Enforcing alignment of approved changes and deployed changes in the software change life-cycle

• US 9,602,515 B2
• Filed: 09/09/2015
• Issued: 03/21/2017
• Est. Priority Date: 02/02/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Roy-Chowdhury, Rahul, Sebes, E. John, Vaishnav, Jay
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US14/848,522
• Publication Number:
  US 20160105444A1
• Time in Patent Office: 559 Days
• Field of Search: 726 1- 7, 726 26- 30, 713165-167, 709/225, 709/229
• US Class Current: 1/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/70 Software maintenance or management
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/55 Push-based network services

Abstract

On a host, host content change requests are intercepted in real-time. In a tracking mode, the change requests are logged and allowed to take effect on the host. In an enforcement mode, the change requests are logged and additionally compared against authorized change policies and a determination is made whether to allow the change to take effect or to block the changes, thereby enforcing the authorized change policies on the host. Tracking and enforcement can be done in real-time. In either mode and at any time, the logged changes can be reconciled against a set of approved change orders in order to identify classes of changes, including changes that were deployed but not approved and changes that were approved but not deployed.

Claims

1. One or more non-transitory computer readable media having computer-executable instructions and when executed by at least one processor, cause the at least one processor to:

receive, on a host computer, a host content change request indicating a change for a persistent object within the host computer;

determine, by the host computer, whether the change is authorized based on one or more change authorization policies;

allow the host content change request to proceed based on the change being determined to be authorized;

determine information associated with the host content change request is to be added to a set of change log information based, at least in part, on one or more criteria of a filter applied to the host content change request, the set of change log information aggregated from a plurality of computers; and

provide the information to be added to the set of change log information.

2. The one or more non-transitory computer readable media of claim 1, wherein the one or more criteria include at least one of a file type, a registry key, or a directory.

3. The one or more non-transitory computer readable media of claim 1, wherein the one or more criteria include input associated with the host computer.

4. The one or more non-transitory computer readable media of claim 1, wherein the information is added to the set of change log information in real-time.

5. The one or more non-transitory computer readable media of claim 1, wherein the information indicates whether the change included performing an operation on the persistent object or whether the change included setting or modifying an attribute of the persistent object.

6. The one or more non-transitory computer readable media of claim 5, wherein the operation is selected from a group of operations including:

creating, deleting, renaming, moving, writing to, reading, viewing, accessing, executing, and running the persistent object.

7. The one or more non-transitory computer readable media of claim 1, wherein the computer-executable instructions, when executed, cause the at least one processor to:

block the host content change request from proceeding based on the change being determined to be not authorized based on the one or more change authorization policies.

8. The one or more non-transitory computer readable media of claim 1, wherein the computer-executable instructions, when executed, cause the at least one processor to:

provide the information to a reconciliation module to determine whether the host content change request corresponds to an approved change order.

9. The one or more non-transitory computer readable media of claim 1, wherein the information includes an identification of an entity that deployed the host content change request, wherein the entity is a person, an automated program, or both a person and a program.

10. The one or more non-transitory computer readable media of claim 1, wherein the information includes an identification of the host computer.

11. The one or more non-transitory computer readable media of claim 1, wherein at least one of the one or more change authorization policies indicates a time window during which host content changes are allowed for the persistent object.

12. The one or more non-transitory computer readable media of claim 1, wherein the one or more change authorization policies includes at least one policy indicating a set of users, programs or entities that can make changes to the persistent object.

13. The one or more non-transitory computer readable media of claim 12, wherein the one or more change authorization policies indicate a type of change that the set of users, programs or entities are allowed to make to the persistent object.

14. An apparatus, comprising:

a memory element for storing a set of change authorization policies; and

a processor to execute an agent module on the apparatus to;

receive, on a host computer, a host content change request indicating a change for a persistent object within the host computer;

determine, by the host computer, whether the change is authorized based on one or more change authorization policies;

allow the host content change request to proceed based on the change being determined to be authorized;

determine information associated with the host content change request is to be added to a set of change log information based, at least in part, on one or more criteria of a filter applied to the host content change request, the set of change log information aggregated from a plurality of computers; and

provide the information to be added to the set of change log information.

15. The apparatus of claim 14, wherein the one or more criteria include at least one of a file type, a registry key, or a directory.

16. The apparatus of claim 14, wherein the information is added to the set of change log information in real-time.

17. The apparatus of claim 14, wherein the one or more criteria include input associated with the host computer.

18. The apparatus of claim 14, wherein the information indicates whether the change included performing an operation on the persistent object or whether the change included setting or modifying an attribute of the persistent object.

19. The method of claim 14, wherein the one or more criteria include at least one of a file type or a registry key.

20. A method to be executed by a processor, comprising:

receiving, on a host computer, a host content change request indicating a change for a persistent object within the host computer;

determining, by the host computer, whether the change is authorized based on one or more change authorization policies;

allowing the host content change request to proceed based on the change being determined to be authorized;

determining information associated with the host content change request is to be added to a set of change log information based, at least in part, on one or more criteria of a filter applied to the host content change request, the set of change log information aggregated from a plurality of computers; and

providing the information to be added to the set of change log information.