Methods and apparatus for remediation workflow

• US 8,819,491 B2
• Filed: 09/16/2011
• Issued: 08/26/2014
• Est. Priority Date: 09/16/2011
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Whitlock, David, Gascoigne-Piggford, Guy, Granum, Geoff, Petrie, Mark
• Primary Examiner(s): Baderman, Scott
• Assistant Examiner(s): KUDIRKA, JOSEPH R
• Application Number:
  US13/235,189
• Publication Number:
  US 20130073893A1
• Time in Patent Office: 1,075 Days
• Field of Search: 714/4.1, 714/33, 714/37, 714/47.1
• US Class Current: 714/33
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/26 Functional testing
• CPC Class Codes: G06Q 10/0631 Resource planning, allocation, distributing or scheduling for enterprises or organisations

Abstract

Disclosed herein are methods, systems, and articles associated with remediation workflow. A method may include determining one or more test failures related to a policy test within a computer network, and reviewing the one or more test failures. The method may further include, based upon a result of the reviewing, creating a remediation work order that includes at least one of the one or more test failures. Each test failure within the remediation work order may be approved or denied. For each test failure that is approved for remediation, a remediation process may be executed.

Claims

1. A method, comprising:

analyzing or facilitating analyzing, by a computing device, one or more test failures related to one or more policy tests within a computer network;

based upon a result of the analyzing of the one or more test failures, creating or facilitating creating, by the computing device, a remediation work order that specifies the one or more test failures;

reviewing or facilitating reviewing, by the computing device, each test failure specified within the remediation work order to approve or deny remediation for the test failure; and

executing or facilitating executing, by the computing device, for each test failure that is approved for remediation, a remediation process that corresponds to the particular test failure that is approved for remediation,

wherein the reviewing or facilitating reviewing comprises denying remediation for a respective one of the test failures because the respective one of the test failures is associated with an application that is being upgraded or an application that is subject to a change order.

2. The method of claim 1, further comprising:

determining or facilitating determining, by the computing device, the one or more test failures as being related to the one or more policy tests within the computer network.

3. The method of claim 1, wherein facilitating analyzing comprises facilitating a compliance entity, facilitating reviewing comprises facilitating a change approval entity, and facilitating executing comprises facilitating a remediation entity.

4. The method of claim 3, wherein the change approval entity comprises a change approval board that comprises two or more persons.

5. The method of claim 1, wherein the remediation process comprises one or more remediation scripts.

6. The method of claim 1, further comprising:

commenting or facilitating commenting, by the computing device, as to why a test failure should be remediated.

7. The method of claim 1, further comprising:

excluding or facilitating excluding, by the computing device, a test failure from the remediation work order.

8. The method of claim 1, further comprising:

commenting or facilitating commenting, by the computing device, as to why a test failure is approved or denied.

9. The method of claim 1, further comprising:

assigning or facilitating assigning, by the computing device, a remedial approval identification (ID) to a remediation work order.

10. The method of claim 1, further comprising:

upon completion of all remediation processes within a work order, transitioning or facilitating transitioning, by the computing device, the remediation work order to a complete state.

11. The method of claim 10, further comprising:

based upon transitioning the remediation work order to a complete state, closing or facilitating closing, by the computing device, the remediation work order.

12. The method of claim 11, further comprising:

storing, by the computing device, the remediation work order after closing the remediation work order so that the remediation work order is available for future reference.

13. The method of claim 12, further comprising:

retrieving or facilitating retrieving, by the computing device, a stored remediation work order for future review.

14. The method of claim 1, further comprising:

upon approving or denying each test failure within the remediation work order, deferring or facilitating deferring, by the computing device, to be remediated later, at least one test failure that is approved for remediation; and

upon completion of all remediation processes within a work order, transitioning or facilitating transitioning, by the computing device, the remediation work order to a complete state.

15. An article of manufacture, comprising:

a non-transitory computer-readable storage medium; and

a plurality of programming instructions stored on the computer readable storage medium and configured to enable one or more computing devices, in response to execution of a programming instruction, to perform operations including;

obtaining or facilitating obtaining, one or more test failures related to one or more policy tests within a computer network;

creating or facilitating creating, a remediation work order that includes the one or more test failures;

approving or facilitating approving, at least one of the one or more test failures of the remediation order, for remediation;

executing or facilitating executing, for each test failure that is approved for remediation, a remediation process that corresponds to a particular test failure that is approved for remediation;

denying remediation for a respective one of the test failures because the respective one of the test failures is associated with an application that is being upgraded or is subject to a change order.

16. The article of manufacture of claim 15, wherein facilitating obtaining comprises facilitating obtaining by a compliance entity, facilitating approving comprises facilitating approval by a change approval entity, and facilitating executing comprises facilitating executing by a remediation entity.

17. The article of manufacture of claim 16, wherein the change approval entity comprises a change approval board that comprises two or more persons.

18. The article of manufacture of claim 15, wherein the remediation process comprises one or more remediation scripts.

19. The article of manufacture of claim 15, wherein the operations further comprise:

excluding or facilitating excluding a test failure from the remediation work order.

20. The article of manufacture of claim 15, wherein the operations further comprise:

assigning or facilitating assigning a remediation approval identification (ID) to the remediation work order.

21. The article of manufacture of claim 20, wherein the operations further comprise:

upon completion of all the remediation processes within a work order, transitioning or facilitating transitioning the remediation work order to a complete state.

22. The article of manufacture of claim 21, wherein the operations further comprise:

based upon transitioning the remediation work order to a complete state, closing or facilitating closing the remediation work order.

23. The article of manufacture of claim 22, wherein the operations further comprise:

storing or facilitating storing the remediation work order after closing the remediation work order so that the remediation work order is available for future reference.

24. A method, comprising:

analyzing or facilitating analyzing, by a computing device, one or more test failures related to one or more policy tests within a computer network;

based upon a result of the analyzing of the one or more test failures, creating or facilitating creating, by the computing device, a remediation work order that specifies the one or more test failures;

reviewing or facilitating reviewing, by the computing device, each test failure specified within the remediation work order to approve or deny remediation for the test failure; and

executing or facilitating executing, by the computing device, for each test failure that is approved for remediation, a remediation process that corresponds to the particular test failure that is approved for remediation,

wherein the reviewing or facilitating reviewing comprises denying remediation for a respective one of the test failures because remediation would disable one or more applications needed for security.

25. An article of manufacture, comprising:

a non-transitory computer-readable storage medium; and

a plurality of programming instructions stored on the computer readable storage medium and configured to enable one or more computing devices, in response to execution of a programming instruction, to perform operations including;

obtaining or facilitating obtaining, one or more test failures related to one or more policy tests within a computer network;

creating or facilitating creating, a remediation work order that includes the one or more test failures;

approving or facilitating approving, at least one of the one or more test failures of the remediation order, for remediation;

executing or facilitating executing, for each test failure that is approved for remediation, a remediation process that corresponds to a particular test failure that is approved for remediation; and

denying remediation for a respective one of the test failures because remediation would disable one or more applications needed for security.