Build your wings before jumping into the cloud - SIGS€¦ · © 2017 ServiceNow, Inc. ... Build your wings before jumping into the cloud. 2 © 2017 ServiceNow, Inc. ... training

1© 2017 ServiceNow, Inc. All Rights ReservedConfidential© 2017 ServiceNow, Inc. All Rights ReservedConfidential

Build your wings before jumping into the cloud

2© 2017 ServiceNow, Inc. All Rights ReservedConfidential

SECURITY & COMPLIANCENOW ON NOW AVAILABILITY OPERATIONS




ServiceNow Is A Fast-Growing, Global Company

~4,800 Employees

Major SitesSilicon Valley, San Diego, Seattle

Amsterdam, London Sydney, Tel Aviv, Hyderabad

$28M $64M$128M

$683M

$1B

’16

$1.38B*

‘09

$244M

$425M

* Wall Street Consensus Estimates For Full Year 2016 Revenue As Of 1/22/17

$1+ Billion In Annual Revenue

‘10 ‘11 ‘12 ‘13 ‘14 ‘15

5© 2017 ServiceNow, Inc. All Rights ReservedConfidential© 2017 ServiceNow All Rights Reserved

Cloud Infrastructure

BUSINESS APPSIT SECURITY HRCUSTOMER SERVICE

Create Your Lightspeed Enterprise™ With ServiceNow

Platform

WorkflowEngine

SingleDatabase

ContextualCollaboration

ServiceCatalog

ServicePortal

Subscription & Notification

KnowledgeBase

DeveloperTools

Intelligent Automation

Machine IntelligenceBenchmarks Analytics

. .. .....

... .....

.

.. .. ....

.... .....

.

..... ..

. .. ..........

. .. .....

... .....

.

..... .. . .. ..

Secure & Compliant ScalableMulti-Instance


Global Enterprises In Every Industry Rely on ServiceNow

Construction Federal Financial Services Healthcare Higher Education Insurance IT Services Manufacturing Media MSPs Oil and Gas Retail Services Technology


Three Tenets of Cloud ArchitectureAvailability

• Distributed paired data centers

• Load balanced application tier

• Separated tiers

• High availability

• Disaster Recovery

Ensure measureable redundancy and failover capabilities

Integrity

• Centralized logging and event monitoring

• Intrusion detection system (IDS)

• Continuous monitoring

• Open source intelligence

• Independent auditing

Maintain trustworthiness of systems and data

Confidentiality

• Multi-tenant architecture vssingle tenant architecture

• Customer-level isolation

• Strong encryption to protect data while in transit and at rest

• ACL engine built into platform

Protect information from disclosure to unauthorized parties




DevelopersEnterprise

Department

ConsumerEntertainmentShopping

Sales Human Resources

Enterprise IT Infrastructure

The world has changed just in the last 2 years – clouds everywhere

Finance

Communications


Availability

• Availability numbers can be misleading

• What is planned uptime?• Planned maintenance?• What is the definition of an outage?

• Recovery Point Objective (RPO)?

• Recovery Time Objective (RTO)?

• How is availability monitored?

• What is real availability?

Demand Transparency


Data CenterLocations

Redundant Pair

USCanadaEuropeSwitzerlandAustraliaAsiaBrazilUS-FISMA

USJapan

USEurope

US USEuropeJapanBrazilUS-FISMA

USEurope

US

Defining Availability Standards

Average Uptime % 99.995% 99.800% 99.500% 99.960% 99.950% 99.000% 99.900%

Planned Maintenance Per Quarter 6 hours 68 hours 182 hours 14 hours 6.5 hours 65 hours 39 hours

Total Availability % 99.720% 96.686% 91.167% 99.304% 99.652% 96.024% 98.114%

Recovery Time Objective (RTO) 2 hours 12 hours 12 hours Not Published Not Published Not Published Not Published

Recovery Point Objective (RPO) 1 hour 4 hours 1 hour Not Published Not Published Not Published Not Published


Definition of availability - Is this System Up?


Cloud Availability & Real Availability

Uptime %

SaaS provider failurenetwork or hardware

SaaS provider failureserious software defect

3rd Partyissue

Customer Createdissue

Real AvailabilityAll issues that make a cloud offering unusable


What type of transparency do you have into availability?

prod1

prod2

training

test

dev


Additional Availability Questions?• Ask for application and infrastructure documentation• Don’t get hung up on versions of software, etc• High availability architecture?• Definition of high availability?• Disaster recovery?

– Definition of disaster– Datacenter?– Core router?– POD?

• How often DR/high availability tested?• Can you test DR with cloud service provider?




Security Excellence is NOT Optional


Look for Investments in ComplianceComprehensive compliance strategy delivers confidence, reduces audit burden

ServiceNow Certifications Date Achieved

SSAE 16 / SOC 1 Type 1 October 2012

PCI DSS Level 2 October 2012

ISO 27001 December 2012

SSAE 16 / SOC 1 Type 2 October 2013

SOC 2 Type 2 October 2013

FISMA Moderate Government-wide Authorization (ATO) March 2013

FedRAMP February 2015


Customer data isolationTenancy Model:• Logically single-tenant

– Customer-specific Application instance– Customer-dedicated Database instance

• Physically “multi-instance”– Server hardware and infrastructure are multi-

tenant

Dedicated Hardware Option?:• Physically separated (i.e. dedicated)

hardware for a single customer


ISO 27001

FISMA

SSAE16 / SOC 1

Independent Audits

SOC 2

Nightly Build Security Testing

Code Analysis

Code Reviews and Training

Product Features

3rd Party Penetration Testing

3rd Party Code Inspection

Security Event Monitoring

Vulnerability Scanning

Perimeter Countermeasures

Security is an integral part of . . .

Operations3rd Party Audits

ReleaseDevelopment

Cloud Security Program


Resolve Real Security Threats FastAlign security & IT to resolve security threats on a single platform

Prioritize incidents by business impact

Automatically integrate threat intelligence

Hand off tasks between security & IT

Speed remediation with orchestration


Resolve Real Security Threats FastIntegrate Your

Security Products

Automatically Prioritize Security Incidents

Utilize Threat Intelligence

Determine Response Action

Remediate Threats Fast

1 3

4

5

6

Review Post Incident Reports

!

2


Expect security transparency

Internal pen-testing

3rd party pen-testing Every release! Annual Annual *Unknown Annual Annual Annual

Customer pen-testing *

Continuous DR testing

Customer DR testing




Operations• How are upgrades applied?• Patch management process

– Operational impact

• Change management– What percentage of changes are automated?

• Backups– Media– 3rd party

26© 2017 ServiceNow, Inc. All Rights ReservedConfidential© 2017 ServiceNow All Rights Reserved

www.servicenow.com/sec-ops

Documents

Build your wings before jumping into the cloud - SIGS€¦ · © 2017 ServiceNow, Inc. ... Build your wings before jumping into the cloud. 2 © 2017 ServiceNow, Inc. ... training