welcome to another episode of inside the barrel where john and i talk behind the scenes uh servicenow architecture being a consultant and just all around um all around conversations about servicenow yes all around conversations yeah today we actually have some special guests which are really awesome um i'm currently going through the certified technical architecture program and we had a class this week on webinar uh tips and so i thought we would just jump right in and do a live stream with with some of my uh cohort so john's going to bring him in so that we can introduce them what i i kind of lost you there on your audio what did you say oh do you want to bring him in and i'll introduce you yeah yeah so i'll let each of them go and just give you know their name the company and we'll kind of jump right in um all right so uh i'll start then so hello guys um my name is lucas guarino i work for a company called crossfields here in the uk we also run a practice in the in the us um currently i'm a servicenow principal technical consultant there and i've been working with the platform for seven years and a half now um yeah excited to be here thank you guys hello everybody my name is adrian hardan i'm the founder of dave hd a small servicenow practice in romania i've been working with servicenow for the past eight years working as a solution architect part of the cta program in doria hi everyone my name is mohammed zyad i'm currently working in saudi arabia for a seriousness partner called as unicom i have 10 plus years of experience and i am a servicenow consultant awesome so in our cta program they challenge us to do presentations in 10 minutes so we have eight minutes to explain servicenow's architecture and scoped applications uh so we're gonna see if we can just jump right in and do a quick high level overview a lot of these the use case i want you to think about or the use case that was presented to us is really around banking and like how to support like a multi uh global or multinational uh company and making sure that the right security architecture is in place for them john wants to share my screen beautiful and so i know we normally don't do a scripted one but i threw in a quick presentation um so we'll go through these slides so you can see it and have it while we then i'll jump into and doing demos um so the first thing to know that's really important about servicenow is their shared security model and pretty much what that really means it boils down to is that the infrastructure and the physical security like servicenow will manage those data centers for you you don't need to almost everything else is a joint or on the customer's responsibility in order to manage and support and so you know servicenow is is multinational and so it's uh worldwide so it's it's good to know where your data center and service is stored so as for the security architecture there's really three layers that is really important to talk about there is the internet service layer or also called the network layer the application layer and the database layer so we'll kind of dive into each of those but at a high level like understanding where the configuration is is really important in the service now space so at the internet or the network layer just some things to know is all the traffic's encrypted uh there's ip access control um the ip access control is actually controlled at the application layer like in this tool but just know that you have that capability and then the unique thing and that is normally useful to know about really large enterprises is edge encryption and so the idea is if you didn't want certain data to be stored on servicenow server you can use edge encryption in order to encrypt it before it gets to servicenow service so in the banking situation there may be things where you can't have customer data in a certain data center you could in theory use edge encryption in order to solve for that um the application layer so there's a lot in the application layer and this is most of the time where all of the things are configured so whether that's your pre-login your authentication your authorization your instant starting or your or platform encryption we'll kind of dive into that in the demo but just know that there's a lot of different ways that you can configure the application in order to support your use case and then the database layer this one's really the easiest one because it's just in a standard of database encryption so encrypting data at rest um and decrypting it in memory um every instance is uh supported for this and there's a small impact to performance but it's very minor as for like full disc encryption it's just essentially from protects you from physical theft of the hardware um or the storage itself and so i i have this chart up here on talking about the differences i'm not going to go dive into all the differences on on this but just know that this this little chart is useful for you to understand it i think the biggest thing that i like to remember is platform encryption is also known as like role-based encryption so you definitely keep that in mind when they talk about platform encryption so i'll jump into the instance and uh and let's just go through a demo of a few things so the first thing i want to show is uh instant security center so in instant security center if you've never used it i'll show you how you get to it but it kind of talks about a lot of different areas in uh in the instance that you can harden or you can make sure that your security is up to up to standards so for example in the hardening section it talks about like different things that servicenow provides as best practices that you can then you know configure or change if need be right so this is a really useful tool to start with is once you install service now just jumping right into the instance you know as we talked about before ip access controls um so ip access controls in the system allows you to configure which ips can access the system so that's useful in cases where it's a private or only internal you want it behind a vpn you could do something around that as for the pre-login and in the login side of things there's installation exits and this notion of redirect rules with sp entry so with uh installation exits you can configure change how login works so buy an ip address buy a roll or buy something related to like a device or location you can use instant installation exits for the sp entry is normally done through redirect rules so there's properties that you can set so you can set the page.script or the first page.script in order to define where someone's routed um on the system as well and that and how you can figure that is through this script include i do really wish one day servicenow will make this a better configuration um and then lastly around security there is these high security settings that you can look through and configure and turn on and off as necessary for the requirements of your organization so kind of moving past that we there's this shout out to data class and the only reason i bring that up is like if you think about labeling your pii or labeling certain key classifications on fields you can essentially create data classifications and then apply those to certain fields so in this case i created a data class called pii and this will allow you to to click on it and see that this is applied to some super secret field on incident so that's kind of uh that most of the security behind that um we don't have enough time to jump into encrypted fields or platform encryption but what i'm just going to show here is if i elevate in order to do it is that you can create context and then apply those contexts to rules so in this case i have this context for the super secret field and it's applied to the it like i named it itil admin only and then on the i uh the itil admin you're able to assign this context that's really useful if you want to hide or encrypt certain fields or show and hide based on like who is accessing the system or that form so now we'll kind of switch back into um going into the scoped applications and so like what is a scoped application for the in the basic sense is just an organization of resources so it's just like a folder that you have that has permissions on who and who can access it so like the steps to build it to think about migrating or creating it's very simple you name it you then create the files that you want underneath it you set the access levels based on who wants to access it or what other applications want to access it and then you add you know you actually build it with your logic and design and so there's a couple different methods here servicenow is recommending you know rome forward to link your things to get repositories and publish through the application repository for people that are around update sets you know that those existed from 2016 and are still there um and then john's favorite topic around crosstalk privileges uh this is the reason it's john's favorite topic is because if you ever work in the hr space you know a lot about this and so there's there's a couple different things about access tracking or restricted caller access that defines that the fine grain control or if you just need generic one um and so some things you want to think about when you think of scoped applications is can you just like turn off you know restricted access you probably don't want to do that because that um creates a security gap and then it also doesn't show you that like you're building your thing um the correct way and then you also have other securities like acls so even if you did turn it off you your acls may still block the thing that you need and the nice thing is a service that will generate these restricted caller accesses for you based on your based on you developing in your definitions and so some things you want to like keep in mind is like relevant personas documentation related to that any integrations you know reusability so when you're building your scoped applications you want to think about all the things that may be useful for you before you even start and so i know we're running short on time so i'll just quickly jump into the scoped applications so they're really the things that you probably will control is around the custom application itself has this application administration that's one area of security where it prevents the system administrator from it and then this run uh runtime access tracking so those are the two this is an example of a scope that's here versus i have an example here of a global scope and then what's um where the cross access scopes actually get generated is while you're developing they actually get generated here so on this restricted caller access privileges and um also on the cross code privileges if you needed to find it at a higher level so i know that was a blast in in 10 minutes but i hope that at least gives you some context on some of the security architecture and on the um scoped applications and how those two um mesh well in servicenow's ecosystem what do you think john are you now an expert on security i'm amazed that you got all that information in so fast it's a lot of information and you're so right i honestly have so much trouble with call restricted records i do not like the way they work a lot of the time and i also agree with you on sp entry page i i can't wait till that's redone in in a better fashion yeah i i i couldn't agree more it's it's just definitely pain points that i've seen in the ecosystem so yes it's a huge pain point from a port from the portal side anyways [Music] cool well let's we'll cut this one short so that we don't get in trouble um [Music] and no one no one hates us for it but i do appreciate everyone coming on and supported yeah come back for one that we like talk for an hour and we like dive into like encryption in one right or um you know any one of these topics we could probably have in a whole session on oh yeah yeah definitely cool cool all right thanks again thank you guys thank you all bye-bye