Methods and apparatus to assess compliance of a computing resource in a virtual computing environment

Patent metadata

Field	Value
Publication number	US-10728284-B2
Application number	US-201314069225-A
Country	US
Kind code	B2
Filing date	Oct 31, 2013
Priority date	May 3, 2013
Publication date	Jul 28, 2020
Grant date	Jul 28, 2020

Abstract

Methods, apparatus, systems and articles of manufacture are disclosed to assess compliance of a virtual computing environment. An example method disclosed herein to assess compliance of computing resources of a computing environment includes monitoring for an occurrence of a change in a computing resource in the computing environment, and in response to detecting the occurrence and without waiting for batch testing, assessing compliance of the computing resource with a compliance policy.

First claim

What is claimed is:

1. A method to assess compliance of a computing resource of a computing environment, the method comprising:
monitoring an events stream for an occurrence of a change in a configuration of a computing resource in the computing environment;
parsing the events stream to identify the computing resource;
identifying additional computing resources related to the computing resource;
retrieving a compliance policy comprising a plurality of rules comprising a plurality of scope conditions which specify whether the plurality of rules apply to the computing resource;
in response to detecting the occurrence of the change in the configuration of the computing resource, assessing compliance of the additional computing resources with the compliance policy;
grouping compliance failures into defect classes;
determining a respective relevance of individual defect classes based on a previous assessment of compliance failures and based on a record of past repair actions, wherein a first defect class with a shorter detect-to-repair time is determined to have a higher respective relevance than a second defect class with a longer detect-to-repair time;
determining a priority order for the defect classes based on the respective relevance of the individual defect classes;
determining a response priority corresponding to the compliance of the additional computing resources with the compliance policy based on the defect classes and the priority order; and
rendering content associated with the response priority in a user interface.

2. The method as defined in claim 1 , further comprising:
periodically batch testing of a plurality of logged events logged over a time period, the batch testing targeting computing resources associated with the logged events; and
retesting the computing resource associated with the occurrence of the change for compliance with the compliance policy.

3. The method as defined in claim 1 , wherein assessing compliance of the additional computing resources with the compliance policy further includes:
determining if at least one of the additional computing resources satisfies a first scope condition of a first rule of the compliance policy to determine whether the at least one of the additional computing resources is subject to complying with the first rule; and
in response to determining that the at least one of the additional computing resources satisfies the first scope condition of the first rule, determining if the at least one of the additional computing resources satisfies a check condition of the first rule of the compliance policy indicative of the at least one of the additional computing resources satisfying the first rule.

4. The method as defined in claim 3 , further including determining if the at least one of the additional computing resources satisfies a second scope condition of a second rule of the compliance policy when the at least one of the additional computing resources fails the first scope condition of the first rule.

5. The method as defined in claim 3 , further including determining if the at least one of the additional computing resources satisfies a second scope condition of a second rule of the compliance policy.

6. The method as defined in claim 1 , wherein the computing resource is a first computing resource, and further including:
monitoring a length of time since a second computing resource was subject to a compliance assessment; and
if the length of time is greater than a threshold duration, assessing compliance of the second computing resource with the compliance policy.

7. The method as defined in claim 6 , wherein the assessing of the compliance of the second computing resource occurs after assessing compliance of the first computing resource.

8. The method as defined in claim 1 , further including detecting the occurrence of the change in the configuration of the computing resource via a subsystem of an operating system kernel of the computing environment.

9. The method as defined in claim 1 , wherein the occurrence of the change in the configuration of the computing resource is detected in less than ten seconds after the change.

10. The method as defined in claim 1 , further including determining a compliance score of the computing resource with respect to the compliance policy.

11. The method as defined in claim 1 , further including generating a report including a result of the compliance assessment.

12. The method as defined in claim 1 , further including displaying a compliance summary including a compliance assessment of the computing resource with respect to the compliance policy.

13. The method as defined in claim 12 , wherein the compliance summary includes at least a number of compliance successes, a number of compliance critical-failures or a number of compliance warnings.

14. A non-transitory computer readable storage medium comprising instructions that, when executed, cause at least one processor to:
monitor an events stream for an occurrence of a change in a configuration of a computing resource in a computing environment;
parse the events stream to identify the computing resource;
identify additional computing resources related to the computing resource;
retrieve a compliance policy comprising a plurality of rules comprising a plurality of scope conditions which specify whether the plurality of rules apply to the computing resource;
in response to the occurrence of the change in the configuration of the computing resource, assess compliance of the additional computing resources with the compliance policy;
group compliance failures into defect classes;
determine a respective relevance of individual defect classes based on a previous assessment of compliance failures and based on a record of past repair actions, wherein a first defect class with a shorter detect-to-repair time is determined to have a higher respective relevance than a second defect class with a longer detect-to-repair time;
determine a priority order for the defect classes based on the respective relevance of the individual defect classes;
determine a response priority corresponding to the compliance of the additional computing resources with the compliance policy based on the defect classes and the priority order; and
render content associated with the response priority in a user interface.

15. The non-transitory computer readable storage medium as defined in claim 14 , wherein the instructions further cause the at least one processor to detect the occurrence of the change in the configuration of the computing resource via a subsystem of an operating system kernel of the computing environment.

16. The non-transitory computer readable storage medium as defined in claim 14 , wherein the instructions further cause the at least one processor to detect the occurrence of the change in the configuration of the computing resource by detecting an notify system call.

17. The non-transitory computer readable storage medium as defined in claim 14 , wherein the instructions further cause the at least one processor to detect the occurrence of the change in the configuration of the computing resource by detecting a FileSystem Watcher subsystem.

18. The non-transitory computer readable storage medium as defined in claim 14 , wherein the occurrence of the change in the configuration of the computing resource is detected in less than ten seconds after the change.

19. The non-transitory computer readable storage medium as defined in claim 14 , wherein the computing resource comprises at least on

Assignees

• Vmware Inc

Inventors

• Helander Robert
• Smith Rebecca
• Nelson Eric D
• Sullivan James
• Frascadore Gregory A

Classifications

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• G06F2009/45591

  Monitoring or debugging support · CPC title