Securing the Service Account users in Servicenow

rahulyamgar — Wed, 29 May 2024 10:35:56 GMT

Hello friends,

We are filtering some of our records/CIs using the Query Before Rules. However, there are few Service Accounts which need to bypass this Query before Business Rule execution. This is implemented using the filter/condition in Business rules to exclude the execution for certain users - condition is gs.getUserDisplayName() is not 'ABC'. However, anyone with admin access can maliciously tamper the user record to have display name as ABC.

What is the most efficient way to achieve this behavior? My friend suggested to use the system properties to hold the sys_ids of the users but anyone with ADMIN access can tamper/update this system property.. @GunjanK

Thanks in advance,

Re: Securing the Service Account users in Servicenow

Kieran Anson — Wed, 29 May 2024 10:46:09 GMT

Hi,

Admins will always be able to work around processes, it's why it's such a highly privileged role. If a customer is concerned about this, they need to review who has admin access in production and regulate it tightly.

Assuming these service accounts are only using APIs, consider using the gs.isInteractive() function to check whether the transaction is a user (via a webpage) or an API call.

question Securing the Service Account users in Servicenow in ServiceNow AI Platform forum

Securing the Service Account users in Servicenow

Re: Securing the Service Account users in Servicenow