ServiceNow integrates SecOps with Microsoft to boost user security

Over the past year, organizations worldwide have seen an increasing number of cyberattacks. Phishing and vulnerability exploits continue to be leading attack channels. The content adapts to the times (COVID-19-related phishing, for example), but the attack channels themselves are not new. Combating these attack types requires a focus on transforming security operations and response.

ServiceNow is building on its workflow and platform approach to Security Operations (SecOps) by adding integrations with Microsoft security solutions, including Azure Sentinel, Teams, SharePoint, and Threat & Vulnerability Management. These integrations are another exciting step that increases security teams’ efficiency and responsiveness, keeping customers, citizens, and users safe.

The rise of ransomware attacks

Beginning well before the COVD-19 pandemic, organizations and governments began to see an alarming rise in the number of ransomware attacks across the globe. Verizon’s 2021 Data Breach Investigations Report revealed 10% of breaches in 2020 involved ransomware—double the amount from the previous year.

Security operations teams are increasingly stretched and struggle to keep their heads above water when responding to (and preventing) these attacks. To make matters worse, most of the tools and processes at security teams’ disposal today simply aren’t integrated or automated.

Furthermore, if an incident becomes a major incident like the Colonial Pipeline ransomware event, there’s even more pressure and focus on responding quickly and collaborating across the organization.

Preventing and responding to ransomware attacks requires centralized visibility into security posture, risk-based prioritization of vulnerabilities and incidents, automated workflows for efficient response, and collaboration inside and outside of security.

An integrated response

ServiceNow’s integration with the Microsoft security suite helps achieve these goals. With the Microsoft Azure Sentinel integration, ServiceNow Security Incident Response (SIR) can respond to an incident quickly after Azure detects it. Knowledge and evidence sharing are automatic, so the organization can catch an incident before it impacts customers.

Microsoft Teams and SharePoint integrations with the upcoming SIR Major Security Incident Management feature will ensure streamlined coordination across the enterprise. Cross-functional teams will be able to collaborate on incidents using the automated setup of dedicated Teams channels.

In addition, all evidence and data that teams gather can be stored in SharePoint folder structures that are automatically created and linked to the case record. In combination with task tracking, audit logs, and more, the Teams and SharePoint integrations are part of a virtual war room experience that helps customers stay on top of mission-critical events.

Microsoft Threat & Vulnerability Management integration with ServiceNow Vulnerability Response allows teams to become more proactive in preventing attacks. Using asset and business context, Vulnerability Response prioritizes vulnerabilities and drives remediation and deferral workflows across security and IT.

As a result, teams can better coordinate on incident response and on proactive attack surface management, making high-priority incidents such as ransomware less likely.

Benefits for every industry

Almost 80% of the Fortune 500 are using the Now Platform, and more and more customers are realizing the value of running security operations on the same platform as IT.

In particular, two sets of industries stand to benefit: those that have been hit particularly hard over the past year (including retail and e-commerce) and industries in regulated markets, such as financial services and the public sector.

ServiceNow’s partnership with Microsoft enables security teams to:

• Get the context they need for risk-based prioritization
  
• Drive workflow and automated actions to respond to incidents that threaten mission-critical assets
  
• Record a paper trail that makes it easy to audit the incident afterward
  

As security incidents such as Colonial Pipeline grow increasingly prevalent, organizations will continue to rely on workflows to strengthen their security posture. These new integrations that tie Microsoft’s security suite into the ServiceNow SecOps ecosystem are an important part of that story.

Learn how ServiceNow SIR helps you stay ahead of cybercriminals.

See a SecOps demo.

ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of ServiceNow, Inc. in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective companies with which they are associated.