Systems and methods for automated governance, risk, and compliance
AssigneeServiceNow, Inc.
InventorsDavid Barkovic, Cresta Kirkwood, Lal Narayanasamy, Anushree Randad, Clifford Huntington, Richard Reybok, Harold Byun
Life of this patent
Estimating the term…
Abstract
Systems and methods for configuration vulnerability checking and remediation are provided. The systems provided herein map vulnerability data with compliance data, such that automated compliance indication may be facilitated.
Claims20
A tangible, non-transitory, machine-readable medium, comprising machine-readable instructions, that when executed by one or more processors, cause the processors to:
- retrieve, from one or more application programming interfaces (APIs), a set of Secure Configuration Assessment (SCA) data, the SCA data comprising configuration test results for a set of configuration tests evaluated against one or more configuration items (CIs);
- normalize and store the set of SCA data as normalized SCA data, such that SCA data provided from different SCA providers is stored in a common format;
- and
- present the normalized SCA data in a configuration compliance dashboard configured to provide an indication of compliance to a set of controls by the CIs.
A tangible, non-transitory, machine-readable medium, comprising machine-readable instructions, that when executed by one or more processors, cause the processors to:
- retrieve compliance data for a configuration item (CI), via a SCA source application programming interface (API);
- retrieve an authoritative policy from an authoritative source API;
- access a mapping between a subset of the compliance data and the authoritative policy;
- and
- present a compliance status of the CI to the authoritative policy, based upon the subset of the compliance data.
A system, comprising:
- a network, comprising a plurality of configuration items (CIs);
- a platform configured to present information regarding the CIs, the platform comprising:
- a Secure Configuration Assessment (SCA) data integration, configured retrieve configuration test and configuration test result information for the CIs;
- an Authoritative Source integration, configured to retrieve an authoritative policy for security configurations of the CIs, the authoritative policy comprising a set of policy statements;
- and
- a database configured to store a set of services associated with the CIs;
- and
- a management, instrumentation, and discovery (MID) server, configured to facilitate data transfer between the CIs and platform, the data enabling presentation of the information regarding the CIs via the platform;
- wherein the platform is configured to:
- map at least one configuration test and configuration test result to at least one particular policy statement;
- identify a risk of non-compliance with at least one policy statement based upon:
- the criticality of the services associated with a CI that at least one configuration test and configuration test result pertains to;
- and
- the criticality of at least one policy statement, as indicated by the retrieved authoritative policy;
- and
- render an indication of:
- a compliance status of the configuration test and configuration test result to the at least one particular policy statement, the identified risk of non-compliance with the at least one policy statement, or both.
Dependencies are inferred from the claim text.