Architecture, design, and threat modeling

This broad control addresses high level design considerations and key elements to implement a secure application. This covers the tenants of availability, confidentiality processing integrity, non-repudiation and privacy. Additionally, elements of a secure software development lifecycle are included.

• Certificate based authentication not enforced [New in Security Center 1.3]
  The glide.authenticate.mutual.enabled property enables certificate based authentication, a type of mutual authentication for inbound REST connections to REST and SOAP APIs in the ServiceNow AI Platform.
• Check impersonation on ACL evaluation in HR App [New in Security Center 1.3 and updated in 1.5]
  Use the sn_hr_core.impersonateCheck property to prevent a user from impersonating another user and accessing their HR information.
• Define allowed ServiceNow internal IP addresses [Updated in Security Center 1.3 and 1.5]
  Use the glide.ip.authenticate.strict property to specify IP ranges that can make inbound connections on an instance.
• Disable legacy JQuery behavior [Updated in Securty Center 1.3]
  The glide.jquery.legacy is used to prevent older prepatched JQuery versions from being used which will introduce unpatched vulnerabilities in the library.
• Disable GlideRecord Scope Fencing Legacy Behavior [New in Security Center 1.3 and updated in 1.5 and 2.0]
  The glide.record.legacy_cross_scope_access_policy_in_script property disables scope fencing allowing scoped apps to access global script interfaces. It was created as a patch to GlideRecord's cross scope access.
• Disable legacy AngularJS behavior [Removed in Security Center 2.2]
  Use the glide.angular.legacy property to protect from potential security risks arising from attacks on vulnerabilities discovered in outdated AngularJS library versions.
• Disable local login for users with Single Sign-On (SSO) enabled
  Update user records to disable local login for users with Single Sign-On (SSO) enabled.
• Disable unauthenticated published reports [Updated in Security Center 2.0]
  Deactivate this property to prevent the user from publishing or accessing reports. This property disables the published reports feature in reporting.
• Enforce field ACLs for inbound query requests
  Manage how incoming queries are validated on your instance.
• Enforce read ACLs on report views
  Manage how Read ACLs are enforced on your instance.
• Enforce Query ACLs for Knowledge Quick Links
  Enforce query ACLs for Knowledge Quick Links using a system property.
• Enforce Query ACLs for SubLists, List Counts and Widget Data Tables
  Enforce query ACLs on sublist, list count, and widget data table queries using system properties.
• Enforce valid query string choice [New in Security Center 7.0]
  Use a system property to ensure that any choice field value, when passed via a URL query string, is a valid active choice when a record is created.
• Ensure An Instance is Allowed to Connect to Only Trusted IP Addresses
  Use a system property to define a list of IP ranges that are appended to the outbound IP allow list.
• Ensure only Trusted IP Addresses are Allowed to Connect to An Instance
  Use a system property to define a list of IP ranges that are appended to the outbound IP allow list.
• For Self-Hosted Instance, Ensure only Trusted IP Addresses are Allowed to Connect to An Instance
  Use system properties to control which inbound IP addresses can connect to self-hosted instances.
• Require authorization for data broker rest API [Updated in Security Center 1.3]
  Use the glide.basicauth.required.databrokerrestapiprocessor property to require basic authorization for all inbound Data Broker Rest API requests.
• Restricted Binding functionality in case Bearer Authorization [New in Security Center 7.0]
  Use a system property and restricted binding to ensure that an access token generated using that entity can’t be used for UI calls.
• Deny by default with empty ACLs [Updated in Security Center 1.3]
  Use the glide.sm.default_mode property to control the default behavior of security manager when it finds that existing Access Control List (ACL) rules are a part of wildcard table ACL rules.
• Set Automatic Token Cleanup for Token Credentials [New in Security Center 2.0]
  Use the com.snc.platform.security.token.auth.cleanup property to ensure that expired API keys and HMAC secrets are deleted, thereby limiting the potential for token reuse.