Multi-policy security auditing system and method
View Patent ↗A method includes running a set of policies simultaneously using two levels of optimizations. After selecting the policies to be run, the number of technical controls performed is minimized by coalescing (unioning) the technical controls of the policies in the first level of optimization. Further, the number of queries performed is minimized by coalescing (unioning) the queries of the technical controls in the second level of optimization. The technical controls and queries performed are determined by the set of polices that are to be run, in a policy driven manner.
1. A computer implemented method comprising:
executing a multi-policy security auditing application on a computer processor, wherein said executing includes:
selecting a set of security policies to be run;
unioning technical controls of said set of security policies to generate a set of technical controls wherein each technical control in said set is unique and further wherein a unique technical control is a technical control of which there are no other identical technical controls; and
unioning queries of said set of technical controls to generate a set of queries wherein each query in said set of queries is unique and further wherein a unique query is a query of which there are no other identical queries.
2. The computer implemented method of claim 1 further comprising invoking each query in said set of queries.
3. The computer implemented method of claim 2 further comprising storing query results of said invoked queries in a queries results table.
4. The computer implemented method of claim 3 further comprising comparing said query results to desired states.
5. The computer implemented method of claim 4 wherein said comparing said query results to desired states comprises determining whether said query results are in compliance with said desired states.
6. The computer implemented method of claim 4 further comprising reconstructing said policies.
7. The computer implemented method of claim 6 wherein said reconstructing said policies comprises using a policy map, said policy map comprising:
said set of unique technical controls of said technical controls;
queries of said set of unique technical controls; and
references to policies that included said unique technical controls.
8. The computer implemented method of claim 7 further comprising setting each of said unique technical controls to policies to which said each of said unique technical controls is referenced.
9. The computer implemented method of claim 1 wherein each of said policies comprises at least one of said technical controls.
10. The computer implemented method of claim 1 wherein each of said technical controls comprises:
a reference to one of said queries;
a reference to a query result;
a desired state; and
a comparison result.
11. The computer implemented method of claim 1 wherein said unioning technical controls of said policies comprises storing unique technical controls of said technical controls in a policy map.
12. The computer implemented method of claim 11 wherein a first policy of said policies comprises a first instance of a unique technical control and a second policy of said policies comprises a second instance of said unique technical control, said storing unique technical controls of said technical controls in a policy map comprises adding said unique technical control to said policy map only once.
13. The computer implemented method of claim 11 further comprising adding a reference to each of said policies that include a unique technical control to said policy map.
14. The computer implemented method of claim 11 further comprising flagging technical controls that conflict.
15. The computer implemented method of claim 14 further comprising resolving said technical controls that conflict.
16. The computer implemented method of claim 15 further comprising creating a list of required queries.
17. A computer system comprising:
a memory having stored therein a multi-policy security auditing application; and
a processor coupled to said memory, wherein execution of said multi-policy security auditing application generates a method comprising:
selecting a set of security policies to be run;
unioning technical controls of said set of security policies to generate a set of technical controls wherein each technical control in said set is unique and further wherein a unique technical control is a technical control of which there are no other identical technical controls; and
unioning queries of said set of technical controls to generate a set of queries wherein each query in said set of queries is unique and further wherein a unique query is a query of which there are no other identical queries.
18. A computer-program product comprising a computer readable medium containing computer program code comprising:
a multi-policy security auditing application for selecting a set of security policies to be run;
said multi-policy security auditing application further for unioning technical controls of said set of security policies to generate a set of technical controls wherein each technical control in said set is unique and further wherein a unique technical control is a technical control of which there are no other identical technical controls; and
said multi-policy security auditing application further for unioning queries of said set of technical controls to generate a set of queries wherein each query in said set of queries is unique and further wherein a unique query is a query of which there are no other identical queries.
19. A computer system comprising:
means for selecting a set of security policies to be run;
means for unioning technical controls of said set of security policies to generate a set of technical controls wherein each technical control in said set is unique and further wherein a unique technical control is a technical control of which there are no other identical technical controls; and
means for unioning queries of said set of technical controls to generate a set of queries wherein each query in said set of queries is unique and further wherein a unique query is a query of which there are no other identical queries.