ServiceNow Security Operations (SecOps): Tools and Use Cases

Among the key problems of contemporary corporate IT there can be named the number of alerts, advanced cybercriminals, and non-cooperative technology stack. Classical Security Operation Center cannot be efficient because of manual triaging, poor integration of communication channels, and absence of point solutions. Security analyst gets alert from first endpoint protection solution, conducts manual pivot to firewall dashboard, retrieves info from identity provider and sends an email to the infrastructure admin for remediation. It is the lengthy process that gives opportunities for the attacker and annoys IT specialists.

ServiceNow Security Operations or ServiceNow SecOps unites IT operations with enterprise-level cybersecurity. Integration of all security data, configuration items, automation and workflows on Now Platform makes it possible to eliminate reactive security approach and adopt proactive security strategy. The current research will consider the architecture, components and tools, enterprise applications of ServiceNow SecOps, as well as best practices of its implementation and benefits for the business.

SecOps Integration: Evolution and Requirement

In the enterprises that have an enterprise security team and enterprise IT operations team, it was noticed that there were some differences between the two. Though some tools existed among the enterprise security team, which included IDS, SIEM, Vulnerability Scan, there were other tools belonging to the IT team regarding Change Control, Inventory, Patching, and Access Management.

In case of any threat to the organization, the handing over process between the two teams used to be difficult. The reason for this is that in case the enterprise security team created a ticket or spreadsheet for any vulnerability or infection on the endpoint, the IT team had to do analysis to determine who was accountable and the maintenance window.

The inability to coordinate operations was an issue which the ServiceNow SecOps solution was designed to solve. ServiceNow SecOps uses the ServiceNow Configuration Management Database and establishes a connection between the alerts, vulnerability or threat and the associated business asset/service. It means that security can be integrated into the system managing IT Service Management, IT Asset Management, and Strategic Portfolio Management. Security analysts will not have to identify the business service associated with the attacked server and get in touch with the system owner via e-mails.

Main Tools and Modules of the ServiceNow SecOps Solution

There are reasons to believe that it is not surprising that the ServiceNow SecOps solution is not a huge platform in a single application but several modules aimed at solving various cybersecurity problems.

Security Incident Response

Security Incident Response is a very important aspect of the SecOps platform. The Security Incident Response Platform acts as the intelligent orchestration layer over the native detection platforms. No matter what kind of alert this is, whether it’s a SIEM platform, cloud security posture management solution or endpoint detection and response solution, the Security Incident Response will aggregate all these alerts into security incidents.

The Security Incident Response automates all sorts of manual and unstructured processes and uses dynamic playbooks which are based on industry standard incident handling procedures such as NIST and SANS Institute incident handling procedure. Once the incident is logged, the platform automatically identifies indicators of compromise, enriches them with background information, determines risk based on business services impacted, and assigns the incident to the appropriate team. There is a single console for security analysts which provides situational awareness of all impacted users, configuration items, threat intelligence, and past incidents.

Addressing the Vulnerabilities

Information overload has always been a challenge for each and every vulnerability management process since millions of vulnerabilities have been created within the IT environment due to the network scanners, application scanners, and cloud vulnerability scanners. All these vulnerabilities cannot be addressed especially when considering the CVSS rating and ignoring the context and exploitability.

The Vulnerability Response module provides organizations with a capability to connect their enterprise scanners with the ServiceNow configuration management database. Vulnerability Response collects scan data and turns this data into vulnerabilities and remediation tasks. Risk score can be viewed as a combination of the severity score of the scanner, threat intelligence which shows that the vulnerability is being exploited at the moment, and the criticality of the host item.

Moreover, the Vulnerability Response module allows organizations to become independent from their infrastructure. This means that there are separate modules for application vulnerability response, container vulnerability response, and cloud security posture management. Integration with the IT Service Management makes it possible to create change management requests through remediation tasks and patching according to the service level agreement.

Threat Intelligence

The triage process improves significantly when one receives contextual information about malicious entities in a timely manner. The Threat Intelligence feature makes it possible to automate the gathering, standardization, and scoring of intelligence about the threats coming from external sources thanks to the use of the Structured Threat Information Expression and Trusted Automated Exchange of Intelligence Information standards.

If an IP address, domain name, URL, or file hash is mentioned in the incident or vulnerability report, the Threat Intelligence tool automatically evaluates reputation of the object in the external reputation databases or sandboxes. The indicators will be scored according to the level of confidence and history of the malicious activities related to these indicators along with specific threat actors and tactics, techniques, and procedures used in the MITRE ATT&CK framework. To put it differently, the security analyst will be able to find out immediately if the network connection that is analyzed belongs to the good or bad systems.

Critical Security Incident Management

While routine incidents could be addressed using normal business processes, critical incidents, including large-scale ransomware attacks, theft of intellectual property, and APT attacks have to be addressed through the collaboration of senior managers. There is a specific sub-module within the system that is devoted to crisis management.

It proves to be very useful in terms of collecting all technical actions, contacts with lawyers, meeting with executives, contacts with media, and other compliance-related activities. It can be applied as a means of coordination of multiple child incidents, war rooms creation, ensuring the integrity of communications, and managing a number of action items. After crisis resolution, the post-incident analysis can be conducted using the module.

Configuration Compliance

In addition to the flaws of the software products themselves, there is another threat that cannot be overlooked. Configuration Compliance module works in cooperation with configuration auditing tools in order to check the compliance of assets with the internal security policies as well as various benchmarking standards (Center for Internet Security, Defense Information Systems Agency Security Technical Implementation Guides).

The Configuration Compliance will map the results of compliance scanning to configuration items in Configuration Management Database while focusing on the remediation activities based on the asset value. If there is any insecure configuration like audit logging disabled, unsecured communications, unnecessary administrative privileges, etc., the module will produce all required remediation tasks and IT Change Requests to fix the configuration to its baseline.

Data Loss Prevention Incident Response

Given the increasing number of data distribution channels in remote workforces, collaboration tools, and hybrid clouds, the chances of data exfiltration increase. The Data Loss Prevention Incident Response will correlate all the data loss prevention incidents generated by different data protection solutions, endpoint detection and response solutions, as well as cloud access security brokers.

Routing those alerts to ServiceNow system will enable companies to leverage their incident response processes for investigating the data policy violation incidents. Besides, this module will give the ability to contact the end-users automatically and ask for an explanation about the legitimacy of the data transfer.

Automation Engine: Security Orchestration, Automation, and Response

The key feature of the ServiceNow SecOps platform is SOAR that stands for Security Orchestration, Automation, and Response. Use of ServiceNow Flow Designer and Integration Hub can be done in order to create an automated playbook, which would be either codeless, low code, or customized, so as to be able to automate complex business processes within an environment that uses multiple vendor technologies. Practicing hands-on experience with these tools is essential for their deployment and customization, which can be gained from servicenow developer online training offered by OnlineITGuru.

All the tasks executed by security analysts imply repetitive work like entering IP address in the threat intelligence system, looking for user manager details in the directory service, performing password reset, network devices search and so on. All these tasks are handled immediately through SOAR workflow automation.

The playbook could be either automated or human-in-the-loop based. If the playbook is automated and the required level of confidence is reached, it is possible to isolate the host and update firewall rules without involving humans. In the case of human-in-the-loop playbook, all the needed information is collected and threat intelligence/host analysis is conducted but remediation actions take only one click.

Use Cases for ServiceNow SecOps

In order to see the impact of ServiceNow SecOps on the organizations, it is necessary to see how this technology is used by these companies. The use of the incident response automation enables the shift from a reactive approach to the more coordinated one.

Automated Triage and Response to Phishing Incidents

The phishing attacks continue to remain among the most popular methods for attacking corporate networks. Hundreds or thousands of emails containing the phishing threats are received each week in the corporate email boxes. Manual checks of all emails are not possible due to the risk of analyst fatigue and missing some of the threats.

Using ServiceNow SecOps, the automated triaging of phishing incidents can be achieved. Once a suspicious email is reported by the employee through the email client plugin, the incident becomes a security incident case in ServiceNow.

In this stage, the system searches for any threat intelligence feeds or sandbox detonations to analyze the artifacts. The presence of a known credential harvesting URL or malicious malware in the attachment indicates that there is really a threat.

The next phase is the containment phase where the email server of the enterprise network is searched for all mailboxes containing this email address and the email is removed from everywhere along with resetting the credentials of those clicking the link. The final phase of the process is to send a notification back to the reporting employee in an acknowledgment message without human analyst’s intervention.

Business-Context Driven Vulnerability Lifecycle Management

The vulnerability management process is highly dependent on the output of scan; hence a conflict arises between the security expert, who wants it patched immediately and the system administrator who does not want any downtime.

ServiceNow Vulnerability Response enables automatic loading of the vulnerability information into the platform; hence there is no need to go through different vulnerability lists to correlate with the Configuration Management Database.

Three factors are used in the analysis for calculating the dynamic risk score for a vulnerability: the technical severity of the vulnerability; the exploitation of the vulnerability by an exploit kit or targeting any organization as mentioned in any threat intelligence feed; and the significance of the underlying asset from the business perspective. If a vulnerability having a high technical risk score is found in a test server, it will have a lower priority than a medium-risk vulnerability in a transaction processing server available on the Internet, which will have a higher priority.

Once the vulnerabilities have been prioritized, the tool logically categorizes these vulnerabilities into tasks for fixing them and assigns IT change management templates to these tasks, which have been pre-approved. The owners of the systems are instructed about the software updates needed and deadlines of these tasks, which emerge from service level agreements. In case of delay in patching because of some operational issue, it can be done using the exception request feature of the system.

Malware and Ransomware Control

As far as the control of malware infections and lateral movement are concerned, the first thing to mention is the aspect of rapid reaction which is among the most important factors. This is because the problem can quickly evolve into complete compromise of the corporate environment in the next few hours.

In case of the suspicious activity detection and response solution identifies, then the incident is immediately created in the ServiceNow platform. After that, the response incident playbook enriches the incident with such information about the user working with the machine, as well as physical and network locations, which are retrieved from asset databases.

Additionally, the workflow checks the network flows in order to receive information about external IP addresses that communicate with the host machine. If the problem is confirmed, the host machine will be isolated from the corporate network by using the API call to the endpoint agent.

Moreover, the firewall integration is used to block all the communications between the host machine and enterprise gateways, whereas identity integration locks the user account.

Investigations Related to Insider Threat and Data Exfiltration

Measures required to be taken against the insider threat require high confidentiality and cooperation between security, HR, and legal departments. There will be various elements which will determine if the individual is trying to gain access to his/her intellectual property as well as customer information before leaving the company. These elements will be derived from various sources which include cloud storage, data loss prevention tools and badging.

ServiceNow SecOps will make sure that all of these elements are collected together and a workflow regarding the insider threat will be established. In case there is any incident involving data loss prevention tools because of large scale file transfer, the profile of the individual will be analyzed through HR modules. In case it comes to light that the individual concerned has either resigned or is under a performance improvement plan, then the matter will be automatically escalated.

All of this will happen in a very safe manner. Playbooks in SecOps are used to access browser history and audit logs of enterprise cloud storages.

Audit readiness, regulatory compliance, and governance

Companies operating in the regulated industry sectors like finance, health care, defense, and critical infrastructure need to be aware of the fact that they are bound to follow the strict compliance regime, such as Sarbanes-Oxley Act, HIPAA, PCI DSS, and GDPR. The requirement of demonstrating compliance means proving that the vulnerabilities have been dealt with in the specified timeframe and that the security breaches have been adequately investigated with the help of the rigorous methodology.

Because of the ServiceNow SecOps solution, the process of becoming audit-ready gets converted into the ongoing assurance process because all alerts, investigations, analyst decisions, and remediation efforts get stored in one system.

During the audit of the critical infrastructure patching process, the SecOps solution prepares a comprehensive report explaining in detail how long it took to scan the vulnerabilities, to create a ticket, to approve the ticket, to install the patches, and to close the tickets. In case of an incident audit, SecOps prepares an immutable record of all actions taken, notifications delivered to the external entities, and the results of the post-incident review.

Best Practices for the Successful Deployment of SecOps on ServiceNow

In order to ensure the successful deployment of SecOps there is a need to make a process transformation which is not restricted to installing the software only. Here are some best practices of SecOps program implementation.

Pay Attention to CMDB Maturity

What makes ServiceNow SecOps different from the rest of the security mechanisms is the use of Configuration Management Database (CMDB). Without configuration information, it would not be possible to estimate context risk score, determine asset owners and manage changes in a safe way.

The organization needs to have assets discovery and normalization capabilities available. The Common Service Data Model will help to connect technical assets to applications and services supported by them. In case of low CMDB maturity during implementation process, it is better to begin with tier-one system discovery.

Crawl, Walk, Run Automation

Once automation has been brought to the enterprise, people usually try to automate the containment process immediately. It may lead to outages because of lack of data validation.

Maturity Approach in Efficient Automation of Security

Crawl phase - In this phase, the process only entails collection of information for alerting of the threats and also looking up of the threat itself. Walk phase - The processes include inclusion of the human-in-the-loop approval process where the playbooks recommend actions for remediation and the analyst approves the action in a single click. Run phase - Highly confident and low risk actions such as isolation of the phishing campaign and endpoint isolation are automated.

Why is it Important to Align Security and IT Operations?

SecOps occurs when there is collaboration between the security team and IT team rather than competition between the two parties. It is very important for the security teams to comprehend the IT change management and interdependence.

The organization should establish a governance board in order to develop a standard SLA and escalation process. SOP must be created before the playbook creation. The remediation process efficiency will be increased significantly since IT departments treat SecOps as a valuable tool for creating a structure out of criticism.

The Role of Telemetry Data in Integration

It is only telemetry data that determines whether the project is successful or not. It is essential to understand the existing architecture in order to collect the information obtained from logs, SIEMs, vulnerabilities, and endpoints and APIs in order to perform the information gathering process in ServiceNow. Anyone wishing to obtain the practical experience in the current architecture from the specialists should enroll in the top servicenow institute in hyderabad, OnlineITGuru.

It is also important to have some rules about sending alerts. When adding security alerts to the incidents' queue without filtering, the system is overloaded with information, thus working inefficiently. The alerts should reach the ServiceNow incidents only when it is really important.

Conclusion

Taking into account the increasing complexity of the threat environment in which organizations operate, there is no sense in dividing the detection process in cybersecurity and remediation in IT operations. It can be done via the use of the ServiceNow Security Operations tool, which is a platform that facilitates telemetry, context, workflow automation, and teamwork.

With the help of Security Incident Response, Vulnerability Response, Threat Intelligence, and Configuration Compliance applications, companies will be able to make sure that their processes are automated but not disjointed. By virtue of SecOps approach, it has now become possible for us to examine the entire threat in the right context as well as to deal with all types of vulnerabilities. In the light of the need to adapt to the automated workflow methodology owing to increased demands, it has become necessary to script. By opting for the servicenow developer training in hyderabad by OnlineITGuru, it becomes possible for us to train our engineers in essential practical skills needed for implementing SecOps approach.