[Music] hey everyone it's justin thanks for watching in this video i want to talk about something unusual something not out of the box that came up last week in a use case with a customer that's two things the common service data model and security incident response the use case i got from the customer was security incident comes in and it's possible that some data might have been breached or leaked or gotten out as part of that security incident it could be pii could be specific types of pii could be employee data whatever and they were saying at that point when that happens they need a team to actually review that in this case it was a privacy team and so i was thinking i had just got done reading the cs tm4io and i was thinking hey there is this actual thing called an information object in the common service data model so you see it there on the upper left above my head information object so in the csdm fly model you introduce this information object and you usually manage it in the application portfolio so something that you would say this particular application or this system has this type of information think about it from like a hey we need to know everything that has customer data everything that has financial data everything that has employee data you'd be able to really quickly see every configuration item within the cmdb to have that data so in the newest version of the cstm they talk about the information object as being part of that new portfolio for information related to business application could contain pii pci hipaa or phi stuff like that that's in there but these are also types of information that might uh be leaked or breached in a security incident so i was like what if we could say on a security incident i know i've already got this information that's base platform and the csdm information object i may not be flying yet but i have i could put some information in there customer data employee data corporate data whatever high level or get granular so i said what if we could relate it to the security incident and kick off a process kick off a task to notify a team that they need to go do something so what i did is i did some back end work to relate the tables and i edited this form that you're seeing here first thing to call your attention to is that i called this the data breach view within this particular security incident so i made a new view so that if i added or changed fields on this form actually it's that right right there if i added or change fields on this form it will be only for this particular view one of those things i changed is down below i created a new related list so i'm going to show all the related lists there and we should see two i'm not out of the box list for data breached and one for private tasks now i did private tasks in this scenario because the company that i've talked to is already using pts case for what they're doing but you could potentially say open a privacy task in the privacy application or another child incident or an incident subtask for this but the purpose is a demo um i did private tasks and let me show you all the flow here is i'm the analyst i'm working my security ins and i'm like hey we just realized that customer email was inside of that whatever leak or breach and i'm going to list that as an information object that was leaked so if i scroll back up what you'll see happen is it says a new information object is associated um it created a task for the privacy managers and it's gone now out there for them to review right so we kicked off our workflow hopefully with a new task there might be a notification or a teams thing but if we come down here to those private tasks i'll just click refresh and now i'll actually see the short description for the security incident it's a stage attack and then for the description i said hey customer email address which is associated with this security incident and kind of kick off that flow for them to manage hey this is work in progress close complete all that stuff you would do on a task when you're investigating this now the second part of the use case was what if down the road a month a week or whatever we find that hey some other information was part of that breach well i can come back down here to data breach put in another row for an information object and let's call this customer driver's license number so we got driver's license number now that gets associated with the incident we can see that these were created at different times uh let me show you that one more time right there this one was created 12 15 was created 12 16 but it could be weeks or months apart and it's still going to go ahead create that additional task if i scroll down to the bottom and hit refresh on my task we'll see it there now i've got a second task for whatever team is accountable for that data or data element that was lost to go look at now if you're curious what an information object is let's click on one of these let's click on customer email address and see what the csdm and cmdb tells us about an information object we see that customer email address and this is demo data highly sensitive it's owned by this particular person they're in sales and it's a sales department so what can we do we can use workflows to say hey now we're going to open a task for a privacy team or a security team or a compliance team whoever that is but we're going to let this business owner and this department know that hey you're responsible for this and this is all related to the security incidents in progress so bringing two concepts together they're not linked out of the box i had to do some linking and referencing on the back end to actually create this relationship many many relationships between the two tables but i think it's an excellent use case maybe get your feet wet in the csdm earlier than the fly stage with information objects and enhance your security incident response process i hope you liked this video if you did please like please subscribe or share with someone who you think might be interested until next time i'll see you on the next one [Music] you