Policy based network compliance

A system comprising:

• one or more processors;
• and
• memory storing computer executable instructions that when executed on the one or more processors causes the system to provide:
• a policy manager configured to:
• maintain a set of policies, each policy in the set including:
• i) a set of rules and corresponding violation criteria for rules within the set of rules;
• ii) a policy scope that indicates what resources from a network environment the rules in the policy are to be applied;
• iii) a policy compliance statement that defines a set of rule violations of varying severity that determine overall policy violation;
• define a range of severity levels, each of the rules having a severity level;
• identify, for each severity level, a threshold indicative of a cumulative number of violations of the rules in the set of rules included in the policy;
• and
• receive a user definition for the threshold for each policy, the threshold defining a number of rules of each severity that constitute a failure of the policy, each threshold independent of the threshold of other policies;
• a repository configured to receive gathered compliance data from observed network activity, the compliance data indicative of network resources;
• a violation processor configured to apply the set of policies and associated sets of rules to the gathered compliance data to calculate compliance results indicating compliance of those network resources represented by the compliance data;
• a network interface configured to automatically transmit notifications to alert at least one destination recipient of a threshold number of rule violations of a particular severity;
• and
• wherein the system processor is operable to maintain the network environment including the network resources in a predictable and manageable state by enforcing the set of policies based on the compliance results.

A computer program product having a non-transitory computer readable storage medium storing computer program logic embodied in computer program code encoded as a set of processor based instructions thereon for policy-based testing of network resource compliance comprising:

• computer program code for maintaining a set of policies, each policy in the set including:
• i) a set of rules and corresponding violation criteria for rules within the set of rules;
• ii) a policy scope that indicates what resources from a network environment the rules in the policy are to be applied;
• iii) a policy compliance statement that defines a set of rule violations of varying severity that determine overall policy violation;
• computer program code for defining a range of severity levels, each of the rules having a severity level;
• computer program code for identifying, for each severity level, a threshold indicative of a cumulative number of violations of the rules in the set of rules included in the policy defining failure of a particular policy;
• computer program code for gathering compliance data from observed network activity, the compliance data indicative of network resources, the network resources including hosts, services and connections, the hosts operable to execute applications, the services provided by the applications, and the connections operable to communicate between the applications, the gathered compliance data reflecting operation of the resources;
• computer program code for defining a policy for inclusion in the set of policies, each policy including a set of rules, each rule identifying an object, scope and condition applicable to test a particular subset of network resources;
• computer program code for applying the set of policies and associated sets of rules to the gathered compliance data to calculate compliance results indicating compliance of those network resources represented by the compliance data;
• computer program code for automatically transmitting notifications to alert at least one destination recipient of a threshold number of rule violations of a particular severity;
• and
• computer program code for maintaining the network environment including the network resources in a predictable and manageable state by enforcing the set of policies based on the compliance results.