System compliance based on a mix of hotpatches and coldpatches

A computer system for enacting compliance actions using an assessment that considers a mix of coldpatches and hotpatches, comprising:

• a processor;
• and
• a hardware storage device that stores computer-executable instructions that are executable by the processor to at least:
• identify one or more system policies that define one or more compliance conditions based on patching status of software components, including identifying a particular system policy that defines a particular compliance condition for a particular software component, the particular compliance condition defining a set of one or more hotpatch binaries to be applied to at least one coldpatched binary from which the particular software component is loaded;
• determine a patching state of the particular software component, including:
• identifying a plurality of evidence, each corresponding to a binary file of a plurality of binary files that has been applied to the particular software component, the plurality of binary files including (i) one or more coldpatched binary files from which the particular software component is loadable, and (ii) one or more hotpatch binary files applicable to the particular software component;
• and
• determining, based on the plurality of evidence, whether or not at least a subset of the one or more hotpatch binary files has been applied to a memory image into which an instance of the particular software component is loaded from at least a subset of the one or more coldpatched binary files within system memory at the computer system;
• based on the particular system policy, and based on the determined patching state of the particular software component, enact a compliance action for the particular compliance condition, the compliance action including at least one of:
• generating at least one of a health report or a health attestation, based at least on the patching state of the particular software component;
• initiating a patching action on the particular software component;
• or
• initiating an execution control action on the particular software component.

A computer program product comprising a hardware storage device that stores computer-executable instructions that are executable by a processor to cause a computer system to enact compliance actions using an assessment that considers a mix of coldpatches and hotpatches, the computer-executable instructions including instructions that are executable by the processor to cause the computer system to at least:

• identify one or more system policies that define one or more compliance conditions based on patching status of software components, including identifying a particular system policy that defines a particular compliance condition for a particular software component, the particular compliance condition defining a set of one or more hotpatch binaries to be applied to at least one coldpatched binary from which the particular software component is loaded;
• determine a patching state of the particular software component, including:
• identifying a plurality of evidence, each corresponding to a binary file of a plurality of binary files that has been applied to the particular software component, the plurality of binary files including (i) one or more coldpatched binary files from which the particular software component is loadable, and (ii) one or more hotpatch binary files applicable to the particular software component;
• and
• determining, based on the plurality of evidence, whether or not at least a subset of the one or more hotpatch binary files has been applied to a memory image into which an instance of the particular software component is loaded from at least a subset of the one or more coldpatched binary files within system memory at the computer system;
• based on the particular system policy, and based on the determined patching state of the particular software component, enact a compliance action for the particular compliance condition, the compliance action including at least one of:
• generating at least one of a health report or a health attestation, based at least on the patching state of the particular software component;
• initiating a patching action on the particular software component;
• or
• initiating an execution control action on the particular software component.