Remediation Of Detected Configuration Violations

What is this patent about?

’393 is related to the field of cybersecurity, specifically the automated remediation of configuration violations in cloud-based services. Modern enterprises rely on numerous SaaS platforms, each with its own security settings. Manually managing these settings across different platforms is complex and error-prone, leading to potential security breaches and compliance issues. The patent addresses the problem of efficiently identifying and resolving these configuration discrepancies.

The underlying idea behind ’393 is to automate the process of detecting and fixing configuration violations by comparing actual settings against prescribed settings defined in an organization's internal reference information. This involves querying data source servers for their current configurations, comparing them to desired configurations (policies, best practices, etc.), and then automatically or manually applying remediations to correct any discrepancies. The system also maintains an audit log to track all actions taken.

The claims of ’393 focus on a system, method, and computer program product for detecting and remediating configuration violations at a data source server. The core process involves receiving an indication to perform an audit against a policy, obtaining stored mappings, querying the data source server for configured security attributes , obtaining prescribed security attributes , comparing these attributes based on policy type and role group, determining if a violation exists based on the comparison, providing a remediation, and storing an audit log of the remediation events.

In practice, the system operates by first defining policies that specify the desired security configurations for various elements within a SaaS platform. When a violation is detected, the system can automatically generate API commands to correct the misconfiguration, or it can generate a manual remediation plan for a security administrator to implement. The choice between automatic and manual remediation can be based on the severity of the violation or the availability of an API for automated correction. The audit log provides a record of all actions taken, ensuring accountability and facilitating compliance reporting.

The invention differentiates itself from prior approaches by providing a centralized system for managing security configurations across multiple SaaS platforms. Unlike manual processes that are time-consuming and prone to error, this system automates the detection and remediation of violations, reducing the risk of security breaches and improving compliance posture. The use of internal reference information allows organizations to customize the system to their specific security policies and best practices, making it a flexible and adaptable solution.