International Business Machines Corporation

Kyndryl, Inc.

Kyndral, Inc.

Milton H Hernandez

Constantin Mircea Adam

Maja Vukovic

Yaoping Ruan

Sai Zeng

Muhammed Fatih Bulut

Vugranam Chakravarthy Sreedhar

Nikolaos Anerousis

Brian L Peterson

Jinho Hwang

Robert Filepp

Anup Kalia

Jim Alain Laredo

Richard Jay Cohen

Kumar Bhaskaran

Bhavna Agrawal

Paul Driscoll

Sambit Sahu

Larisa Shwartz

Zon-Yin Shae

Sriram K Rajagopal

Mattias Marder

Lawrence David Bergman

Hai Huang

Debanjan Saha

Robert Alan Flavin

Chee Meng Low

Guan Zhang

Christopher J Giblin

Debasisha Padhi

Winnie W Cheng

Daniel S Riley

Fabio Minoru Tanada

Steven Ocepek

Ravi B Konuru

Nandagopal Seshagiri

Frederick Y-f Wu

Prema Vivekanandan

Vysakh K Chandran

Paul Jennings

Clifford A Pickover

Kuntal Dey

Arun Kumar

Hani Talal Jamjoom

John Joseph Rofrano

Anees Abdul Shaikh

Gopal Sarma Pingali

Srinivas Babu Tummalapenta

Karin Murthy

Aliza Rivka Heching

Ramendra K Sahoo

Abhijit Bose

Prashant Pradhan

Lisa M Chavez

Sreeram Ramakrishnan

Jill L Jermyn

Virginia Mayo

Cindy J Mullen

Jeffrey Edward Lammers

Hani Talal Jamjoon

Lilian Mathias Ngweta

Brian Peterson

Guan Qun Zhang

Xinli Wang

Supreet R Mandala

Hoda Parvin

Systems and techniques that facilitate automated health-check risk assessment of computing assets are provided that can generate a baseline health-check risk score that corresponds to non-compliance of a computing asset with a stipulated control, and can adjust the baseline health-check risk score based on a weakness factor of the stipulated control, an environmental factor of the computing asset, a criticality factor of the computing asset, and a maturity factor of the computing asset.

Automated health-check risk assessment of computing assets

Users of an endpoint remediation system can be assigned to different roles, from which they can request exceptions, approve exceptions, and/or enable remediation on endpoint devices. The compliance scanning and enforcing process can be automated, while allowing entities to request and/or approve certain exceptions. Therefore, security compliance for customers can be actively managed to provide visibility to the endpoint device compliance state at any time.

Testing and remediating endpoint device compliance controls

Systems, computer-implemented methods, and computer program products that facilitate vulnerability and attack technique association are provided. According to an embodiment, a system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can comprise a map component that defines mappings between vulnerability data representing a vulnerability of a computing resource and attack data representing at least one attack technique. The computer executable components can further comprise an estimation component that analyzes the mappings to estimate a probability that the vulnerability will be exploited to attack the computing resource.

Vulnerability and attack technique association

An assessment component that facilitates assessment and enforcement of policies within a computer environment can comprise a compliance component that determines whether a policy, that defines one or more requirements associated with usage of one or more enterprise components of an enterprise computing system, is in compliance with a plurality of standardized policies that govern operation of the one or more enterprise components of the enterprise computing system. The assessment component can also comprise a policy optimization component that determines one or more changes to the policy that achieve the compliance with the plurality of standardized polices based on a determination that the policy complies with a first standardized policy of the plurality of standardized policies and fails to comply with a second standardized policy of the plurality of standardized policies.

Computer environment compliance

Computer implemented reconstruction of compliance mapping due to an update in a regulation in the compliance mapping by a computing device includes comparing a first version of a regulation in the compliance mapping to a second, updated version of the first regulation. A change in the second version with respect to the first version is identified. The change may be an added control description, a deleted control description, or an updated control description. Upon determining that the change is an updated control description, the updated control description is analyzed to determine a type of update. The mapping of the regulation is reconstructed based on the change and, if the change is an updated control description, the type of update, using at least one of natural language processing and/or machine learning. The risk of the reconstructed mapping is assessed, and a service owner is notified about the risk of the changes.

Computer implemented live cross walks in compliance mappings in response to regulatory changes and assessing risks of changes

Testing and remediating compliance controls

Systems, computer-implemented methods, and computer program products that can facilitate compliance process risk assessment are provided. According to an embodiment, a system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can comprise a metric assignment component that assigns one or more risk assessment metrics based on vulnerability data of a compliance process. The computer executable components can further comprise a risk assignment component that assigns a risk score of the compliance process based on the one or more risk assessment metrics.

Compliance process risk assessment

Streamlining compliance reporting and remediation through clustering compliance deviations by receiving inspection scan compliance deviation report data, analyzing the inspection scan compliance deviation report data, in response to the analysis, creating normalized deviation report documents, comparing the normalized deviation report documents, in response to the comparisons, clustering the normalized deviation report documents, creating a common cluster deviation profile comprising clustered deviation reports, and generating a summary system asset compliance report comprising the common cluster deviation profile.

Compliance by clustering assets according to deviations

A method provides for controlling compliance remediation that includes performing compliance inspection runs by account nodes for multiple accounts. Inspection results of the inspection runs from each account node are aggregated by an account cognitive policy advisory (CPA) service. The inspection results from each account are aggregated. It is determined whether remediations are required by analyzing the inspection results combined with a current compliance mode of a server. Upon a determination that the current compliance mode of the server is a first mode, the account CPA service determines whether a policy fingerprint has changed. Upon a change to the policy fingerprint, compliance enforcement runs on the account nodes are temporarily suspended.

Controlling compliance remediations

Embodiments relate to an intelligent computer platform to utilize machine learning techniques to minimize compliance risk. Data, collected from a plurality of sources is subject to analysis and correlation to assess impact across data points. The assessment measures impact between at least two different compliance domains, facilitates understanding of cross-impact between compliance domains, and provides an estimation of compliance risk. A recommendation plan for one or more new compliance activities is created and dynamically subject to a machine learning reinforcement algorithm.

Minimizing compliance risk using machine learning techniques

Embodiments relate to an intelligent computer platform to utilize a micro-service architecture that supports secure connection and policy management for devices. The micro-services include managers to support establishment of a secure connection. The managers register devices in the architecture, and define security policies which are encoded as rules. The policies and corresponding rules are stored in a knowledge base operatively coupled to the architecture. The patterns of security policies are learned over time and used for recommending new rules or validating existing rules. The managers selectively validate one or more rules that correspond to a setting of a requesting device. The secure connection is established for a network level device determined to comply with one or more of the selectively validated rules.

Hybrid network infrastructure management

A compliance of a system is managed. Internal parameters of the system are received. One or more compliance control documents that relate to the system are identified. Each compliance control document is decomposed into one or more auditable units. Auditable units that are relevant to the system, are identified. Relevant auditable units are mapped to a corresponding available executable code. Each mapped executable code is executed. A risk associated with each relevant auditable unit that is deemed to be not compliant is identified. For each compliance control document, a compliance risk is calculated based on the identified risk. A report of compliance risk for each document is created to be displayed on a user interface of a computing device.

Automated fixups based on partial goal satisfaction

Access is obtained to a plurality of intermediately transformed electronic documents (with a plurality of sections and subsections) which have been transformed, by topical analysis and text summarization techniques, from a plurality of original electronic documents comprising at least some unstructured electronic documents. Audit and retrieval agent code is appended to the sections and subsections to create a plurality of finally transformed electronic documents. Users are allowed to access the finally transformed electronic documents. The users are provided with accountability reminders contemporaneous with the access. The access of the users to the sections and subsections of the finally transformed electronic documents is logged. An audit report is provided based on the logging. Also provided is a cloud service for enterprise-level sensitive data protection with variable data granularity, using one or more one guest virtual machine images.

Enterprise-level data protection with variable data granularity and data disclosure control with hierarchical summarization, topical structuring, and traversal audit

Growing community of inventors

Tenafly, NJ, United States of America

Milton H Hernandez