Comments on: What Everybody Should Know About ServiceNow Security

By: Mark Stanger

Mark Stanger — Fri, 24 May 2024 19:39:54 +0000

In reply to Wrangler. Thanks for the feedback! I've updated the links above to point to the corresponding 'Docs' references.

By: Wrangler

Wrangler — Tue, 07 Jun 2022 16:50:48 +0000

This is a good review of the SNOW security mechanisms. Unfortunately all of the links to ‘wiki.service-now.com’ are dead. Fortunately, everything likely exists over at docs.servicenow.com so maybe a few minutes updating the links and this becomes a useful resource again?

By: Peter Tran

Peter Tran — Mon, 07 Mar 2016 13:37:06 +0000

Thanks for your article.

By: harsh chhajer

harsh chhajer — Fri, 06 Jan 2012 13:14:09 +0000

thanks for these contents
i learnt a lot of things about the ACL. nice work :)

By: Brian Broadhurst

Brian Broadhurst — Thu, 30 Jun 2011 14:11:57 +0000

In reply to Mark Stanger.

Ah yes – now I understand what you’re saying – you’re right, on the few occasions that I have used a row-level read ACL it has been on small tables where that effect has not been obvious. Brian

By: Mark Stanger

Mark Stanger — Thu, 30 Jun 2011 12:58:35 +0000

In reply to Brian Broadhurst. Thanks for the comment. There may be exceptions for extremely small tables, but the security message isn't really the issue, it's the fact that you might have to page through thousands of results to see the 5 records in the table that you are allowed to read. Row-level read ACLs don't collapse all of that data for you down to the first page.

By: Brian Broadhurst

Brian Broadhurst — Thu, 30 Jun 2011 12:55:46 +0000

Great post Mark. I take your point about using the “before query” business rule in preference to a row-level ACL, but sometimes it is very difficult to construct the query conditions in the business rule, and it’s easier to use a scripted ACL – and live with the security message.

Brian

By: Abhiram Bharadwaj

Abhiram Bharadwaj — Thu, 30 Jun 2011 11:19:21 +0000

Good Post.Thanks for the info on ACLs :D