all right let's get it started thanks everyone for joining the session platform privacy and Academy section the topic that we're going to cover today is around protect employee and customer personal information with servicenow data privacy my name is Fergus Saleem I'm a hotman PM in platform privacy and security team uh with me today uh Barca I would like to introduce yourself yes thank you so much for cut hello everyone thank you for joining us today my name is Barca batija I'm part of the platform security and privacy product management team my my primary responsibilities here include everything related to data privacy like data Discovery classification and optimization and all the different regulations that we work on just enabling and helping our customers to to be in compliance with all these regulations on the servicenow platform thank you okay thank you let's get it started so as always we have to start by reminding you that we might talk about things that are on the roadmap uh since we are publicly traded company there are some rules about making forward-looking statements so please remind you please make your purchasing decision based on the product that it exists today the quick agenda item that we're gonna cover the first we're gonna talk about the unique business value of volt as well as around the data privacy which is uh uh which which is part of servicenow uh World product and then we're going to be talking about the data privacy specifically and then I'll pass it over to Barca and Barca is going to go through it's not the end to end demo on how to protect Financial Services operation around uh with data privacy and then all the covers on the the customer engagement Channels with other incoming Academy session topics and then we'll address some questions as well so uh the before we talk a little bit more about the search now well let's talk about some of the uh the the the why data privacy is extremely important right now uh what is the uh the essentials that we need to know what what is the problem that we're trying to solve as well so there's increasing number of security and privacy regulations being created and managed by governments and organizations around the world and you can see a visual list of just how many there on this map and this is not even all of them in fact 71 of countries already have legislation with another nine percent on the debt to introduce new legislations this means that the data protection and privacy conversation is one of that we need to be proactive about and feel more comfortable with as we serve a global customer base gdpr listed in the middle of the screen is arguably the most well-known set of data privacy rules companies cut not complying for example not abiding by those right to be forgotten mandates can be fined uh roughly around like 20 million or four percent of the worldwide turnover for the preceding Financial year and whichever number is greater is the one that will affect them the customers that have that are worried about this want to know that their software vendors have solution in place to help them comply with these type of regulations and that's where servicenow gold can help and what is service network it is our Marquis security enhancement Suite intended to provide additional layer of security and privacy capabilities for the now platform and it consists of five key security elements one platform encryption native standard based data address encryption with customer control key lifecycle which allows organization to comply with industry mandates the second data privacy to ensure data privacy by classifying and anonymizing specific data fields containing personally identifying identifiable information or we call it pii and this is one of the area that we're going to cover heavily today the third Secrets management to securely store and control access to credentials in servicenow like passwords certificates API keys and tokens the fourth code signing to validate authenticity and integrity of the software in the on the mid server and the last premium product that we would like to cover here as part of servicenow voltage log as per service we call it Las which improves security threat monitoring with easy integration of servicenow system logs into a larger Enterprise security analytics system so this comprehensive security solution has been packaged to make it easy for organization to order and consume the solution but as part of today's sessions we're going to be covering data privacy specifically which is a part of servicenowable disable so what is dated privacy service now data privacy provides a tool to protect sensitive data like pii and Phi by using data Discovery classification and anonymization capability to specific data fields or users to ensure the privacy of confidential data and increase regulatory complaints it consists of three major components data discovery data classification and the data anonymization both data Discovery and classification features really help users to discover and understand their confidential data properly with the right data classes before it gets anonymized the data anonymization gives users the ability to redact sensitive information in service now instances by using the right tool and technique and as you can see the data Discovery as well as data classification is it's all about know about your data and the data anonymization is more about protecting your data by using the right techniques and tools servicenow data Discovery is a new feature that we introduced in May the store release as part of data privacy what it really does is to identify the sensitive data by applying intelligent Discovery capability to the table we target with actadata patterns we created and Define what data we have where it's located with all the classification statuses it also elevates the compliance level and the reduced Risk by identifying sensitive data and avoid potential threats and a negative impact to your brand as well that anonymization gives the user the ability to redact sensitive information in servicenow instances by using the right tool and the techniques data privacy including data the anonymization feature has two main use cases the first use case is gdpr as I just explained in previous slide right to be forgotten request one use case is for gdpr right to be for gunner request is let's say an employee leaves a company uh or a customer of a customer of ours has their own customers think customer service management CSM for example where they need to anonymize customer data and you can select the user and a customer pii or Phi associated with that user in a production instances the Second Use case is to anonymize sensitive data going into cloning or sub-production environments so that the information is not accidentally shared with the third parties or as part of delegating implementations such as with system implementers delegated development in customer software development lifecycle for example sdlc the production environment has all the real data including pii Phi and other sensitive data as well and in order for these other instances to be used properly they also need data most often copied from production in order to provide the most realistic way to test new configurations but if we copy information from production that usually means we are copying Phi and pii and other sensitive data and exposing it to the development teams that may not need to see it or they shouldn't see it these Dev team in these other environment can be full-time employees of the company themselves or they could be the third party contractors working outside of the company or even the country that the development is occurring in and so the customer can use data anonymization to natively de-identify the pii and Phi associated with the information they're pushing down into these lower environment this ensures that these sub prods have the legitimate data they need for configuration and testing without exposing information they shouldn't be exposing outside of the production uh the environment so with that I concluded the uh the the service now overall or what it does and what it contains with all the premium products and then uh today's section we're going to be covering more around like data privacy uh with that I'll pass it over to barca to go over some of the real-time demo as well thank you for cut um let me know if you're able to see my screen now I can okay great so um we will cover two different demos the first one is going to be data Discovery and classification that's the know your data part so if you if you don't even know where exactly your sensitive or pii data is located you will not be able to protect it so the first step is always understanding where your data is located and creating a catalog of it with the help of data classification on this instance I have data Discovery installed data Discovery was introduced it went GA just last month in May as a store app and it works on top of Utah with this I have the data Discovery installed let me go to all data pattern here by default out of box we are shipping few data patents anything which has a protection policy as read-only these are the data patterns which we have shipped out of the box so that includes social security number credit card number diners credit card number Amex credit card Discover and credit card MasterCard and credit card Visa we also ship out of box pattern for us phone number and email ID customers do have an option of creating their own custom data pattern by using regular expression in this case I have created two uh two custom data pattern which is for Argentina phone number and the health record number I'm gonna go ahead and click on new and I'm gonna create a new data pattern here I'm going to enter the description it's going to be the data pattern for capturing or discovering US driver's license record check I enter the name and I enter the regular expression for the drivers for the US driver license number once I've done that I am not 100 sure if this is the correct regular expression so in this case the next step I do is I click on test this is the expression I enter a driver's license number to see if it matches or it does not match once I've entered it I click on test and the button was discovered so that means this pattern is correct and it's able to discover it I'll go ahead and cancel it once I've canceled it I can go ahead and submit this data pattern once I submit it it comes up here in the list now under data Discovery all data pattern you will have a list of everything each and every data pattern that was shipped out of box at the same time that you have created the next one is active data pattern so any data pattern that you would like to scan as part of the next job needs to be under the active data pattern list so right now active data pattern list for me is empty I'm gonna click on edit it's gonna give me a list of all the available data patterns I'm gonna click few of them like social security number diners credit card Diners Club Us phone number Amex discover email and MasterCard Visa I would like to scan these data patterns so I'm gonna that's the reason I've picked it under the selected list I'm going to go ahead and click on Save now I have I know what data patterns I would like to search for but where exactly I am searching this for am I searching this within the complete instance or under selected table I need to pick that so for that I'm going to go to the third step which is picking the target tables in this case I already have few tables set including the sys users this user table does have some PIR which we will go through that I'm gonna go ahead and click on new and pick a table a Target table that I would like to scan on this instance I have CSM which is a customer service management and the financial services operations workflow so if the one I and I know in the CSM consumer table I do have some Pia so I'm gonna pick on CSM consumer and I'm gonna submit I would like to add one more table which is for the accounts so I'm gonna go ahead and pick the customer account table to discover pii under that table once I have picked the data patterns once I've picked the tables in which I would like to run a scan the last step is running the data Discovery job right now it's empty because I haven't run any job I'm gonna click on new and then um so with Utah we have data discovery which mainly is useful for structured data use cases and that's called sample scan so what that means is it will go ahead and scan for for 10 000 records or 10 000 rows in a table so it will go ahead and scan CSM consumer table only 10 000 records but let's say the table includes 1 million records it will not go ahead and scan each and every record it will just scan for 10 000 records this is helpful and valuable in case of structured data use cases so if I have SSN in 10 different rows I know I'm gonna have SSN and other rows as well so this will help in that use case we are also coming up with a full detailed scan so it will go ahead and do a full scan for the first time and then the next time it will be a Delta scan so anything that is added or modify right after the first scan will run as Delta scan so full and Delta scan is coming up later this year in Vancouver for now we have sample scan I'm gonna go ahead and add all the information to run the scan I've put the name I'm gonna put the time as well I'm going to put the description I'm going to put the time and I'm going to submit it I'm gonna click on that schedule the job once the job is scheduled the state will change so right now it is in progress under context and summary it will give you the complete description of what all data patterns are being searched what are the different columns that are being scanned what are the number of rows that are being scanned and then how long it's taking I'm gonna go ahead and finish the job the job is in a completed state right now at the bottom of the job if you see it will give a complete description of the data Discovery findings so under CSM consumer table there was email data pattern that was discovered in the email column and the data pattern match count is 81 so try to search for 80 it try to scan 82 records but it was able to find the data pattern in 81 of them and by default the status on each of the new data Discovery findings is set to new now data Discovery finding it shows me everything here which is specific to this job but if I have multiple jobs I'm gonna go under the data Discovery findings tab it will give me all the details for all the different jobs in my case I already I only have one Chopra so it only has that job details next I'm gonna go and I'm gonna Group by the data pattern so I have multiple data patterns but I'm I would like to group and see what what data patterns were discovered so in this case I do see data pattern email so I was able to discover e email in the CSM consumer column I'm going to go ahead and select those I'm gonna scroll on this side so this default status is new I know about this email column but at this stage I do not want to take any action on it so that is the reason I'm gonna go ahead and change the state status from new to ignode next I'm going to go and pick few other columns like customer account email and sys user email I I know this has pii and I would like to take an action on that that is the reason I've selected those and then on top I'm gonna go ahead and click on classify data classification is an out of box plugin which was introduced in Quebec data classification will help you group your pii into different into different items by default I believe we have four or five data classes for piis and stuff public information but you do have an option of going ahead and either adding your own data classes by having a parent or a child relationship or you can use the existing data classes as well in this case I have modified my data classification a little bit and I've added a data class called confidential I'm gonna click on confidential and I would like to classify these three items under confidential and I'm going to go ahead and click on classify once it is classified I would like to see how it shows up I wanna I I would like to have a single pane of Class View so I'm going to go to the dashboard under dashboard it will tell me details on what were all the Discover data pattern so I don't need to go to the Discovery findings and go through each and every row I can just go to this donor chart and and get a nice view of what were the Discover data pattern what is the status of those how many of them are new how many of them are classified and how many of them I've marked as ignored it also gives me a very good layout of what were all the data patterns that were discovered in each table and a detailed view as well so this is data Discovery and classification data Discovery and classification will help you discover your PIR within the servicenow instance and then go ahead and classify that now we have classified it that's great but how do I protect it what do I do in order to protect it so if you remember for cut show the third pillar which was apply protection of anonymization so this is a second demo and I'm gonna go and walk you through the different use cases for data anonymization I'm going to click on all here I have data privacy which includes an overview of classification and anonymization installed data anonymization was introduced as a plugin in Tokyo and it is part of Vault on top of that we added a store app in Feb of this year which works on top of Utah the store app is the new UI for anonymization but in terms of functionality the plugin which works with Tokyo does the exact same thing but if you if you care about the new UI then that's something which was discovered which was released as a store app in February this year here I have the new store app installed which is data privacy Store app under that we have overview classification and anonymization I'm gonna click on overview with the overview it gives me a very good view of what all is classifiable data so what all data I have on my instance which can be classified then the data that is classified what is it classified as so I have 13 records which are classified as confidential it also gives me a view of anonymization job what were the anonymization jobs that could run and what is the status in case if I would like to see what is classification what is anonymization and the different FAQ resources I do not have to leave my store up I do not have to leave my instance I can just go ahead and click on learn more and it will have a step-by-step walkthrough for what is classification and what is anonymization next I'm gonna go to classification and let's look at what all we have classified so we have confidential internal public and restricted right now we have some classified data so I have the data classified as confidential so I have 13 records which are which are classified as confidential year so everything will show up here now let's look at what pii do we have within this instance as I said we have CSM and financial services installed here and I do have some pii under the CSM column and also the customer account table I have some Pia under sys user as well so let's just go ahead and see what we have there so I have financial services and then I'm gonna go under customer I'm gonna go to Consumers this is my consumers table I have pii which is personally identifiable information like name mobile number credit card number and then city as well let me go to the second table which is the accounts table under the accounts table I have some pil like name then I have the physical address which is the street address the city email ID and also the phone number the third table that we are going to anonymize a part of anonymous today is the sys user so under the sys users table I have user ID I have the email ID the employee number and the phone number as well now we've seen we have all the pii here in these three different columns now let's go to anonymization and let's see how we can anonymize the information in these tables I'm going to anonymization in anonymization out of box we have few techniques I'm gonna click on view techniques to see exactly what these techniques are out of box we have selected selective replay static replace random replace remove and if at all you do not want to take any action we also have no action now all between all these different techniques they can be used for multiple use cases but we do support structure and format preserving techniques which we will see um once we go to creating custom technique and also policies you would like to create if you if you would like to save the format of let's say phone number or email ID you can go ahead and do that so in this case if I want to have the email ID format by making sure at the rate symbol stays in the email so I know that's the actual email we have an option of excluding that as well so these are the base techniques either you can use a base technique or create a custom technique right now I'm going to create a custom technique using static replays suffix static replace I'm going to use this to anonymize customer phone number so I've given that as a technique name I'm gonna give the description click on next Soviet selective replays I can pick what do I want to replace the pii with so in this case if my pii is a date time value this is what I'm replacing it with that is 1988-11-11 and then the time if it is a date value this is what I'm replacing it but that's 98-11-11 if it's a number value I would like to replace it with zero zero zero so I have added that here if it is a string value I'm replacing it with text one two three with that I'm gonna go ahead and create the custom technique for the ease of this demo I've created few more custom techniques like anonymized credit card number anonymized email and also the customer phone number let's go ahead and look at each of these techniques and see what do we have what is the base technique so the customer phone number we already checked what we have here so in customer phone number for a string value I'm replacing it with text123 for anonymized email ID in this case I am going to use this to anonymize the email ID yeah I would like to keep the format of the email ID and that is the reason under exclude character I have typed at the rate so I do not want to anonymize at the rate and that is what it is here um I I would like to anonymize and replace my email ID with a asterisk symbol so I've mentioned that here I would like to start anonymization right from the first character of the email so that is the reason I have written one year I'm gonna go ahead and save your let's look at what we are using to anonymize the credit card number to anonymize credit card number I'm using the selective replace here I I do not want to anonymize the first digit of my credit card number because the first digit of my credit card number would have information on is it from discover Visa or Mastercard so I do not want to anonymize that at the same time I do not want to anonymize the last four digits of my credit card number that is the reason the end index or credit card typically is 16 digit long so you're under end index I have put 12. so we will go ahead and anonymize only till the 12th character I do not want to exclude anything so I'm going to keep it blank I'm anonymizing it with the asterisk and then I'm starting this from the second character because I need to keep the first digit of the credit card intact so that's the reason start index in indexes too I'm gonna go ahead and save it so this is step one of anonymization is that is creating techniques the step two is creating a policy between techniques and policy it's not going to be something that you would do on a regular basis you would typically be creating techniques and policy just once initially and then it's mainly just going to be running the anonymization job either as part of Clone or it can be also when someone leaves the company which is mainly for right to be forgotten use case let me go to the Second Step which is creating a new policy so as forecast mentioned in the slide we have two main use cases the first one is for subprod use case so if you would like to um to have a clone on your lower or subprod environment but you do not want any sensitive data leakage in that case you would like to anonymize certain columns so that is the data tables or column so that's the use case and the other one we have is user specific data if you would like to anonymize pii only specific to a user so let's say the user is no longer part of the company or if if it's not doing any any business with you and you do not want to have any legal liability of keeping their PIR you can go ahead and anonymize that data for this demo let us first look at anonymizing data tables or columns I'm going to click on that create I'm gonna enter some basic information and anonymization is dependent on data classification in short all the pii or all the data must be classified in order to use data anonymization here I have a mandatory field to pick which data class I would like to process here in this case I'm going to pick confidential that is where we had uh 13 around 13 columns that were classified as confidential the other one is cloning activate policy during cloning if you would like this anonymization job to run only during clone and anonymize it only in your sub Rod you will you will activate this policy so I'm going to go ahead and activate it and you also have an option of putting in the policy number if you do not put anything I I Believe by default it's the 100 number but you do have an option of how important anonymization is for you as compared to other other scripts that are running during clone for the sake of this demo I do not want to run this as part of Clone but again this is an option that you should be able that you should leverage especially when you are moving your pii in your lower environment foreign here I have an option of assigning the techniques the techniques that we created so that is the out of box base techniques and the custom techniques we have an option of picking all of this technique so here under CSM consumer table we have business phone number right and then the data type is pH underscore phone number which technique I would like to use here so if you guys remember we did create a technique which was for customer phone number so I'm gonna pick the customer phone number here you also have an option of using the bulk assign technique if you do not want to go over each and every column year but for the sake of this demo I have created or I have added techniques for other items as well so for sys user employee number I do not want to anonymize that so I have picked no action so do not take any action there are few more columns on which I'm not taking any action on the home phone number I'm anonymizing it using customer phone number if I scroll down on the customer accounts table email column I am using anonymized email so anonymize email we were using selective replace technique in which we are excluding at the rate to keep the structure and the format of the email ID and for CSM consumer table credit card number column we are using anonymized credit card number which is again using selective replace but keeping the first and the last four digits intact with that I'm going to go ahead and publish the policy once the policy is published I can go ahead and click on schedule job I can add the job description I can put in the start and the end time here we have a small box which is called as dry run if as part of a job you do not want to anonymize the actual data but you just want to run what you just want to understand what will be the rows or the columns that will be impacted due to this job you can click on dry run again Drive run will not anonymize the actual data it will just give you an idea of how the data would look like and what what will be the rows and columns that will be impacted during anonymization I'm not going to select Drive run here and click on schedule job so I have already scheduled the job let's look at what's happening the job is completed since a job is completed the data must be anonymized now we can go ahead and look at the data but before that why don't we create one more policy which is for users so I'm going to go ahead and create a new policy and I'm here I'm gonna pick user specific data so I am going to anonymize pii only that is specific to certain users so I'm going to click that click on create I'm going to enter some basic information so I'm using this for gdpr right to be forgotten request I'm going to pick the data class which is confidential click on continue and again I need to pick all the techniques here I have already assigned certain techniques so for sys user email I'm using the remove technique so what that means is the email ID will be completely removed it will not show up as as trick or something but I'm going ahead and completely removing it so that's removed I have few more items here like for fax number I do not want to touch it so it's no action home phone number I'm removing that as well and even the gender I'm gonna remove it phone number I'm removing it and for few others I'm not taking any action I'm Gonna Save the policy and publish it once it is published I have an option of scheduling a job I'm gonna schedule a job in this I can go ahead and pick the start and the end time I also have an option of running try run but if you notice I have one more selection here which is Select users here I can pick the users whose pii I would like to anonymize so I'm gonna go ahead and pick two users which is able tutor and Abraham Lincoln so I would like to anonymize pii of able tutor and Abraham Lincoln so I'm gonna pick those users I'm gonna click on the schedule job let me go and see what happened with the job it's completed your if you notice there is a rollback Button as well in case if you anonymized user data because of and later you realize it was a mistake of fat fingers you have an option of using rollback so whenever you anonymized it will create a rollback context by default the rollback context is created for three days but you do have an option of changing it from three days to either zero disk or increasing it as well right now I'm not gonna go ahead and roll back so I'm gonna cancel this out and since the job has completed let's go and look at the actual tables and see how does my data look like right now so if you remember we went to the consumer table and we saw there was some pii let's go and look at the consumer table again so this is the consumer table under mobile phone number we have anonymized it using a static replace technique so anything that was string data we we said replace it with text one two three so that's how it shows up here so mobile phone number anonymized using static replace text123 credit card number we used selective replace we kept the first character intact we anonymized from character 2 to 12 and we also kept the last four characters intact so that is what the credit card number shows the past let's go to the second column and here this is anonymized as as a complete column so the complete credit card number column is anonymized let's go to the second table which is the accounts table here we anonymize the email ID again vo selective replace by keeping at the rate symbol so we have everything Anonymous except for at the rate which keeps the format of the email ID so this is the first two scheduled jobs that we had this is something which is useful if you want to an anonymous data within a complete column let's look at the third table which is the sys user table under sys user table we used a we we picked able tutor and Abraham Lincoln and we would like to we wanted to anonymize PIR only related to Able tutor and Abraham Lincoln so you are for Abel and Abraham we have completely removed the email ID the employee phone number and the mobile phone number but we haven't touched any other user so for example Adela we have the email ID employee phone number and the mobile phone number intact we we did not make we did not anonymize any of that information so this is something that you can use if the employee is no longer part of your company and you do not want to have any legal liability of keeping their pii that's one option the other one is in case of an ex-employ if they have put in a request to remove their pii or anonymize their piid identify the API you can go ahead and use anonymization right to be forgotten policy for the same as well with that I will pause and pass it over to you for cut all right thank you that's a very uh quite a lot of information there with all the demos with two use cases Thank you Buck bark on this uh there's uh two questions one is from Michelle regarding to his data Discovery part of itsm pro okay so right now is part of servicenow World um and service now vault is a completely different skew and it is not part of itsm pro but data Discovery is a platform white picture so you can use it for any workflow you can use it for itsm or for hrsd legal SD or anything but in terms of Licensing it's a difference queue the second one is the simple scan the first um 10K or uh or random it is random uh random 10 000 records all right there's a third question with data anonymization record history and audit information is not getting anonymized especially in the task activity feed all the historic information will still display username details even after anonymizing username this is affecting our gdpr requirements any possible uh workaround for this um so there are few things that the team is looking at one is if you have an option of disabling the audit tracking which I know a lot of people will not be able to do that uh especially for audit purposes but we are also looking at supporting um the history and the audit record in anonymization it's something which is in the roadmap and it is a top priority so it will come up sometime soon all right thank you so much any other questions you'll feel free to type and we're happy to address that as well there's one more question disabling audit is definitely not an option for us any ETA in audit anonymization we are looking um on audit anonymization for some time early 2024. so that will that will probably be sometime in Washington but again we are still planning for Washington so it's not finalized and this is forward-looking information but yeah it is it is a top priority awesome is the licensing based on the number of users licensing for Vault currently is based on percent of annual contract value and it does not matter how many users you have it it's just a percentage of your total uh yearly contract value yep that's what I typed the same as well there's a lot of wonderful questions there thanks for asking yeah let me share my screen as you recap so with that uh there are a few other Academy sessions that we will be covering as part of um the service Naval components and feel free to tune in and register by scanning the QR code below I'll just pause here a little bit uh and then feel free to ask any questions if you still have and also we how the plenty of different documentations feel free to um register our platform privacy and Security Academy sessions on YouTube and uh that we have the documentations available for you to read through all the blog posts and articles and some other uh the guidance around all the Vault components as well and we have our uh platform privacy and security Community side where you can see all the uh the relevant information around the use cases too uh with not only on the data privacy related but also all servicenow World related as well and there are two more questions in Tokyo can we do I uh the apply information for more than 10 000 users at a time so yeah so not in Tokyo but in Vancouver which is released later this year I believe in September you can go ahead and pick more than 10 users and you can go ahead and pick groups as well for anonymization but that's coming in Vancouver that's later this year okay thank you and John asked the um that will this slide uh can we share the slide uh this will not be shared as it's internal but I will upload all the recordings on our YouTube channel and then I sent the link on our chat window as well or you just simply go into YouTube and then just type uh servicenow platform privacy or security or servicenow vault and you will see all the relevant uh the information that we are uploading on that channel as well no problem thank you let's wait one more minute to see if there's any other questions although I will wrap up uh thank you bark I appreciate it for your uh for your participation it's wonderful demo thanks for joining in with that I'll summarize today's sessions or on servicenow volt especially in data privacy with uh all the use cases plus the real-time demo on protecting uh financial service operation thanks for joining don't forget to just subscribe our YouTube channel to see all uh different the recordings and presentation there at the same time please register to our incoming uh webinars as well with that thank you so much for joining till next time stay tuned bye-bye thank you bye