Business Logic

This category looks at the logic and flow unique to each application with general secure principles. Specifically ensure that the intended sequence of business logic flow cannot by bypassed, that limits exist to detect and prevent automated attacks, and that protections against spoofing, tampering, information disclosure and elevation of privilege attacks exist.

The following are some security controls that an administrator can configure to restrict unauthorized access to sensitive entities within the ServiceNow AI Platform.

• Limit max comments per user per day
  Configure the sn_kb_social_qa.max_comments_per_user_daily property to restrict the number of QA comments per day.
• Limit max subscriptions per user per day
  Configure the sn_kb_social_qa.max_subscriptions_per_user_daily property to limit the max number subscriptions a user can subscribe to in a day.
• Minimize SMTP Recipient Quantity
  The glide.email.smtp.max_recipients specifies the maximum number of recipients the instance can list in the To: line for a single email notification.
• Timeout Guest Sessions
  Use a system property to control the inactive session timeout for unauthenticated users.
• Validate remote host
  Set the property to true to prevent bad actors from using internal port scanning in your network.

Parent Topic:Hardening settings