Basic Security Guidelines for Now Instances - Security

Basic Security Guidelines for Now Instances  Basic Security Guidelines for Now Instances ServiceNow continuously urges all customers to revisit their Instance Security settings and ensure it is configured according to each company's needs and requirements. Below are the basic security elements each customer should consider. At the bottom is a list of more advanced options customers can also configure.

ServiceNow recommends the following basic security elements be configured:

If your company has Single Sign-On, enable federated single sign-on from your corporate authentication Identity Provider (IdP). See Single Sign-On If your IdP has the capability for multi-factor authentication, this should be considered, especially for users with privileged access within the Now instance. See your internal Identity and Access administrator or contact the provider of your Single-Sign-On solution. Enable multi-factor authentication (MFA) for all local accounts within your instances to mitigate credential compromise attacks. See MFA Review the Access Control Lists (ACLs) to ensure access rights have been correctly implemented. See here for documentation on ACLs. See here to understand the different ACL rule types. Review user and system configuration logs for unusual changes and anomalous behavior ServiceNow user and system configuration logging Use the ServiceNow Instance Security Center to check which hardening steps are not implemented and continuously validate your Security Settings.

Advanced Options Customers should consider:

Configure Adaptive Authentication to enforce authentication via contextual controls, such as restricting Admin users to only specified IP Address ranges. See Adaptive Authentication Configure Corporate IP restrictions – ServiceNow allows customers to create allow and deny restrictions based on IP address ranges to further control access to your ServiceNow instance. Configuring IP Restrictions and IP range based authentication Data at-rest Encryption – Customers can encrypt specific field types with the ServiceNow Column-Level Encryption service or can encrypt all data within their instance using database encryption. Column Level Encryption and Database Encryption Add classification labels to your data to identify and drive user access controls. This technique will allow customers to limit access to your most sensitive data. Data Classification Implement Input Validation Rules. These settings prevent issues resulting from malformed data and can mitigate specific ransomware attacks where data is replaced with a synthetic encrypted value. - Data Integrity and Field Input Validation

For a full list of security options, see Platform Security , which contains ServiceNow's Instance Hardening Guide as well as the Instance Security Best Practices Guide .