International Business Machines Corporation

Kyndryl, Inc.

Globalfoundries Inc.

Brian L Peterson

Jinho Hwang

Maja Vukovic

John Joseph Rofrano

Sai Zeng

Constantin Mircea Adam

Milton H Hernandez

Robert Filepp

Kun Bai

Birgit Monika Pfitzmann

Christopher Charles Young

Nikolaos Anerousis

Frederick Y Wu

Richard Jay Cohen

Shang Qing Guo

Utz Bacher

Anup Kalia

Christopher Ward

Vugranam Chakravarthy Sreedhar

Xiaolan Zhang

Hai Huang

Florian Graf

Kamal Bhattacharya

Guan Zhang

Stefan Raspl

Bhavna Agrawal

Kristiann J Schultz

Milton A Bonilla

David Kohen

Marco Aurelio Stelmar Netto

Harigovind Venkatraj Ramasamy

Norbert George Vogl

Nikolai A Joukov

Eric James Barkie

Marcos Dias De Assuncao

Trieu Can Chieu

Lakshminarayanan Renganarayana

Jing Luo

Christopher R Dotson

Kunwadee Sripanidkulchai

William J Hladik, Jr

Yarden Nir-Buchbinder

Colm V Malone

Charles S Gauthier

Kevin David Galloway

Christopher Wicher

Kewei Sun

Frederick Y-f Wu

Karen Cheng

Luis Benici Casco-Arias

James R Barros

Jeffrey Edward Lammers

Thomas Dean Christopherson

Jose R Figueroa

Ratnasagar M Ramaratnam

James R S Barros, Ii

David L Westerman

Christopher C Young

Xiongfei Wei

William L Bliss, Jr

Stephen Biondi

Katherine A Imming

Cheng Yi Lee

An assessment component that facilitates assessment and enforcement of policies within a computer environment can comprise a compliance component that determines whether a policy, that defines one or more requirements associated with usage of one or more enterprise components of an enterprise computing system, is in compliance with a plurality of standardized policies that govern operation of the one or more enterprise components of the enterprise computing system. The assessment component can also comprise a policy optimization component that determines one or more changes to the policy that achieve the compliance with the plurality of standardized polices based on a determination that the policy complies with a first standardized policy of the plurality of standardized policies and fails to comply with a second standardized policy of the plurality of standardized policies.

Computer environment compliance

Users of an endpoint remediation system can be assigned to different roles, from which they can request exceptions, approve exceptions, and/or enable remediation on endpoint devices. The compliance scanning and enforcing process can be automated, while allowing entities to request and/or approve certain exceptions. Therefore, security compliance for customers can be actively managed to provide visibility to the endpoint device compliance state at any time.

Testing and remediating compliance controls

Using a first key, an encrypted file fingerprint is decrypted, the decrypting resulting in a decrypted file fingerprint. Using a hash function on a script file, a script file fingerprint is computed, the script file intended to be executed by an interpreter. Responsive to the script file fingerprint matching the decrypted file fingerprint, the script file is executed.

Preventing untrusted script execution

Embodiments relate to an intelligent computer platform to utilize a micro-service architecture that supports secure connection and policy management for devices. The micro-services include managers to support establishment of a secure connection. The managers register devices in the architecture, and define security policies which are encoded as rules. The policies and corresponding rules are stored in a knowledge base operatively coupled to the architecture. The patterns of security policies are learned over time and used for recommending new rules or validating existing rules. The managers selectively validate one or more rules that correspond to a setting of a requesting device. The secure connection is established for a network level device determined to comply with one or more of the selectively validated rules.

Hybrid network infrastructure management

Aspects of the disclosure relate to managing migration of an application. The managing migration of an application includes establishing a source dataset. The source dataset includes a set of source features. The source features relate to a source. The source includes the application. A determination of a first set of migration plans is made. The determination is made with an evaluation. The evaluation is made using the source dataset and a set of legacy features. The evaluation is performed with a cost measure. The application is migrated from the source to the target. The migration is based on the determined first set of migration plans.

Managing migration of an application from a source to a target

A self-service experience for a change requester is provided. Authorized endpoint changes are identified along with corresponding change types. Resource attributes are identified and corresponding parameters of the resources are changed according to change window requirements. Where the changes comply with business policies, the changes are executed.

Self-service server change management

A method is provided to eliminate many of the manual steps in a server change management process, creating a self-service experience for a change requester. The method may automatically retrieve the current state of a server; constrain the requested change to a valid, feasible specification; verify that the requested change is compliant with business policies; implement the changes automatically; and develop a knowledge base of automated change risk that is used to modify the change management business process by identifying safe changes that can be performed outside of change windows and/or during change freezes. The method can be applied to changes to physical servers, virtual servers, and servers in a cloud environment.

A method to perform server provisioning on a plurality of computer systems to generate a plurality of target virtual machines includes: obtaining configurations from a pool comprising at least one existing candidate virtual server or server image through a discovery process; performing a clustering analysis on the configurations to group the configurations into at least two groups; and for each group, selecting a configuration from among the configurations of the group as a candidate virtual machine image; determining a cost of actions required to be performed on the candidate virtual image to result in target virtual machines with a same configuration as the configurations of the group; and selecting the candidate virtual image with the lowest cost.

Server build optimization

Automatically validating a firewall rule for provisioning in a computer system. One or more firewall rules for provisioning on a server is received from a user device. Based on predefined firewall rules, whether to approve one or more of the firewall rules and deny one or more of the firewall rules is determined. Responsive to determining that one or more of the firewall rules are denied, additional validation of one or more of the firewall rules that are denied are performed. A firewall rule learning engine is updated with a result of the additional validation. Based on the result of the additional validation, the firewall rule learning engine updates the predefined firewall rules. One or more of the firewall rules that are approved on the server may be provisioned.

Automatically validating enterprise firewall rules and provisioning firewall rules in computer systems

Generating configuration images and deploying computer components in a computing environment that comprises a shared pool of configurable computing resources may be provided. Configuration templates from a plurality of repositories may be mined and classified. Base templates may be created that represent different service configurations based on the configuration templates classified into classes of different service configurations. For deploying a requested service with specified requirements, a plurality of candidate templates may be created based on the base templates that represent configurations for the requested service and configurations that meet the specified requirements. A target template from the plurality of candidate templates may be selected that most meets the specified requirements. Computer resources for the requested service may be deployed by running the target template.

Automatically generating configuration images and deploying computer components in a computing environment that comprises a shared pool of configurable computing resources

Growing community of inventors

Somers, NY, United States of America

Brian L Peterson