Method and apparatus for assessing policy compliance of as-built data networks

A computer-implemented system, comprising:

• one or more processors;
• one or more non-transitory computer-readable storage mediums containing instructions configured to cause the one or more processors to perform operations including:
• duplicating a pre-existing network environment by segmenting a pre-existing network into a plurality of defined zones, wherein a zone is defined by data elements and data associated with the data elements, and wherein interrelationships between zones are determined between two or more defined zones;
• querying the pre-existing network for all packet access, wherein packet access includes inter-zone packet access;
• summarizing inter-zone packet access;
• generating an access dataset using the summarized inter-zone packet access, wherein summarizing includes generating a summary including a list of one or more protocol and destination port combinations found directionally between zone accesses;
• receiving a policy set including a collection of approvals indicating whether a broad or narrow set of access is permissible;
• computing the status of the pre-existing network by comparing the access dataset with the policy set;
• and
• generating a compliance report using the computed status, wherein the compliance report is automatically re-generated and the status is automatically re-computed when a change to the pre-existing network environment is detected.

A computer-program product, tangibly embodied in a machine-readable non-transitory storage medium, including instructions configured to cause a data processing apparatus to:

• duplicate a pre-existing network environment by segmenting a pre-existing network into a plurality of defined zones, wherein a zone is defined by data elements and data associated with the data elements, and wherein interrelationships between zones are determined between two or more defined zones;
• query the pre-existing network for all packet access, wherein packet access includes inter-zone packet access;
• summarize inter-zone packet access;
• generate an access dataset using the summarized inter-zone packet access, wherein summarizing includes generating a summary including a list of one or more protocol and destination port combinations found directionally between zone accesses;
• receive a policy set including a collection of approvals indicating whether a broad or narrow set of access is permissible;
• compute the status of the pre-existing network by comparing the access dataset with the policy set;
• and
• generate a compliance report using the computed status, wherein the compliance report is automatically re-generated and the status is automatically re-computed when a change to the pre-existing network environment is detected.