Database Management and Platform Security · Topic 5 of 5
Security Center and the Shared Responsibility Model
Security Center and the shared responsibility model for the CSA exam: hardening score, scanner findings, and what ServiceNow versus the customer secures.
- 4 min
- ServiceNow secures the platform, infrastructure and data centers.
- The customer secures the instance configuration: users, roles, ACLs, authentication and its own data.
- Customer-built scripts, apps and integrations are the customer's to secure.
What it is
Security Center is the instance security dashboard. It helps an administrator see how well the instance follows recommended security settings, and which settings still need attention.
The shared responsibility model explains who secures what. ServiceNow runs and protects the cloud platform. The customer is responsible for how the instance is configured and used. The two topics belong together: Security Center is the customer's tool for the customer's half of the model.
How it works
Security Center
Security Center gives an overview of the instance's security posture. Its main pieces:
| Area | Purpose |
|---|---|
| Overview | A high level view of the compliance score and the customer actions that are due |
| Hardening | Compares instance settings with ServiceNow recommended settings, with a score trend and a list of all settings |
The hardening score is a percentage based on how many recommended settings are in place. It is recalculated regularly. It is a guide for the administrator, not a guarantee that the instance is secure, so keep working through non-compliant items.
Security Center reports and recommends. The administrator still makes the changes, for example by changing a system property or an authentication setting.
The shared responsibility model
Cloud security is split. The split is easy to remember if you ask who controls the thing.
| ServiceNow is responsible for | The customer is responsible for |
|---|---|
| Physical security of data centers | Who has accounts, roles and groups |
| The infrastructure and platform the instance runs on | Writing and testing ACLs |
| Platform availability and keeping the platform up to date | Authentication setup such as single sign-on and multi-factor authentication |
| Providing security features and tools | Turning on and tuning those features, such as the hardening settings |
| The data that is stored, and how it is classified and protected | |
| Custom scripts, applications and integrations they build |
ServiceNow supplies the locks. The customer decides who gets keys and whether the doors are locked.
For example, if an unauthorized user reads confidential records because an ACL was too broad, that is the customer's configuration. If a data center loses power, that is the platform provider's responsibility.
The same split applies to data. ServiceNow provides the platform features for protecting stored data, but the customer decides which data goes into the instance, who may read it, and which protection features to switch on. A question that asks who decides access to a record always points to the customer.
What the customer side looks like in practice
Customer duties are mostly ordinary administration tasks that you have seen in this chapter:
- Give roles to groups and review who holds powerful roles such as
adminandsecurity_admin. - Write ACLs so that tables and fields are not open to everyone.
- Connect the instance to the company identity provider for single sign-on and turn on multi-factor authentication where it is offered.
- Work through the non-compliant items in Security Center on a regular basis.
- Review custom scripts and integrations before they go live, and protect the credentials they use.
How the exam asks about this
- "Who is responsible for configuring ACLs and roles on the instance?" The customer.
- "Where does an administrator review security settings against recommendations?" Security Center.
- "Who secures the physical data center?" ServiceNow.
What to remember for the exam
- ServiceNow secures the platform, infrastructure and data centers.
- The customer secures the instance configuration: users, roles, ACLs, authentication and its own data.
- Customer-built scripts, apps and integrations are the customer's to secure.
- Security Center shows hardening compliance and the settings that need attention.
- Security Center advises; the administrator makes the changes.
- A high hardening score reduces risk but does not remove the need for good access control.
Moving to a cloud-hosted platform does not move responsibility for access control. The customer still owns roles, ACLs and who can log in.
Common mistakes
Assuming ServiceNow handles all security. The platform is secured by ServiceNow, but an over-permissive ACL is the customer's problem.
Treating Security Center as an automatic fix. It reports and recommends; settings change only when an administrator changes them.
Ignoring custom code. Scripts and integrations the customer builds are the customer's responsibility to review and secure.
Check yourself
Who is responsible for ACLs and role assignments?
The customer, because instance configuration and access control belong to the customer side of the shared responsibility model.
What does the Security Center hardening score show?
How closely the instance settings follow ServiceNow recommended settings, shown as a percentage, with the non-compliant settings listed.
Who protects the physical data centers?
ServiceNow, as part of securing the platform and infrastructure.
Topic 5 of 5 in Database Management and Platform Security
Test yourself on Database Management and Platform Security
The full ServiceNow CSA question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ServiceNow. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.