Attachments (instance security hardening)

Many ServiceNow AI Platform business processes allow for the upload of data/information. It regularly checks the validity and security of text, but accepting these files can introduce even more risk.

To reduce the risk, you should validate for malicious files so that the ServiceNow AI Platform can correctly protect against attackers who send these files. You handle these files by including business logic that scans files during the upload process and rejects those files perceived as malicious.

Internal References

• Administering attachments
• Configure attachment system properties

• Downloadable MIME types (instance security hardening)
  Use the glide.ui.attachment.download_mime_types property to specify a list of comma-separated attachment MIME types that should be downloaded but not render inline in the browser.
• Enable deny list for attachments (instance security hardening)
  Use the glide.security.attachment_type.use_blacklist property to designate if the ServiceNow AI Platform should validate the attachment against a specified exclusion list.
• Enable file download restrictions (instance security hardening)
  Use the glide.ui.strict_customer_uploaded_static_content property to enable restrictions on the file types that can be downloaded when they have been uploaded using the Upload File functionality.
• Enforce strict user image upload (instance security hardening)
  Use the glide.security.strict.user_image_upload property to enable Access Control for the upload/update of a profile picture when performed on a user record.
• Force Download MIME types (instance security hardening)
  Use the glide.ui.attachment.force_download_all_mime_types property to force the download of all MIME type attachments.
• Restrict file extensions (instance security hardening)
  Define which file types can be uploaded to your instance using the glide.attachment.extensions system property. This property uses a comma-delimited list of allowed file extension types. Only the specified file extension types be uploaded as attachments.
• Restrict unauthenticated access to attachments (instance security hardening)
  Use the glide.image_provider.security_enabled property to control the security settings for images. If set to true, images are visible only to authenticated and authorized users. If set to false, images are visible to anyone with a URL to the attachment.
• Specify excluded attachment extensions (instance security hardening)
  When you enable exclusion list validation in the ServiceNow AI Platform, use the glide.attachment.blacklisted.extensions property to create a comma-delimited list of restricted uploadable file extension types. Uploading of the specified file extension types is restricted.
• Specify excluded attachment file types (instance security hardening)
  When the exclusion list validation is enabled in the ServiceNow AI Platform, use the glide.attachment.blacklisted.types property to create a comma-delimited list of restricted uploadable file types. Uploading of the specified file types is restricted.
• Downloadable file types (instance security hardening)
  Use the glide.ui.strict_customer_uploaded_content_types property to create a comma-delimited list of restricted downloadable file types. The specified files types are the only ones that can be downloaded as static content from an instance.
• Upload MIME type restriction (instance security hardening)
  Use the glide.security.file.mime_type.validation property to activate MIME type checking for uploads. You can enable (set the property to true) or disable (set it to false) MIME type validation for file attachments.

Related reference

• Access control (instance security hardening)
• Email security (instance security hardening)
• Input validation (instance security hardening)
• Secure communications (instance security hardening)
• Security best practices (instance security hardening)
• Security inclusion list (instance security hardening)
• Session management (instance security hardening)
• Other settings and security resources