ServiceNow Security and Patching of Platform
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3 weeks ago
I am curious of other customers input/interactions with ServiceNow providing security maintenance notifications with very little security information included. I find the recent shift by ServiceNow to perform more frequent security patching along with the overall lack of security details being addressed provides Security practitioners no relevant information to discern the level if risk at the time prior to remediation. With every notification, we have to open a case to ask the same questions so we as a business know or can figure out the level of risk associated to confidentiality, integrity and availability is it relates to our use of ServiceNow and the various applications.
ServiceNow is not being open or transparent with customers regarding the security items being detected and addressed.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3 weeks ago
I agree that having more context around the security fixes would be useful, especially for security teams that need to assess the business risk before approving a patch.
That said, ServiceNow’s patching program is primarily focused on keeping instances current with security, performance, and functional fixes. ServiceNow recommends keeping the platform on supported releases and applying patches promptly.
For the actual risk assessment, you can ask ServiceNow Support for the specific vulnerability/CVE details associated with the security notification, including the affected component, severity, and remediation/patch information. That should give your security team enough information to assess confidentiality, integrity, and availability impact in your environment.
It would definitely be helpful if more of that context were included directly in the security maintenance notification rather than requiring a separate case for every patch.
