Ruslan Rakhmetov, Security Vision
Historically, information security monitoring centers (Security Operations Center, SOC) and IT operations units functioned as isolated structures. This (albeit traditional) isolation can lead to slowdowns of various processes, critical delays in response, resource desynchronization between teams, misplaced task priorities, overall low efficiency, and other problems that are unacceptable in the face of serious cyberattacks.
In this series of articles, we will discuss how to synthesize information security automation technologies with platform ITSM solutions (for example, ServiceNow, Jira Service Management, Naumen ESM, 1C:ITIL) enables the creation of seamless, end-to-end value chains: for example, in practical security, from the initial detection of network traffic anomalies by monitoring systems to the automatic generation of specific, measurable tasks for specialized system administrators and responsible business representatives. Integrating information security requirements into the everyday life of the IT infrastructure requires adapting classic practices that have traditionally focused exclusively on service availability and quality. To begin, we will examine four key ITSM processes.
Table of contents
1) Incident Management
2) Problem Management
3) Change management
4) Service requests
5) Conclusion
Incident Management Management)
Imagine a pipe bursts in your apartment, rapidly flooding the floor. You grab rags, put buckets under the water, and rush to shut off the main valve. Your task is to stop the flood as quickly as possible (threat containment) and mop up the floor to prevent flooding your downstairs neighbors (recovery). As with flood management, the primary goal of incident management is to minimize damage and quickly restore normal operations. You address the symptoms (clean up the water, isolate the compromised server) to get the system back online, even if you don't have time to figure out why the pipe burst.
Traditionally, the goal of incident management is to restore normal service provision as quickly as possible while minimizing the negative impact on an enterprise's business processes. However, in the context of information security, an "incident" takes on additional, more complex characteristics. Its criticality is determined not only and not primarily by the technical unavailability of the service, but rather by the potential compromise of data confidentiality, violation of transaction integrity, or financial and reputational risks.
While a traditional IT incident (e.g., a hardware failure of a network router) is handled primarily in a linear fashion, a cybersecurity incident (e.g., detection of ransomware activity on a database server) requires the parallel execution of procedures outlined in response standards (e.g., NIST or SANS). Such procedures include containment, eradication, recovery, and post- mortem analysis. Incident) and the collection and preservation of digital evidence for subsequent investigation (forensics). We have already written about these stages.
Therefore, the information security incident management process requires the implementation of multi-vector categorization and prioritization. Implementing ITSM processes enables the automation of initial incident routing (triage), ensuring immediate transfer of the task to the appropriate support line (which we wrote about previously) with the necessary technical and business context.
Automation also reduces the workload on analysts, allowing them to focus on investigations, while the system takes over communication with users and timeline control (for example, by automatically calculating SLAs based on employee work schedules and incident parameters).
Problem Management Management)
You've collected water, but the kitchen pipes are leaking for the third time this month, and your neighbors are also constantly complaining about leaks. You call the chief engineer, who studies the drawings, takes readings, and determines that the true cause lies in a faulty pump in the basement, which is delivering excessive pressure to the riser. Problem management isn't about wiping the floors (incident response), but rather aims to identify the root cause of a series of failures in order to fix the systemic flaw and prevent future incidents. Just as a doctor doesn't simply administer a painkiller but determines the cause of the illness, information security analysts investigate the entry point and search for a systemic architectural error or unpatched vulnerability.
While incident management focuses on quickly eliminating the symptoms of a failure or localizing a current threat, problem management is aimed at identifying and eliminating root causes (Root Cause Analysis (RCA) to prevent recurring failures and similar incidents in the future.
In SecOps practice, infrastructure vulnerabilities that are not identified in a timely manner (a task solved by Security Vision VS and VM modules) or systematic architectural configuration errors (for example, in the Security Vision SPC module) inevitably develop into global security incidents.
Integrating ITSM and information security processes means that mass incidents (for example, multiple antivirus software activations on dozens of workstations within a short period of time) should automatically trigger the creation of a single problem record in the system. To address this issue, SOC analysts and system administrators form a working group whose collaboration can lead to the identification of zero-day vulnerabilities, flaws in corporate network segmentation policies, or errors in the access provisioning process.
Effective management of an information security issue always results in a request to modify the IT landscape to eliminate the vulnerability.
Change Management Management)
To permanently solve the high pressure problem, you need to replace the basement pump. You can't just turn off the water whenever you want, so you schedule the work for Wednesday at 2:00 PM (when most people are at work), post a notice for residents in advance (coordination with the business), purchase a tested part, and keep the old pump on hand in case the new one doesn't work (having a rollback plan). Any infrastructure intervention (massive installation of security patches, changing firewall rules) must be securely planned to prevent an accidental error from disrupting business services. If the basement pump has already exploded and water is flooding the building's electrical panel, you don't wait until Wednesday to collect residents' signatures, and the management company organizes an emergency committee. In information security, this is the emergency deployment of a critical patch, bypassing bureaucracy to protect against an active attack.
Any technical intervention required to eliminate a discovered vulnerability or contain an active incident (e.g., mass installation of a critical patch, blocking certain network ports, changing routing rules, or revoking compromised certificates) is classified as a change in the ITIL methodology. Therefore, change management ensures risk assessment (Security Vision RM module), planning for testing updates in sandboxes and the mandatory presence of a rollback plan (Rollback plan) in case of unforeseen consequences to ensure business continuity (Security Vision BCM).
Traditionally, the process of approving changes in IT can be lengthy, but for critical vulnerabilities that are actively exploited by attackers (for example, exploits with a CVSS score close to 10) or vulnerabilities from the database of trending vulnerabilities (replenished by Security analysts) Vision daily), the standard process is adapted by implementing the “emergency change” model.
This model mandates the creation of a committee consisting of information security managers, the CIO, and the owners of the affected business processes, which allows for the deployment of a critical patch within hours, bypassing standard bureaucracy, thereby minimizing business risks from a possible hack.
Requests on Service Request Management
Now imagine you bought a new washing machine and called a technician from the management company to connect it. You then go to the concierge to request a duplicate intercom key for the technician. In this case, nothing is broken and there's no threat; it's simply a standard service request. In IT and information security, these are routine, low-risk tasks: issuing a laptop to a new employee, granting access to a financial system, or resetting a forgotten password. Such tasks are always performed according to a pre-approved template.
Service requests are standardized, repeatable, low-risk procedures that do not involve service interruptions or system failures. These requests include procedures for granting and revoking system access, issuing cryptographic certificates, changing firewall rules based on an approved template, auditing accounts, or deploying endpoint security tools on new servers.
Transforming these routine tasks from unstructured email correspondence into a formalized IT service catalog with configured workflows and automated approvals reduces the operational burden on the SOC's frontline support and system administrators. This functionality is provided by the Security Vision Platform's core set of builders: This minimizes the impact of human factors, ensuring strict version control of security policies and guaranteeing the presence of a digital footprint for compliance needs (Security Vision CM) and regulators (GosSOPKA, NKTsKI or FinCERT Central Bank of the Russian Federation).
Conclusion
Radical optimization of various routine and large-scale operations is achieved through the formalization and implementation of a specialized information security section within the overall corporate IT Service Catalog. Deep integration of SIEM systems and orchestration platforms SOAR, VM vulnerability management systems and a centralized AM /CMDB asset base creates a seamless, closed-loop threat processing cycle.
For holding companies and subsidiaries, such tasks are solved by self-service and self-assessment (SA) portals, the main strategic goal of which is to describe complex internal security processes, clearly define the list of available services, formalize strict requirements for submitted applications, and establish transparent, predictable deadlines for business.
Implementing an ITSM process catalog transforms business/security communications from chaotic emails, phone calls, and instant messaging into managed digital workflows that are easily audited, optimized, and, of course, automated. As a vendor, transparency and speed of management across all technologies and resources is our primary focus.
.jpg)
