How credentials are secured.

[jcanjura]

We're in the need of a document about the measures taken by Service-Now to protect and secure passwords (especially Discovery Credentials). We know the encryption key itself is encrypted with a key that is stored in the program, not in the database. Also that the supported encryption formats are AES 128 Bit, AES 256 Bit, and Tripple DES, but we need a document that specifies details like (besides the above):

Describe the key credential chain
How the encryption keys (the full chain) is protected?
How is internally managed/protected to prevent any breach?
Are the keys stored on a Hardware Security Module or something similar?
What kind of encryption is used?

I already got this "Encryption support" document, but we're looking for a detailed document on how this all works with a focus on security.

https://docs.servicenow.com/bundle/jakarta-servicenow-platform/page/administer/encryption/concept/c_EncryptionSupport.html?title=Encryption_Support#Encrypting_Passwords_in_System_Properties

Thank you

[Gaurav Shirsat]

Hi jcanjura

The passwords used for local authentication are stored in ServiceNow instance database as element type "password and are hashed with "SHA-2" algorithm which is then "salted " to strengthen the protection.

Please refer the below docs.

1)Key Credential Chain:-

https://docs.servicenow.com/bundle/orlando-servicenow-platform/page/product/credentials/reference/r_...

2)How the encryption keys (the full chain) is protected?
When using Database Encryption all data is encrypted, including attachments, logs, and backups. Keys are managed by ServiceNow using a three-level key hierarchy: 1st level: An AES-256 key is used to encrypt the data. 2nd level: An AES-256 key is used to protect the AES-256 key

https://docs.servicenow.com/bundle/orlando-servicenow-platform/page/administer/edge-encryption/task/...

3)How is internally managed/protected to prevent any breach?

please find the attchment for this:-subscription server guide.

4)Are the keys stored on a Hardware Security Module or something similar?

https://docs.servicenow.com/bundle/orlando-servicenow-platform/page/administer/edge-encryption/conce...

5)What kind of encryption is used?

ServiceNow makes use of encryption for both data in transit and data at rest. ServiceNow customers access their instances over the Internet using forced Transport Layer Security (TLS) encryption for all user access.

https://docs.servicenow.com/bundle/orlando-platform-administration/page/administer/encryption/concep...

Please refer this link also

:-https://docs.servicenow.com/bundle/jakarta-servicenow-platform/page/administer/encryption/concept/c_...

Please Mark Correct and Helpful

Thanks and Regards

Gaurav Shirsat

[Ashutosh Munot1]

Hi, I don't know if you went through this ITOM & credential security – best practice https://www.linkedin.com/pulse/itom-credential-security-best-practice-alexander-ljungstr%C3%B6m. This explain how the Instance is secured in terms of credentials. Thanks, Ashutosh

[chuckm · Accepted solution]

The information you are looking for is in KB0679355 (Credentials Encryption/MID Server and Credentials Encryption/Decryption).  The KB article explains the detailed workflow on how the credentials used for Discovery and Orchestration are encrypted/decrypted in the ServicerNow platform and the MID Server.  You will have to open a HI ticket to get access to this KB.