How are you tracking MFA for Business Applications in ServiceNow?

[Andrew Gruden]

I’m interested in how other organizations track whether a Business Application uses or requires MFA.

1. Where are you storing the MFA information, and how is it tied back to the Business Application?
2. Are you using existing ServiceNow tables/structures, or was this a customization?
3. How well has your approach worked with existing modules or custom processes, especially for keeping the information current?

I’d appreciate hearing what has worked well and anything you would do differently.

Thanks.

[MEBoatman]

This is a GREAT question! I have it on my backlog to address this but haven't been able to prioritize it. Will be interested to hear the responses you get here!

[rebekahcurrier]

We are using an Information Object to track MFA applications.

[Chetna_Aggarwal]

One approach could be to model MFA as a Technical Service/Application Service and relate it to the Business Application. This way, you can easily identify which Business Applications depend on MFA and visualize the relationship in the CMDB.

It also scales better than adding a custom field if you plan to track other shared security services in the future.

[Mathew Hillyard]

Hi @Andrew Gruden 
I would advise against tracking MFA as a separate Business Application - it's really feature embedded in many platforms/applications (e.g. ServiceNow) rather than a Business Application in its own right.

I would also advise that Information Object is not the right place for this. An Information Object indicates the type of data the Business Application contains or uses. It has nothing to do with MFA, which is a security software feature.

I would even more strongly push back against adding checkboxes to any records to track these things -  it's a poor data model and there is neither lineage nor auditability just by ticking boxes. This is a common architectural mistake organisations make and sooner or later they end up unpicking the mess.

It makes more sense as one or more Technology Management Service Offerings with a parent Identity and Access Management Service. Then point the Offerings at the relevant Service Instances that are an instance of the Business Applications that contain that feature (e.g. if you just have a single Multi-Factor Authentication TMSO, point it at the ServiceNow Production Service Instance, and any others).

By looking at the technology from a support and management perspective it plugs nicely into ops - you have the Service Instance so now you automatically see the support, approval and change teams and it aligns nicely with CSDM.

As to keeping this information current - how do you prove MFA is turned on today? If you have some kind of scanning tools or automated harvesting then you could go and look at that data, but usually people want to know the currency of the data for technology compliance, so I'd leave the structure as-is above and use Compliance Indicators to examine wherever you are pulling that data into ServiceNow instead, tied to the relevant security Control(s). If not, then you will need recurring attestation-based Controls pointed at the owner of the Business Application to establish currency.

This is the same ask for many similar such as SSO or Security Hardening, which are sources for similar cyber-security controls.

I hope this helps!
Mat