{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":41307,"path":"platform-security/instance-security-hardening-settings/sc-architecture-design-threat-molding.md","title":"Architecture, design, and threat modeling","bundle":null,"doc_type":null,"release":"australia","body":"\n# Architecture, design, and threat modeling\n\nThis broad control addresses high level design considerations and key elements to implement a secure application. This covers the tenants of availability, confidentiality processing integrity, non-repudiation and privacy. Additionally, elements of a secure software development lifecycle are included.\n\n-   **[Check impersonation on ACL evaluation in HR App \\[New in Security Center 1.3 and updated in 1.5\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-check-impersonation-on-acl.md)**  \nUse the **sn\\_hr\\_core.impersonateCheck** property to prevent a user from impersonating another user and accessing their HR information.\n-   **[Reduce the Scope of the IP Allow List for an Instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-ip-addresses-access-allowlist.md)**  \nUse the **glide.ip.authenticate.strict** property to specify IP ranges that can make inbound connections on an instance.\n-   **[Disable legacy JQuery behavior](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-legacy-jquery-behavior.md)**  \nThe **glide.jquery.legacy** is used to prevent older prepatched JQuery versions from being used which will introduce unpatched vulnerabilities in the library.\n-   **[Disable GlideRecord Scope Fencing Legacy Behavior](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enable-gliderecord-scope-fencing-legacy-behavior.md)**  \nThe **glide.record.legacy\\_cross\\_scope\\_access\\_policy\\_in\\_script** property disables scope fencing allowing scoped apps to access global script interfaces. It was created as a patch to GlideRecord's cross scope access.\n-   **[Disable legacy AngularJS behavior \\[Removed in Security Center 2.2\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-legacy-angularjs-behavior.md)**  \nUse the **glide.angular.legacy** property to protect from potential security risks arising from attacks on vulnerabilities discovered in outdated AngularJS library versions.\n-   **[Disable local login for users with Single Sign-On \\(SSO\\) enabled](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-disable-local-login-for-users-with-single-sign-on-sso-enabled.md)**  \nUpdate user records to disable local login for users with Single Sign-On \\(SSO\\) enabled.\n-   **[Disable unauthenticated published reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-disable-unauthenticated-published-reports.md)**  \nDeactivate this property to prevent the user from publishing or accessing reports. This property disables the published reports feature in reporting.\n-   **[Disable public access to favorites](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-public-access-to-favorites.md)**  \nUse the **glide.ui.magellan.favorites.allow\\_public** to specify whether unauthenticated users are allowed to see **Favorites** in the navigator.\n-   **[Enforce field ACLs for inbound query requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enforce-field-acls-for-inbound-query-requests.md)**  \nManage how incoming queries are validated on your instance.\n-   **[Enforce read ACLs on report views](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enforce-read-acls-on-report-views.md)**  \nManage how Read ACLs are enforced on your instance.\n-   **[Enable Anti-CSRF Token for Userperf](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enable-anti-csrf-token-for-userperf.md)**  \nUse a system property to ensure CSRF \\(Cross-Site Request Forgery\\) protection is enforced when setting user preferences.\n-   **[Enforce Query ACLs for Knowledge Quick Links](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enforce-query-acls-for-knowledge-quick-links.md)**  \nEnforce query ACLs for Knowledge Quick Links using a system property.\n-   **[Enforce Query ACLs for SubLists, List Counts and Widget Data Tables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enforce-query-acls-for-sublists-list-counts-and-widget-data-tables.md)**  \nEnforce query ACLs on sublist, list count, and widget data table queries using system properties.\n-   **[Enforce valid query string choice \\[New in Security Center 7.0\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enforce-valid-query-string-choice.md)**  \nUse a system property to ensure that any choice field value, when passed via a URL query string, is a valid active choice when a record is created.\n-   **[Ensure An Instance is Allowed to Connect to Only Trusted IP Addresses](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-ensure-an-instance-is-allowed-to-connect-to-only-trusted-ip-addresses.md)**  \nUse a system property to define a list of IP ranges that are appended to the outbound IP allow list.\n-   **[Ensure only Trusted IP Addresses are Allowed to Connect to An Instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/performance-monitoring-ip-restriction.md)**  \nUse a system property to define a list of IP ranges that are appended to the outbound IP allow list.\n-   **[For Self-Hosted Instance, Ensure only Trusted IP Addresses are Allowed to Connect to An Instance](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-for-self-hosted-instance-en.md)**  \nUse system properties to control which inbound IP addresses can connect to self-hosted instances.\n-   **[Require authorization for data broker rest API \\[Updated in Security Center 1.3\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-data-broker-rest-api-authorization.md)**  \nUse the **glide.basicauth.required.databrokerrestapiprocessor** property to require basic authorization for all inbound Data Broker Rest API requests.\n-   **[Restricted Binding functionality in case Bearer Authorization \\[New in Security Center 7.0\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-restricted-binding-functionality-in-case-bearer-authorization.md)**  \nUse a system property and restricted binding to ensure that an access token generated using that entity can’t be used for UI calls.\n-   **[Deny by default with empty ACLs \\[Updated in Security Center 1.3\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-security-manager-default-deny.md)**  \nUse the **glide.sm.default\\_mode** property to control the default behavior of security manager when it finds that existing Access Control List \\(ACL\\) rules are a part of wildcard table ACL rules.\n-   **[Set Automatic Token Cleanup for Token Credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-set-automatic-token-cleanup-for-token-credentials.md)**  \nUse the **com.snc.platform.security.token.auth.cleanup** property to ensure that expired API keys and HMAC secrets are deleted, thereby limiting the potential for token reuse.\n\n**Parent Topic:**[Hardening settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/security-hardening-settings.md)\n\n"}}