Category: IT & Support

Secure ServiceNow browsing

Secure ServiceNow browsing means protecting IT and security workflows from malicious links, unsafe attachments, and session compromise in browser-based ticketing.

Quick answer

Legba can isolate browser sessions while your team uses ServiceNow.

Support tooling often bridges into sensitive systems. Isolation helps reduce exposure from external links, attachments, and untrusted portals used alongside ServiceNow.

This page does not imply an official integration with ServiceNow—it’s a guide to securing browser workflows around the app.

When you need this

Your team uses ServiceNow in a browser every day.
You want to reduce phishing, malicious downloads, and session theft without slowing users down.
You need role-based policies for employees, admins, and contractors.

Last updated

2026-01-29

Common browser risks

Malicious links embedded in tickets that route staff to phishing or malware sites.
Attachments uploaded by external users containing malware or deceptive documents.
Impersonation via ticket comments to request urgent access changes or credential resets.
Session hijacking that provides access to sensitive workflows and internal data.
Copy/paste leakage of internal incident details into untrusted tools or AI prompts.

Typical sensitive data in ServiceNow

IT tickets containing system details and user data.
Incident response notes and root cause analyses.
Attachments like logs, screenshots, and documents.
Links to internal dashboards, runbooks, and vendor portals.
User identity and access workflows.
Audit logs and admin configurations (depending on setup).

Recommended policies by role

Support

Open customer-provided links in isolation by default; treat them as untrusted.
Restrict downloading attachments from external users; scan and release through a controlled workflow.
Avoid pasting secrets into tickets; use secure sharing for credentials and tokens.

IT Admins

Use separate profiles for admin workflows vs general browsing to reduce session compromise risk.
Enforce extension allowlists and safe browsing policies for IT staff.
Isolate unknown domains opened from tickets, alerts, and vendor communications.

Security

Use isolation for investigating suspicious URLs and attachments referenced in incidents.
Deploy policies that reduce data leakage to AI tools from browser-based incident workflows.
Monitor for unusual export and access patterns, especially during active incidents.

See Legba for Chrome

FAQs

Why are ITSM tools risky?

They collect links, files, and operational detail. Attackers exploit that by embedding malicious URLs and using social engineering through ticket comments.

Should IT staff isolate browsing more than other teams?

Often yes. IT and security teams handle sensitive data and click unknown links during investigations.

Does isolation help with malicious attachments?

It reduces endpoint exposure from risky browsing and supports safer workflows, but file scanning and controlled release are still required.

What’s a practical first step?

Isolate unknown links opened from tickets and restrict attachment downloads from external users.