How to Prevent Downloading of Files to Personal/Unmanaged Devices

[cmitchell2323]

Good Afternoon Everyone,

I work for an organization that is trying to implement a solution to prevent users from downloading ServiceNow files to their personal/unmanaged devices. Here is a scenario:

• UserA wants to acccess ServiceNow through their personal desktop. They navigate to our ServiceNow URL, authenticate via our IdP, and then log in.
• UserA is now able to navigate to any record (i.e. a TASK with an attachment) and download that attachment to their personal device

Based on the above scenario, we do not want this situation to occur. Does ServiceNow provide any way to restrict this? I have been brainstorming and so far, I have thought of potentially using IP Address Access Controls with the following condition: If a user is on managed device (which could be extracted via IP address), then downloading files is allowed, but if a user is on an unmanaged device, file downloading is not allowed.

Has anyone ever tried to implement a solution like this?

[Tanushree Maiti]

Hi @cmitchell2323 

A. Virtual Desktop Infrastructure (VDI)

Using solutions like Citrix, or VMware ensures data never leaves the user's desktop.

• Disable Local Mapping: Disable client drive mapping (CDM) in the VDI settings to prevent users from mapping local drives to the virtual instance.
• Disable Clipboard/Copy-Paste: Disable clipboard redirection to prevent users from copying text from the application to their personal device
• Disable Attachment transfer using MS teams using selecting external id

B. Browser-Only Access & Session Control

•   Enable internal Data Loss Prevention (DLP)  to scan files for sensitive data and block downloads automatically.

C. "Adaptive authentication" or how to restrict access to users based on a specific criteria

D. Block users from downloading or sharing attachments