Access control (instance security hardening)

Access controls determine whether access to a particular resource should be granted or denied. It only allows access to resources to those users permitted to use them.

Authorization is not equivalent to authentication, as these terms and their definitions are frequently confused.

• Authentication is providing and validating identity.
• Authorization includes execution rules that determine what functionality and data the user (or principal) can access, ensuring the proper allocation of access rights after authentication is successful.

Authorization is a process that comes after a successful authentication. You can configure security properties that designate if, after determining that a user holds valid credentials associated with a well-defined set of roles and privileges, resource authorization occurs.

The following are some security controls that an administrator can configure to restrict unauthorized access to sensitive entities within the ServiceNow AI Platform.

• Access Control List Rules
• Configuring an ACL rule
• ServiceNow access control

• Access to GlideSystemUserSession scriptable API
  The client callable GlideSystemUserSessionSandbox scriptable API exposes GlideSystemUserSession's addErrorMessageNoSanitization and addInfoMessageNoSanitization methods to the javascript sandbox. This allows all users to call this method via script.
• Authorization for script execution
  Use the glide.script_processor.authorized_script_module_role property to restrict the usage of running scripts from sys_app_module table to the defined role within the property.
• Basic auth: JSONv2 requests (instance security hardening)
  Use the glide.basicauth.required.jsonv2 property to designate if incoming JSONv2 requests should require basic authorization.
• Basic auth: SOAP requests (instance security hardening)
  Use the glide.basicauth.required.soap property to designate if incoming SOAP requests should require basic authorization.
• Block access for delegated developer
  This configuration affects access for delegated developers that are updating user roles through script. When the configuration is compliant, the developer will not be able to update or insert records into the table sys_user_has_role without also the user_admin role.
• Check UI action conditions before execution (instance security hardening)
  Use the glide.security.strict.actions property to enable checking of UI actions conditions in forms and lists before they execute. When you set this property to true, it adds an extra layer of validation on the table UI actions before they are executed.
• Contextual Security: Role Management plugin (instance security hardening)
  Activate the Contextual Security: Role Management (com.glide.role_management) plugin to enable contextual security, which secures a record/information using create, read, write, and delete functionality.
• CSV request authorization (instance security hardening)
  Use the glide.basicauth.required.csv property to designate if incoming CSV (Comma-Separated Values) requests should require basic authentication.
• Default deny (instance security hardening)
  Use the glide.sm.default_mode property to control the default behavior of security manager when it finds that existing ACL rules are a part of wildcard table ACL rules.
• Double check inbound transactions (instance security hardening)
  The glide.security.strict.updates property to enables double-checking of security on inbound transactions during form submission, and adds an extra layer of table validation before a form renders in the browser. This property is set to true by default
• Enable ACLs to control live profile details (instance security hardening)
  Use the glide.live_profile.details property to designate whether a user should be able to view all detail fields, such as company name and phone numbers, in a live profile.
• Enabling AJAXGlideRecord ACL checking (instance security hardening)
  Use the glide.script.secure.ajaxgliderecord property to perform access control rule (ACL) validation when server-side records, such as tables, are accessed using GlideAjax APIs within a client script.
• Excel request authorization (instance security hardening)
  Use the glide.basicauth.required.excel property to designate if incoming Excel requests should require basic authentication.
• Explicit Role plugin (instance security hardening)
  Activate the Explicit Role (com.glide.explicit_roles) plugin to provide the instance with the new snc_internal and snc_external roles for B2B and B2C applications, preventing external users from accessing internal data. Enterprise users (employees) must have the internal role while non-enterprise users (non-employees) must have the external role.
• Import request authorization (instance security hardening)
  Use the glide.basicauth.required.importprocessor property to designate if incoming import requests should require basic authentication.
• PDF request authorization (instance security hardening)
  Use the glide.basicauth.required.pdf property to designate if incoming PDF requests should require basic authentication.
• Performance monitoring (ACL) (instance security hardening)
  Use the glide.security.diag_txns_acl property to control stats.do, threads.do, thread_pool_stats, and replication.do access from an unauthenticated connection.
• Performance monitoring IP restriction (instance security hardening)
  Use the glide.custom.ip.authenticate.allow property to enable only a specified comma-separated list or a range of IP addresses access to stats.do, threads.do, and replication.do pages. If this property is not enabled, it is possible to access those types of pages from any IP address.
• Privacy on client-callable script includes (instance security hardening)
  By default, client-callable script includes that do not explicitly set visibility, are public. If needed, add the glide.script.ccsi.ispublic property to enable privacy control over all client-callable script includes accessed by public pages.
• Disable public access to favorites [Updated in Security Center 1.3]
  Use the glide.ui.magellan.favorites.allow_public to specify whether unauthenticated users are allowed to see Favorites in the navigator.
• Restrict access to specific IP ranges (instance security hardening)
  Use the com.snc.ipauthenticator property to restrict access to specific IP ranges. Unless public access is intended for the instance, administrators should limit access to their assigned IP net blocks.
• RSS request authorization (instance security hardening)
  Use the glide.basicauth.required.rss property to designate if incoming RSS requests should require basic authentication.
• SAML 2.0 web browser SSO profile (instance security hardening)
  The com.snc.integration.sso.saml20.update1 plugin ensures that the status of the SAML 2.0 Single Sign-On plugin is active.
• Script request authorization (instance security hardening)
  Use the glide.basicauth.required.scriptedprocessor property to designate if incoming script requests should require basic authentication.
• Security jump start (ACL rules) (instance security hardening)
  Activate the Security Jump Start (ACL Rules) (com.snc.system_security) plugin to create several important ACLs that validate the Access Controls on some of the key system tables within the ServiceNow AI Platform.
• SNC Access Control plugin (instance security hardening)
  Activate the SNC Access Control (com.snc.snc_access_control) plugin to control access to your instances by Customer Service and Support personnel.
• SOAP content type checking (instance security hardening)
  Use the glide.soap.require_content_type_xml property to enable validation of a content type as text/xml and protect against invalid SOAP requests.
• Strict IP restriction (instance security hardening)
  Use the glide.ip.authenticate.strict property to enable a strict set of IP addresses, such as DC and secure VPN, to access this instance.
• Unload request authorization (instance security hardening)
  Use the glide.basicauth.required.unl (useUnloadFormat) property to designate if incoming unload requests should require basic authentication.
• WSDL request authorization (instance security hardening)
  Use the glide.basicauth.required.wsdl property to designate if incoming WSDL (Web Services Description Language) requests should require basic authentication.
• XML request authorization (instance security hardening)
  Use the glide.basicauth.required.xml property to designate if incoming XML requests should require basic authentication.
• XSD request authorization (instance security hardening)
  Use the glide.basicauth.required.xsd property to designate if incoming XSD (XML Schema Definition) requests should require basic authentication.

Related reference

• Attachments (instance security hardening)
• Email security (instance security hardening)
• Input validation (instance security hardening)
• Secure communications (instance security hardening)
• Security best practices (instance security hardening)
• Security inclusion list (instance security hardening)
• Session management (instance security hardening)
• Other settings and security resources