Method and system to evaluate risk of configuration changes in an information system

摘要

A system and method to manage configuration of an information system comprises an automated risk evaluation for a requested change of a configuration item in an information system. Change history information indicative of the effects of multiple historical changes to respective configuration items may accessed, and the automated risk evaluation may be based at least in part on the change history information. The requested change may be authorized or as part based on an assessment of a risk value which is calculated in the automated risk evaluation. Additional apparatus, systems, and methods are described.

主权项

1. A system comprising:
one or more processors; a receiving module to receive a request for change of a configuration item in a configuration management database that contains a plurality of configuration items for respective components in an Information Technology (IT) infrastructure; a database access module to access change history information that indicates respective effects of multiple historical changes to respective prior configuration items; and a hardware-implemented risk evaluation module configured to perform, using one or more processors, an automated risk evaluation for the requested change of the configuration item based on the change history information, to produce a risk value indicative of a risk associated with the requested change of the configuration item, performance of the automated risk evaluation comprising:
identifying from the change history information a subset of historical changes that are associated with the requested change,for each historical change in the identified subset, identifying a respective success type selected from a predetermined set of success types that comprises multiple different success types, andfor each historical change in the identified subset, assigning a respective weight selected from a predetermined set of weights that comprises multiple different weights, each of which corresponds to a respective success type in the predetermined set of success types.