Gospel Okororie - 100908710

MGMT 1216-04 Security Auditing and Governance

Week 2 – Assignment

Week #2 – Independent/case study – Risk event exercise:

Evaluate the cloud controls of a recognized product's CSP. Select at least one control class domain and
choose five controls from it. Analyze both the control specifications, and implemented controls, and
identify the threat agent, threat, vulnerability, impact, and risk.

CSP – ServiceNow

Control Class Domain: Identity and Access Management

1. Separation of Duties
2. Least Privilege
3. User Access Provisioning
4. User Access Changes and Revocation
5. User Access Review.

1. Separation of Duties: Employ the separation of duties principle when implementing information
system access.

Implemented Control:

ServiceNow User Identities:

ServiceNow's Information Security Policy requires that a reasonable attempt to segregate duties, areas
of responsibility, and access be made based on risk, without impacting ServiceNow’s ability to effectively
support its customers and operations. The intent of such segregation shall be to address the potential for
abuse of authorized privileges and to help reduce the risk of malevolent activity without collusion. The
majority of ServiceNow personnel have no access to any systems hosting customer data, or to customer
data in general.

Customer Instance User Identities:

ServiceNow customers are responsible for the management of user identities within their instances. This
includes the creation of individual identities (credentials) for each of their users, both internal and
external, the methods used to authenticate those users, password policies (for built‐in authentication),
and the entitlements and access levels granted to those users.
Threat Agent: Malicious Insider threat. Disgruntled worker. Unauthorized user. Malicious threat actor
who has gained access to

Threat: Unauthorized access, data breach, exfiltration of sensitive data.

Vulnerability: Lack of proper access controls and separation of duties. Lack of security awareness
training. Lack of detailed job description. And responsibility

Impact: Loss of sensitive information, reputation damage, financial loss, and major impact on people,
processes, and systems.

Risk: High risk.

2. Least Privilege: Employ the least privilege principle when implementing information system access.

Implemented Control:

ServiceNow User Identities:

ServiceNow's Information Security Policy requires that information system access be designed based on
the principle of least privilege and role-based access. The majority of ServiceNow personnel have no
access to any systems hosting customer data, or to customer data in general.

Customer Instance User Identities:

ServiceNow customers are responsible for the management of user identities within their instances. This
includes the creation of individual identities (credentials) for each of their users, both internal and
external, the methods used to authenticate those users, password policies (for built‐in authentication),
and the entitlements and access levels granted to those users.

Threat Agent: Malicious Insider threat. Disgruntled worker. Unauthorized user

Threat: Unauthorized access, data breach, exfiltration of sensitive data

Vulnerability: Weak/Lack of proper access controls and separation of duties.

Impact: Loss of sensitive information, reputation damage, financial loss, and major impact on people,
processes, and systems.

Risk: High risk.

3. User Access Provisioning: Define and implement a user access provisioning process which
authorizes, records, and communicates access changes to data and assets.

Implemented Control:

ServiceNow User Identities:

Customer Instance User Identities:

ServiceNow customers are responsible for the management of user identities within their instances. This
includes the creation of individual identities (credentials) for each of their users, both internal and
external, the methods used to authenticate those users, password policies (for built‐in authentication),
and the entitlements and access levels granted to those users.

Threat Agent: Malicious insiders, unauthorized users

Threat: Unauthorized access, data breaches, misuse of data and/or exfiltration of sensitive data

Vulnerability: Weak access controls, lack of user access provisioning policies

Impact: Loss of data, data breaches, sustained negative media coverage and reputational damage

Risk: High

4. User Access Changes and Revocation: De-provision or respectively modify access of movers / leavers
or system identity changes in a timely manner in order to effectively adopt and communicate identity
and access management policies.

Implemented Control:

ServiceNow User Identities:

ServiceNow utilizes an identity and access management system to automatically remove information
system access on a user's termination date. Reviews also take place when personnel change roles within
ServiceNow. The majority of ServiceNow personnel have no access to any systems hosting customer
data, or to customer data in general.

Customer Instance User Identities:

ServiceNow customers are responsible for the management of user identities within their instances. This
includes the creation of individual identities (credentials) for each of their users, both internal and
external, the methods used to authenticate those users, password policies (for built‐in authentication),
and the entitlements and access levels granted to those users.

Threat Agent: Malicious insiders, unauthorized users

Threat: Unauthorized access, data breaches, misuse of data and/or exfiltration of sensitive data

Vulnerability: Weak access controls, lack of user access revocation policies, lack of automated access
revocation.

Impact: Loss of data, data breaches, sustained negative media coverage and reputational damage

Risk: High
5. User Access Review: Review and revalidate user access for least privilege and separation of duties
with a frequency that is commensurate with organizational risk tolerance.

ServiceNow User Identities:

ServiceNow utilizes an identity and access management system to maintain an inventory of identities
including level of information system access. At a minimum, quarterly entitlement reviews are carried
out to ensure that personnel have the appropriate logical access rights assigned to them. Reviews also
take place when personnel change roles within ServiceNow. The majority of ServiceNow personnel have
no access to any systems hosting customer data, or to customer data in general.

Customer Instance User Identities:

ServiceNow customers are responsible for the management of user identities within their instances. This
includes the creation of individual identities (credentials) for each of their users, both internal and
external, the methods used to authenticate those users, password policies (for built‐in authentication),
and the entitlements and access levels granted to those users.

Threat Agent: Malicious insiders, Unauthorized users

Threat: Unauthorized access, data breaches, misuse of data and/or exfiltration of sensitive data

Vulnerability: Weak access controls, lack of user access review policies

Impact: Loss of data, data breaches, sustained negative media coverage and reputational damage

Risk: High