Query on Instance hardening

[Suggy]

There are several system properties where ServiceNow says 'Security risk - HIGH'

and also gives us recommendations.

Ex -

Use the glide.ui.escape_html_list_field property to force HTML escapes for HTML fields in a list view.

Security risk rating

8.8

Security risk

HIGH

Link - https://www.servicenow.com/docs/bundle/xanadu-platform-security/page/administer/security-center/refe...

My question is - if its such a high risk, why does even ServiceNow allow us to turn off/modify such properties? Who wants to take risk knowingly? Why cant ServiceNow make such properties as READ ONLY?

[Suggy]

@Sohail Khilji Thaniks for replying. I have implemented instance hardening for several customers and majority of them when asked - what do you prefer for this security property/setting, they just tell me do what is recommended by ServiceNow. Hardly customers really look into all those security system properties.

Also my point was - when the security score is risk is high or very high, then ServiceNow should have not allowed to edit such properties. For low/medium risk one, it can make sense to give flexibility for us to take a call is what I strongly feel.

[Sohail Khilji]

Hi @Suggy 

In order to avoid over customization properties are provided this will allow you to just play with properties rather customizing or over doing changes.