Enable a deny-list password validation check
Manage the deny-list passwords in the Excluded Password table.
Use the glide.enable.blacklist_password property to monitor deny-list passwords. When the property is set to true, the user's password is checked against a specific list of deny-listed passwords. This denial prevents users from using a password from a set of breached passwords. You can maintain the list by inserting passwords into the Excluded Password [blacklisted_password] table. ServiceNow provides a small, medium, or large password list that can be inserted to the Excluded Password table through the UI page found at All > Password Policy > Exclusion List Management. ServiceNow installs the small list of 5,000 passwords to new instances.
Ensure that the glide.enable.blacklist_password system property is set to true and that the Excluded Password [blacklisted_password] table contains a minimum of 5,000 records.
More information
| Attribute | Description |
|---|---|
| Configuration name |
|
| Configuration type | - System Properties \(/sys\_properties\_list.do\) - Table record \(/blacklisted\_password\_list.do\) |
| Data type | - Boolean - Table record |
| Recommended value | - true - A minimum of 5,000 records |
| Default value | - true - ServiceNow provided list of 5,000 records |
| Fallback Value | - false - ServiceNow provided list of 5,000 records |
| Category | Authentication |
| Security risk | - Severity score: 5.9 - CVSS score: Medium - Security risk details: Attackers often target commonly used or previously exposed passwords. This can lead to account compromise through credential stuffing or brute-force attacks. Enforcing deny-listed password checks strengthens authentication security and reduces exposure to credential-based attacks. |
| Functional Impact | Some users may have difficulty selecting a password. |
| Dependencies and prerequisites | None |
| References | Exclude passwords through password policies on your instance |
Parent Topic:Authentication