Agent Workspace: Security Incident Response
Overview
Security Incident Response (SIR) product manages the life cycle of a security incidents from initial analysis to containment, eradication and recovery. SIR provides a comprehensive understanding of incident response procedures performed by analysts, and understand trends and bottlenecks in those procedures with analytic-driven dashboards and reporting.
Business Problem:
Improving the critical incident triaging experience for the Security analyst within the predefined SLAs
User Challenges:
Due to the complexity of the ServiceNow product, security analysts find it challenging to filter out critical incidents and resolve them within the specified timeline, which impacts overall productivity
Opportunity Areas:
Provide analysts with an actionable dashboard that highlights critical incidents, displays intra-departmental dependencies, offers actionable preview screens, and features a clutter-free incident details page
Solution:
Redesigned the Security Incident Response Dashboard, List page, and Preview experience, along with the Incident Detail page featuring a triaging workflow. This improved design enables security analysts to resolve critical incidents involving malicious content, leveraging an automated playbook to address issues with minimal assistance while adhering to predefined SLAs
Impact:
Cleaner UI & Consistent experience
Improved Task Prioritizations
Discovery of Playbook experience
Solving of experience within SLAs
Before
After
V
S
Process:
Discover
Research Phase
Define
Synthesis Phase
Development
Ideation Phase
Deliver
Implementation Phase
Do know
should be
Don’t know
could be
Converging
Converging
Diverging
Diverging
Ideate
Evaluate 1st
ideas
Define research
areas & methods
Conduct
secondary
research
Set ideas, a
design vision
& hypothesis
Conduct
primary
research
Set ideas, a
design vision
& hypothesis
Answers,
Product,
Solutions
First ideas & vision,
Potential solutions,
Hypothetical answers
Final brief,
HMW questions,
Stategy
Unstructured
research
findings
Build themes & clusters
Prototype, Test & Analyse
Learn, Iterate, Repeat
Build, Iterate, Repeat
Release
Find insights
Deduce opportunity areas
HMW
Questions,
Challenge,
Client brief
User Persona
Key Collaborators :
My role:
As the staff designer, I was responsible for the end to end design process, including esearch, interaction and visual design to design validation and final handoff to the developers and business stakeholders.
Other Collaborators:
1
Design Review:
SecOps Design Manager, Servicenow DERT Team
2
Product manager
3
Developer
4
Customer Success and Growth Team (Inhouse)
5
Customers
Research
Process Blueprint
Based on interviews with customers and internal users
Workflow for an incident
1
Phishing Incident happened (Identified by affected person or Automated systems which detect suspicious logs.
Time frame: 4 hours
2
Identified person or someone his/ her behalf reports the incident.
3
System converts the reporting email into incident or the suspicious log which is reported into the system as an alert gets converted into a security incident.
Time frame: 2 mins
4
Incidents comes to the incident pool and either SOC Manager/ Level 2 analyst reviews and assign the incident to Level 1 or Level 2 can assign incidents to themselves. Incidents can also remain unassigned for a day which would be overdue for next day.
Time frame for the draft state: 1 day (max.)
5
SIR Analyst takes the incident based upon criticality and starts working on the same based upon his skill level. Similar incidents gets clubbed together and become Master Incident.
SLAs for an incident triage:
1
Email Reported: 4 hours
2
Draft State: 1 day (max)
3
Analysis: 2 hours
4
Containment: 2 hours
5
Eradication: 3 hours
6
Review: 3 days
Feedback from User walkthroughs:
Challenges with existing designs (Dashboard):
1
No personalized data
No data showing any personalized information about the Agent.
4
No actionable shortcuts
Shows a lot of data visualisation, however, no option to click and navigate to the category of the incidents.
2
No visibility of notifying critical information
No way of showing the critical automatically generated incidents as well as for the the Failed login SIR incidents.
3
Information out of context
Showing Customer satisfaction chart seems out of context for an analyst. It made more sense for the leadership.
5
No option of tracking interdepartmental data
No way of tracking the interdepartmental communication, especially with IT teams.
6
Historical data missing
Cases by product didn’t helped Analysts and something they achieved made more sense to them.
Challenges with existing designs (Incident details page):
2
Context of the incident missing
Context of incident details such as subject line, original email received missing upfront.
3
Visibility of call to actions
Call to actions not visible upfront at top and shows up only after the scroll.
5
No options for playbook selection
No way of applying/ modifying of playbooks for automated approach of triaging incidents
6
Visibility of Activity feeds
Placement of activity feeds are placed down below after the first scroll.
4
No SLA for each step
Incident triaging typically takes 2-3 days so SLA for each step helps Analysts understanding if any incident is pending for long duration
7
Too much cluttered info
Too much tabs placed together
seems misguiding Analyst and leads to accidental clicks.
1
Incident summary complicated
The summary of the incidents doesn’t contain information which are important to take actions.
Persona: Who are we designing for?
About Avinash
Avinash has graduated in information security and privacy at city college. Having extensive experience on white hat hacking and solving complicated phishing related issues and works as a senior information Security Analyst at ACME Corp’s SOC.
Goals & Responsibilities:
1
Handle complicated security incidents.
2
Identify the security incidents correctly and assign them to juniors based upon complexity and ensure that they fix them correctly.
3
Collect enough and more evidence towards an incident.
4
Take an incident to closure ASAP.
5
Adhere to the team processes and industry compliance.
6
Situationally aware, always
7
Always adding value to the company and security.
8
Interact with incidents, not the tool.
Avinash
Senior SOC Analyst
Age: 32 • Gender: Male
Education: Engineering graduate
Experience: 4 years
Motivations:
1
Stop the bad guy.
2
Keep the organisation safe.
3
Mentor and ensure the junior analysts do their job efficiently.
Challenges:
1
Co-ordination with other teams are time consuming.
2
Increase of critical incidents for himself and for his team.
3
Incidents which are false positives.
Empathy Map: What do they say, thinks, feels and does?
See
1
Lists of incidents assigned to them.
2
List of incidents for team.
3
Critical incidents.
4
Pending incidents.
5
Open incidents.
6
Completed incidents
Say
1
Informs the management about the closure of the incidents.
2
Informs the IT person about the virus scanning
3
Informs threat intelligence team about resolution of the incidents.
Hear
1
Requests from manager.
2
Requests from Manager or Admin.
3
Critical incidents.
4
Pending incidents.
Do
1
Look into the incident pool for critical incidents.
2
Assign incidents to themselves.
3
Work on incidents triaging process.
4
Initiate playbooks if needed.
4
Co-ordinate with IT and threat intelligence teams.
Mind Map: How do they understand the universe
Visual Design
New designs for Dashboard, list and detailed page.
Dashboard (New):
4
Secondary actions
Once Analyst are done with Critical can also view the secondary set incidents which needs of actions including Open, Assigned and all incidents.
5
Task assigned to other teams
Status info of the task assigned to IT team shown upfront for the Analyst to have clarity of the progress.
6
Details of the historical data
Shows the details of the incidents closed with certain duration
7
Incidents by state
Showing graphical view of incidents with each states
1
Critical information upfront
Actions for critical incidents which requires immediate attention, is placed top-left. Next follows the “Overdues” for the incidents pending from yesterday.
2
Easy access for work in progress incidents
Incidents which users are currently working on needed to be shown upfront to the users to prevent additional clicks.
3
Access to team work
With access to team’s incident pool helps agents assign the incidents to themselves
Incident List Page (New design):
4
Option to modify details
Analyst can easily modify details on preview.
5
Activity feeds
The preview also includes 3rd column for the “Activity Feeds”
1
Incident preview
Introduced preview side-panel with details of incident such as description, requested by, affected user, observables type malicious or not as well as activity fields.
2
Malicious content info
Preview shows malicious content so Agents can take it as priority
All interactions for list page
List page: All incidents
Analyst can click on the expand view icon (placed left of page header) to view the incidents in a horizontally expanded view.
List page: All incidents
Analyst can view all incidents in a single view and filter out incidents based upon Incident number, priority, title, category, risk score, status or with a specific date as well as within a date range.
List page: Unassigned incidents
Show all unassigned incidents from the pool
List page: Incident preview
Preview shows the details of the incidents and well as suggest if the incidents has got malicious content. At the same time, Analyst can also post comment on the activity stream to inform the team know the reason of he assigning the incident to another agent or any other communication about this particular incident.
List page: Edit incident info
Edit incident info
List page: Activity
Add comments for the incidents
Incident Detailed Page
Basis the tight timelines, we did an immediate release with introduction of left nav and creating a design system to make the design and experience consistent.
Incident Detailed Page (After):
5
Calls to actions upfront on the top
Call to actions have been placed at the top right so they are easy to discover as well as there is a consistency on the placement of the buttons.
6
Better design tabs
Linear tabs with “More options” which shows up as dropdown.
7
Details of the playbook
Summary showing playbook selected and Analyst can change and modify playbook as they land upon the Playbook tab.
8
Activity field with historical activities upfront
Analyst can view activity logs of the incident to understand the history and take necessary actions.
1
Context of the incident upfront
Subject of the incident upfront which gives a lot of context about the incident
2
Timeline with SLAs
Incidents which users are currently working on needed to be shown upfront to the users to prevent additional clicks.
3
Simplified summary
Introduced “Overview” tab with simplified summary of incident with actionable cards so Analysts can click and navigate to the information directly
4
Original email for context
Visibility of the original email upfront so that Analysts can refer it while solving the incident
Incident Detail Page Interactions
Incident details page: Details
The Analyst would then switch the tab and view details about the incident.
After viewing the details, the analyst would either go and manually triage the incident or would follow the playbook approach.
Incident details page: Details
The analyst view the Observables upfront and see if there are malicious content
Incident details page: Details
The list of tasks associated with Phishing Playbook would load and the Analyst would start triaging the incident via Playbook. The first task is task is to review the email.
Incident details page: Details
Select or add new playbook
Cognitive Walkthroughs
30 minutes long user testing sessions were conducted with the 6 internal users from Now-on-now team members who uses the SIR products for internal use, via zoom video session, with the goal to validate if the Now-on-now members are able to achieve tasks with different use cases such as the content on the Dashboard, the list view screens, the innovative preview approach as well as introducing the playbook approach along with multiple playbooks & change playbooks. The the designs were also tested with two customers who extensively use SIR products. They all were very positive about the new design, with some feedback for improvement.
Likes
Clean interface.
Prioritisation of tasks based upon criticality
Status of the the task dependency on other teams.
The preview with details of the incidents along with options with add work notes/ comments.
Change and add multiple playbooks when needed.
Making playbook available in the right panel even when agents needs to switching the tabs.
Dislikes
May not need to see alerts on the dashboard since they are result of the suspicious logs generated by automated systems which may be false positives.
The date and time on the list view could provide the information in terms of hours and days instead of time and date, which would communicate the urgency.
Impact:
Cleaner UI & Consistent experience
Improved Task Prioritizations
Discovery of Playbook experience
Solving of experience within SLAs