Transcript

X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:0 [MUSIC PLAYING] Organizations have long struggled to keep up with the overwhelming amount of data loss prevention incidents they have to manage. Disparate products across their infrastructure make managing the incidents difficult to track in a timely fashion and can be even more frustrating for end users and their managers. DLP Incident Response, part of ServiceNow Security Operations, gives us the power to integrate with data loss prevention products to import incidents from multiple sources, including endpoint, network, email, and cloud, into a single platform. Then using a remediation workflow, we can automatically assign incidents to end users, managers, and DLP analyst teams with automated incident assignment and escalation, all using intuitive, easy to use workspaces designed specifically to make managing and reporting this work easy. There are four main use cases that DLP Incident Response helps address. First, by enabling the API integration with solutions, like Symantec Broadcom DLP, we can import incidents for endpoint, network, cloud, and email into ServiceNow and then invoke DLP incident remediation workflows involving end users or employees, managers, and DLP analysts. DLP Incident Response also allows DLP administrators the ability to define and filter which incidents will be imported into ServiceNow based on the requirements of the organization. DLP administrators can also configure email templates for coaching and communicating to end users and provides comprehensive reporting on incident trends. And when it's needed, incidents can be escalated up the chain of command. DLP admins can define the escalation criteria for the different types of incidents. Furthermore, DLP analysts can also look into their own workspace to view the state of DLP across their enterprise and respond to different incidents directly when needed. Finally, DLP Incident Response reduces the burden on the DLP analyst team. Since many DLP incidents are generated due to the error on the end users' part, now incidents can be assigned directly to the end users. And email templates can be used either as a weekly digest or whenever an incident is discovered with why the incident was generated and how to resolve it. Let's take a look at the DLP Analyst Workspace first. And then we'll see what the end user workspace looks like. The DLP Analyst Workspace is designed to give the people responsible for managing incidents a holistic view of data loss incidents in their environment. It shows DLP analysts a wealth of information, including open incidents by severity, the top offenders. If we scroll down, we can even see open incidents by policy, scan source, and more. Let's drill into one of these categories. Let's look at the critical open incidents by severity. We can see that there's a lot of information available to the DLP analyst, including the policy names, the state of each individual incident, the severity, et cetera. If we look at one of these, we can see that it shows the state, the scam type, the source, as well as the end user. And in this particular case, we can see that this particular DLP incident was assigned to the end user automatically based on assignment rules the DLP admin set up. Now let's switch personas and take on the role of Danny Watson. We're now logged in as Danny, as we can see in the upper right hand corner. We could see a few important details when we log in to the end user workspace. We can see the escalated incidents, incidents that are assigned to you, due to the next seven days, et cetera. Let's go ahead and look at the incidents assigned to you. And, again, we see a lot of useful information for the end user, including the policy name of each incident, the severity, scan source, and, when appropriate, the file location. I'm going to scroll down and find the same incident that we were looking at earlier. A lot of the same information is available to the end user that the DLP analyst saw, such as the scan type, source, end user. It's worth noting that Danny can upload attachments if needed. For example, if Danny received an email exception from management, they can attach an email right here. The end user can also take direct action, such as reporting this as a false positive, reporting that it's the wrong owner, or submitting a response. Let's go ahead and see what different responses are available to us. Now, these responses were set up by the DLP administrator ahead of time. This is fully customizable. So in this particular case, we can say that we've deleted the content. We can say this is required for a business process, like in the example we had just talked about, using the attached file. Or we can say we've deleted the file. Once that's done, we can enter in some comments and click Submit. That was a brief look at the new DLP Incident Response for ServiceNow Security Operations. If you'd like to learn more, please visit us at www.servicenow.com/sec-ops. Thank you. [MUSIC PLAYING]