Enforcing alignment of approved changes and deployed changes in the software change life-cycle
On a host, host content change requests are intercepted in real-time. In a tracking mode, the change requests are logged and allowed to take effect on the host. In an enforcement mode, the change requests are logged and additionally compared against authorized change policies and a determination is made whether to allow the change to take effect or to block the changes, thereby enforcing the authorized change policies on the host. Tracking and enforcement can be done in real-time. In either mode and at any time, the logged changes can be reconciled against a set of approved change orders in order to identify classes of changes, including changes that were deployed but not approved and changes that were approved but not deployed.
1. One or more non-transitory computer readable media having computer-executable instructions and when executed by at least one processor, cause the at least one processor to:
receive, from a separate computer system, at an agent module, a host content change request for a persistent object within a host computer; and
apply, by the agent module, one or more change authorization policies to the host content change request to allow the host content change request when the host content change request meets the one or more change authorization policies, wherein at least one of the change authorization policies indicates a time window, during which host content changes are enabled for the persistent object;
allow the host content change request when the host content change request does not meet the at least one change authorization policy indicating the time window during which host content changes are enabled for the persistent object; and
record information associated with a host content change to the persistent object that results from the host content change request being allowed, wherein the information indicates that the persistent object did not meet the at least one change authorization policy indicating the time window.
2. The one or more non-transitory computer readable media of claim 1 , wherein the one or more change authorization policies are included in a set of change authorization policies comprising at least one policy indicating a set of persistent objects that can be changed without restriction.
3. The one or more non-transitory computer readable media of claim 1 , wherein the one or more change authorization policies are included in a set of change authorization policies comprising at least one policy indicating a set of users, programs or entities that can make changes to a specified set of persistent objects at any time.
4. The one or more non-transitory computer readable media of claim 1 , wherein the one or more change authorization policies are included in a set of change authorization policies comprising at least one policy indicating a set of users, programs or entities that can make changes to a specified set of persistent objects during one or more specified time windows.
5. The one or more non-transitory computer readable media of claim 1 , wherein the information includes a time at which the host content change occurred.
6. The one or more non-transitory computer readable media of claim 1 , wherein the information includes one or more of a nature of the host content change, attributes of the persistent object prior to the host content change taking effect, and attributes of the persistent object after the host content change takes effect.
7. The one or more non-transitory computer readable media of claim 1 , wherein the computer-executable instructions, when executed by at least one processor, cause the at least one processor to:
provide the information to a reconciliation module to reconcile the host content change to a set of one or more approved change orders.
8. One or more non-transitory computer readable media having computer-executable instructions and when executed by at least one processor, cause the at least one processor to:
access change log information for a host in a network environment, wherein the change log information indicates whether a host content change to a persistent object on a host was deployed or blocked in the host, wherein the host content change is requested by a host content change request;
compare the change log information to one or more approved change orders;
reconcile the host content change to the one or more approved change orders based, at least in part, on whether the host content change was deployed or blocked on the host and whether any one of the one or more approved change orders corresponds to the host content change.
9. The one or more non-transitory computer readable media of claim 8 , wherein the change log information includes an identification of the host associated with the host content change on the host, a time of the host content change, an initiator of the host content change, and a nature of the host content change.
10. The one or more non-transitory computer readable media of claim 8 , wherein the computer-executable instructions, when executed by the at least one processor, cause the at least one processor to:
determine whether the host content change was deployed on the host and authorized by a corresponding approved change order, deployed on the host without a corresponding approved change order, blocked on the host and authorized by a corresponding approved change order, or blocked on the host and not authorized by a corresponding approved change order.
11. The one or more non-transitory computer readable media of claim 8 , wherein, when the host content change request does not meet a change authorization policy specifying a time window during which host content changes to the persistent object are allowed, the change log information includes a time of the host content change request and an indication that the host content change was blocked.
12. The one or more non-transitory computer readable media of claim 8 , wherein an approved change order corresponding to the host content change indicates one or more time windows during which the host content change is authorized.
13. The one or more non-transitory computer readable media of claim 8 , wherein an approved change order corresponding to the host content change indicates one or more circumstances under which the host content change is authorized, wherein the circumstances include environmental settings at a particular time during which the host content change is authorized.
14. The one or more non-transitory computer readable media of claim 8 , wherein the host content change request is intercepted by the host and blocked by the host when the host content change is not authorized based on at least one change authorization policy.
15. The one or more non-transitory computer readable media of claim 8 , wherein the host content change request is intercepted by the host and allowed to take effect on the host when the host content change is determined to be authorized based on a set of change authorization policies.
16. The one or more non-transitory computer readable media of claim 8 , wherein the change log information of the host includes a separate entry for each host content change, and wherein the change log information is included in a set of change log information aggregated from a plurality of hosts in the network environment.
17. The one or more non-transitory computer readable media of claim 16 , wherein the one or more change authorization policies are included in a set of change authorization policies comprising at least one policy indicating a set of users, programs or entities that can make changes to a specified set of persistent objects during one or more specified time windows.
18. One or more non-transitory computer readable media having computer-executable instructions and when executed by at least one processor, cause the at least one processor to:
receive, from a separate computer system, at an agent module, a host content change request for a persistent object within a host computer;
apply, by the agent module, one or more change authorization policies to the host content change request to allow the host content change request when the host content change request meets the one or more change authorization policies, wherein at least one of the change authorization policies indicates a time window, during which host content changes are enabled for the persistent object;
record information associated with a host content change to the persistent object that results from the host content change request being allowed; and
provide the information to a reconciliation module to reconcile the host content change to a set of one or more approved change orders.
19. One or more non-transitory computer readable media having computer-executable instructions and when executed by at least one processor, cause the at least one processor to:
receive, from a separate computer system, at an agent module, a host content change request for a persistent object within a host computer;
apply, by the agent module, one or more change authorization policies to the host content change request to allow the host content change request when the host content change request meets the one or more change authorization policies, wherein at least one of the change authorization policies indicates a time window, during which host content changes are enabled for the persistent object;
when the host content change request is blocked, record information associated with the host content change request for the persistent object; and
provide the information to a reconciliation module to reconcile the host content change request to a set of one or more approved change orders.
20. The one or more non-transitory computer readable media of claim 19 , wherein the computer-executable instructions, when executed by at least one processor, cause the at least one processor to:
block the host content change request when the host content change request does not meet the at least one change authorization policy indicating the time window during which host content changes are enabled for the persistent object.