METHOD AND APPARATUS FOR CONTINUOUS COMPLIANCE ASSESSMENT

• US 20100005107A1
• Filed: 07/03/2008
• Published: 01/07/2010
• Est. Priority Date: 07/03/2008
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: DiFalco, Robert A.
• Granted Patent: US 8,914,341 B2
• Time in Patent Office: Days
• US Class Current: 707/100
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: H04L 43/50 Testing arrangements

Abstract

Methods, systems, and articles for receiving, by a compliance server, change data associated with a change captured on a target host, are described herein. In various embodiments, the target host may have provided the change data in response to detecting the change, and the change data may include one or more rules, settings, and/or parameters. Also, in various embodiments, the compliance server may determine whether the one or more rules, settings, and/or parameters meet one or more compliance policies and generate one or more test results based at least on the results of the determining. Further, in some embodiments, the target host may detect a change to a rule, setting, and/or parameter based on a collection policy defining what change data is to be collected by the target host and provide data associated with the rule, setting, and/or parameter as change data to the compliance server.

Claims

1. A method comprising:

receiving, by a compliance server, change data associated with a change captured on a target host, the target host providing the change data in response to detecting the change, wherein the change data includes one or more rules, settings, and/or parameters;

determining, by the compliance server, whether the one or more rules, settings, and/or parameters meet one or more compliance policies; and

generating, by the compliance server, one or more test results based at least on the results of the determining.

2. The method of claim 1, further comprising storing, by the compliance server, the received change data in a change database.

3. The method of claim 1, further comprising:

in response to receiving the change data, generating, by the compliance server, an event; and

performing said determining in response to the generated event.

4. The method of claim 1, wherein the change data includes a rule that generated the change, the target host or node from which the change data was collected, a specific element name associated with the change, and element data associated with the change.

5. The method of claim 1, wherein each compliance policy includes one or more of a rule, a change name, one or more waivers from the policy, and an expression for evaluating element data of the change.

6. The method of claim 1, further comprising filtering, by the compliance server, the received change data and conditionally performing the determining based on a result of the filtering.

7. The method of claim 6, wherein the filtering includes one or more of

comparing a first rule specified in the change data with a second rule specified in the one or more compliance policies,

determining whether a target host or node specified in the change data is associated with one or more waivers specified by the one or more compliance policies, or

comparing an element name specified in the change data with a name specified in the one or more compliance policies.

8. The method of claim 1, wherein the determining comprises evaluating an expression of at least one of the compliance policies against element data specified in the change data.

9. The method of claim 1, wherein the generating the one or more test results comprises generating a report to the target host and/or an administrative user.

10. The method of claim 1, further comprising receiving or retrieving, by the compliance server, new or updated compliance policies.

11. The method of claim 1, further comprising repeating the receiving, determining, and generating in real time each time the target host captures an additional change.

12. A compliance server comprising:

a processor;

a change database for storing change data associated with a change captured on a target host, the target host providing the change data in response to detecting the change, wherein the change data includes one or more rules, settings, and/or parameters; and

logic communicatively coupled to the change database and to be operated by the processor to;

receive the change data;

store the change data in the change database;

determine whether the one or more rules, settings, and/or parameters meet one or more compliance policies; and

generate one or more test results based at least on the results of the determining.

13. The compliance server of claim 12, wherein the logic is further to:

in response to receiving the change data, generate an event; and

perform said determine in response to the generated event.

14. The compliance server of claim 12, further comprising an event listener to listen for the generated event.

15. The compliance server of claim 12, wherein the compliance policies ensure that the target host is in compliance with one or more standards.

16. The compliance server of claim 12, wherein the logic is further to filter the received change data and conditionally perform the determining based on a result of the filtering.

17. The compliance server of claim 12, wherein the logic is further to evaluate an expression of at least one of the compliance policies against element data specified in the change data.

18. An article of manufacture comprising:

a storage medium; and

a plurality of programming instructions stored on the storage medium and configured to program a target host to;

detect a change to a rule, setting, or parameter based on a collection policy defining what change data is to be collected by the target host; and

provide data associated with the rule, setting, or parameter as change data to a compliance server, the compliance server to determine whether the rule, setting, and/or parameter meet one or more compliance policies.

19. The article of claim 18, wherein the plurality of programming instruction are configured to repeat the detecting and providing each time a change occurs on the target host.

20. The article of claim 18, wherein the plurality of programming instruction are configured to receive a report from the compliance server including one or more test results based at least on the results of the determining by the compliance server.

21. The article of claim 18, wherein the collection policy defines a scope of what change data is to be collected, and for which elements of the target host.