---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Architecture, design, and threat modeling

# Architecture, design, and threat modeling {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

This broad control addresses high level design considerations and key elements to
implement a secure application. This covers the tenants of availability, confidentiality
processing integrity, non-repudiation and privacy. Additionally, elements of a secure software
development lifecycle are included.
* **[Certificate based authentication not enforced \[New in Security Center 1.3\]](eI9ehNuiYqNr2O9ngiKXhg)**   
  The glide.authenticate.mutual.enabled property enables certificate based authentication, a type of mutual authentication for inbound REST connections to REST and SOAP APIs in the ServiceNow AI Platform.
* **[Check impersonation on ACL evaluation in HR App \[New in Security Center 1.3 and updated in 1.5\]](HQnEmjc3hpJ9xM8tkEi1WA)**   
  Use the sn_hr_core.impersonateCheck property to prevent a user from impersonating another user and accessing their HR information.
* **[Define allowed ServiceNow internal IP addresses \[Updated in Security Center 1.3 and 1.5\]](9t~uGEwgxrZxgmTQyqlxNg)**   
  Use the glide.ip.authenticate.strict property to specify IP ranges that can make inbound connections on an instance.
* **[Disable legacy JQuery behavior \[Updated in Securty Center 1.3\]](bnRhQwtCMEazkdoXVRLrUw)**   
  The glide.jquery.legacy is used to prevent older prepatched JQuery versions from being used which will introduce unpatched vulnerabilities in the library.
* **[Disable GlideRecord Scope Fencing Legacy Behavior \[New in Security Center 1.3 and updated in 1.5 and 2.0\]](Q4AiOEk_siPtibdffTRNdA)**   
  The glide.record.legacy_cross_scope_access_policy_in_script property disables scope fencing allowing scoped apps to access global script interfaces. It was created as a patch to GlideRecord's cross scope access.
* **[Disable legacy AngularJS behavior \[Removed in Security Center 2.2\]](KL8qU5Gs8fqi4vh0Lavn8A)**   
  Use the glide.angular.legacy property to protect from potential security risks arising from attacks on vulnerabilities discovered in outdated AngularJS library versions.
* **[Disable local login for users with Single Sign-On (SSO) enabled](https://servicenow-prod.fluidtopics.net/k828Px1pWq5_RUzaZp31gw)**   
  Update user records to disable local login for users with Single Sign-On (SSO) enabled.
* **[Disable unauthenticated published reports \[Updated in Security Center 2.0\]](q_ZPjxcHiUyEboTjsrW~2w)**   
  Deactivate this property to prevent the user from publishing or accessing reports. This property disables the published reports feature in reporting.
* **[Enforce field ACLs for inbound query requests](https://servicenow-prod.fluidtopics.net/WRHcWYEvmO4okxtkiT33pA)**   
  Manage how incoming queries are validated on your instance.
* **[Enforce read ACLs on report views](https://servicenow-prod.fluidtopics.net/p0AmF8qzrezYV_t4Q8GmUw)**   
  Manage how Read ACLs are enforced on your instance.
* **[Enforce Query ACLs for Knowledge Quick Links](https://servicenow-prod.fluidtopics.net/EUcIiTJmmPpiKbxyFoBPBQ)**   
  Enforce query ACLs for Knowledge Quick Links using a system property.
* **[Enforce Query ACLs for SubLists, List Counts and Widget Data Tables](https://servicenow-prod.fluidtopics.net/NEl~aThtYIZ2hDoVqzWPBg)**   
  Enforce query ACLs on sublist, list count, and widget data table queries using system properties.
* **[Enforce valid query string choice \[New in Security Center 7.0\]](iXe3LbpYn4A~FwTaI66JXg)**   
  Use a system property to ensure that any choice field value, when passed via a URL query string, is a valid active choice when a record is created.
* **[Ensure An Instance is Allowed to Connect to Only Trusted IP Addresses](https://servicenow-prod.fluidtopics.net/M9MenzDZLPm_bGLI4QR6Vw)**   
  Use a system property to define a list of IP ranges that are appended to the outbound IP allow list.
* **[Ensure only Trusted IP Addresses are Allowed to Connect to An Instance](https://servicenow-prod.fluidtopics.net/muT~9FJQpfhqcHw4dYZvyw)**   
  Use a system property to define a list of IP ranges that are appended to the outbound IP allow list.
* **[For Self-Hosted Instance, Ensure only Trusted IP Addresses are Allowed to Connect to An Instance](https://servicenow-prod.fluidtopics.net/_Q8jRaeatoymf6cdjIJFlw)**   
  Use system properties to control which inbound IP addresses can connect to self-hosted instances.
* **[Require authorization for data broker rest API \[Updated in Security Center 1.3\]](5X5IFM4wlm~5JQagSdaRmQ)**   
  Use the glide.basicauth.required.databrokerrestapiprocessor property to require basic authorization for all inbound Data Broker Rest API requests.
* **[Restricted Binding functionality in case Bearer Authorization \[New in Security Center 7.0\]](etGPjwNvsph49pqCnS1EuQ)**   
  Use a system property and restricted binding to ensure that an access token generated using that entity can't be used for UI calls.
* **[Deny by default with empty ACLs \[Updated in Security Center 1.3\]](YaSAeTv6kOt01Eqq7u4HpQ)**   
  Use the glide.sm.default_mode property to control the default behavior of security manager when it finds that existing Access Control List (ACL) rules are a part of wildcard table ACL rules.
* **[Set Automatic Token Cleanup for Token Credentials \[New in Security Center 2.0\]](Pd1alsVUqdsNBh7gRYExEw)**   
  Use the com.snc.platform.security.token.auth.cleanup property to ensure that expired API keys and HMAC secrets are deleted, thereby limiting the potential for token reuse.