Securing a custom service portal

[CarrieH]

How do you approach securing a custom Service Portal that exposes data from multiple tables with different access rules? What's your strategy for preventing data leakage?

[GlideFather]

Hi @CarrieH,

what data are we talking about?

If you want to secure any data, use ACL and it will manage the access in all the ServiceNow aspects - service portal, native ui or any other location

[Tanushree Maiti]

Hi @CarrieH 

To prevent data leakage, first you need to ensure authorized users only able to login to access the data.

For it just validate whether your instance have that security :

- ServiceNow provides various security features, including multi-factor authentication (MFA), SSO, role-based access control (RBAC), encryption options, and the High-Security Plugin (HSP) etc

Next Before checking Data level security, You should check whether your Platform is secured as per ServiceNow Platform security features like 

  - Security Hardening ( Refer : https://www.servicenow.com/docs/r/platform-security/instance-security-hardening-settings/sc-access-c...)

   - 

Lastly for your Data security, you need to secure your data using ACL or other data security protection method:

Refer : https://www.servicenow.com/community/developer-articles/servicenow-custom-scoped-app-security-a-deve....

This as well : https://www.reco.ai/hub/servicenow-security-best-practices