Automated compliance exception approval

Patent metadata

Field	Value
Publication number	US-9773122-B2
Application number	US-201514953260-A
Country	US
Kind code	B2
Filing date	Nov 27, 2015
Priority date	Nov 27, 2015
Publication date	Sep 26, 2017
Grant date	Sep 26, 2017

Abstract

The invention relates to a computer-implemented method for automated approval of a non-compliance of a modified configuration of a computer system with one or more compliance rules, the method comprising: receiving by a package management system a pre-approved modification pattern in form of a software package, deploying a modification pattern of the software package and providing compliance exception pre-approvals of the software package to a compliance management system, performing a compliance check of the resulting modified configuration of the computer system, in response to detecting a non-compliance with a compliance rule, comparing the detected non-compliance with the one or more pre-approved non-compliances, in response to a matching of the detected non-compliance with one or more of the respective pre-approved non-compliances, automatically approving the detected non-compliance by the compliance management system.

First claim

The invention claimed is:

1. A computer-implemented method for automated approval of a non-compliance of a modified configuration of a first computer system with one or more compliance rules,
the method comprising:
receiving by a first package management system a pre-approved modification pattern in form of a software package comprising a modification pattern specifying one or more modifications to be applied to a first configuration of the first computer system and one or more compliance exception pre-approvals assigned to the respective modification pattern, each of the respective pre-approvals specifying a pre-approved non-compliance of one or more of the respective modifications with the one or more compliance rules,
deploying the respective pre-approved modification pattern by modifying the first configuration according to the modification pattern and providing the one or more compliance exception pre-approvals to a first compliance management system,
performing a compliance check of the resulting modified configuration of the first computer system by the respective first compliance management system,
in response to detecting a non-compliance with the one or more compliance rules, comparing the detected non-compliance with the one or more pre-approved non-compliances by the compliance management system,
in response to a matching of the detected non-compliance with one or more of the respective pre-approved non-compliances, automatically approving the detected non-compliance by the first compliance management system.

2. The computer-implemented method of claim 1 , the method further comprising:
recording the automatic approval of the detected non-compliance to a logfile.

3. The computer-implemented method of claim 1 , the method further comprising:
in response to determining that the detected non-compliance is not matching with any of the pre-approved non-compliances, requesting by the compliance management system a compliance exception approval for the detected non-compliance,
approving the detected non-compliance by the compliance management system upon receiving a compliance exception approval for the detected non-compliance.

4. The computer-implemented method of claim 3 , the method further comprising:
cancelling non-compliant modifications of the first configuration of the first computer system for which no compliance exception approvals are received.

5. The computer-implemented method of claim 1 , each non-compliance comprised by the first configuration of the first computer system being approved by a compliance exception approval.

6. The computer-implemented method of claim 1 , the first computer system being a virtual machine and modifying the first configuration of the first computer system comprises modifying software installed on the respective virtual machine.

7. The computer-implemented method of claim 1 , the method further comprising for generating the pre-approved modification pattern:
receiving by a second package management system the modification pattern,
deploying the modification pattern by modifying a second configuration of a second computer system according to the modification pattern,
performing a compliance check of the modified second configuration by a second compliance management system,
in response to detecting one or more non-compliances with the one or more compliance rules, requesting one or more compliance exception approvals for the detected non-compliances,
receiving one or more compliance exception pre-approvals assigned to the detected non-compliances,
generating by the second package management system the software package comprising the modification pattern and the one or more compliance exception pre-approvals.

8. The computer-implemented method of claim 7 , the method comprising:
in response to generating the software package, storing the software package in a software package repository,
receiving the software package of the pre-approved modification pattern from the software package repository in response to sending a request to the respective repository.

9. The computer-implemented method of claim 7 , the first and second compliance management system being the same compliance management system.

10. The computer-implemented method of claim 1 , the compliance exception pre-approval being assigned with a first digital signature and an ID identifying an approving authority, the method further comprising:
upon receipt of the compliance exception pre-approval, verifying by the first compliance management system the first signature and the authorization of the approving authority identified by the ID.

11. The computer-implemented method of claim 1 , the pre-approved modification pattern being assigned with a second digital signature, the method further comprising:
upon receipt of the pre-approved modification pattern, verifying the second signature.

12. The computer-implemented method of claim 1 , the modification pattern further comprising machine-readable installation instructions specifying an installation procedure to be applied and machine-readable configuration instructions specifying post-installation configuration adjustments to be applied, the modifying of the first configuration of the first computer system comprising:
executing the respective installation instructions,
executing the respective configuration instructions.

13. The computer-implemented method of claim 12 , the pre-approved modification pattern further comprising installable payload, the method further comprising:
upon execution of the installation instructions installing the installable payload.

14. The computer-implemented method of claim 12 , the pre-approved modification pattern further comprising one or more references to one or more installable files, the method further comprising:
upon execution of the installation instructions requesting, receiving and installing the respective installable files.

15. The computer-implemented method of claim 1 , the pre-approved modification pattern further comprising machine-readable mitigation instructions specifying adjustments to be applied to the modifications of the first configuration specified by the modification pattern for mitigating non-compliances of the respective modifications, the method further comprising:
executing the respective mitigation instructions.

16. The computer-implemented method of claim 1 , the pre-approved modification pattern further comprising control instructions specifying requirements to be met when controlling the first computer system for deploying the respective pre-approved modification pattern, the method further comprising:
controlling the first computer system according to the control requirements when deploying the respective pre-approved modification pattern.

17. The computer-implemented method of claim 1 , the pre-approved modification pattern further comprising pre-conditions specifying requirements to be satisfied by the first configuration of the first computer system for deploying the respective pre-approved modification pattern, the method further comprising:
checking whether the first configuration meets the requirements specified by the pre-conditions,
in response to detecting a requirement specified by the pre-conditions which is not met by the first configuration, initiating an initial modification of the first configuration such that the first configuration meets the respective requirement.

18. A computer-implemented method for automated approval of a non-compliance of a modified configuration of a computer s

Assignees

• IBM

Inventors

• Betzler Boas
• Kuehmichel Andreas
• Nachtwey Volker
• Schleicher Klaus-Thomas

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F8/61

  Installation · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title