New hardening settings for baseline version 2.0

New hardening settings have been released with Security Center baseline version 2.0.

• Ensure archive table ACLs are checked

• Enforce application scope restrictions [New in Security Center 1.3 and removed in 1.5]

• Enable the hardened java security manager

• Verify certificate revocation

• Require clearing pasteboard when backgrounding mobile application

• Enable protected tables plugin

• Enforce strict elevate privilege

• Limit integrations’ active session life span

• Proactively Invalidate Sessions After Defined Durations

• Enable MID audit log

• Use of secure insert multiple operation within import set API

• Enforce OCSP check on network error

• Enforce security rules to sharing dashboards

• Restrict oauth parameters to POST body [New in Security Center 1.3]

• Limit attachment size in training and prediction flows for GraphQL endpoints [New in Security Center 1.3 and updated in 1.5]

• Disable GlideRecord Scope Fencing Legacy Behavior

• Required JMS connection factories

• Limit attachment size in training and prediction flows [New in Security Center 1.3 and updated in 1.5]

• Log session audit events

• Require write access to access service catalog add item page

• Define active session timeout exception roles

• Enforce scoped ACL access for information request playbooks [New in Security Center 1.3 and updated in 1.5]

• Hide user comments on articles

• Ensure dashboards creation/deletion requires access check [New in Security Center 1.3 and updated in 2.0]

• Enforce device encryption and passcode requirements [New in Security Center 1.3]

• Validate file mime type in AttachmentCreator soap web service [New in Security Center 1.3 and updated in 1.5]

• Verify certificate revocation

• Check impersonation on ACL evaluation in HR App [New in Security Center 1.3 and updated in 1.5]

• Require CAPTCHA for guest walk-up experience in customer service application

• Require Authentication on Event Management HTTP Processor [New in Security Center 1.3, Updated in 1.5, and removed in 2.0]

• Limit guest’s active session life span

• Disallow target cloning [New in Security Center 1.3]

• Set safe content security policy for SVG files

• Anti-CSRF token validation time

• Restrict knowledge bases access

• Enforce scope security for public sector digital services [New in Security Center 1.3]

• Restrict HR case updates from personal emails

• Limit UI active session life span

• Enforce secure referrer policy

Parent Topic:New hardening settings