ENFORCING ALIGNMENT OF APPROVED CHANGES AND DEPLOYED CHANGES IN THE SOFTWARE CHANGE LIFE-CYCLE

• US 20120278853A1
• Filed: 07/02/2012
• Published: 11/01/2012
• Est. Priority Date: 02/02/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Roy-Chowdhury, Rahul, Sebes, E. John, Vaishnav, Jay
• Granted Patent: US 8,707,446 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/70 Software maintenance or management
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/55 Push-based network services

Abstract

On a host, host content change requests are intercepted in real-time. In a tracking mode, the change requests are logged and allowed to take effect on the host. In an enforcement mode, the change requests are logged and additionally compared against authorized change policies and a determination is made whether to allow the change to take effect or to block the changes, thereby enforcing the authorized change policies on the host. Tracking and enforcement can be done in real-time. In either mode and at any time, the logged changes can be reconciled against a set of approved change orders in order to identify classes of changes, including changes that were deployed but not approved and changes that were approved but not deployed.

Claims

1-24. -24. (canceled)

25. A method to be executed by a processor, comprising:

intercepting a host content change request indicating a change to a persistent object on a host;

determining whether the change is authorized, as indicated by a set of change authorization policies; and

allowing the change to take effect when the change is authorized,

wherein the set of change authorization policies is configurable to define whether the persistent object can be changed.

26. The method of claim 25, further comprising:

allowing the change to take effect when the change is not authorized for an initial period;

logging information about the host content change request when the change is not authorized during the initial period; and

blocking the change from taking effect when the change is not authorized after the initial period.

27. The method of claim 25, further comprising:

logging information about the host content change request;

obtaining a log representing a set of host content change requests;

filtering the log to select change requests which meet a condition to form a filtered log;

comparing the filtered log to a set of approved change orders for any one or more of a plurality of persistent objects on the host;

identifying at least one correlation between the set of host content change requests and the set of approved change orders; and

providing user-readable data representing the at least one correlation.

28. The method of claim 27, wherein the condition is selected from a group consisting of:

change requests related to a specified set of hosts;

change requests generated in a time window; and

change requests that represent a change in one or more specified host capabilities.

29. The method of claim 25, further comprising:

logging information about the host content change request from a plurality of time windows;

obtaining a log for each time window of the plurality of time windows;

identifying a bug during a time window of the plurality of time windows; and

identifying a set of persistent objects from the log of the time window of the bug.

30. The method of claim 25, further comprising:

logging information about the host content change request; and

filtering the host content change request to prevent logging the host content change request if the host content change request is non-material.

31. The method of claim 30, wherein the host content change request is non-material if the host content change request includes one or more of:

creation of specified registry entries;

modification of specified registry entries; and

creation, deletion, or modification of temporary objects.

32. Logic encoded in one or more non-transitory computer readable media having computer-executable instructions and when executed by a processor is operable to perform operations comprising:

intercepting a host content change request indicating a change to a persistent object on a host;

determining whether the change is authorized, as indicated by a set of change authorization policies; and

allowing the change to take effect when the change is authorized,

wherein the set of change authorization policies is configurable to define whether the persistent object can be changed.

33. The logic of claim 32, wherein the operations further comprise:

allowing the change to take effect when the change is not authorized for an initial period;

logging information about the host content change request when the change is not authorized during the initial period; and

blocking the change from taking effect when the change is not authorized after the initial period.

34. The logic of claim 32, wherein the operations further comprise:

logging information about the host content change request;

obtaining a log representing a set of host content change requests;

filtering the log to select change requests which meet a condition to form a filtered log;

comparing the filtered log to a set of approved change orders for any one or more of a plurality of persistent objects on the host;

identifying at least one correlation between the set of host content change requests and the set of approved change orders; and

providing user-readable data representing the at least one correlation.

35. The logic of claim 34, wherein the condition is selected from a group consisting of:

change requests related to a specified set of hosts;

change requests generated in a time window; and

change requests that represent a change in one or more specified host capabilities.

36. The logic of claim 32, wherein the operations further comprise:

logging information about the host content change request from a plurality of time windows;

obtaining a log for each time window of the plurality of time windows;

identifying a bug during a time window of the plurality of time windows; and

identifying a set of persistent objects from the log of the time window of the bug.

37. The logic of claim 32, wherein the operations further comprise:

logging information about the host content change request; and

filtering the host content change request to prevent logging the host content change request if the host content change request is non-material.

38. The logic of claim 37, wherein the host content change request is non-material if the host content change request includes one or more of:

creation of specified registry entries;

modification of specified registry entries; and

creation, deletion, or modification of temporary objects.

39. A host, comprising:

a memory element for storing data; and

a processor operable to execute instructions associated with the data, wherein the processor and the memory element cooperate when the processor executes the instructions, such that the host is configured to;

intercept a host content change request indicating a change to a persistent object on the host;

determine whether the change is authorized, as indicated by a set of change authorization policies; and

allow the change to take effect when the change is authorized,

wherein the set of change authorization policies is configurable to define whether the persistent object can be changed.

40. The host of claim 39, wherein the host is further configured to:

allow the change to take effect when the change is not authorized for an initial period;

log information about the host content change request when the change is not authorized during the initial period; and

block the change from taking effect when the change is not authorized after the initial period.

41. The host of claim 39, wherein the host is further configured to:

log information about the host content change request;

obtain a log representing a set of host content change requests;

filter the log to select change requests which meet a condition to form a filtered log;

compare the filtered log to a set of approved change orders for any one or more of a plurality of persistent objects on the host;

identify at least one correlation between the set of host content change requests and the set of approved change orders; and

provide user-readable data representing the at least one correlation.

42. The host of claim 41, wherein the condition is selected from a group consisting of:

change requests related to a specified set of hosts;

change requests generated in a time window; and

change requests that represent a change in one or more specified host capabilities.

43. The host of claim 39, wherein the host is further configured to:

log information about the host content change request from a plurality of time windows;

obtain a log for each time window of the plurality of time windows;

identify a bug during a time window of the plurality of time windows; and

identify a set of persistent objects from the log of the time window of the bug.

44. The host of claim 39, wherein the host is further configured to:

log information about the host content change request; and

filter the host content change request to prevent logging the host content change request if the host content change request is non-material.