Data-centric monitoring of compliance of distributed applications

Log(s) of IT events are accessed in a distributed system that includes a distributed application. The distributed system includes multiple data objects. The distributed application uses, processes, or otherwise accesses one or more of data objects. The IT events concern the distributed application and concern accesses by the distributed application to the data object(s). The IT events are correlated with a selected set of the data objects. Risks are estimated to the selected set of data objects based on the information technology events. Estimating risks uses at least ranks of compliance rules as these rules apply to the data objects in the system, and vulnerability scores of systems corresponding to the set of data objects and information technology events. Information is output that allows a user to determine the estimated risks for the selected set of data objects. Techniques for determining ranks of compliance rules are also disclosed.

BACKGROUND

The present invention relates to networks, and more particularly to data-centric monitoring of compliance of applications.

Existing compliance monitoring systems focus on IT events. For instance, one common monitoring system is intrusion detection, which is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents, such as violations or imminent threats of violation of computer security policies, acceptable use policies, or standard security practices. Another example is log analysis for intrusion detection, which is the process used to detect attacks on a specific environment using logs as the primary source of information.

Meanwhile, regulatory compliance requirements focus on data protection and privacy. For instance, the Health Insurance Portability and Accountability Act (HIPAA) regulation impacts those in healthcare that exchange patient information electronically. HIPAA regulations were established to protect the integrity and security of health information, including protecting against unauthorized use or disclosure of the information. For HIPAA, a security management process must exist in order to protect against “attempted or successful unauthorized access, use, disclosure, modification, or interference with system operations”.

Other laws and rules such as the Family Educational Rights and Privacy Act (FERPA) also require that information is to be protected for compliance requirements. These compliance requirements are currently being met by focusing on IT events.

For a distributed system, IT events (such as a privileged user login) on one component (e.g., holding keys) of the system may affect the protection of data on another component (e.g., holding encrypted data that can be decrypted using the keys) of the system. A system that focuses solely on IT events may not be able to capture such relationships, especially since the privileged user login might not be an IT event that would be considered an intrusion or other insecure network access and there may not be anything that links the login on one component to the data on another component.

SUMMARY

This section is intended to include examples and is not intended to be limiting.

An exemplary embodiment is a method for monitoring state of compliance of a distributed application in a data-centric manner. The method includes accessing, by a computer system, one or more logs of information technology events in a distributed system comprising the distributed application. The distributed system comprises a plurality of data objects, and the distributed application uses, processes, or otherwise accesses one or more of the plurality of the data objects. The information technology events concern the distributed application and concern accesses by the distributed application to one or more of the data objects. The method includes correlating, by the computer system, the information technology events with a selected set of the plurality of data objects. The method further estimating, by the computer system, risks to the selected set of data objects based on the information technology events. The estimating risks uses at least ranks of compliance rules as these rules apply to the data objects in the system and vulnerability scores of systems corresponding to the set of data objects and information technology events. The method includes outputting, by the computer system, information allowing a user to determine the estimated risks for the selected set of data objects.

In another exemplary embodiment, a computer system is disclosed for monitoring state of compliance of a distributed application in a data-centric manner. The computer system comprise one or more memories comprising computer-readable code and one or more processors. The computer system performs the following responsive to execution by the one or more processors of the computer-readable code: accessing one or more logs of information technology events in a distributed system comprising the distributed application, wherein the distributed system comprises a plurality of data objects, and the distributed application uses, processes, or otherwise accesses one or more of the plurality of the data objects, and wherein the information technology events concern the distributed application and concern accesses by the distributed application to one or more of the data objects; correlating the information technology events with a selected set of the plurality of data objects; estimating risks to the selected set of data objects based on the information technology events, wherein estimating risks uses at least ranks of compliance rules as these rules apply to the data objects in the system and vulnerability scores of systems corresponding to the set of data objects and information technology events; and outputting information allowing a user to determine the estimated risks for the selected set of data objects.

In yet another exemplary embodiment, a method is disclosed for determining ranks of compliance rules. The method includes the following: identifying dependencies between a plurality of compliance rules, wherein the compliance rules are defined by one or more regulations; representing the dependencies as a graph having nodes and edges, wherein each node represents a compliance rule or a group of compliance rules, and wherein each edge is a directed edge from a first node to another node such that the first node is dependent on the other node; traversing, by the computer system, the graph and computing rank of each node using one of a recurrence relation or dynamic programming; and outputting, by the computer system, the rank of each node, wherein each node is a rank of a compliance rule or a group of compliance rules.

DETAILED DESCRIPTION

As stated above, a system that focuses solely on IT events may not be able to capture relationships that nonetheless could impact security. To correct this, as described herein, methods, systems, and computer program products for data-centric compliance monitoring are disclosed. These bridge the gap between IT events and data protection as needed by regulatory compliance, and may be considered to be “big data” for compliance monitoring. The term “big data” refers to data sets that are so large or complex that traditional data processing applications are inadequate.

In brief, the techniques herein move from IT-centric monitoring to data-centric monitoring for, e.g., regulatory compliance. In an exemplary embodiment, IT events are translated from one or more components in a system to a risk associated with one or more associated sensitive data items. Consider the following example. A privileged user logs into a VM that is processing a genomic data item with a UUID of id1. This event contributes to an increase of the risk associated with the data item with the UUID of id1. This risk is a risk that the access might cause a breach of compliance regulations as well as may lead to data breaches.

In other exemplary embodiments, risks of each data item are estimated dynamically based on, e.g., distributed IT events, rank of regulatory compliance rules, sensitivity of data items, and component vulnerabilities. Such a system may then be a system for a data-centric monitoring dashboard using “big-data”, as described in more detail below. More detailed description of exemplary techniques provided herein for data-centric monitoring of compliance of applications is provided after an introduction is provided to an exemplary system that might be used for such monitoring.

Turning now toFIG. 1, this figure illustrates an exemplary system100used for data-centric monitoring of compliance of applications in an exemplary embodiment.FIG. 1illustrates one possible example and there are many others, such as systems with webservers, application servers, and cloud applications and servers. The system100comprises the computer systems110and120-1through120-x, which communicates in part via the networks125-1and125-2. The computer system110is a computer system that performs compliance monitoring in this example, and it should be noted that there could be multiple systems110performing such compliance monitoring. The computer systems120are the monitored computer systems. In this example, there is a network125-1of computer systems120-1through120-n, and another network125-2of computer systems120-mthrough120-x. The letters n, m, and x have no meaning other than to distinguish separate systems. There could be one network125or multiple networks125. For instance, the network125-1could be a local area network (LAN), while the network125-2could be a wide area network (WAN) or the Internet or the “cloud”, e.g., and one or more of the computer systems120-mthrough120-xcould be a webserver or a cloud-based server or an application server. The computer systems120could all be outside the Internet (as a network)125, as another example, and communicate to other computer systems120solely via the Internet. Many other possibilities exist, too.

The computer system110comprises one or multiple processors150, one or more multiple memories155, interface circuitry178, and one or more network (N/W) interfaces (I/F(s))113. The computer system110may include or be connected to one or more user interface elements173. The one or more memories155comprise a data-centric monitor101, provided information107, logged IT events111, compliance information175, and dashboard information108. The data-centric monitor101comprises functionality as described herein and comprises computer-readable code that, when executed by the one or more processors150, cause the computer system110to perform the functionality described herein. The encryptor101may also be implemented (in part or completely) as hardware, such as being internal to the one or more processors150.

In this example, a user (a human being, not shown) is using the computer system110and is viewing a dashboard195, which allows the user to determine, e.g., risks associated with data objects. This is described in more detail below. The user interface elements173could therefore include a display upon which the dashboard195is shown. The dashboard information108includes information to allow the dashboard195to be presented to the user. It should be noted that the compliance monitoring computer system110could be a server or the like, and a user using a monitored computer system120(or other computer system) could access the compliance monitoring computer system110and show a dashboard on the monitored computer system120or other computer system.

For ease of reference, it is assumed all of the monitored computer systems120are similar, and a block diagram of the internals of only one monitored computer system120is shown inFIG. 1. The computer system120comprises one or multiple processors170, one or more multiple memories180, interface circuitry188, and one or more network (N/W) interfaces (I/F(s))118. The computer system120may include or be connected to one or more user interface elements183. The one or more memories180may comprise some or all of an OS102, middleware127, application(s)115, and data objects160. It should be noted that although these descriptions use the multiple version of the nouns, these may also be singular. The OS102is a collection of software that directs a computer's operations, controlling and scheduling the execution of other programs, and managing storage, input/output, and communication resources. Middleware127represents software that serves to connect separate, often complex and already existing, programs. The data objects160are the objects that can be tracked in terms of compliance. Applications115are applications that use, process, or otherwise access the data objects160, and one example of these is described in reference toFIG. 2A.

The computer readable memories155and180may be of any type suitable to the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor based memory devices, flash memory, magnetic memory devices and systems, optical memory devices and systems, fixed memory and removable memory, or some combination of these. The computer readable memories155and180may be means for performing storage functions. The processors150and170may be of any type suitable to the local technical environment, and may include one or more of general purpose processors, special purpose processors, microprocessors, gate arrays, programmable logic devices, digital signal processors (DSPs) and processors based on a multi-core processor architecture, or combinations of these, as non-limiting examples. The processors150and170may be means for performing functions, such as controlling the computer systems110and120, respectively, and other functions as described herein.

The network interfaces113and118may be wired and/or wireless and communicate over the Internet/other network125via any communication technique. The insecure communication medium105may also be a wireless communication channel, or any other medium over which data can be communicated.

The user interface elements173and183may include, for instance, one or more of keyboards, mice, trackballs, displays (e.g., touch screen or non-touch screen), and the like. The computer systems110and120may be personal computer systems, laptops, and wireless devices such as smartphones and tablets.

Turning toFIG. 2A, this figure illustrates an example of a multi-tier distributed application115in accordance with an exemplary embodiment. A distributed application115is an application that is executed or run on multiple computers within a network. These applications interact in order to achieve a specific goal or task. Traditional applications relied on a single system to run them. Even in the client-server model, the application software had to run on either the client, or the server that the client was accessing. However, distributed applications run on both simultaneously. With distributed applications, if a node that is running a particular application goes down, another node can resume the task. A distributed application also may be used in the client-server model when used simultaneously on a server and client computer. The front end of the operation runs on the client computer and requires minimal processing power, while the back end requires a lot more processing power and a more dedicated system and runs on a server computer.

FIG. 2Aalso shows a web server116, an application server117such as a WebSphere Application Server (WAS), and a database119such as a DB2 database, each of which is located in the cloud50. IBM DB2 is a family of database server products developed by IBM. Each component115,116,117, and119may be running on a VM (virtual machine), container, or a stand-alone system. References123-1,123-2,123-3, and123-4illustrate that each of the components115,116,117, and119may be running on a VM (virtual machine), container, or a stand-alone system. VMs are guest systems running on a host system and managed by a Hypervisor or such other software. Containers are virtual systems with low footprint. A stand-alone system could be illustrated by a computer system120. A host system could also be illustrated by one or more of the computer systems120, and the VM would be in the memory/memories170, and would be executed by the one or more processors170. More detail on possible cloud implementations of a distributed application115are provided below. Each component115,116,117, and119may be include or use a local storage197(197-1,197-2,197-3, and197-4, respectively). The system inFIG. 2Aalso includes shared (e.g., virtual) storage service198, and each component115,116,117, and119has access to this shared storage service198.

Characteristics are as follows:

Service Models are as follows:

Deployment Models are as follows:

Referring now toFIG. 2C, a set of functional abstraction layers provided by cloud computing environment50(FIG. 2B) is shown. It should be understood in advance that the components, layers, and functions shown inFIG. 2Care intended to be illustrative only and embodiments of the invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

Workloads layer90provides examples of functionality for which the cloud computing environment may be utilized. Examples of workloads and functions which may be provided from this layer include: mapping and navigation91; software development and lifecycle management92; virtual classroom education delivery93; data analytics processing94; transaction processing95; and application96, which is an embodiment of application115in this example.

The instant techniques might be best presented from the point of view of a user using the system, so this aspect will be described first. After that, additional detail on exemplary implementations will be described.

Referring toFIG. 3, this figure is an example of a dashboard200presented to a user for data-centric monitoring of compliance of applications, in an exemplary embodiment. The dashboard200is one way of representing risks to a user, but the instant embodiments are not limited to this particular technique. The dashboard200is an example of the dashboard195ofFIG. 1, and the display200is one example of the user interface element(s)173. The dashboard200is entitled “Risk Overview”, and each column210corresponds to days of the month (from April 29, through all of May, and to part of June 3rd), while each row230corresponds to an indicator235-1through235-28of a VCF object250-1through250-28(that is, an object in the VCF format), respectively, and includes a unique ID (e.g., bf001 . . . , 1ffc1d . . . ), which is the UUID in this example. Each indictor235therefore has a one-to-one correspondence with a VCF object250. The VCF objects are examples of data objects160that are being monitored. The dashboard may show all the data objects250/160being monitored but for large systems100will likely show only a set of the data objects250/160but not all the data objects. The dashboard195focuses therefore on risks to data, which are unique VCF objects250. At each entry240, some indication is made to quantify the risk accruing due to, e.g., a user, the network, and application events associated with a corresponding VCF object250for the particular day. Risks can be estimated to be, e.g., a value between 0-1 or 0-100 and this value can be shown as a color on the dashboard. One way to indicate the risks is via the color of each entry240. Since the figure is in black and white, a description of the coloring will have to suffice. A “normal” risk (e.g., low risk) is indicated by reference240-4and may be dark green; a higher risk is indicated by reference240-1and may be light green; an even higher risk is indicated by reference240-3, which may be pinkish; and the highest risk is indicated by reference240-2, which is red. Other schemes, such as using a numbering system (e.g., higher numbers indicate higher risks) or lettering system (e.g., H for high, M for medium, L for low) may be used. Using color is simply one approach, and many other approaches are valid.

The user has the ability to select an entry250to get more detail about the risk.

Now that one example from point of view of a user using the system has been presented, additional detail on exemplary implementations is described.

Referring now toFIG. 4, which includesFIGS. 4A, 4B, and 4C, this figure is a logic flow diagram for data-centric monitoring of compliance of applications. This figure also illustrates the operation of an exemplary method, a result of execution of computer program instructions embodied on a computer readable memory, functions performed by logic implemented in hardware, and/or interconnected means for performing functions in accordance with exemplary embodiments. Many of the blocks inFIG. 4are assumed to be performed by the compliance monitoring computer system110, e.g., under control in part by the data centric monitor101. That is, the data centric monitor101is programmed via computer-readable code and/or hardware logic to cause the compliance monitoring computer system110to perform blocks inFIG. 4(and alsoFIG. 5).

In reference toFIG. 4A, the compliant paths and configurations305, compliance rules/policies and ranks310, authorized events315, authorized/permitted data and control flow events320, and vulnerabilities325are provided by a user (e.g., as provided information107ofFIG. 3). The vulnerabilities325may include vulnerability scores326, which are provided. These scores are available from CVE (CVSS scores as per NVD), vulnerability scan reports, APPSCAN dynamic scans, and APPSCAN source scans, and other sources. APPSCAN is an IBM product that enhances web application security and mobile application security, improves application security program management and strengthens regulatory compliance, by scanning web and mobile applications prior to deployment. CVE is a list of information security vulnerabilities and exposures that aims to provide common names for publicly known problems. Ranks of compliance rules (see reference310) are used to assign degrees of importance to each compliance rule. Each compliance regulation has a number of rules (HIPAA has 59 rules). Ranks are assigned to each of these rules such that if a rule X has a rank of 10 and another rule Y has a rank of 5, then X has more weightage than Y. In another implementation of this method, X maybe regarded to have less weightage than Y because X has higher rank than Y. These ranks are either pre-specified to the system, or are computed by a method.

In block340, the compliance monitoring computer system110gets (e.g., collects) logged IT events (e.g., and may store these as the logged IT events111ofFIG. 1). For instance, the compliance monitoring computer system110could collect logs of events as follows: each event ‘e’ is directly or indirectly related to an action on a data object160. Each logged event could contain (for instance) the following: the system/component where the log was generated; what was the data object160(such as UUID referring to that object); when the event occurred and or the duration; userid(s) associated with the event; IP address(s) for the event; other data objects160and/or information for the event. In an exemplary embodiment, an access of a user to a system that is processing or has stored the sensitive data is a ‘related event’. The compliance monitoring computer system110may receive logs from different system components, application components, middleware components as well as network and non-functional components. The events are collected by each component in the distributed application and the underlying system and stored in the respective log management system or a file system. Some components may or may not log their events. The logs are then collected from each of these log management systems or file systems and brought to the data-centric compliance monitoring (DCCM) system (e.g., compliance monitor110) via a pull or push method or a combination of push and pull methods depending on the types of components. In a pull method, the DCCM system collects the data from the log management systems, whereas in push method the log management system of one or more components sends the logs to the DCCM. The log collection by DCCM can be real-time.

In block335, the compliance monitoring computer system110performs big data for log analytics. Big data in this context includes data analysis over a large dataset. Block335receives information from blocks305,310,315,320,325, and340. One example of possible data analysis is shown inFIG. 4B.

InFIG. 4B, the compliance monitoring computer system110identifies in block336a set of compliance rules to be monitored. The set of compliance rules to be monitored are specified by compliance rules/policies, and ranks310.

In block337, the compliance monitoring computer system110identifies a set of sensitive data objects160. This set of sensitive data objects (such as healthcare records) are objects160that need to be protected as part of the compliance requirements (e.g., as per the compliance rules/policies in310), and may identify other data objects (such as keys, passwords) that are used to protect the data objects160and the system. Sensitive data objects stored/processed/transmitted by an application are specified by the system administrator and/or the application administrator.

In block338, the compliance monitoring computer system110identifies entities of a service (a service is a running instance of the distributed application) that are authorized to carry out some form of access to a sensitive data object160. Such entities may be stored in the storage components local197and shared198, and may be network devices (such as intrusion protection services, firewalls, routers and switches, VPN gateways, as examples), and other entities of the service that are authorized to some form of access to a sensitive data object160. Data flow and control flow paths and configurations of the applications that are compliant with respect to the compliance requirements305, compliance rules and ranks310, authorized events315, authorized and permitted data and control flow events320and vulnerabilities of the application components325are specified by the system and/or application administrator and such information is subject to change. The identified entities may store, transmit, process, or get temporary storage for a data object160. Block338may include identifying the time and other meta-data associated with such authorized access.

The compliance monitoring computer system110in block339identifies a set of authorized events (e.g., using the supplied authorized events315) that have occurred in the logged IT events. Such events may include events classified as “normal”. The authorized events may include accesses and operations on the sensitive data objects160with other meta-data, characterized in an example as the following: what (e.g., IDs of data objects160); where (e.g., IP addresses/component names); who (e.g., user IDs); when (e.g., time and/or duration); and how (e.g., operation to gain access, what other information used, etc.), and the like.

Returning toFIG. 3A, in block330, the compliance monitoring computer system110assigns ranks (e.g., weights) to compliance rules. This may use a pre-defined table of ranks, such as one provided by the compliance rules/policies, and ranks310.

In block331, the compliance monitoring computer system110identifies a vulnerability (or vulnerabilities) of the system using an attack graph of the application115. The attack graph is an input to the method ofFIG. 4.

In block345, the compliance monitoring computer system110correlates events for data objects160. Specifically, the compliance monitoring computer system110may correlate the log events based on the ID (e.g., UUID) of data objects160. Additionally, the compliance monitoring computer system110may pivot streams from the log(s) to be indexed by the specific data item (e.g., specified by the ID). Pivoting the streams means the data streams are matched and co-related with respect to a specific identifier(s) such as UUID specifying data objects. Events may be correlated across time, IP addresses, user names, and the like. Block345receives information from block335.

The compliance monitoring computer system110in block350identifies events that are not authorized. Such unauthorized may include anomalous events and include accesses/operations to sensitive data objects160(e.g., identified previously in block337). Block350uses information at least from blocks315,320,335and345.

In block355, the compliance monitoring computer system110identifies potential vulnerabilities. In particular, the compliance monitoring computer system110can identify potential vulnerabilities of the system/components that have access to the sensitive data objects160(e.g., determined in block337). Block355uses data from at least from blocks345and350.

The compliance monitoring computer system110in block360maps each of these unauthorized events to the compliance rules (e.g., the compliance rules to be monitored determined in block336). Block360uses information from block355and350. Output from block360may include a set of compliance rules and policies being violated365, where the degree of compromise370is non-zero. Concerning the degree of compromise370, the degree of compromise is a measure that is estimated based on the vulnerabilities of the components and the unauthorized events and sensitivity of data that have been exposed. The degree of compromise370varies from 0-1, 0 (zero) being the fact that the application is not compromised at all (e.g., no unauthorized events have occurred), and 1 (one) being that the application has been compromised such that all the sensitive data may have been breached.

In block375, the compliance monitoring computer system110computes risk. Block375takes input from blocks330,350,365, and370. Examples of block375are shown inFIG. 4C. The compliance monitoring computer system110computes (block376) risk of non-compliance for each data object160, such as risk associated with the unauthorized events previously determined in block350. For example, block376may entail computing risk based on one or more of the following: a size of the data object160; a “weight” assigned to the data object160; weights assigned to the compliance rules; weights assigned to the anomalous events (with respect to the weights of the normal events); and/or vulnerabilities of the system. Additionally, block376may include aggregating the weights. One example is to aggregate the risks and normalize the aggregated value to 0-100. One such example technique would be to aggregate the following risks: risk of each data object, each anomalous event, each compliance rule, each vulnerability in the system as per block331, and such other risks. Each risk is either the weight of the entity or multiplication of the weights (such as for each data object: multiply the size in bytes with the weight of the anomalous events associated with that data object).

Block375may also include block337, where the compliance monitoring computer system110computes risk of non-compliance for each component, and in turn for the service. Block377may include computing risk of non-compliance for each component, and in turn for the service from the individual measures of risk-of-non-compliance of each of the data objects160.

The compliance information175fromFIG. 1may capture any compliance information such as blocks365and370, and the output of block375(compute risk). The compliance information175is then used to perform block380.

In block380, the compliance monitoring computer system110outputs dashboard information, which may be thought of as information allowing a user to determine the estimated risks for the selected set of data objects. Such information may be used to display a dashboard195to a user on a display, for instance, or could be data suitable for use for another computer (such as a webserver) to be able to display the dashboard or some other display system for viewing risk associated with data objects. In another example, block380can actively display the dashboard information, as described inFIG. 5.

Turning toFIG. 5, this figure is a logic flow diagram for displaying and updating a dashboard used for data-centric monitoring of compliance of applications in an exemplary embodiment. This may be considered one implementation of block380ofFIG. 4.FIG. 5also illustrates the operation of an exemplary method, a result of execution of computer program instructions embodied on a computer readable memory, functions performed by logic implemented in hardware, and/or interconnected means for performing functions in accordance with exemplary embodiments. The blocks inFIG. 5are assumed to be performed by the compliance monitoring computer system110, e.g., under control in part by the data centric monitor101. That is, the data centric monitor101is programmed via computer-readable code and/or hardware logic to cause the compliance monitoring computer system110to perform blocks inFIG. 5.

In block405, the compliance monitoring computer system110presents a representation on dashboard for each data object and associated risks of that data object. Such representations may be, for instance, the colored entries240ofFIG. 3, each of which corresponds to a VCF object250. One example is therefore to color-code the risk, where risks 0-100 are represented in a scale from green to red. Many other examples are possible. Also, the dashboard195inFIG. 3is based on a time scale (days in the example ofFIG. 3), but other representations for data objects160/250are possible, such as monitored computer systems120, virtual machines, networks, and the like.

The user is allowed to select a representation (such as a colored entry240) and it is determined in block410if the user does select a representation of an object. If the user does select a representation of a data object160/250(block410=Yes), flow proceeds to block415, where the compliance monitoring computer system110presents detailed representation on the dashboard195for selected data object160. See block415. Examples of such detailed representation include (block420) displaying on the dashboard one or more of: 1) details of the events (e.g., abnormal and/or normal) associated with the data object during a selected duration; and/or 2) details of the risk, compliance rules and associated weights; and/or 3) risks of the complete service, and components associated with the data object. Note that, depending on implementation, the user may be able to delve deeper into any or all of 1), 2), and/or 3), too, although this is not shown inFIG. 5.

In block425, the compliance monitoring computer system110allows the user to move to the overview (e.g., as illustrated by dashboard195ofFIG. 3). If the user does not move to the overview (e.g., by clicking on a “back” button or anything else that can let the compliance monitoring computer system110know the user wants to move to the overview) (block425=No), flow goes back to block415. If the user does want to move to the overview (block425=Yes) or if the user does not select a representation of a data object160/250(block410=No), in block430the compliance monitoring computer system110provides the user with an opportunity to select one or more of the following: a specific time duration; a set of data objects; a set of systems or users; a set of each of these entities related to one or more data objects/time/system. If the user selects different monitoring information (block435=Yes), the compliance monitoring computer system110in block440displays risks, events associated with the those entities and durations. If the user does not select different monitoring information (block435=No) or block440has been performed, the flow proceeds to block405.

It is noted that the user (e.g., a person) using the system would typically perform mitigation of the risk for the data objects. For instance, if there is a computer system that is allowing unauthorized users access to restricted data objects, then the user would determine why the computer system is allowing the unauthorized users access and correct this.

Turning toFIG. 6, this figure is another way of looking at a portion of the exemplary system ofFIG. 1based on part of the description ofFIG. 4. In the application-specific details610, the compliant paths and configurations305, the authorized events315, and the authorized/permitted data and control flow events320have been placed. The application-specific details620include such items as CVEs, NVD information, and vulnerability scans by Nessus (which is a vulnerability scanner for auditors and security analysts and a tool designed to automate the testing and discovery of known security problems). The application-specific details620can be considered to be part of the logged IT events340. The compliance rules/policies, and ranks310are also shown. The application115that is being monitored can be monitored on the cloud50, or on a non-cloud infrastructure. The compliance monitor630is a version of the data-centric monitor101ofFIG. 1. Reference640indicates compliance monitoring/auditing personnel, such as a person examining a system for compliance.

FIG. 6is merely one way of examining how a system may be structured and is merely an example. Additional entities fromFIG. 4may also be added toFIG. 6. For example, the authorized events315and the authorized/permitted data and flow control events320would likely fit in the application-specific details610. Application-specific details620are vulnerabilities325in this example (and may include the vulnerability scores326).

Referring toFIG. 7, this figure is a logic flow diagram for computation of compliance ranks in an exemplary embodiment. This figure also illustrates the operation of an exemplary method, a result of execution of computer program instructions embodied on a computer readable memory, functions performed by logic implemented in hardware, and/or interconnected means for performing functions in accordance with exemplary embodiments. The blocksFIG. 7are assumed to be performed by the compliance monitoring computer system110, e.g., under control in part by the data centric monitor101.FIG. 7is an example of block330ofFIG. 4.

In block705, the compliance monitoring computer system110identifies a dependency or dependencies between compliance rules. Such a dependency or dependencies may be identified using, for example, a HIPAA dependency graph as show inFIG. 8or other graph. InFIG. 8, the numbers are the sections of the HIPAA. The administrative safeguards are dependent on the physical safeguards, the technical safeguards, and the policies and documentation. The physical safeguards are dependent on the technical safeguards, while the technical safeguards are dependent on the policies and documentation. Each of the safeguards at the top of a column corresponds to the sections in that column. For instance, the physical safeguards include the sections 164.310(s)(1): Facility Access Controls, 164.310(b): Workstation Use, 164.310(b): Workstation Security, and 164.310(a)(1): Device and Media Controls. It can be seen that (as one example) section 163.308(a)(4)(i) is dependent on section 164.310(a)(1) and the technical safeguards. That is, section 164.310(a)(1) is dependent on all of the sections in the technical safeguards, although this is merely exemplary. Similarly, section 164.308(a)(7(i) is dependent on the technical safeguards. Other relationships are illustrated by the figure.

In block710, the compliance monitoring computer system110represents the dependencies as a graph. For instance, in block715, the compliance monitoring computer system110can represent each node as a compliance rule or group of compliance rules and in block720, the compliance monitoring computer system110can represent each edge as a directed edge from one node X to another node Y such that X is dependent on Y. Such dependencies and their corresponding graph may be determined usingFIG. 8as an example.

In block725, the compliance monitoring computer system110traverses the graph. In block730, the compliance monitoring computer system110computes a rank of each node using a recurrence relation and dynamic programming or other techniques. As an example, in block735, the compliance monitoring computer system110uses a pagerank type of technique: the rank of each node Y depends on the rank of each other node X that has an edge to Y. In block740, the compliance monitoring computer system110outputs the rank of each node, which is the rank of each compliance rule. The leaves are assigned an initial rank such as 1.

Turning toFIG. 9, this figure is a logic flow diagram for data-centric monitoring of compliance of a distributed application in an exemplary embodiment. This figure also illustrates the operation of an exemplary method, a result of execution of computer program instructions embodied on a computer readable memory, functions performed by logic implemented in hardware, and/or interconnected means for performing functions in accordance with exemplary embodiments. The blocks inFIG. 9may be assumed to be performed by a computer system110, e.g., under the control at least in part of the data-centric monitor101.

In block910, the computer system110performs accessing one or more logs of information technology events in a distributed system comprising a distributed application. The distributed system comprises a plurality of data objects, and the distributed application uses, processes, or otherwise accesses one or more of the plurality of the data objects. The information technology events concern the distributed application and concern accesses by the distributed application to one or more of the data objects. In block920, the computer system110performs correlating the information technology events with a selected set of the plurality of data objects.

In block930, the computer system110performs estimating risks to the selected set of data objects based on the information technology events. The estimating risks uses at least ranks of compliance rules as these rules apply to the data objects in the system and vulnerability scores of systems corresponding to the set of data objects and information technology events. In block940, the computer system110performs outputting information allowing a user to determine the estimated risks for the selected set of data objects.

The flow inFIG. 9is also referred to as example 1 herein. The following are additional examples related to this example.

The method of example 1, wherein outputting information further comprises outputting information suitable for display to the user and comprising visual indications of the risk for the selected set of data objects.

The method of example 2, wherein the visual indications comprise a color code from a range of colors from a first color to a second color, and wherein outputting information further comprises outputting an indication of the color code for each data object in the selected set of data objects.

The method of example 2, wherein outputting further comprises outputting, in response to the user selecting a representation of a selected one of the set of data objects, information for a detailed representation on a dashboard for the selected data object.

The method of example 4, wherein the detailed representation comprises one or more of the following: details of information technology events associated with the selected data object during a selected duration; details of the risk, compliance rules and associated weights associated with the selected data object; or risks of a complete service and risks of components associated with the data object.

The method of example 2, wherein: the method further comprises providing the user with an opportunity to select one or more of the following criteria: a specific time duration; a subset of the set of data objects; a set of systems or users; or a set of each of these entities related to one or more of the specific time duration, subset of data objects, or the set of systems or users; and outputting information further comprises outputting information enabling display to the user of risks and information technology events associated with the selected criteria.

The method of example 1, wherein: estimating risks comprises: aggregating at least two of the following risks to an aggregated value for one or more of the selected set of data objects: risk corresponding to each data object; risk corresponding to each anomalous event; risk corresponding to each compliance rule; or risk corresponding to each vulnerability of the system; and normalizing the aggregated value to a range of values; and outputting comprises outputting the aggregated value for the one or more of the selected set of data objects.

The method of example 7, further comprising determining each vulnerability of the system using an attack graph for the distributed application.

The method of example 7, wherein each risk is a weight of a corresponding entity.

The method of example 7, wherein a risk used to determine the aggregated risk is determined by multiplication of weights for entities from multiple risks.

The method of example 10, wherein a risk used to determine the aggregated risk is determined by, for a given data object, multiplying a size in bytes of the given data object with a weight of anomalous events associated with that given data object.

The method of example 7, wherein the aggregated value is normalized to a range of values from zero to one hundred:

The method of example 1, wherein estimating risks comprises computing risk based on one or more of the following: a size of a given data object; a weight assigned to the given data object; weights assigned to compliance rules; or weights assigned to anomalous events, wherein weights assigned to anomalous events are assigned with respect to weights of normal events.

The method of example 1, further comprising determining the ranks of the compliance rules as follows: identifying dependencies between compliance rules; representing the dependencies as a graph having nodes and edges, wherein each node represents a compliance rule or a group of compliance rules, and wherein each edge is a directed edge from a first node to another node such that the first node is dependent on the other node; traversing the graph and computing rank of each node using one of a recurrence relation or dynamic programming; and outputting the rank of each node.

The method of example 14, wherein computing rank using a recurrence relation comprises using a pagerank algorithm wherein a rank of each node Y depends on the rank of each other node X that has an edge to Y.

Another example is computer system comprising one or more memories comprising computer-readable code and one or more processors. The computer system performs the method of any of the examples of 1-15, responsive to execution by the one or more processors of the computer-readable code. A further example is a computer program product comprising a computer-readable storage medium comprising computer-readable code that causes a computer system to perform the operations of the method of any of the examples of 1-15.

Referring now toFIG. 10, this figure is a logic flow diagram for determining ranks of compliance rules in an exemplary embodiment. This figure further illustrates the operation of an exemplary method, a result of execution of computer program instructions embodied on a computer readable memory, functions performed by logic implemented in hardware, and/or interconnected means for performing functions in accordance with exemplary embodiments. The blocks inFIG. 10may be assumed to be performed by a computer system110, e.g., under the control at least in part of the data-centric monitor101.

In block1010, the flow comprises identifying dependencies between a plurality of compliance rules, wherein the compliance rules are defined by one or more regulations. This block may be performed by a person or possibly by computer system110. In block1020, the flow comprises representing the dependencies as a graph having nodes and edges, wherein each node represents a compliance rule or a group of compliance rules, and wherein each edge is a directed edge from a first node to another node such that the first node is dependent on the other node. Representing the dependencies may be programmed into the computer system110by a person, or the computer system110may perform this block. In block1030, the computer system110performs traversing the graph and computing rank of each node using one of a recurrence relation or dynamic programming, and in block1040, the computer system110performs outputting the rank of each node, wherein each node is a rank of a compliance rule or a group of compliance rules.

The flow inFIG. 10is also called example 16 herein. The following are additional examples based on the flow inFIG. 10.

The method of example 16, wherein computing rank using a recurrence relation comprises using a pagerank algorithm wherein a rank of each node Y depends on the rank of each other node X that has an edge to Y.

The method of example 16, wherein the plurality of compliance rules are one of Health Insurance Portability and Accountability Act or Family Educational Rights and Privacy Act compliance rules.

Another example is computer system comprising one or more memories comprising computer-readable code and one or more processors. The computer system performs the method of any of the examples of 16-18, responsive to execution by the one or more processors of the computer-readable code. A further example is a computer program product comprising a computer-readable storage medium comprising computer-readable code that causes a computer system to perform the operations of the method of any of the examples of 16-18.

The following abbreviations that may be found in the specification and/or the drawing figures are defined as follows:CVE Common Vulnerabilities and ExposuresCVSS Common Vulnerability Scoring SystemDCCM Data-Centric Compliance MonitoringFERPA Family Educational Rights and Privacy ActHIPAA Health Insurance Portability and Accountability ActIBM International Business Machines CorporationID identifierIP Internet ProtocolIT Information TechnologyLAN Local Area NetworkNVD National Vulnerability DatabaseOS Operating SystemSSH secure shellUUID Universally Unique IDVCF Variant Call FormatVM Virtual MachineWAN Wide Area NetworkWAS WebSphere Application Server