CTA Week 5 — Platform Security Review

Security Mindset Checklist

Ask "What might go wrong?" and "What can we do to prevent it?"

Identify sensitive data types (PII, financial, regulated) High Risk

Map customer vs ServiceNow responsibilities (shared security model)

Document compliance requirements (GDPR, HIPAA, SOC2, ISO 27001)

Define solution personas and required access tiers

0 of 5 complete0%

Network Security Checklist

Confirm all traffic uses HTTPS with TLS 1.2 minimum

Assess need for IP Range Based Authentication plugin (com.snc.ipauthenticator) Plugin

Define Allow/Deny IP rules for inbound, outbound, or bidirectional traffic

Review SSL/TLS certificates — LDAP, web services, MID Server

Assess VPN requirement for mobile users or datacenter integration High Risk

If VPN required: raise ServiceNow Support request (allow ~1 week build time)

0 of 6 complete0%

Authentication & Pre-Logon

Configure Adaptive Authentication policies (role, device, location)

Enforce corporate SSO as first priority Priority

Enable MFA for all non-SSO local accounts (mandatory from Yokohama)

Set 4 policy decisions: Allow / MFA Required / Reduced Access / Deny

Audit local accounts for weak or default credentials High Risk

0 of 5 complete0%

Authorization & ACLs

Validate role assignments follow least-privilege principle

Confirm security_admin requires explicit elevation — not freely assigned

Review application scope settings (design-time and runtime access)

Check Restricted Caller Access Privilege for cross-scope resources

Secure REST Table API with ACLs — open by default High Risk

0 of 5 complete0%

Zero Trust & Instance Configuration

Evaluate Zero Trust Access for dynamic least-privilege enforcement Plugin

Run Security Center — review hardening compliance score

Review Security Monitoring console for active threat notifications

Work through Security Posture step-by-step remediations

Document all hardening settings and approved exceptions

0 of 5 complete0%

Database Security Checklist

Identify all fields requiring encryption at rest (PII, financial, regulated) High Risk

Configure Field Encryption — Yokohama+ replaces Column-Level Encryption Platform Encryption

Define Module Access Policies (MAPs) to control encrypted field access

Assess Cloud Encryption requirement for datacenter physical compliance

Evaluate ServiceNow Vault — Code Signing, Data Privacy, Data Discovery Paid

Run Data Discovery to find unprotected sensitive data (credit cards, SSNs, emails)

Configure Log Export Service to SIEM for ongoing threat monitoring

0 of 7 complete0%

Remediation Checklist

Compile all findings into a risk register (threat, layer, severity, owner)

Prioritise remediations: Critical → High → Medium → Low

Assign remediation owners and target completion dates

Validate Security Center hardening score improves post-remediation

Present findings to customer stakeholders and obtain formal sign-off

Schedule periodic re-review (recommended: per major ServiceNow release)

0 of 6 complete0%

Takeaway 01

Security is Everyone's Responsibility

Security reviews require cross-functional collaboration between architects, developers, operations, and business stakeholders. A shared mindset and threat modelling culture is the foundation.

Takeaway 02

Defence in Depth Across All Layers

No single control is sufficient. Security must be layered across network, application, and database levels — with encryption, access controls, and monitoring at each tier.

Takeaway 03

Document & Iterate Continuously

A security review is not a one-time event. Findings must be prioritised, owners assigned, and progress tracked. Re-review with each major platform release to stay ahead of new threats.

Platform Security Review — Process Flow

Platform Security Review Process