Key Features

• Hardening Settings Attributes: Each configuration includes an overview, property/plugin name, location of configuration, data type, recommended and default values, category, security risk score (using CVSS), dependencies, functional impact, and references.
• Security Risk Scoring: Uses the CVSS scoring system (0.0 to 10.0) to quantify potential security risks, categorized from None to Critical, helping prioritize remediation efforts.
• Configuration Management: Some settings require Customer Service and Support intervention, indicated accordingly.
• Integrated Documentation and Resources: Links to detailed configuration guides and security content are accessible within the Security Center and ServiceNow product documentation.

Security Categories Covered

The hardening settings encompass a broad range of security domains critical to enterprise security:

• Access Control: Protects resources through permission models and credential validation.
• API and Web Service: Ensures secure authentication, authorization, input validation, and session management for APIs.
• Architecture, Design, and Threat Modeling: Addresses secure design principles including availability, confidentiality, integrity, non-repudiation, privacy, and secure software development lifecycle.
• Authentication: Implements modern authentication controls to prevent impersonation and password interception.
• Business Logic: Validates application-specific logic to prevent bypasses, automated attacks, and privilege escalations.
• Communications: Ensures strong encryption, TLS versions, cipher suites, trusted certificates, and encrypted component connections.
• Configuration: Promotes secure build environments, hardened third-party components, and automated testing for vulnerability prevention.
• Data Protection: Focuses on confidentiality, integrity, and availability of data.
• Error Handling and Logging: Controls logging quality and prevents sensitive information exposure.
• File and Resources: Safeguards handling and storage of untrusted file data with limited permissions.
• Malicious Code: Ensures code is free from vulnerabilities and unwanted behaviors.
• Session Management: Secures user session uniqueness, token management, cookie attributes, and session invalidation.
• Stored Cryptography: Covers secure encryption practices, key management, and data classification-based encryption.
• Validation, Sanitization, and Encoding: Prevents common input-based attacks such as XSS and SQL injection through robust validation.

Practical Benefits for ServiceNow Customers

• Provides a structured and measurable approach to securing your ServiceNow instance.
• Enables continuous security compliance monitoring with daily scoring and actionable recommendations.
• Supports prioritization of security efforts based on defined severity levels and risk impact.
• Facilitates centralized management and documentation access for security configuration.
• Helps align your instance with best practices in security design, authentication, data protection, and operational integrity.