Method and apparatus for assessing policy compliance of as-built data networks
View Patent ↗An as-built network is evaluated by analyzing a model of the network by the steps of determining zones within the network, computing the access between zones, summarizing the access between zones to produce a dataset, then inputting a policy set comprising a collection of approvals, typically in the form of simple white-lists of approvals, then comparing the dataset and particularly the access between zones with the policy set of approvals (white-lists) to determine which access fall outside the approvals, and producing therefrom as an output to an end user a report of compliance and noncompliance, and then repeating the steps of determining, computing, and summarizing, and then the comparing step, after a period or after the network has changed. Thus a network operator or auditor can readily and interactively assess whether the infrastructure is in compliance with regulatory or other design requirements.
1. A computer-implemented method, comprising:
duplicating, on a computing device, a pre-existing network environment by segmenting a pre-existing network into a plurality of defined zones, wherein a zone is defined by data elements and data associated with the data elements, and wherein interrelationships between zones are determined between two or more defined zones;
querying the pre-existing network for all packet access, wherein packet access includes inter-zone packet access;
summarizing inter-zone packet access;
generating an access dataset using the summarized inter-zone packet access, wherein summarizing includes generating a summary including a list of one or more protocol and destination port combinations found directionally between zone accesses;
receiving a policy set including a collection of approvals indicating whether a broad or narrow set of access is permissible;
computing the status of the pre-existing network by comparing the access dataset with the policy set; and
generating a compliance report using the computed status, wherein the compliance report is automatically re-generated and the status is automatically re-computed when a change to the pre-existing network environment is detected.
2. The method of claim 1 , wherein duplicating the pre-existing network environment facilitates the execution of testing and analysis of the pre-existing network environment without disrupting the pre-existing network environment.
3. The method of claim 1 , wherein the pre-existing network environment is in compliance with the policy set when the access data set is approved.
4. The method of claim 1 , wherein the compliance report is a Payment Card Industry compliance report.
5. The method of claim 1 , wherein the policy set includes a collection of negative rules.
6. The method of claim 1 , wherein the policy set includes a collection of exclusive rules.
7. A computer-implemented system, comprising:
one or more processors;
one or more non-transitory computer-readable storage mediums containing instructions configured to cause the one or more processors to perform operations including:
duplicating a pre-existing network environment by segmenting a pre-existing network into a plurality of defined zones, wherein a zone is defined by data elements and data associated with the data elements, and wherein interrelationships between zones are determined between two or more defined zones;
querying the pre-existing network for all packet access, wherein packet access includes inter-zone packet access;
summarizing inter-zone packet access;
generating an access dataset using the summarized inter-zone packet access, wherein summarizing includes generating a summary including a list of one or more protocol and destination port combinations found directionally between zone accesses;
receiving a policy set including a collection of approvals indicating whether a broad or narrow set of access is permissible;
computing the status of the pre-existing network by comparing the access dataset with the policy set; and
generating a compliance report using the computed status, wherein the compliance report is automatically re-generated and the status is automatically re-computed when a change to the pre-existing network environment is detected.
8. The system of claim 7 , wherein duplicating the pre-existing network environment facilitates the execution of testing and analysis of the pre-existing network environment without disrupting the pre-existing network environment.
9. The system of claim 7 , wherein the pre-existing network environment is in compliance with the policy set when the access data set is approved.
10. The system of claim 7 , wherein the compliance report is a Payment Card Industry compliance report.
11. The system of claim 7 , wherein the policy set includes a collection of negative rules.
12. The system of claim 7 , wherein the policy set includes a collection of exclusive rules.
13. A computer-program product, tangibly embodied in a machine-readable non-transitory storage medium, including instructions configured to cause a data processing apparatus to:
duplicate a pre-existing network environment by segmenting a pre-existing network into a plurality of defined zones, wherein a zone is defined by data elements and data associated with the data elements, and wherein interrelationships between zones are determined between two or more defined zones;
query the pre-existing network for all packet access, wherein packet access includes inter-zone packet access;
summarize inter-zone packet access;
generate an access dataset using the summarized inter-zone packet access, wherein summarizing includes generating a summary including a list of one or more protocol and destination port combinations found directionally between zone accesses;
receive a policy set including a collection of approvals indicating whether a broad or narrow set of access is permissible;
compute the status of the pre-existing network by comparing the access dataset with the policy set; and
generate a compliance report using the computed status, wherein the compliance report is automatically re-generated and the status is automatically re-computed when a change to the pre-existing network environment is detected.
14. The computer-program product of claim 13 , wherein duplicating the pre-existing network environment facilitates the execution of testing and analysis of the pre-existing network environment without disrupting the pre-existing network environment.
15. The computer-program product of claim 13 , wherein the pre-existing network environment is in compliance with the policy set when the access data set is approved.
16. The computer-program product of claim 13 , wherein the compliance report is based upon external regulatory standards, guidelines, and procedures for the collection, transmittal, and storage of credit card information.
17. The computer-program product of claim 13 , wherein the policy set includes a collection of negative rules.
18. The computer-program product of claim 13 , wherein the policy set includes a collection of exclusive rules.