Methods for assuring security governance in managed computer systems
An agile governance system provides recommendations for infrastructure change requests concerning a cloud-based computer environment in accordance with security policies regarding data to be used in connection with applications impacted by the requests. The nature and character of the data is determined using an interactive dialog with a requesting entity. Possible responses provided by the requesting entity are mapped to security policy requirements, which, in turn, are used to determine infrastructure stack requirements. Where pre-approved solutions that satisfy the security needs for the requested infrastructure change exist, they are recommended; otherwise, the requesting entity is presented with the recommendation for the requested infrastructure change along with a list of required approvals and approvers.
1. A method, comprising:
receiving, at a server, an infrastructure change request issued from a requesting entity, the infrastructure change request concerning an agile information technology environment;
describing and classifying, by the server, the infrastructure change request on the bases of a nature and character of the agile information technology environment, and the requesting entity's specification of a nature and character of data intended to be collected, operated upon, and/or generated by an application running in the agile information technology environment in which the requested infrastructure change will be instantiated;
processing, by the server, the infrastructure change request according to data-centric, risk-based metrics that have associated security policies;
based on the security policies, the server producing and presenting recommendations for instantiations of the requested infrastructure change using, where available, pre-approved solutions for the requested infrastructure change, and when no pre-approved solution for the requested infrastructure change is available, derived recommendations, the server including with the derived recommendations a list of approvals required before the requested infrastructure change can be provisioned, and a list of approvers required to give said approvals; and
upon receipt of the approvals, one or more of the derived recommendations is added to a library of pre-approved solutions for infrastructure change requests.
2. The method of claim 1 , further comprising providing a recommended solution for the requested infrastructure change to an automated provisioning system for deployment in the agile information technology environment.
3. The method of claim 1 , wherein the requesting entity's specification of the nature and character of data intended to be collected, operated upon, and/or generated by the application running in the agile information technology environment in which the requested infrastructure change will be instantiated is received as responses to multiple choice questions presented via a user interface.
4. The method of claim 3 , wherein the multiple choice questions are presented by the server to the requesting entity dynamically such that each successive question is determined according to one or more of:
(i) the requesting entity's prior responses to previous responses;
(ii) a risk profile for the requested infrastructure change;
(iii) an agility profile for the requested infrastructure change;
(iv) deployment policies for components implicated by said infrastructure change;
(v) approved templates for provisioning of said infrastructure change in agile environments available to host said application; and
(vi) a time at which the requested infrastructure change will be provisioned.
5. The method of claim 1 , wherein the recommendations provide for use of an existing agile information technology environment but also require an exception to a pre-approved solution for deployment in that environment.
6. The method of claim 5 , wherein the recommendations permit use of an existing cloud infrastructure available to the requesting entity, but only if an exception to the pre-approved solution is permitted.
7. The method of claim 1 , wherein the recommendations provide for use of an existing agile information technology environment but also require custom provisioning.
8. The method of claim 1 , wherein the recommendations require custom development, installation, and provisioning of a solution.
9. A method, comprising:
receiving, at a server, an infrastructure change request issued from a requesting entity, the infrastructure change request concerning an agile information technology environment;
describing and classifying, by the server, the infrastructure change request on the bases of a nature and character of the agile information technology environment, and the requesting entity's specification of a nature and character of data intended to be collected, operated upon, and/or generated by an application running in the agile information technology environment in which the requested infrastructure change will be instantiated;
processing, by the server, the infrastructure change request according to data-centric, risk-based metrics that have associated security policies; and
based on the security policies, the server producing and presenting recommendations for instantiations of the requested infrastructure change using, where available, pre-approved solutions for the requested infrastructure change, and when no pre-approved solution for the requested infrastructure change is available, derived recommendations,
wherein the requesting entity's specification of the nature and character of data intended to be collected, operated upon, and/or generated by the application running in the agile information technology environment in which the requested infrastructure change will be instantiated is received as responses to multiple choice questions presented via a user interface, and
wherein the multiple choice questions are presented by the server to the requesting entity dynamically such that each successive question is determined according to one or more of:
(i) the requesting entity's prior responses to previous responses;
(ii) a risk profile for the requested infrastructure change;
(iii) an agility profile for the requested infrastructure change;
(iv) deployment policies for components implicated by said infrastructure change;
(v) approved templates for provisioning of said infrastructure change in agile environments available to host said application; and
(vi) a time at which the requested infrastructure change will be provisioned.
10. The method of claim 9 , further comprising providing a recommended solution for the requested infrastructure change to an automated provisioning system for deployment in the agile information technology environment.
11. The method of claim 9 , wherein when no pre-approved solution for the requested infrastructure change is available, the server including with the derived recommendations a list of approvals required before the requested infrastructure change can be provisioned.
12. The method of claim 11 , when no pre-approved solution for the requested infrastructure change is available, the server including with the derived recommendations a list of approvers required to give the approvals required before the requested infrastructure change can be provisioned.
13. The method of claim 12 , wherein upon receipt of the approvals, one or more of the derived recommendations is added to a library of pre-approved solutions for infrastructure change requests.
14. The method of claim 9 , wherein the recommendations provide for use of an existing agile information technology environment but also require an exception to a pre-approved solution for deployment in that environment.
15. The method of claim 14 , wherein the recommendations permit use of an existing cloud infrastructure available to the requesting entity, but only if an exception to the pre-approved solution is permitted.
16. The method of claim 9 , wherein the recommendations provide for use of an existing agile information technology environment but also require custom provisioning.
17. The method of claim 9 , wherein the recommendations require custom development, installation, and provisioning of a solution.