Endpoint Selection Prioritization for Compliance Checking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Bandwidth limitations during a change window make it difficult to maintain all servers in a compliant state with the latest security patches, as not all endpoints can be checked for compliance within the restricted time frame.
Innovation Solution
A computer-implemented method prioritizes servers based on criteria such as compliance-check history, usage statistics, risk level, and business criticality, allowing high-priority servers to perform compliance-checks first and ensuring that lower-priority servers are checked at less frequent intervals or in subsequent change windows, thereby optimizing network bandwidth usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If compliance checks are performed on all servers during a change window, then all servers can maintain compliant state with latest security patches, but bandwidth limitations prevent checking all endpoints within the restricted time frame
Solution Approach 1:
The system segments the server population into multiple priority groups (critical, high, medium, low) based on business importance and compliance risk. This segmentation allows the compliance checking process to be divided into sequential batches, where critical servers are checked first during the change window, followed by high-priority servers, and so on. This resolves the contradiction by ensuring that while not all servers can be checked simultaneously due to bandwidth limits, all servers will eventually be checked through multiple change windows, maintaining overall compliance reliability.
Solution Approach 2:
The system performs preliminary actions by pre-calculating and storing priority rankings for all servers before the change window begins. Compliance check history, usage statistics, and risk assessments are analyzed in advance to determine the notification order. This preliminary preparation allows the system to efficiently distribute compliance checks across change windows without real-time decision-making delays, maximizing the number of servers that can be checked within bandwidth constraints while maintaining reliability.
2Productivity
If multiple servers are checked for compliance simultaneously during a change window, then more servers can be processed in parallel, but network bandwidth is exceeded causing delays and incomplete compliance checks
Solution Approach 1:
The system implements periodic action by distributing compliance checks across multiple change windows rather than attempting to check all servers in a single window. Servers are notified in periodic batches according to their priority level, with critical servers checked in the first window, high-priority servers in subsequent windows, and so on. This periodic distribution prevents network bandwidth overload while maintaining high productivity over time, as the system can continuously process servers across multiple windows without exceeding bandwidth limits in any single window.
3Reliability
If compliance checks are performed frequently on all servers, then compliance state is maintained more consistently, but network bandwidth consumption increases beyond available capacity
Solution Approach 1:
The system applies local quality by differentiating the compliance checking frequency and timing for different server groups based on their specific needs. Critical servers receive more frequent checking attention and higher priority notification, while low-priority servers are checked less frequently. This localized quality approach ensures that bandwidth-intensive compliance checks are concentrated on servers where they are most necessary, maintaining compliance reliability for critical infrastructure while conserving network bandwidth for less critical systems.
Data Source
AI summary
A method, system, and computer program product for prioritizing endpoints to be checked during a change window based on certain criteria. The method may include receiving a request for processing from a plurality of servers. The method may also include determining a priority for each server of the plurality of servers based on specified criteria, where the specified criteria includes at least compliance-check history. The method may also include determining whether each server belongs to one or more groups. The method may also include determining a notification order for the plurality of servers based on the priority and whether each server belongs to the one or more groups. The method may also include sending a notification to each server in the notification order.