How Vulnerability Assessment and Penetration Testing (VAPT) is Done in ServiceNow

[BillMartin]

There has been a lot of questions being raised on how VAPT is done in ServiceNow.

What I will be sharing involves the procedures, responsibilities of both the customer and ServiceNow during a VAPT activity.

ServiceNow has multi-levels of penetration testing and vulnerability scanning: 

ServiceNow initiates a uninterrupted loop of penetration testing against its daily builds for development. The test entails of OWASP Top 10 vulnerabilities in the developed code.

Designed to catch vulnerabilities as the code is produced, the activity is initiated by a third-party organization.

Annually ServiceNow undertake a major release penetration test by an external organization.

Clients can perform one penetration test per year while ServiceNow implements over 100 tests yearly.

Furthermore, on how penetration testing is implemented. ServiceNow uses a commercial vulnerability solution to scan both its perimeter and internal hosts that produces reports that are addressed through patching and configuration changes.

You can read more on this document link provided

https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/resource-center/ebook...

Thanks,

Bill

[BillMartin · Accepted solution]

Hi @BernadetteGlove .

Can you mark it as helpful please and accept the solution?

Many thanks!

[BernadetteGlove]

Thanks for sharing how VAPT is done in ServiceNow.

[BillMartin · Accepted solution]

Hi @BernadetteGlove .

Can you mark it as helpful please and accept the solution?

Many thanks!

[Campkathleen]

In ServiceNow, Vulnerability Assessment and Penetration Testing (VAPT) is typically done by integrating security testing services with the Security Incident Response module. The process includes:

1. Vulnerability Assessment: Identifying and prioritizing vulnerabilities through automated scanning tools integrated with ServiceNow, such as Qualys or Tenable.
2. Penetration Testing: Simulating real-world attacks to exploit vulnerabilities and assess system security. This can be managed through Security Operations or Vulnerability Response in ServiceNow.
3. Remediation: Automatically triggering workflows in ServiceNow for patching or mitigating discovered vulnerabilities.

By using security testing services, businesses ensure continuous monitoring and faster response to emerging threats within the ServiceNow platform.

[BillMartin · Accepted solution]

@Campkathleen let me complement what you have mentioned to guide the community and ServiceNow clients correctly!

ServiceNow customers can perform a penetration test against a sub-production instance by following the Customer penetration testing policy (requires a Now Support account). Any security testing outside of this process is not permitted. 

Providing the latest official reference for further details:

Vulnerability assessment and penetration testing in ServiceNow