Security inclusion list (instance security hardening)

A 'positive' security model (also known as an 'inclusion list') is one that defines what is allowed, and rejects everything else. This section contains security controls that an administrator can configure to restrict behavior to known inclusion lists.

Note:

Security inclusion list properties must be set up manually in each instance, as update sets will not promote the configuration and will return an error.

• Check allow list member calls (instance security hardening)
  Review and remove inclusion list member call entries as needed from the sys_whitelist_member table.
• Check allow list package calls (instance security hardening)
  Review and remove inclusion list package call entries as needed from the sys_whitelist_package table.
• Enable URL allow list for cross-origin iframe communication (instance security hardening)
  Use the glide.ui.concourse.onmessage_enforce_same_origin property to enable cross-origin communication between iframes.
• Enforce relative links (instance security hardening)
  Use the glide.cms.catalog_uri_relative property to enforce relative links from the URI parameter on /ess/catalog.do.
• Packages call removal tool (instance security hardening)
  Activate and run the Packages Call Removal Tool (com.glide.script.packages_call_removal) plugin, and then consider whether each of the proposed changes should be completed or rejected.
• Specify URL allow list for cross-origin iframe communication (instance security hardening)
  Use the glide.ui.concourse.onmessage_enforce_same_origin_whitelist property to enable cross-origin communication between iframes from trusted domains you specify in an inclusion list.
• URL allow list for logout redirects (instance security hardening)
  Use the glide.security.url.whitelist property to add extra layer of validation to ensure whether any external URL introduced should be a part of inclusion listed URLs.
• Virtual agent embedded client content security policy (instance security hardening)
  Use the com.glide.cs.embed.csp_frame_ancestors property to enable the configuration of the frame-ancestors policy for only the https://<your-instance>.service-now.com/sn_va_web_client_app_embed.do page.
• Virtual agent embedded client X-Frame-Options (instance security hardening)
  Use the com.glide.cs.embed.xframe_options property to enable the configuration of the X-Frame header for only the https://<your-instance>.service-now.com/sn_va_web_client_app_embed.do page.
• X-Frame-Options: SAMEORIGIN (instance security hardening)
  Use the glide.set_x_frame_options property to set the X-Frame-Options response header to SAMEORIGIN for all UI pages.
• XML external entity processing validation
  These properties enable entity expansion, and restrict any external entity (for example, URL) when included as a part of XML DOCTYPE reference. DTD is basically an XML schema. If you are looking for a solution for entity declarations that could have potential for XXE (external entity), enable an inclusion listed defense against XXE using system properties.
• XML external entity processing - allow list (instance security hardening)
  Use the glide.xml.entity.whitelist property to enable access to a listing of comma-delimited FQDN, if needed. These URLs are the only ones that can be reached using XML Entity processing.

Related reference

• Access control (instance security hardening)
• Attachments (instance security hardening)
• Email security (instance security hardening)
• Input validation (instance security hardening)
• Secure communications (instance security hardening)
• Security best practices (instance security hardening)
• Session management (instance security hardening)
• Other settings and security resources