Meredith Haines

Juvare

Transcript

1. Meredith Haines Product Review
2. CyberSecurity Incident Response System ACTIVITY MONITOR
3. FROM CONCEPTION TO MARKET Contents • Problem Statement • UX Strategy • Workfllow • Stakeholders & Team Interaction • User Interviews • • Design Iteration & Usability Testing Value Points 1. Began to master data visualization 2. Weekly demos increased product visibility 3. Innovation for MITRE attacks and remediation 4. Distilling Departmental Friction ACTIVITY MONITOR
4. Problem Corprations can only react to MITRE framework security attacks after they have happened. 1. The reaction time is too long 2. Companies need safeguards in place in advance
5. UX Strategy The focus of the user experience was to provide the user with data and system status visibility, and the abiliity to auto-remediate at the point of attack. This was a 100% greenfield project! Specific implementations: 1. Progressive disclosure 2. Self-segmentation 3. Intuitive/guessable interface 4. Compress data into visualizations 5. Create comprehensive dashboards that allow deep dives / launching points 6. Custom query creation 7. Visual Remediation setup / execution
6. UX Methodologies There are nearly endless options for research methodologies selection in both qualitative and quantitative methods. Ideally, a combo of both yields best results. Quantitative • Card sorting / tree testing • First click testing (heatmaps) Qualitative • User interviews • Moderated & unmoderated usability testing
7. Team Roles Our project team was comprised of myself (UX and Prodduct Design), a graphic design intern, two TPMs in charge of JIRA/AC, and our Director of Product. Our CEO and CIO worked closely with me to define the scope, strategy and approach to designing the interfaces and crafting the UX. My role was to conduct discovery user research to understand the market need, hold product design and research review sessions, invent the workflow and UX strategy for user interaction, design the screens in lofi, create brand guidelines/standards for dev to implement (style guide and design system), oversee and tweak hifi deliverables from our intern, to gamify and entice user interaction with fun (yes, even in cybersecurity a product can be fun!
8. Stakeholder Interaction / Distilling Cross-Silo Friction Naturally with many cooks in the product kitchen, there is a delicate political landscape to traverse. • TPMs expect deliverables on accelerated timeline • No requirements provided yet minimal research time • Offshore team wrote wrong APIs; were delivering APIs before we had a front-end! • FRICTION: I distilled arguments by focusing on the user and results of testing. Our debates were based in user research and to quell concerns I often ran A/B tests to satisfy PMs / exemplify the experience is ideal • Last minute product team involvement to change large parts of the product and to “create fires”
9. Workflow / Process Technical dev AC tickets to work off of. Had to décerné what design would be most effective based on limited development resources. PROJECT WORKFLOW 1. Understand business/tech requirements 2. Kickoff workshop w/ all major stakeholders 3. User discovery research, interviews & usability testing 4. Lofi mock-ups/MVP concepts 5. Meet w/ dev to see if design concepts are feasible 6. Iterate lofi usability testing 7. Develop hifi prototypes 8. Review final designs and interaction w/ dev 9. TPMs write AC & move designs to JIRA “Ready for Dev” lane
10. User Interviews & Usability Testing Qualitative Approach 1. Daily Testing of small features (agile) 2. Usability tests and surveys run through UT.com and OW.com; returned between a few hours and a few days 3. Distilled insights via affinity diagramming to find common highs and lows. These anomalies provide a launching point to dig deeper on certain topics
11. Results • The MITRE ATT&CK Framework queries were successfully implemented. We pre-loaded every Mitre attack type and technique known (700+) and also created the ability for users to create custom queries specific to their business or industry ◦ • The ATT&CK playbook was a huge hit. Customers loved feeling safe with unprotected files auto-quarantined ◦ • The visibility into data was the bathwater the baby was desperately crying for and we delivered it! Our new dashboards with key metric visualizations widgets sold the product on its own.