Sensitive Data Masking Pattern for…

advancedTested on Xanadu

The Sensitive Data Masking Pattern provides a multi-layered approach to protecting sensitive information in ServiceNow by combining field-level encryption, display value scripting, and access controls. This pattern ensures that sensitive data like Social Security Numbers, credit card numbers, and passwords are stored securely and displayed appropriately based on user roles and context.

This pattern addresses the challenge of maintaining data security while preserving system functionality. It allows authorized users to access sensitive data when needed for legitimate business purposes while masking or encrypting the data for unauthorized users. The pattern includes database-level encryption for data at rest, dynamic masking for display purposes, and audit trail protection to prevent sensitive data exposure in logs.

The implementation uses ServiceNow's built-in edge encryption capabilities combined with custom display business rules, UI policies, and ACL configurations. This creates a comprehensive security layer that protects sensitive data throughout its lifecycle in the platform, from initial data entry through reporting and integration scenarios.

Chrome Extension

Sourdough: ServiceNow Monitoring and Analytics

A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.

Instance HealthGraphs & ChartsAPI HealthDeveloper ToolsQuick SearchInstance Switcher

Add to Chrome

Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.

Overview

Tasks

CMDB

API

Metrics

Monitor

Internals

Instance:sourdoughdev·Version:Yokohama

Instance StateONLINE

System StatusFully Operational

Session Timeout90 minutes

Logged-In Sessions2 (20 active)

Build Nameyokohama-12-18-2024_p1

IP Address10.159.128.43

Instance HealthHealth Score: 90%

🔥 5dSourdough (Chrome Plugin)Dark Mode

Use This When

Use this pattern when handling personally identifiable information (PII), financial data, healthcare records, or any sensitive information that requires regulatory compliance such as PCI DSS, HIPAA, or GDPR. This pattern is essential for organizations that need to maintain detailed audit trails while ensuring sensitive data remains protected from unauthorized access.

Avoid When

Avoid this pattern for non-sensitive reference data or when the performance overhead of encryption and masking would significantly impact system performance. Do not use this approach if your organization lacks the governance framework to properly manage encryption keys and access controls, as improper implementation can create security vulnerabilities rather than preventing them.

Implementation

Server-side

// Script Include: SensitiveDataMaskingUtil
var SensitiveDataMaskingUtil = Class.create();
SensitiveDataMaskingUtil.prototype = {
    initialize: function() {
        this.MASK_CHAR = '*';
        this.SSN_PATTERN = /^\d{3}-?\d{2}-?\d{4}$/;
        this.CC_PATTERN = /^\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}$/;
    },

    // Main masking function based on user role and field type
    maskSensitiveField: function(value, fieldType, userRole) {
        if (!value || this._hasFullAccess(userRole)) {
            return value;
        }

        switch (fieldType) {
            case 'ssn':
                return this._maskSSN(value);
            case 'credit_card':
                return this._maskCreditCard(value);
            case 'password':
                return this._maskPassword(value);
            default:
                return this._maskGeneric(value);
        }
    },

    // Check if user has full access to sensitive data
    _hasFullAccess: function(userRole) {
        var authorizedRoles = ['admin', 'privacy_officer', 'security_admin'];
        return authorizedRoles.indexOf(userRole) !== -1;
    },

    // Mask SSN showing only last 4 digits
    _maskSSN: function(ssn) {
        if (!this.SSN_PATTERN.test(ssn)) {
            return this._maskGeneric(ssn);
        }
        var cleaned = ssn.replace(/[^\d]/g, '');
        return '***-**-' + cleaned.slice(-4);
    },

    // Mask credit card showing only last 4 digits
    _maskCreditCard: function(ccNumber) {
        if (!this.CC_PATTERN.test(ccNumber)) {
            return this._maskGeneric(ccNumber);
        }
        var cleaned = ccNumber.replace(/[^\d]/g, '');
        return '**** **** **** ' + cleaned.slice(-4);
    },

    // Completely mask passwords
    _maskPassword: function(password) {
        return new Array(8).join(this.MASK_CHAR);
    },

    // Generic masking for unknown field types
    _maskGeneric: function(value) {
        if (value.length <= 4) {
            return new Array(value.length + 1).join(this.MASK_CHAR);
        }
        return value.substring(0, 2) + new Array(value.length - 3).join(this.MASK_CHAR) + value.slice(-2);
    },

    // Scrub sensitive data from audit logs
    scrubAuditEntry: function(auditGr) {
        var sensitiveFields = ['ssn', 'credit_card_number', 'password', 'bank_account'];
        
        if (sensitiveFields.indexOf(auditGr.getValue('fieldname')) !== -1) {
            auditGr.setValue('oldvalue', this._maskGeneric(auditGr.getValue('oldvalue')));
            auditGr.setValue('newvalue', this._maskGeneric(auditGr.getValue('newvalue')));
            auditGr.update();
        }
    },

    type: 'SensitiveDataMaskingUtil'
};

// Display Business Rule: Mask Sensitive Data on Load
// Table: [target table], When: display, Order: 100
(function executeRule(current, previous /*null when async*/) {
    var maskUtil = new SensitiveDataMaskingUtil();
    var userRole = gs.getUser().getRoles().toString();
    
    // Mask SSN field
    if (current.ssn) {
        current.ssn.setDisplayValue(maskUtil.maskSensitiveField(current.getValue('ssn'), 'ssn', userRole));
    }
    
    // Mask credit card field  
    if (current.credit_card_number) {
        current.credit_card_number.setDisplayValue(maskUtil.maskSensitiveField(current.getValue('credit_card_number'), 'credit_card', userRole));
    }
    
})(current, previous);

Client-side

// UI Policy Script: Prevent sensitive data copy/paste
// Condition: true (runs on all records)
function onCondition() {
    // Get sensitive fields on the form
    var sensitiveFields = ['ssn', 'credit_card_number', 'bank_account_number'];
    
    sensitiveFields.forEach(function(fieldName) {
        var field = g_form.getControl(fieldName);
        if (field) {
            // Disable right-click context menu
            field.oncontextmenu = function() { return false; };
            
            // Disable text selection
            field.style.webkitUserSelect = 'none';
            field.style.mozUserSelect = 'none';
            field.style.msUserSelect = 'none';
            field.style.userSelect = 'none';
            
            // Add visual indicator for sensitive fields
            field.style.backgroundColor = '#ffe6e6';
            field.setAttribute('title', 'Sensitive Data - Access Restricted');
        }
    });
}

// Catalog Client Script: Mask input in real-time
function onChange(control, oldValue, newValue, isLoading) {
    if (isLoading || !newValue) return;
    
    // For SSN field, show masking as user types (after 4 characters)
    if (g_form.getFieldName() === 'ssn' && newValue.length > 4) {
        var masked = newValue.substring(0, newValue.length - 4).replace(/./g, '*') + newValue.slice(-4);
        // Store actual value in hidden field for processing
        g_form.setValue('ssn_actual', newValue);
        // Display masked value
        setTimeout(function() {
            g_form.setValue('ssn', masked);
        }, 100);
    }
}

The server-side code implements a comprehensive masking utility that handles different types of sensitive data with role-based access controls, using display business rules to dynamically mask data during form loading. The client-side code adds an additional security layer by preventing copy-paste operations and providing real-time input masking for sensitive fields. Key features include pattern validation, audit log scrubbing, and configurable masking strategies based on data type and user permissions.

Alternatives

Edge Encryption Only

Uses ServiceNow's built-in edge encryption without custom masking logic, providing strong data-at-rest protection but limited display control and no role-based masking capabilities.

External Tokenization Service

Integrates with external tokenization platforms like CyberArk or HashiCorp Vault for enterprise-grade key management and tokenization, but adds architectural complexity and external dependencies.

Field-Level ACLs Only

Relies purely on Access Control Lists to restrict field visibility without masking, providing simpler implementation but less granular control and no protection against authorized users with legitimate but limited access needs.

Test Your Knowledge

Quick 3-question quiz — see how your ServiceNow skills stack up.

Question 1 of 3Performance

A list view on a table with millions of records is slow. Best fix?

Select an answer to continue