System and method for detection of non-compliant software installation

A computer-implemented security method for detecting non-compliant software installation, the method comprising:

• storing a mapping of each of more than two defined authorization policies to one of two states;
• for a first device associated with one of the defined authorization policies, setting a state of the first device to the one of the two states to which the policy, with which the first device is associated, is mapped;
• and
• on a periodic basis:
• determining which of the two states is set for the first device;
• and
• depending on which of the two states is determined in the determining step to be set for the first device, either (i) determining whether to generate a baseline representation of modules stored on the first device, or (ii) comparing a current representation of modules stored on the first device to the baseline representation.

A hardware computer-readable medium having a program stored thereon, the program being executable by a processor, comprising:

• a program code arrangement for detecting a non-compliant software installation by performing the following:
• checking and determining a status of a flag;
• where the flag is determined to be set to a first state, generating and storing a baseline representation of modules stored on a device;
• and
• where the flag is determined, in the checking step, to be set to a second state,
• generating an active representation of modules stored on the device,
• comparing the active representation of modules to the baseline representation of modules,
• determining if there is a difference between the baseline and the active representations of the modules, and
• outputting an alert if there is a difference between the baseline and the active representations of the modules.

A computer-implemented security method for detecting a non-compliant software installation, the method comprising:

• at least one processor performing the following on a periodic basis:
• determining a settable state of a device;
• and
• depending on the settable state of the device, either:
• (i) generating a baseline representation of software modules stored on the device;
• or
• (ii) comparing a current representation of the software modules stored on the device to a previously generated baseline representation of the software modules stored on the device, and outputting an alert if a discrepancy is determined in the comparing step.

A computer-implemented security method for detecting non-compliant software installation, the method comprising:

• on a set periodic basis, a computer processor executing program instructions, the instructions configured to, in each of the periods, cause the processor to:
• generate an active representation of executable software modules stored on a first device;
• and
• compare the generated active representation to a baseline representation of executable software modules stored on the first device to determine whether there has been change;
• and
• for each of at least one of the periodic comparisons whose result indicated the change, output an alert;
• and
• subsequent to the start of the periodic execution of the program instructions, in response to presence of a predetermined state, storing a new version of the baseline representation of executable software modules for the comparison to the active representations generated in subsequent ones of the periods of the periodic execution.