Legit Scans for Secrets in ServiceNow ITSM Tickets

Get details on Legit's ability to scan for secrets in ServiceNow tickets.

Secrets, credentials, and non-human identities (NHIs) are proliferating, causing massive headaches for security teams. Some recent incidents include the Sisense breach and Snowflake's stolen credentials. 

While much of the secrets spotlight has been on hard-coded passwords in source code, ticketing systems are another popular, but often overlooked, spot for this type of exposure. Following the release of our Jira secrets scanner, Legit is happy to announce the new ability to scan ServiceNow tickets, broadening our coverage and defense against this challenge. 

Why ticketing systems are increasing your secrets exposure  

Ticketing systems enable support teams, service desks, application-lifecycle management, bug trackers, and more. They are a massive, daily-use collaboration tool, but the information shared between parties is often personal, and sometimes very sensitive, data.

Consider a ticket opened for “can’t connect,” with a frustrated employee sharing “here are the credentials I tried – XXX, please help.” Change requests often include sensitive configuration files, certificates, non-human identities, and tokens.  

The challenge is complicated by the fact that ticketing systems are often configured to allow accessing and sharing tickets with many people in the organization, and sometimes even externally.

If a help desk or support agent has their identity compromised, an attacker with access to support cases can quickly scan them for sensitive data and then move laterally and compromise more data.  

Legit has had many customer requests to detect and remediate secrets in ticketing systems, and had much success doing this in systems like Jira. 

Scan secrets in your tickets, right away 

Legit’s SeviceNow secrets scanner uses APIs to scan, in an agentless manner, all tickets and to provide a thorough analysis of all secrets buried within them. 

• The scanner goes through all fields and the data included, and uses Legit’s industry-leading detection engine with hundreds of detectors, including AI-based ones, to identify true secrets, classify them, and prioritize them.
  

• You can manage ServiceNow secrets centrally, together with all organizational secrets, so security teams have a unified view and policy of their secrets posture across all tools.  
  

• The ServiceNow scanning includes all our existing scanning capabilities, including validity checks, AI-assisted accuracy and false-positive removal, centralized policy management, and exception management.  
   

• When it comes to remediation and the need to rotate or revoke a password, it is imperative to know all locations this non-human-identity is being used. Legit’s new Actions view will group together all secrets bearing the same value exactly for that purpose. For example – a cloud key in a ticket that’s also being relied on by some lines of code. 

• Lastly, new tickets with secrets will be quickly identified and Legit’s workflow system can alert the security team, allowing them to react fast. Coming soon: preventive capabilities to mask the sensitive data or even block the ticket at creation.  

Keep secrets in your ServiceNow tickets secure  

As often happens with secrets, an honest mistake or a small breach escalates to a larger incident. Tools like ServiceNow are buzzing with tickets, service requests, and, invariably,  sensitive data. Legit customers are now a click away from assessing their ServiceNow secrets posture and continuously protecting it. 

Learn more or get a free trial 

Learn more about Legit’s secrets scanning capabilities, or, for a limited time, get a 2-week free trial to see first-hand the power of Legit secrets detection and prevention.