Great products require building bridges between customer needs and technology through cross-functional thinking and closer collaboration of product management, marketing, and sales teams. Product management excellence provides companies a distinct competitive advantage but achieving high performance consistently is a constant struggle for even the most innovative companies. Reducing time to market with a data-driven product development and accomplishing competitive distinctiveness are critical to the success of any product organization.
At Boston BSides last year, we discussed information-driven product design (IDPD), a methodology that simultaneously increases a product’s cyber security and enables data scientists to gain deeper insights into user behavior. Now we can share how information-driven product design was leveraged to launch one of Symantec’s fastest products in its history.
Even when utilizing agile methodologies, launching a General Availability product in a big company is a time-consuming process due to cyber security and legal hurdles of the traditional Product Life Cycle (PLC). However, information-driven product design enabled us to a) design b) build and c) launch a product, including a full PLC approval, within 4 months. Typically the PLC process takes about 6 months.
Figure 1. Three Key Personas
Consider this scenario. A cyber insurance provider is interested in bundling a cyber security self-assessment with its existing products, while the end user would like to get benefit from the advice of a Symantec cyber security Consultant, based on the results of the assessment.
Product Challenge
To do this, our team had to meet two seemingly contradictory customer needs – shareability and exclusivity. On one hand, the customer should be able to exclusively share the cyber security assessment with their multiple customers holding cyber insurance policies. At the same time, these customers should not be able to share the assessment link with other users by posting it on social media. In addition, results of the assessment needed to be available both to the user and Symantec for further consultation in the future.
Information Driven Product Design
There are two key principles of information-driven product design:
- First, reduce the exposed information accessible to the potential attacker
- Second, increase the useful information available to the data scientists for subsequent research.
Benefits
1. Save Time
Applying the first IDPD principle to cyber security assessments: reducing information available to potential attackers and thus reducing time to market
As the cyber security assessment captures potentially sensitive information about the users (e.g. ABC Corp. encrypts data with sha2), we decided to completely remove the login functionality, making it anonymous. This anonymous assessment feature defends against a potential attacker breaking into Symantec’s database and stealing every assessment answer; or, in a less extreme scenario, prevents compromising individual user credentials in case of password reuse.
But how do we make this anonymous survey exclusive?
To overcome that challenge we built a unique, one-time link generator, with links expiring after the assessment starts. This way our customer receives approximately 1000 unique links for the cyber security assessments and shares one each with their user, while no social media post of the expired link can go viral.
Figure 2. Workflow.
Symantec shares access to the security assessment with its customer, who then can forward individual invitations to their users. These invitations expire on activation and thus cannot be spread on a public forum.
2. Increase Insight
Applying the first IDPD principle to cyber security assessments: increasing relevant user information for data scientists and improving our understanding of the user behavior
To capture all valuable user information, we still hold all the answered assessments of the user in our database identifying them with a unique code that we display on the summary report available at the end of the assessment. If the user chooses to contact Symantec to discuss the assessment results, we can pull up the full result based on the code but without revealing the identity of the user. Even our security consultants don’t know whose data they are discussing, while full access is available to statistical averages based on industry and company size. Thus we can study detailed security trends in their historical perspective using the IDPD principles.
Figure 3.Walk through the anonymous cyber security assessment
Walk through the anonymous cyber security assessment
When a user receives a one-time link that expires on click, while no login is required and user is prompted to chose an industry and company size and answer a few cyber security questions. In the end, user receives a summary PDF report.
Information-driven product design is a rapidly developing framework with more examples emerging every day. Here, we describe how it enables faster product launch, as no personally identifiably information (PII) is available to potential attackers. An additional benefit is that, both the cyber security assessment of the product as well the legal clearance by privacy lawyers and terms of use have been achieved within weeks. In addition, the user receives a better experience by not having to login, create a new user account, or give away their email. On the other hand, all the valuable information is captured for further analysis and consultation. Thus information-driven product design is the foundation of one of the fastest Symantec product launch in its history over the past 35 years and can contribute to reduced costs and increased time to market for other products.