ServiceNow Insecure Access Control to Full Admin Takeover
1–10 of 81 posts
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#2Almost exactly a year from report to disclosure. I'm sure it varies a lot, but is that a normal timeline for something this severe?
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#3Almost exactly a year from report to disclosure. I'm sure it varies a lot, but is that a normal timeline for something this severe?
No, judging from the Disclosure Timeline at the very bottom, it appears the lengthy remediation is due to ServiceNow dragging their feet. Took them over a month, plus a followup email, just to get them to respond to the initial report.
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#4Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow.
What an abomination of something seemingly so simple made into something so horrendously complex and bloated.
I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users.
It behaves like it is constantly broken.
People talk shit about it all day, every day.
Maybe one day, some time a long time ago they had a good product, and that's how it got embedded all over the place, but now, what a pile of junk!
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#5Almost exactly a year from report to disclosure. I'm sure it varies a lot, but is that a normal timeline for something this severe?
It can really depend on the nature of the vulnerability and who discovered it. Based on the timeline at the bottom of this article it seems like this was way too slow. Based on the cve information this was ranked as 9.8. The last time I dealt with a bug that bad it was log4j. It was found on a Tuesday, patched on a Thursday, announced on a Friday, and I redeployed all of our servers over the weekend.
The most egregious part in my eyes is the slow response to the initial contact. In shows that Service Now does not monitor it's reporting and that they don't care about security. If I were using a product of theirs to handle proprietary or privileged information I would no longer trust them.
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#6Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantl…
I worked there for exactly two months. After 15 days, I could not receive another offer and put in my notice fast enough. Ended up giving them four days. And I'm usually very careful about not burning bridges.
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#7Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantl…
What makes it so bad?
We are likely to get it next year . I feel it cannot be worse than the aberration we are currently using but I could be wrong :-/
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#8Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantl…
I think all that generally applies to enterprise software like that, no? SAP is absolute garbage but it ticks various C-level agenda items (mainly the act itself of investing in ERP modernization) and so it sells regardless. Servicenow I belive makes it harder for employees to get help and thus saves labor. Enterprise software isn't for you or me, that's why we hate it.
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#9Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantl…
What makes it so bad? We are likely to get it next year . I feel it cannot be worse than the aberration we are currently using but I could be wrong :-/
It’s secret super power for executives is GQL it’s easier to use vs SQL and the interface looks slick compared to what’s out there.
A very well architected instance looks and is pretty good, the issue is that often large enterprises will hire the cheapest possible consulting firm to implement it, and you can really screw it up if you’re not careful.
Re: ServiceNow Insecure Access Control to Full Admin Takeover
#10Earlier quoted context omitted.
What makes it so bad? We are likely to get it next year . I feel it cannot be worse than the aberration we are currently using but I could be wrong :-/
It’s secret super power for executives is GQL it’s easier to use vs SQL and the interface looks slick compared to what’s out there. A very well architected instance looks and is pretty good, the issue is that often large enterprises will hire the cheapest possible consulting firm to implement it, and you can really screw it up if you’re not careful.
My background is ERP so that sounds similar then - the bones may be decent, but how you implement it can make or break it, both as IT exercise and as business transformation / process implementation; is that About right?
I will likely have some input on how it's implemented and particularly the processes. I guess I should start reading up on best practices etc...