Configuration

The Configuration category ensures applications have a secure build environment and hardened third party library components. Specifically, ensuring a build and deploy pipeline is repeatable and includes automated testing and prevents known security issues from being deployed. This includes keeping dependencies up to date and free from known vulnerabilities.

• Auto set content type options [Removed in Security Center 1.3.3]
  Configure the Auto set content type options property on your instance to prevent MIME confusion attacks.
• Cache-Control HTTP Header Value [Updated in Security Center 1.3 and removed in 1.5]
  Use the glide.http.cache_control property to set the default cache-control value in the HTTP response headers that the ServiceNow AI Platform sends when requesting static content data for a page. Examples of static content include images, CSS, and JavaScript rendered from within, for a page.
• Enable HTTP response headers configuration
  Reduce the risk of cookie/session-related hijacking of web apps using a system property.

• sc-disable-chat-server-debugging.md

• Disable legacy JQuery UI usage
  Avoid the introduction of unpatched vulnerabilities in the library by disabling legacy JQuery UI usage.

• Disable locked form elements debugging
  Use a system property to prevent the display of explanation of locked form elements.
• Disable MultiSSO Debugging
  The glide.authenticate.multisso.debug property controls debug logging for Multi-SSO.
• Disallow target cloning [New in Security Center 1.3]
  Configure the glide.db.clone.allow_clone_target property to prevent your instance from being used as a clone target.
• Disable soap fault stack trace display
  Manage how stack traces are displayed in your instance.
• Restrict performance monitoring access
  Use the glide.security.diag_txns_acl property to control stats.do, threads.do, thread_pool_stats, and replication.do access from an unauthenticated connection.
• Enforce secure referrer policy
  Use the com.glide.security.referrerpolicy property to ensure that the Referrer-Policy HTTP header sends the appropriate level of data to each ServiceNow® page to help prevent data leaks.
• Ensure minimum private key size
  Use a system property to determine the minimum size of the private key used for Certificate Signing Request (CSR) generation with the Certificate Inventory Management application.
• Implement the x-frame-options: SAMEORIGIN security header
  Use the glide.set_x_frame_options property to set the X-Frame-Options response header to SAMEORIGIN for all UI pages.
• Require write access to access service catalog add item page
  Use the glide.sc.request.add_item_write_access property to prevent unauthorized operations from being performed on catalog items.
• Set Xframe options to prevent embedding third-party websites
  Configure this property to prevent the content of a web-application from being embedded in a third-party site.

Parent Topic:Hardening settings