using the detected one or more out-of-band changes to audit an enterprise to audit an enterprise.

23. The method of claim 22, wherein using the detected one or more out-of-band changes to audit an enterprise comprises providing an audit trail for an audit.

24. The method of claim 1, using the detected one or more out-of-band changes to facilitate compliance with governmental laws/regulations regarding establishment and maintenance of an internal control structure and/or procedures for financial reporting.

25. An apparatus Comprising:

a storage device having stored therein instructions that, when executed on a computer processor, cause the processor to perform a method comprising;

creating a first digital record of one or more changes detected on a data processing device; and

comparing the first digital record to a second digital record of one or more in-band changes that were intended to have been made to the data processing device, the in-band changes comprising changes which were known by a change agent;

detecting one or more out-of-band changes to the data processing device which were not known by the change agent, the detecting based at least in part on the comparing the first and second digital records.

26. The apparatus of claim 25, wherein the method further comprises determining whether any of the detected changes of the first digital record is not included in the second digital record.

27. The apparatus of claim 25, wherein the method further comprises:

comparing a first state of the data processing device to a second state of the data processing device; and

creating a first file of first one or more records of the application of the first one or more changes to the data processing device.

28. The apparatus of claim 27, wherein the second digital record comprises a second file of second one or more records of the one or more in-band changes that were intended to have been made to the data processing device, and wherein to the method further comprises automatically comparing the first file of first one or more records to the second file of second one or more records.

29. The apparatus of claim 27, wherein the method further comprises obtaining the first and/or second state of the data processing device.

30. The apparatus of claim 29, wherein the method further comprises obtaining the first state of the data processing device using a client portion downloadable onto the data processing device.

31. The apparatus of claim 25, wherein the method further comprises defining one or more responses to the one or more detected out-of-band changes.

32. The apparatus of claim 31, wherein the one or more responses include an automatic remediation or alert response to at least one of the one or more detected out-of-band changes.

33. The apparatus of claim 31, wherein the one or more responses include a no-action automatic approval response to at least one of the one or more detected out-of-band changes.

34. The apparatus of claim 25, wherein the method further comprises determining whether all of the in-band changes have been made to the data processing device.

35. The apparatus of claim 34, wherein the method further comprises updating a baseline state of the data processing device to include in-band changes that have been made.

36. The apparatus of claim 25, wherein the apparatus comprises one or more servers to store and/or execute the instructions.

37. The apparatus of claim 25, wherein the method further comprises using the detected one or more out-of-band changes to maintain or demonstrate control of one or more selected from the group consisting of an enterprise'"'"'s information technology infrastructure, an enterprise'"'"'s financial systems, an enterprise'"'"'s financial data, and an enterprise'"'"'s business processes.