Information technology governance and controls methods and apparatuses

• US 8,176,158 B2
• Filed: 08/09/2006
• Issued: 05/08/2012
• Est. Priority Date: 08/09/2005
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: DiFalco, Robert A., Warmack, Robert L., Keeler, Kenneth L.
• Primary Examiner(s): NGUYEN, PHUOC H
• Application Number:
  US11/463,580
• Publication Number:
  US 20070043674A1
• Time in Patent Office: 2,099 Days
• Field of Search: 709/203, 709/220, 709/223, 709/224
• US Class Current: 709/223
• CPC Class Codes: G06F 16/128 Details of file system snapshots on the file-level, e.g. snapshot creation, administration, deletion use of snapshots for error detection or correction G06F11/14, G06F11/16
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 10/0637 Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Embodiments of the present invention provide methods and systems for automated change audit of an enterprise'"'"'s IT infrastructure, including independent detection of changes, reconciliation of detected changes and independent reporting, to effectuate a triad of controls on managing changes within the IT infrastructure, preventive controls, detective controls and corrective controls.

Claims

1. An article of manufacture comprising:

a non-transitory computer-readable storage medium; and

a plurality of instructions stored in the storage medium;

wherein the plurality of instructions are adapted to provide one or more control modules segregated from persons or technologies associated with an enterprise'"'"'s information technology (IT) infrastructure making authorized changes to the enterprise'"'"'s IT infrastructure, to perform a plurality of audit operations, independent of the persons or technologies making authorized changes, comprising;

independently detecting changes to one or more data processing devices in the IT infrastructure, regardless of source, intent or authorization of the changes;

reconciling the detected changes with intended and authorized changes;

correlating the detected changes to events contained in one or more event logs associated with the one or more data processing devices; and

independently reporting change activities, including the detected changes supplemented with the correlated events, across production systems of the enterprise'"'"'s IT infrastructure, including reporting detected intended and authorized changes to persons or technologies making authorized changes.

2. The article of manufacture of claim 1, wherein reconciling comprises determining whether a detected change of state of at least one of a plurality of data with the enterprise'"'"'s IT infrastructure is conforming, including determining whether the detected change of state is desirable.

3. The article of manufacture of claim 2, wherein reconciling further comprises changing a baseline state for the at least one data, if the detected change of state is conforming.

4. The article of manufacture of claim 2, wherein reconciling further comprises determining at least one of a level of severity or non-conformance for the detected change of state, if the detected change of state is not conforming.

5. The apparatus of claim 2, wherein reconciling further comprises changing a baseline state for the at least one data, if the detected change of state is conforming.

6. The apparatus of claim 2, wherein reconciling further comprises determining at least one of a level of severity or non-conformance for the detected change of state, if the detected change of state is not conforming.

7. An apparatus comprising:

a processor; and

a control module adapted to be operated by the processor to audit an enterprise'"'"'s information technology (IT) infrastructure, the control module being segregated from persons or technologies associated with the IT infrastructure making authorized changes to the IT infrastructure to enable the audit to be performed independent of the persons or technologies making authorized changes, the audit comprising;

independent detection of changes to a first production system in the IT infrastructure, regardless of source, intent or authorization of the changes;

reconciliation of the detected changes with intended and authorized changes;

correlation of the detected changes to events contained in one or more event logs;

and

in response to a request to demonstrate control of the IT infrastructure, independent reporting of change activities, including the detected changes supplemented with the correlated events, to all production systems of the enterprise'"'"'s IT infrastructure including reporting detected intended and authorized changes to persons or technologies making authorized changes.

8. The apparatus of claim 7, wherein reconciling comprises determining whether a detected change of state of at least one of a plurality of data with the enterprise'"'"'s IT infrastructure is conforming, including determining whether the detected change of state is desirable.

9. A computer-implemented method of auditing an enterprise'"'"'s information technology (IT) infrastructure, comprising:

independently detecting, by a control module operated by a computing device, a change to a production system of the IT infrastructure, regardless of source, intent or authorization of the change and independent of persons or technologies making authorized changes to the IT infrastructure, the control module being segregated from the persons or technologies making authorized changes;

reconciling, by the control module, the detected change with intended and authorized changes;

correlating, by the control module, the detected change to an event contained in one or more event logs associated with the production system; and

in response to a request to demonstrate control of the IT infrastructure, independently reporting, by the control module, detected changes, including the detected change supplemented with the correlated event, to all production systems of the enterprise'"'"'s IT infrastructure, including reporting detected intended and authorized changes to persons or technologies making authorized changes.

10. The computer-implemented method of claim 9, wherein reconciling comprises determining whether a detected change of state of at least one of a plurality of data with the enterprise'"'"'s IT infrastructure is conforming, including determining whether the detected change of state is desirable.

11. The method of claim 10, wherein reconciling further comprises changing a baseline state for the at least one data, if the detected change of state is conforming.

12. The method of claim 10, wherein reconciling further comprises determining at least one of a level of severity or non-conformance for the detected change of state, if the detected change of state is not conforming.