Each hardening setting includes attributes such as configuration name, type, data type, recommended and default values, security risk severity (using CVSS scoring), dependencies, functional impact, and reference documentation. Some configurations require assistance from ServiceNow Customer Service and Support.

Key Features

• Compliance Scoring: Daily percentage score reflecting your instance’s security compliance based on recommended hardening settings.
• Comprehensive Configuration Details: Each setting includes important metadata to help you understand its purpose, impact, and security risk rating.
• Security Risk Assessment: Uses CVSS scoring (0.0-10.0) to classify vulnerabilities from None to Critical, helping prioritize remediation efforts.
• Category-Based Controls: Hardening settings are organized into categories such as Access Control, API and Web Service, Authentication, Communications, Data Protection, and more, covering a broad range of security domains.
• Integration with Security Center: Manage and adjust security configurations directly within the Security Center interface.

Security Categories Explained

• Access Control: Protect resources by managing permissions and credentials effectively.
• API and Web Service: Ensure APIs have robust authentication, authorization, and input validation.
• Architecture, Design, and Threat Modeling: Incorporate secure design principles including confidentiality, integrity, and privacy.
• Authentication: Implement modern authentication methods resistant to impersonation and interception.
• Business Logic: Maintain secure application logic flow to prevent bypass and attacks.
• Communications: Use strong encryption standards, TLS versions, and secure certificates for all connections.
• Configuration: Maintain secure build environments and hardened third-party libraries.
• Data Protection: Ensure confidentiality, integrity, and availability of data.
• Error Handling and Logging: Manage logged information to avoid exposing sensitive data.
• File and Resources: Securely handle files and data from untrusted sources.
• Malicious Code: Ensure code is free from vulnerabilities and unwanted functionality.
• Session Management: Secure user sessions with unique, unguessable tokens and proper invalidation.
• Stored Cryptography: Use established algorithms for encrypting stored data and manage keys securely.
• Validation, Sanitization, and Encoding: Protect against injection attacks like XSS and SQL injection by validating inputs properly.

Practical Benefits for ServiceNow Customers

By leveraging the Security Center’s hardening settings, ServiceNow customers can:

• Continuously monitor and improve instance security compliance with actionable scores.
• Understand the security impact and risks associated with each configuration setting.
• Manage security settings in a centralized interface with guidance aligned to industry best practices.
• Prioritize security improvements based on severity and potential impact to your environment.
• Access detailed documentation and recommendations to support secure configuration and operation of your ServiceNow instance.