Audit Management System

• US 20120102543A1
• Filed: 10/24/2011
• Published: 04/26/2012
• Est. Priority Date: 10/26/2010
• Status: Abandoned Application

• Current Assignee: 360 GRC Incorporated
• Original Assignee: 360 GRC Incorporated
• Inventors: George, David A., Kohli, Ashwin, Tinagero, Kevin
• Application Number:
  US13/279,498
• Publication Number:
  US 20120102543A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computer implemented method and system for managing an audit of one or more network layer devices is provided. An audit management system accessible by a user via a graphical user interface acquires network layer device information of the network layer devices and a configuration file comprising configuration file commands. The audit management system allows creation and/or selection of one or more audit policies for the network layer devices. The audit policies comprise one or more audit rules that define functioning of the network layer devices for one or more compliance policies. The audit management system executes the audit policies for performing the audit of the network layer devices by comparing the configuration file commands of the configuration file with the audit rules of the audit policies, and generates a report comprising information about security and compliance of the network layer devices with the compliance policies based on the audit.

Claims

1. A computer implemented method for managing an audit of one or more network layer devices, comprising:

providing an audit management system accessible by a user via a graphical user interface;

acquiring network layer device information of said one or more network layer devices via said graphical user interface by said audit management system;

acquiring a configuration file comprising configuration file commands that define configuration of each of said one or more network layer devices, via said graphical user interface by said audit management system;

allowing one or more of creation and selection of one or more audit policies comprising one or more audit rules for said one or more network layer devices by said audit management system, wherein said one or more audit rules define functioning of said one or more network layer devices for one or more compliance policies;

executing said one or more audit policies for performing said audit of said one or more network layer devices by said audit management system; and

generating a report comprising information about security and compliance of said one or more network layer devices with said one or more compliance policies based on said execution of said one or more audit policies.

2. The computer implemented method of claim 1, wherein said one or more audit policies define an association of said one or more network layer devices with said one or more audit rules.

3. The computer implemented method of claim 1, wherein said execution of said one or more audit policies comprises comparing said configuration file commands of said configuration file with said one or more audit rules of said one or more audit policies for verifying said security and said compliance of said one or more network layer devices with said one or more compliance policies.

4. The computer implemented method of claim 1, wherein said one or more audit rules of said one or more audit policies comprise one of parent audit rules, child audit rules, and a combination thereof, wherein said audit management system selects one or more of said parent audit rules and said child audit rules for enabling a conditional audit of said one or more network layer devices.

5. The computer implemented method of claim 1, further comprising creating said one or more audit rules for said one or more audit policies by said audit management system, comprising:

identifying scope details from said network layer device information associated with said one or more network layer devices for selecting one or more of said network layer devices for said audit;

defining audit commands that correspond to said configuration file commands of said configuration file; and

creating one or more filter conditions for each of said audit commands, wherein said created one or more filter conditions specify criteria for finding a match between said configuration file commands of said configuration file and said one or more audit rules during said execution of said one or more audit policies, and wherein said audit commands with said created one or more filter conditions create said one or more audit rules for performing said audit of said selected one or more network layer devices.

6. The computer implemented method of claim 5, further comprising defining risk information for each of said selected one or more network layer devices when said match between said configuration file commands of said configuration file and said one or more audit rules is not found during said execution said one or more audit policies.

7. The computer implemented method of claim 5, further comprising defining a rule action associated with said one or more filter conditions of said one or more audit rules by said user via said graphical user interface, wherein said audit management system performs said rule action when said one or more filter conditions are met.

8. The computer implemented method of claim 1, further comprising selecting one or more of said audit rules to be excluded during said execution of said one or more audit policies comprising said audit rules, by said user via said graphical user interface.

9. The computer implemented method of claim 1, further comprising selecting one or more of said network layer devices to be excluded during said execution of said one or more audit policies by said user via said graphical user interface.

10. The computer implemented method of claim 1, further comprising grouping one or more of said audit rules within each of said one or more audit policies by said audit management system for optimizing said execution of said one or more audit policies.

11. The computer implemented method of claim 1, further comprising automatically selecting audit commands that match said network layer device information and said configuration file commands of said configuration file by said audit management system for creating said one or more audit rules for said one or more audit policies.

12. The computer implemented method of claim 1, further comprising:

performing a root cause analysis by said audit management system for determining cause of non-compliance of said one or more network layer devices with said one or more compliance policies on said execution of said one or more audit policies, wherein said non-compliance is determined on identifying disparities between said configuration file commands of said configuration file with said one or more audit rules of said one or more audit policies, and on identifying absence of one or more of said configuration file commands in said configuration file;

collecting risk information associated with said non-compliance by said audit management system, wherein said risk information comprises a risk rating that defines severity of said non-compliance;

assigning a non-compliance score as a measure of said non-compliance by said audit management system; and

generating recommendations for remediating said non-compliance and presenting said generated recommendations to said user by said audit management system via said graphical user interface.

13. The computer implemented method of claim 12, further comprising setting scope criteria based on scope details acquired from said network layer device information for said audit of said one or more network layer devices, identifying one or more of said one or more network layer devices that fail to match said scope criteria set for said audit, and notifying said user on said identified one or more network layer devices failing to match said scope criteria, during said performance of said root cause analysis by said audit management system.

14. The computer implemented method of claim 12, wherein said generated recommendations specify modes of adjusting, adding, and removing one or more of said one or more audit rules from said one or more audit policies.

15. The computer implemented method of claim 1, further comprising selectively extracting results of said audit of said one or more network layer devices by said audit management system based on ad-hoc queries associated with said one or more compliance policies and said network layer device information, received from said user via said graphical user interface.

16. The computer implemented method of claim 1, further comprising tracking said performance of said audit of said one or more network layer devices over a predetermined period of time by said audit management system, and presenting risks associated with non-compliance of said one or more network layer devices with said one or more compliance policies, steps for remediation of said risks, and trends analyzed from said audit of said one or more network layer devices by said audit management system to said user via said graphical user interface.

17. The computer implemented method of claim 1, wherein said creation of said one or more audit policies comprises identifying one or more of said one or more audit rules that apply commonly across said one or more compliance policies to generate a list of unique audit rules for said one or more audit policies.

18. The computer implemented method of claim 1, wherein said acquisition of said network layer device information of said one or more network layer devices by said audit management system comprises one or more of acquiring manual entries of said network layer device information from said user via said graphical user interface, extracting said network layer device information based on a simple network management protocol, and performing an interoperable gathering of said network layer device information from third party entities associated with said audit management system.

19. The computer implemented method of claim 1, wherein said acquisition of said configuration file by said audit management system comprises one or more of acquiring manual entries of said configuration file from said user via said graphical user interface, extracting said configuration file based on a simple network management protocol, and performing an interoperable gathering of said configuration file from third party entities associated with said audit management system.

20. The computer implemented method of claim 1, further comprising scheduling said acquisition of said network layer device information, said acquisition of said configuration file, said creation of said one or more audit policies, said execution of said one or more audit policies, said generation of said report comprising said information about said security and said compliance of said one or more network layer devices with said one or more compliance policies, and transmission of notifications on status of said audit by said audit management system based on input received from said user via said graphical user interface.

21. The computer implemented method of claim 1, further comprising monitoring changes in one or more of said network layer device information, said configuration file, and said one or more audit policies by said audit management system, and triggering said acquisition of said network layer device information, said acquisition of said configuration file, acquisition of input from said user for said creation of said one or more audit policies and scheduling of said execution of said one or more audit policies by said audit management system on detecting said changes in said network layer device information, said configuration file, and said one or more audit policies.

22. The computer implemented method of claim 1, wherein said generation of said report by said audit management system comprises one or more of highlighting, prioritizing, and filtering said information about said security and said compliance of said one or more network layer devices with said one or more compliance policies by said audit management system based on predetermined criteria, wherein said predetermined criteria comprise one or more of ratings of impact assessment, said network layer device information, assignment of said one or more network layer devices to said audit, exposure of said one or more network layer devices to potential intrusions, and categories of said one or more network layer devices.

23. A computer implemented system for managing an audit of one or more network layer devices, comprising:

an audit management system accessible to a user via a graphical user interface, wherein said audit management system comprises;

a device information acquisition module that acquires network layer device information of said one or more network layer devices via said graphical user interface;

a configuration file acquisition module that acquires a configuration file via said graphical user interface, wherein said configuration file comprises configuration file commands that define configuration of each of said one or more network layer devices;

an audit policy creation module that allows one or more of creation and selection of one or more audit policies comprising one or more audit rules for said one or more network layer devices, wherein said one or more audit rules define functioning of said one or more network layer devices for one or more compliance policies;

an audit policy execution module that executes said one or more audit policies for performing said audit of said one or more network layer devices; and

a report generation module that generates a report comprising information about security and compliance of said one or more network layer devices with said one or more compliance policies based on said execution of said one or more audit policies.

24. The computer implemented system of claim 23, wherein said audit policy execution module compares said configuration file commands of said configuration file with said one or more audit rules of said one or more audit policies during said execution of said one or more audit policies for verifying said security and said compliance of said one or more network layer devices with said one or more compliance policies.

25. The computer implemented system of claim 23, wherein said audit policy creation module creates said one or more audit rules for said one or more audit policies by:

identifying scope details from said network layer device information associated with said one or more network layer devices for selecting one or more of said network layer devices for said audit;

defining audit commands that correspond to said configuration file commands of said configuration file; and

creating one or more filter conditions for each of said audit commands, wherein said created one or more filter conditions specify criteria for finding a match between said configuration file commands of said configuration file and said one or more audit rules during said execution of said one or more audit policies, and wherein said audit policy creation module creates said one or more audit rules from said audit commands with said created one or more filter conditions for performing said audit of said selected one or more network layer devices.

26. The computer implemented system of claim 25, wherein said audit policy creation module enables definition of a rule action associated with said one or more filter conditions of said one or more audit rules by said user via said graphical user interface, and performs said rule action when said one or more filter conditions are met.

27. The computer implemented system of claim 23, wherein said audit management system further comprises a scheduling engine that schedules said acquisition of said network layer device information, said acquisition of said configuration file, said creation of said one or more audit policies, said execution of said one or more audit policies, said generation of said report comprising said information about said security and said compliance of said one or more network layer devices with said one or more compliance policies, and transmission of notifications on status of said audit based on input received from said user via said graphical user interface.

28. The computer implemented system of claim 23, wherein said audit management system further comprises a root cause analysis module that performs:

a root cause analysis for determining cause of non-compliance of said one or more network layer devices with said one or more compliance policies on said execution of said one or more audit policies, wherein said non-compliance is determined on identifying disparities between said configuration file commands of said configuration file with said one or more audit rules of said one or more audit policies, and on identifying absence of one or more of said configuration file commands in said configuration file; and

setting scope criteria based on scope details acquired from said network layer device information for said audit of said one or more network layer devices, identifying one or more of said one or more network layer devices that fail to match said scope criteria set for said audit, and notifying said user on said identified one or more network layer devices failing to match said scope criteria, during said performance of said root cause analysis.

29. The computer implemented system of claim 23, wherein said audit management system further comprises a risk management module that performs:

defining risk information for each of said selected one or more network layer devices when said match between said configuration file commands of said configuration file and said one or more audit rules is not found during said execution said one or more audit policies; and

collecting said risk information associated with non-compliance of said one or more network layer devices with said one or more compliance policies determined on said execution of said one or more audit policies, and assigning a non-compliance score as a measure of said non-compliance.

30. The computer implemented system of claim 23, wherein said audit management system further comprises a recommendation engine that generates recommendations for remediating said non-compliance and presents said generated recommendations to said user via said graphical user interface, wherein said generated recommendations specify modes of adjusting, adding, and removing one or more of said one or more audit rules from said one or more audit policies.

31. The computer implemented system of claim 23, wherein said audit management system further comprises an ad-hoc query module that selectively extracts results of said audit of said one or more network layer devices based on ad-hoc queries associated with said one or more compliance policies and said network layer device information, received from said user via said graphical user interface.

32. The computer implemented system of claim 23, wherein said audit management system further comprises a tracking module that performs:

tracking said performance of said audit of said one or more network layer devices over a predetermined period of time, and presenting risks associated with non-compliance of said one or more network layer devices with said one or more compliance policies, steps for remediation of said risks, and trends analyzed from said audit of said one or more network layer devices to said user via said graphical user interface; and

monitoring changes in one or more of said network layer device information, said configuration file, and said one or more audit policies, and triggering said acquisition of said network layer device information, said acquisition of said configuration file, acquisition of input from said user for said creation of said one or more audit policies and scheduling of said execution of said one or more audit policies on detecting said changes in said network layer device information, said configuration file, and said one or more audit policies.

33. The computer implemented system of claim 23, wherein said report generation module performs one or more of highlighting, prioritizing, and filtering said information about said security and said compliance of said one or more network layer devices with said one or more compliance policies based on predetermined criteria, wherein said predetermined criteria comprise one or more of ratings of impact assessment, said network layer device information, assignment of said one or more network layer devices to said audit, exposure of said one or more network layer devices to potential intrusions, and categories of said one or more network layer devices.

34. A computer program product comprising computer executable instructions embodied in a non-transitory computer readable storage medium, wherein said computer program product comprises:

a first computer program code for acquiring network layer device information of one or more network layer devices via a graphical user interface of an audit management system accessible by a user;

a second computer program code for acquiring a configuration file comprising configuration file commands that define configuration of each of said one or more network layer devices, via said graphical user interface;

a third computer program code for allowing one or more of creation and selection of one or more audit policies comprising one or more audit rules for said one or more network layer devices by said audit management system, wherein said one or more audit rules define functioning of said one or more network layer devices for one or more compliance policies, and wherein said one or more audit policies define an association of said one or more network layer devices with said one or more audit rules;

a fourth computer program code for executing said one or more audit policies for performing said audit of said one or more network layer devices by said audit management system, wherein said execution of said one or more audit policies comprises comparing said configuration file commands of said configuration file with said one or more audit rules of said one or more audit policies for verifying security and compliance of said one or more network layer devices with said one or more compliance policies; and

a fifth computer program code for generating a report comprising information about said security and said compliance of said one or more network layer devices with said one or more compliance policies based on said execution of said one or more audit policies.