Global Tier 1 Bank

Business Information Risk Officers (BIROs) assist the Cyber Security Operations teams with the investigation and escalation of incidents, particularly ones involving Data Loss Protection (DLP).

A second email notification allowed a DLP Analyst to send a questionnaire to an Impacted User’s Line Manager, so that information on the background and resolution of the incident could be captured from the Line Manager.  

The existing method to capture details of incidents involved the impacted user completing a SharePoint form that sent an email to an offshore team, who in turn keyed the details into the Case Management system for the DLP Analyst to investigate. This was both time consuming and error prone. Automation involved creating a set of web based forms for the Impacted User to complete, which created an incident directly in the Case Management system. 

The Case Management system previously forced the DLP Analyst processing an Incident to proceed through all workbook pages, despite them often knowing quickly that no data loss had occurred.  Improvements were introduced that allowed the Analyst to exit from a workflow and have the system automatically complete the remaining steps when this situation occurred. This allowed a 60% time saving on these cases.

The restrictions involved in the initial implementation of the Case Management system meant that it could not be used, or used completely, within some highly regulated countries. Refinements were introduced that tailored which groups of users could access, and so process, cases for these countries.  This allowed them to adopt the global Case Management system rather than old, out of support system that they had to use previously.