Information technology governance and controls methods and apparatuses
View Patent ↗Embodiments of the present invention provide methods and systems for automated change audit of an enterprise's IT infrastructure, including independent detection of changes, reconciliation of detected changes and independent reporting, to effectuate a triad of controls on managing changes within the IT infrastructure, preventive controls, detective controls and corrective controls.
1. A non-transitory computer-readable storage device storing computer-executable instructions, which when executed by a computer cause the computer to perform a method, the method comprising:
detecting one or more changes to an element at a data processing node by comparing a current state of the element to a baseline state of the element, the data processing node being a data processing node within an information technology (IT) infrastructure, the detected changes comprising a change to a configuration of the data processing node or a change to a file at the data processing node;
determining whether the detected changes include any unknown out-of-band changes by comparing a first memorialization of the detected changes to a second memorialization of one or more in-band changes that should have been made at the data processing node;
determining whether the detected changes conform to a conformance authority, the conformance authority comprising guidelines that define changes as conforming or nonconforming;
if the detected changes are conforming and in-band changes, updating the baseline state of the element to the current state; and
if the detected changes include a non-conforming or out-of-band change, generating an alert instead of updating the baseline state of the element to the current state.
2. The non-transitory computer-readable storage device of claim 1 , wherein the conformance authority defines changes as conforming or nonconforming according to a government regulation or law or a standard established by a standards organization.
3. The non-transitory computer-readable storage device of claim 1 , wherein the detecting the one or more changes is performed by a change detection agent at the data processing node.
4. The non-transitory computer-readable storage device of claim 1 , wherein the method further comprises, if the detected changes include a non-conforming change, reverting the element of the data processing node back to a baseline state.
5. The non-transitory computer-readable storage device of claim 1 , wherein the method further comprises, if the detected changes include a non-conforming change, associating a severity state with the change, and wherein the alert includes the severity state.
6. The non-transitory computer-readable storage device of claim 1 , wherein the alert includes one or more of an identification of a user who made the change or an identification of a guideline that was violated by the change.
7. The non-transitory computer-readable storage device of claim 1 , wherein the method further comprises generating a change report reporting the detected changes in the information technology (IT) infrastructure, wherein the change report includes an identification of one or more of a number of changes detected, dates of the changes detected, times of the changes detected, operators associated with the changes detected, or permissions related to the operators associated with the changes detected.
8. The non-transitory computer-readable storage device of claim 1 , wherein the method further comprises:
determining whether the change is an authorized and planned change by determining whether the change is associated with a submitted work ticket.
9. The non-transitory computer-readable storage device of claim 1 , wherein the method further comprises performing an enrichment operation by:
correlating the detected changes to one or more events associated with the element and identified in a separate event or audit log;
supplementing the detected changes with the correlated one or more events associated with the element; and
storing the detected changes with the supplemental correlated one or more events in a data warehouse.
10. A method, comprising:
by a change detection agent at a data processing node:
detecting one or more changes to an element at the data processing node by comparing a current state of the element to a baseline state of the element, the data processing node being a data processing node within an information technology (IT) infrastructure, the detected changes comprising a change to a configuration of the data processing node or a change to a file at the data processing node; by a change control subsystem:
determining whether the detected changes include any unknown out-of-band changes by comparing a first memorialization of the detected changes to a second memorialization of one or more in-band changes that should have been made at the data processing node;
determining whether the detected changes conform to a conformance authority, the conformance authority comprising guidelines that define changes as conforming or nonconforming;
if the detected changes are conforming and in-band changes, updating the baseline state of the element to the current state; and
if the detected changes include a non-conforming or out-of-band change, generating an alert instead of updating the baseline state of the element to the current state.
11. The method of claim 10 , further comprising:
determining whether the change is an authorized and planned change by determining whether the change is associated with a submitted work ticket.
12. The method of claim 10 , wherein the conformance authority defines changes as conforming or nonconforming according to a government regulation or law, or according to a standard established by a standards organization.
13. The method of claim 10 , wherein the method further comprises, if the detected changes include a non-conforming change, reverting the element of the data processing node back to a baseline state.
14. The method of claim 10 , wherein the method further comprises, if the detected changes include a non-conforming change, associating a severity state with the change, and wherein the alert includes the severity state.
15. The method of claim 10 , wherein the alert includes one or more of an identification of a user who made the change or an identification of a guideline that was violated by the change.
16. The method of claim 10 , wherein the method further comprises generating a change report for the detected changes in the information technology (IT) infrastructure, the change report including one or more of an identification of one or more of a number of changes detected, dates of the changes detected, times of the changes detected, operators associated with the changes detected, or permissions related to the operators associated with the changes detected.
17. The method of claim 10 , further comprising performing an enrichment operation by:
correlating the detected changes to one or more events associated with the element and identified in a separate event or audit log;
supplementing the detected changes with the correlated one or more events associated with the element; and
storing the detected changes with the supplemental correlated one or more events in a data warehouse.
18. A system, comprising:
a change detection agent at a data processing node configured to detect a change to an element at the data processing node by comparing a current state of the element to a baseline state of the element, the data processing node being a data processing node within an information technology (IT) infrastructure, the change being a change to a configuration of the data processing node or a change to a file at the data processing node;
a change control subsystem configured to determine whether the change is an out-of-band change by comparing a first memorialization of the change to a second memorialization of one or more in-band changes that should have been made at the data processing node, determine whether the change conforms to a conformance authority, the conformance authority comprising guidelines for defining changes as conforming or nonconforming, and, if the change is a conforming and in-band change, updating the baseline state of the element to the current state, but, if the change is a non-conforming or out-of-band change, generating an alert reporting the change instead of updating the baseline state of the element to the current state.