System under test analysis method to detect deficiencies and/or auto-corrections
An analysis system includes a control module generates data gathering parameters and data analysis parameters based on one or more inputs regarding an evaluation of a system aspect under test of a system, a data input module receives system gathered data regarding the system aspect under test to produce gathered data, and a data analysis module configured to generate the evaluation of the system aspect under test based on the data analysis parameters and the gathered data One or more databases store one or more of the gathered data, the data analysis parameters, and the evaluation of the system aspect under test and one or more data extraction modules interact with the system aspect under test to extract data from the system aspect under test in accordance with a respective portion of the data gathering parameters to produce the system gathered data and provide the system gathered data.
1. A method for execution by an analysis system that includes one or more computing entities operably coupled to a system via one or more networks, the method comprises:
determining, by the analysis system, a system aspect of at least a section of the system for evaluation from a system build perspective and from a system assets perspective;
obtaining, by the analysis system based upon the system aspect, discovered system build data for the at least the section of the system, wherein the discovered system build data includes one or more physical assets;
determining, by the analysis system, an evaluation aspect for evaluation of the at least the section of the system, wherein the evaluation aspect includes a system implementation perspective, a discovered perspective, a deficiency identification, and an auto-correction analysis of the one or more physical assets;
determining, by the analysis system from the discovered system build data and based upon the evaluation aspect, a plurality of deficiencies of the at least the section of the system, wherein the plurality of deficiencies includes a first type of deficiency and a second type of deficiency;
determining, by the analysis system, an auto-correction for each deficiency of the plurality of deficiencies to produce a plurality of auto-corrections; and
for auto-corrections associated with the first type of deficiency, interacting, by the analysis system, with the at least the section of the system to enact first auto-corrections to resolve deficiencies of the first type of deficiency.
2. The method of claim 1 , wherein the physical assets include at least one of:
a computing entity;
a computing device;
a user software application;
a system software application;
a software tool;
a network software application;
a security software application; or
a system monitoring software application.
3. The method of claim 1 further comprises:
for auto-corrections associated with the second type of deficiency, outputting a notification regarding the auto-corrections associated with the second type of deficiency.
4. The method of claim 3 , wherein the second type of deficiency includes one or more of an extra asset deficiency, a missing hardware deficiency, and a missing network connection deficiency.
5. The method of claim 1 , wherein the first type of deficiency includes one or more of a design deficiency, a build deficiency, a software deficiency, and an installation oversight deficiency.
6. The method of claim 1 , wherein the interacting with the at least the section of the system includes updating encryption software associated with the at least the section of the system.
7. The method of claim 1 , wherein the determining the evaluation aspect comprises: selecting the evaluation aspect based upon at least one of governmental and/or regulatory requirements, system resiliency requirements, security risk awareness and/or risk remediation information, security risk avoidance, performance optimization information, system development guidelines, software development guidelines, hardware requirements, networking requirements, networking guidelines, and/or other system proficiency guidance.
8. The method of claim 1 , further comprising the analysis system producing and outputting a deficiencies report for the at least the section of the system based upon the plurality of deficiencies.
9. The method of claim 1 , wherein:
the obtaining the discovered system build data for the at least the section of the system includes digitally communicating with the at least the section of the system by the analysis system to identify the physical assets of the at least the section of the system; and
based upon the identification of the physical assets, determining by the analysis system, the discovered system build data for the at least the section of the system.
10. The method of claim 1 , wherein the determining, by the analysis system that includes the one or more computing entities, the at least the section of the system comprises at least one of:
selecting the system to evaluate organization awareness of the system;
selecting the at least the section of the system as an organization division of a plurality of organization divisions;
selecting the at least the section of the system as a department of the organization division of the plurality of organization divisions;
selecting the at least the section of the system as a group of the department of the organization division of the plurality of organization divisions;
selecting the at least the section of the system based on a physical asset; and
selecting the at least the section of the system based on a conceptual asset type.
11. A method for execution by an analysis system that includes one or more computing entities operably coupled to a system via one or more networks, the method comprises:
obtaining, by the analysis system, discovered system build data for at least a section of the system, wherein the discovered system build data includes a plurality of discovered system assets including a plurality of networking devices, a plurality of computing entities, and a plurality of software assets;
determining, by the analysis system, a first evaluation aspect for evaluation of the discovered system build data for the at least the section of the system, wherein the first evaluation aspect includes a system test perspective;
obtaining, by the analysis system, system test data corresponding to the first evaluation aspect;
engaging, by the analysis system, with the at least the section of the system to produce system test results for the at least the section of the system in response to the system test data;
determining, by the analysis system, a second evaluation aspect for evaluation of the at least the section of the system, wherein the second evaluation aspect includes a system deficiencies perspective;
processing, by the analysis system, the system test results and the second evaluation aspect to identify a plurality of deficiencies of the at least the section of the system, wherein the plurality of deficiencies includes a first type of deficiency and a second type of deficiency;
determining, by the analysis system, an auto-correction for each deficiency of the plurality of deficiencies to produce a plurality of auto-corrections; and
for auto-corrections associated with the second type of deficiency, outputting, by the analysis system, a notification regarding the auto-corrections associated with the second type of deficiency.
12. The method of claim 11 , wherein the first type of deficiency includes one or more of a design deficiency, a build deficiency, a software deficiency, and an installation oversight deficiency.
13. The method of claim 11 , wherein the second type of deficiency includes one or more of an extra asset deficiency, a missing hardware deficiency, and a missing network connection deficiency.
14. The method of claim 11 further comprises:
for auto-corrections associated with the first type of deficiency, interacting, by the analysis system, with the at least the section of the system to resolve the first type of deficiencies.
15. The method of claim 14 , wherein the interacting with the at least the section of the system includes updating one or more of a policy, a process, a procedure, and a documentation associated with the at least the section of the system.
16. The method of claim 14 , wherein the interacting with the at least the section of the system includes updating encryption software associated with the at least the section of the system.
17. The method of claim 11 , wherein the obtaining the system test data comprises:
selecting the system test data based upon at least one of governmental and/or regulatory requirements, system resiliency requirements, security risk awareness and/or risk remediation information, security risk avoidance, performance optimization information, system development guidelines, software development guidelines, hardware requirements, networking requirements, networking guidelines, and/or other system proficiency guidance.
18. The method of claim 11 , further comprising the analysis system producing and outputting a deficiencies report for the at least the section of the system based upon the plurality of deficiencies.
19. The method of claim 11 , wherein determining, by the analysis system, with the at least the section of the system, the discovered system build data for the at least the section of the system includes:
digitally communicating with the at least the section of the system by the analysis system to identify system assets of the at least the section of the system, the system assets including a plurality of networking devices, a plurality of computing entities, and a plurality of software assets; and
based upon the identification of the system assets of the plurality of computing entities, determining by the analysis system, the discovered system build data for the at least the section of the system.
20. The method of claim 11 , wherein engaging, by the analysis system, with the at least the section of the system to produce system test results for the at least the section of the system in response to the system test data comprises digitally communicating with the at least the section of the system by the analysis system to monitor operation of system assets of the at least the section of the system in response to application of the system test data, the system assets including a plurality of networking devices, a plurality of computing entities, and a plurality of software assets.