Best Practices for User Verification: 2026 Guide

Purpose of this guide:

This document shows how to set up a secure and efficient process for verifying users and guide organizations evaluating solutions for user validation at help desks. Secure user verification prevents social engineering attacks against IT help desks (also called service desks).

Our main focus is on issuing new credentials like passwords and MFA methods, including Temporary Access Pass (TAP) from the IT-help desk. However, these best practices are useful for any type of user verification done by central help desks, including those in Finance and HR. This guide is for solutions to verify users who are already known to your organization, mainly those with a user ID for your internal systems. It is not for checking new customers or other outside individuals.

The guide includes:

  • Summary
  • Problem statement
  • Solution Principles
  • Verification Methods
  • The Business Case
  • Early warnings against attacks
  • IT integration aspects
  • Customer experience
  • Key requirements for a secure validation workflow
  • FastPass functional fit

You can also download the guide in a pdf format here.

Summary:

Think of your IT help desk as your company's front door. Right now, too many companies leave that door wide open to tricky scammers and hackers. These bad actors just need a few convincing answers to get in. This document explains why making that door super secure – with solid ways to check who's calling – isn't just a nice-to-have; it's essential to protect your whole organization.

We'll break down exactly what a top-notch verification system needs. This includes the absolute basics you can't live without, all the way to smart extras that make life easier. Here's where it gets interesting: we then compare two main paths to getting there.

Should you try to build it yourself using your existing ServiceNow system, or go with a specialized tool like FastPassCorp's Identity Verification Manager?

You'll see how a purpose-built tool measures up, especially when it comes to the tough security work for big companies. Most importantly, we'll give you the key things to think about when building the business case for a new solution. These covers saving money, cutting risk, or boosting efficiency.

Get ready to understand not just what you need, but how to get it done and convince the decision-makers it's worth the investment. This is about making your help desk a fortress, not a weak spot. Read on!

Problem: Scattered Spider steals passwords from IT help desks, leading to massive data breaches.

MGM Hotels & Casino told shareholders they lost over $100 million after their 2023 data breach. Clorox has sued their help desk service provider, Cognizant, for $380 million after also being hit by a data breach. Qantas and UK retailers Marks & Spencer were hit in 2025.

The hacker group Scattered Spider is believed to be behind these and many other breaches. Their usual method starts with a phone call to the victim’s help desk. They aim to get a password or another credential to open the doors to the "castle" (your secure systems).

Many people believe that awareness training and clear instructions on user verification can solve this problem and it seems to be the standard verification process today. However, a transcript of the actual attack against the Cognizant help desk shows the hacker didn’t need to prepare any answers for the verification process. Not one question was asked to verify the user’s identity!

Transcript Hacker and Help Desk Clorox Cognizant

Solution Principles

To prevent help desk-based breaches, we need two key decisions:

  1. Make user verification mandatory or required. The only way to do this is to stop help desk agents from directly resetting passwords. Take away their privileged rights to reset user passwords. At the same time, check if any other users have this right when they don't absolutely need it! Reduce the privileged right to the smallest possible number of people.
  2. All user groups must be properly verified before any password reset or other credential is given out. This can only happen with a secure process where IT security staff make all the decisions. We will explain more about this later.

For such a process to work well in a daily help desk setting, it must connect smoothly with your ITSM system, like ServiceNow. All steps taken during the verification process must be logged in the ticket for audits and compliance reviews.

User Verification

Every company can decide how to verify users. Most countries have laws or recommendations that require good user verification, but they don't describe how to do it.

It makes sense to look at guidance from national IT security groups, like the U.S. NIST (National Institute of Standards and Technology). For user authentication, NIST uses a model with three levels of authentication assurance (AAL1–AAL3). These levels depend on how sensitive the user's access is:

• AAL1 (Low Assurance) User Group: For users who access low-risk systems.
• AAL2 (Moderate Assurance) User Group: For employees or contractors who access sensitive, but not classified, systems.
• AAL3 (High Assurance) User Group: For users who access high-value systems (for example, system administrators, or those with access to classified or mission-critical data).

Most countries and some industries, like U.S. defense, Finance (FIPS), and Health Care (HIPAA), have recommended user verification practices you should follow.

Based on these recommendations or requirements, all users should be linked to one of these verification groups. In the real world, this is often done using Active Directory (AD) groups or Organizational Units (OUs).

User Verification Methods

What are User Verification Methods?

User verification methods are the security protocols used to confirm an individual's identity before granting access or resetting credentials. The most secure workflows combine multiple methods to eliminate the risk of social engineering.

The two primary categories of verification are:

  • Possession-based: Proving identity via something the user has (Smartphone App, Hardware Token, Smart Card).
  • Knowledge-based: Proving identity via something the user knows (Dynamic Data from AD, HR, or ServiceNow).

Below is a detailed breakdown of these methods and how to apply them effectively in high-security environments.

  1. Possession-Based Verification (Tokens & MFA)

The strongest form of verification uses tokens, as they are hard for criminals to obtain or replicate. Most tokens today are based on smartphone apps. Since smartphone authentication now uses biometrics (face/fingerprint), this effectively combines "something the user is" with "something they have."

Common Token Examples:

  • TOTP Authenticators: Microsoft Authenticator, Google Authenticator.
  • Security Push Tokens: Duo, Okta, RSA.

Challenges with Token Verification: While secure, reliance on personal devices creates specific gaps that the Service Desk must solve:

  1. The "Lost Device" Scenario: If a user calls because they lost their phone, you cannot use the phone to verify them.
  2. Restricted Environments: In healthcare, nuclear facilities, or sensitive production areas, mobile devices are often prohibited.
  3. User Resistance: Some worker unions or individual employees refuse to use personal smartphones for work tasks.

Alternative Token Solutions:

  • Hardware TOTP Tokens: Cheap, physical devices that generate a new number every 30 seconds. These are secure but easily forgotten if only used for occasional help desk calls.
  • "Soft Tokens": Physical objects with a unique identifier, such as a PC asset tag or an employee badge serial number. Note: Since these codes are static and visible to coworkers, they should always be combined with other tests.
  1. Knowledge-Based Verification (Dynamic Data)

In classic authentication theory, "something only the user knows" is a core element. However, traditional "security questions" (like "What is your mother's maiden name?") are no longer secure because this data is easily found by attackers.

Best Practice: Dynamic Data Verification The modern standard is to use Dynamic Data—information that changes frequently and is sourced live from internal systems. This makes it impossible for an external attacker (and difficult for internal bad actors) to have all the answers.

We recommend sourcing questions from these four isolated systems:

  • AD / Entra ID Data: Highly dynamic information. Ask the user: "When did you last log off?" or "When did you last change your password?" It is practically impossible for an attacker to know these exact timestamps.
  • ServiceNow (ITSM) Data: Leverage ticket history. Ask: "What was the subject of your last support ticket?" or "When did you last contact the service desk?"
  • Operational Data: Pull unique data points from other business systems, such as Asset Management (device IDs), Finance, or Logistics systems.
  • Private User Data (SSPR): If the user has enrolled in a Self-Service Password Reset (SSPR) tool, this private data can be presented to the help desk agent for verification. Alternatively, users can generate a "Help Desk Code" (a specific word or number) where the agent only asks for a portion of the code (e.g., "Tell me digits 2 through 5").

Security Tip: Never display the full answer to the Help Desk agent. If verifying a 10-digit serial number or a salary date, the system should only prompt the agent to ask for a specific part (e.g., "Read me the last 4 digits"). This prevents internal data leakage.

Knowledge-based verification

In classic authentication theory, one element is "something only the user knows." This is also excellent for verification, if the user remembers it and if others cannot know it.

The last point – "others don’t know" – can be hard to achieve. When we use data from internal systems and databases, at least some colleagues know or can find the information. In some situations where we only want to protect against outside criminals, this might be acceptable. However, best practice is to ask a series of questions where the answers come from different internal systems. This makes it impossible for even an internal criminal to get all the information.

Sources:
  • Private user data: The user enters personal information. The benefit is that no one else can see the answers. However, it requires the user to sign up and choose questions and provide answers. This model is often used in Self-Service Password Reset (SSPR) solutions. With FastPass, this data can be shared with the help desk verification solution. In some customer cases, the user is asked to create a special word or number to use when calling the help desk (this can also be generated by the company). When given to the help desk, only a portion of the word is presented (like digits 2-5).
  • AD/Entra data: A lot of information is available, and some of it is dynamic. For example, asking the user when they last logged on or off, or when they last changed their password. It's practically impossible for others to answer these dynamic questions.
  • ServiceNow (or other ITSM) data: A lot of information is available and dynamic. For example, "What was your last ticket about?" or "When was the last time you contacted the help desk?" and much more.
  • Operational data fetched from other systems: Anything related to the user can be used. We see examples like device information from Asset Management, personal information from HR systems (last salary change, last absence period), and information from Finance or Logistics systems.

For many questions, it's best practice to only ask for parts of the correct answer. If you use a 10-digit serial number, ask for 4 digits starting from position X. This means the help desk agent won't get the full number. Remember to regularly change the position!

Building the profile

To be flexible and handle real-world problems like users forgetting their tokens or answers, a user can (and often must) have different ways to be verified.

For example, if a user can confirm a token, that might be enough. But if they have forgotten the token, correctly answering two questions could be an alternative. In FastPass, this is solved by giving each test an individual score, with 100 points required. In this example, the token would give 100 points, and each question would give 50 points. The user can then securely verify their identity with or without the token.

The Business Case

Implementing a new process for secure user verification means new investments and ongoing operating costs. These costs include internal resources and often external software/hardware or a cloud solution. A new verification process might also affect the time spent on each help desk call.

New investments and costs usually require a business case. The costs can be estimated quite accurately, but the challenge is: How do you estimate the benefits? Generally, costs are not reduced, and revenue doesn't increase directly.

We think it's like a business case for insurance! Fire insurance is good business for the insurance company, so why don't we just not get insurance and save the premium? Because it's a bad deal if a disaster hits you. When we look at cybersecurity, it's often even more serious than a building burning down.

Or, would anyone accept a system where outsiders can easily get the keys to your most critical departments? Realize that this is what happens if criminals can get passwords from your help desk! Does that really need a business case?

There are ways to improve the business case to a point where it provides a positive return:

  • FastPass has shown faster help desk verification compared to traditional ITSM processes. For the same verification with two questions, it took 50 seconds with FastPass integrated with ServiceNow, while ServiceNow alone took 109 seconds. This was achieved by FastPass automating the process.
  • When Self-Service Password Reset (SSPR) is part of the project, FastPass has shown that 80-90% of all password-related calls (for Windows and other password types like Oracle, SAP, IBM, etc.) can be handled without involving the help desk. This means users are more productive, and the help desk's workload is reduced. This often pays for the entire project and results in a positive business case!

Early Warnings

When a criminal organization attacks a help desk, they often fail many times. This is part of a hacker's strategy. They need information about your verification process, and they will get it through many failed attempts. They keep trying until they build a profile of a user or find a help desk agent who doesn't follow the procedure.

Any attempt to steal a credential is a criminal act! It's not just a regrettable mistake! So, every failed or aborted password call to the help desk can be seen as an early warning that an attack is happening.

Every time a password reset request is stopped because the caller cannot pass the test, you must send alerts. These alerts can go to the user, their manager, IT security, SIEM systems, and many others. The next steps can be automatic or involve a person, depending on other information.

With FastPass Notification Services, you can set up alerts to go out immediately to many different people based on the type of incident.

Another example might be many password resets for the same user. This could mean a hacker and the real user are fighting over the user ID (or the user has a very poor memory!). This situation should trigger a closer look.

Integration Infrastructure

Any valuable software solution for user verification must connect well with the customer’s existing systems using standard integration methods. It's important to look ahead to anticipate future changes where new integrations might be needed.

  • Automatically launch from the ITSM system, like ServiceNow.
  • Automatically return control and log all events back to the ITSM system (JSON/REST).
  • Integrate with AD/Entra/Hybrid environments to reset passwords and read user information.
  • Integrate with MFA APIs (Okta, Duo, RSA, TOTP Authenticators, and more).
  • Integrate into SIEM systems.

Workflow Solution Requirements

When considering a new solution, all large companies create a list of essential criteria. These criteria ensure the solution will be efficient and technically possible.

Based on talks with customers and experts, we have put together a chapter with ideas in Appendix 1. This is not a final list; it's meant to inspire you to create your own list for comparing different options you've found.

Many customers think about creating their own custom solution based on their experience and skills with ServiceNow. In Appendix 2, we have listed the strengths and weaknesses of this approach, along with concerns to consider.

FastPass IVM

FastPass Identity Verification Manager (IVM) was developed with the exact goal of making internal user verification secure and effective for large companies, with an absolute need for flexibility. IVM has been available since 2020, and we have gained a lot of experience, leading to continuous improvements over the years.

How FastPass IVM Solves It:

FastPass IVM uses advanced authentication methods to verify user identities quickly and securely. Through smart validation methods and integration with leading ITSM solutions like ServiceNow, FastPass IVM makes help desk security stronger while also improving the user experience.

FastPass Infographic flow

ServiceNow gives FastPass control of the ticketing process and FastPass advances automatically the ticket, making decisions along the way and writing all events back to the ticket.
FastPass can be considered a tool-box for IT-security to make exactly the verification tests which are ideal for the different profiles needed.

Perhaps equally important, our partners and we have taken part in many implementations. We have learned from customers how they verify users and how they build efficient workflows. This experience helps us and our customers with new projects, where we can guide and inspire them based on this project experience.

In Appendix 3, you'll find an overview of FastPass IVM's features and qualities, matched with the requirements list.

The Help Desk View on Secure Verification and IVM

We have seen organizations where help desk agents are told to use their "common sense" when verifying callers. This puts the responsibility of verification on the first-line agent. This is not fair to them, and it is definitely not secure. While the activity happens at the help desk, the quality of the verification process must be owned by the IT Security team.

It's well known that staff turnover is often high at service desks. This makes it even riskier to rely on an agent's judgment calls.

With the secure IVM processes, agents and managers can focus on performing the specific tasks presented to them. This will increase productivity and security and reduce stress.

The conversations with users will be smoother. It will be clear that the verification process isn't because the agent doesn't trust the caller, but simply a mandatory process decided by management for everyone.

Real-World Implementations

In this section, you'll find some real-life examples of how this has been implemented. For clear reasons, the customers don’t want their names used, so the cases are anonymous.

Case 1: Large Medical Company Enhances Security with Asset Management Tags

Case Study 1: Medical Company

A large U.S. Fortune 500 medical company needed a secure user verification process at their help desk. This came after they found attempts by unauthorized people trying to gather sensitive information. To fix this, they put FastPass in place. They used a combination of data from their HR system and showed only parts of the correct answers to the support team.

A key part of their plan involves asking users to give the asset number of their PC or use their phone for extra verificati

on. For users in special (privileged) groups, a stricter verification process starts, and cases are often automatically sent to a higher level, still managed by FastPass. The company integrated FastPass on-premises with their existing ServiceNow platform.

 

Case 2: Financial Organization Integrates FastPass and Okta for Enhanced Help Desk Verification

A smaller U.S. financial organization with 3,000 users had already invested in Okta for multi-factor authentication (MFA). They wanted to improve their protection against social engineering attacks. After hearing about a security breach at another financial institution, they looked for a simple yet strong verification process.

With FastPass, the help desk sends an Okta push notification to users who need verification. This protects not only password-related questions but also other types of calls. The organization uses FastPass Cloud, which is integrated with ServiceNow for full security.

Case 3: University Implements Secure Verification for Students and Staff

A European university had problems with students trying to get into other students' accounts by asking the help desk for password resets. They were worried about unauthorized access to central data that held student and alumni information. So, they turned to FastPass for a solution.

The university chose to use SMS as part of the verification process, using their existing database of student phone numbers. If a student couldn’t get to their phone, a set of security questions was used instead. Staff and faculty had to connect their Microsoft Authenticator to FastPass for secure verification. To also reduce the help desk's workload, FastPass’ self-service password reset feature was added. The university integrated FastPass on-premises with their local ITSM system.

Case 4: Service Provider (MSP) Enhances Security and Compliance with FastPass

An international service provider that manages IT help desks for many clients faced increasing demands for secure user verification. This was for handling service requests and password resets. Both their customers and the service provider's management were increasingly concerned about the possible bad outcomes of a data breach caused by weak verification at their help desk.

By using FastPass Identity Verification Manager (IVM), the service provider found a solution that connects smoothly with their ITSM system. This lets them manage multiple client accounts without needing to switch between different systems. This organized process ensures consistent and secure service, no matter which customer contacts their service desk.

Also, the service provider can now give clients real-time reports on compliance. These reports include a detailed log of all verification activities and proof that new passwords were given out securely. Importantly, this move to a more secure verification process has happened without hurting productivity.

Closing: Your Next Step Towards a Secure Help Desk

You've seen the risks. You've understood the principles. Now, the question isn't if your IT help desk needs stronger protection, but how you'll build it effectively.

Dealing with the complex parts of secure user verification for a large organization can feel overwhelming. This is true whether you're thinking about building a custom solution or using a specialized one. This guide aims to make the process clearer, point out key requirements, and offer a straightforward path forward with FastPassCorp's Identity Verification Manager.

Don't let the threat of social engineering attacks on your help desk become your organization's next big news story. We invite you to take the next crucial step. Let's discuss your specific situation, challenges, and goals in detail. Our experts are ready to help you explore how a custom-fit verification strategy can change your IT help desk from a potential weak spot into a strong defense.

Reach out today to schedule a personalized conversation and find out how to make your IT help desk absolutely secure.

You can also download the full IVM guide in pdf format here.

Appendix 1: List of Requirements for User Verification Solution

For a large organization considering a software solution for secure user verification at their IT help desk, the following prioritized functional and technical requirements are crucial:

Prioritization Levels:

  • Must-Have (Critical): Essential for the system's core function and security. Without this, the solution is not viable.
  • Should-Have (High Priority): Important for efficiency, user experience, and robust security, offering significant benefits.
  • Could-Have (Medium Priority): Desirable features that enhance the system but are not strictly necessary for initial deployment.
  • Won't-Have (Low Priority / Future Consideration): Features that are out of scope for the current phase or offer minimal value compared to their cost/effort.

I. Functional Requirements

Must-Have (Critical):

  1. Multi-Factor Authentication (MFA) Support:
    • Support for various strong MFA methods (e.g., authenticator apps, FIDO2 security keys, biometrics like fingerprint/Face ID, corporate issued tokens/cards).
    • Ability to enforce phishing-resistant MFA (e.g., FIDO2).
    • Support for traditional MFA methods like SMS/Email OTP (with clear risk assessment and mitigation strategies for large-scale deployment).
  2. Identity Verification Methods:
    • Knowledge-Based Authentication (KBA) leveraging secure, non-public employee data: Ability to generate dynamic, contextual questions from various trusted data sources (e.g., HR systems, Active Directory attributes, internal corporate data). This should go beyond easily discoverable public information.
    • Employee ID/Badge Number Verification: Securely verify employee IDs or badge numbers.
    • Call Contextual Data Verification: Utilize data like calling line identification (CLI) for initial context (though not as a sole verification method).
  3. Integration with Existing IT Systems:
    • Active Directory (AD) / Azure Active Directory (Entra ID) Integration: Seamless synchronization of user identities and attributes for verification.
    • IT Service Management (ITSM) Platform Integration: Direct, embeddable integration with major ITSM platforms (e.g., ServiceNow, Zendesk) to streamline help desk workflows and allow agents to initiate verification within their existing tools.
    • Human Resources (HR) System Integration: For accessing employee information for KBA and identity verification.
  1. Role-Based Access Control (RBAC) for Help Desk Agents:
    • Granular control over what information and actions help desk agents can perform based on their roles (e.g., different tiers of support, supervisors).
    • Ability to remove privileged access from service desk supporters when not performing verification.
  2. Audit Logging and Reporting:
    • Comprehensive, immutable logs of all verification attempts, successes, failures, and agent actions.
    • Ability to generate detailed reports for compliance, security audits, and performance analysis.
  3. Secure Password Reset/Account Unlock:
    • Facilitate secure password resets and account unlocks across various integrated systems (e.g., AD, SAP, Oracle, Web-services) only after successful identity verification.

Should-Have (High Priority):

  1. Adaptive Authentication/Risk-Based Authentication:
    • Ability to dynamically adjust verification strength based on contextual factors (e.g., user's location, device, time of day, previous suspicious activity, sensitivity of requested action).
    • Scoring system for verification confidence.
  2. Agent Workflow Streamlining:
    • Intuitive and efficient user interface for help desk agents to perform verifications quickly and accurately.
    • Automated workflows for common verification scenarios.
  3. User Self-Service Options (Controlled):
    • For less sensitive operations (e.g., self-service password reset with strong MFA) to offload basic requests from the help desk. The help desk verification solution should integrate with or manage these options.
  4. Customizable Verification Workflows:
    • Define different verification processes for different user groups, levels of risk, or types of requests.
  5. Compliance Reporting Capabilities:
    • Built-in reports and dashboards to demonstrate compliance with relevant regulations (e.g., GDPR, HIPAA, PCI DSS if applicable, internal security policies).
  6. Integration with Security Information and Event Management (SIEM) Systems:
    • Push verification logs and alerts to central SIEM for broader security monitoring and incident response.

Could-Have (Medium Priority):

  1. AI/ML-Powered Fraud Detection:
    • Leverage AI/ML to detect anomalies and potential fraud during verification attempts.
  2. Biometric Verification (Mobile/Desktop Integration):
    • If applicable, direct integration with mobile device biometrics (Face ID, fingerprint) for user verification during calls.
  3. Voice Biometrics:
    • Passive voice recognition for identity verification, especially for repeat callers (consider privacy and accuracy trade-offs for large organizations).
  4. Peer Verification/Manager Approval Workflows:
    • Allow for secondary verification by a manager or trusted peer for high-risk operations.
  5. Offline Verification Capabilities (Limited):
    • For scenarios where agents might need to verify users without immediate access to central systems (with strict controls and audit trails).

II. Technical Requirements

Must-Have (Critical):

  1. Scalability:
    • Ability to handle a large volume of concurrent verification requests and users - characteristic of a large organization.
    • Support for geographical distribution and high availability.
  2. Security Standards & Certifications:
    • Compliance with industry-recognized security standards (e.g., ISO 27001, SOC 2 Type II, FIPS 140-2 for cryptographic modules).
    • End-to-end encryption for all data in transit and at rest.
    • Protection against common web vulnerabilities (OWASP Top 10).
  3. Reliability and Uptime:
    • High availability (e.g., 99.9% uptime or higher) with disaster recovery and business continuity capabilities.
    • Robust error handling and logging.
  4. Performance:
    • Low latency for verification processes to minimize help desk call times.
    • Efficient resource utilization.
  5. API Accessibility and Documentation:
    • Well-documented and robust APIs (RESTful preferred) for seamless integration with existing and future enterprise systems.
    • Availability of SDKs for common development environments.
  6. Data Privacy and Compliance:
    • Adherence to global data privacy regulations (e.g., GDPR, CCPA, local data residency requirements).
    • Strong data anonymization/pseudonymization capabilities where applicable.
  7. Deployment Flexibility:
    • Support for on-premise, cloud-based (SaaS), or hybrid deployment models to align with organizational IT strategy.

Should-Have (High Priority):

  1. Maintainability and Support:
    • Clear documentation, easy configuration, and regular updates/patches from the vendor.
    • Responsive and knowledgeable technical support with SLAs appropriate for enterprise environments.
  2. Monitoring and Alerting:
    • Built-in monitoring tools and integration with enterprise monitoring solutions to track system health, performance, and security events.
    • Configurable alerts for suspicious activities or system failures.
  3. Customizability and Extensibility:
    • Ability to customize UI/UX for agents and potentially users (for self-service).
    • Flexible configuration options for various verification policies and workflows.
  4. Vendor Lock-in Mitigation:
    • Consider data export capabilities and standards-based interfaces to reduce reliance on a single vendor.

Could-Have (Medium Priority):

  1. Containerization Support (e.g., Docker, Kubernetes):
    • For easier deployment, scaling, and management in cloud-native environments.
  2. Infrastructure as Code (IaC) Compatibility:
    • Support for automated provisioning and management of the solution's infrastructure.
  3. Centralized Management Console:
    • A single pane of glass for administrators to manage users, configurations, reports, and integrations.

 

III. Prioritization Justification for Large Organizations:

  • Security First: For large organizations, the financial and reputational impact of a security breach is immense. Therefore, strong MFA, robust identity verification, and comprehensive audit trails are non-negotiable "must-haves."
  • Integration is Key: Large organizations have complex IT ecosystems. A solution that doesn't integrate seamlessly with existing AD/Entra ID and ITSM platforms will create more problems than they solve, leading to inefficiencies and potential security gaps.
  • Scalability and Reliability: Downtime or performance issues at the help desk can halt productivity for thousands of employees. The solution must be able to handle the enterprise scale and maintain high availability.
  • Operational Efficiency: While security is paramount, the solution must also enable the help desk to operate efficiently. This means intuitive agent workflows and the ability to offload basic tasks through controlled self-service.
  • Compliance: Large organizations face significant regulatory scrutiny. The ability to demonstrate compliance through audit logs and reporting is critical.
  • Future-Proofing: While not "must-have" for initial deployment, considering adaptive authentication, AI/ML, and flexible deployment models ensures the solution can evolve with emerging threats and organizational needs.

Appendix 2: Solution Scripting with ServiceNow

Building a secure user verification solution for a large organization's IT help desk primarily using ServiceNow scripting would be a complex undertaking with varying degrees of success against the previously defined requirements.

Here's a breakdown of how it would fare, point by point:

I. Functional Requirements

Must-Have (Critical):

  1. Multi-Factor Authentication (MFA) Support:
    • ServiceNow's Native Capabilities: ServiceNow offers native MFA support for platform logins, including various methods like TOTP (authenticator apps), email, and SMS. It also supports integration with external identity providers (IdPs) like Okta, Azure AD, PingFederate for more advanced MFA and FIDO2.
    • Scripting Impact: While ServiceNow itself handles much of this, custom scripting would be required to integrate these MFA mechanisms directly into the help desk verification workflow for the user calling in, rather than just for agent login. This means scripting to trigger an MFA challenge, receive the response, and validate it.
    • Verdict: Achievable but requires significant custom development. While ServiceNow provides the building blocks, adapting them for live help desk verification during a call would be a substantial scripting effort. Phishing-resistant MFA (FIDO2) would likely require deep integration with a specialized external identity solution, which ServiceNow can integrate with, but not fully script itself.
  2. Identity Verification Methods:
    • Knowledge-Based Authentication (KBA) leveraging secure, non-public employee data:
      • ServiceNow's Capabilities: ServiceNow can store and access various data. Scripting would be essential to dynamically pull data from linked HR profiles, AD, or other records within ServiceNow, generate questions, and validate answers.
      • Scripting Impact: High reliance on scripting to design the KBA logic, question generation, and validation against secure data sources. The security of this data and the KBA logic itself would be paramount.
    • Employee ID/Badge Number Verification: Straightforward to implement with scripting against existing user records in ServiceNow.
    • Call Contextual Data Verification: Possible with scripting if call metadata (CLI) can be passed to ServiceNow via integration.
    • Verdict: Achievable, heavily reliant on custom scripting. The complexity lies in securely accessing and intelligently using diverse data sources for KBA.
  3. Integration with Existing IT Systems:
    • Active Directory (AD) / Azure Active Directory (Entra ID) Integration: ServiceNow has strong native integration capabilities with AD/Azure AD for user provisioning and data synchronization.
    • IT Service Management (ITSM) Platform Integration: This is ServiceNow's core! The solution would be built within the ITSM platform, naturally providing seamless integration.
    • Human Resources (HR) System Integration: ServiceNow offers various integration methods (Integration Hub, REST APIs, JDBC, etc.) to connect with HR systems.
    • Scripting Impact: Scripting would be crucial for orchestrating data flows, transforming data, and triggering actions between ServiceNow and these external systems. While native connectors exist, custom logic for specific verification scenarios would still require scripting.
    • Verdict: Strongly Achievable with ServiceNow's core strengths, but scripting is still required for custom verification logic.
  4. Role-Based Access Control (RBAC) for Help Desk Agents:
    • ServiceNow's Native Capabilities: ServiceNow has robust RBAC capabilities. You can define custom roles and ACLs (Access Control Lists) very granularly.
    • Scripting Impact: Scripting would be used to enforce these ACLs and implement UI policies or business rules that dynamically show/hide information or actions based on the agent's role and the verification status.
    • Verdict: Highly Achievable with native features, enhanced by scripting.
  5. Audit Logging and Reporting:
    • ServiceNow's Native Capabilities: ServiceNow provides comprehensive auditing capabilities for record changes and system events. It also has powerful reporting features.
    • Scripting Impact: Custom scripting is needed to ensure that every step of the verification process, including specific KBA questions asked and answers provided, MFA challenge outcomes, and agent decisions, is meticulously logged. Custom reports could then be built to extract and present this data.
    • Verdict: Highly Achievable with native features but requires diligent scripting for granular audit trails specific to verification steps.
  6. Secure Password Reset/Account Unlock:
    • ServiceNow's Native Capabilities: ServiceNow ITSM often includes self-service password reset capabilities. Integration with AD/other systems for password resets is also common.
    • Scripting Impact: The core challenge here is ensuring the password reset/account unlock only happens after successful verification. Scripting would be critical to enforce this pre-condition and trigger the reset/unlock action securely via integrations.
    • Verdict: Achievable, relies heavily on scripting to enforce the secure workflow.

Should-Have (High Priority):

  1. Adaptive Authentication/Risk-Based Authentication:
    • ServiceNow's Capabilities: ServiceNow's platform does have some risk and compliance management capabilities. However, native adaptive authentication for help desk verification purposes is not a direct out-of-the-box feature in the way dedicated identity platforms offer it.
    • Scripting Impact: This would be a very complex and extensive scripting effort. It would involve:
      • Collecting contextual data (caller ID, historical call data, request type, sensitivity of action).
      • Developing a custom risk scoring engine using scripting.
      • Dynamically adjusting verification methods based on the score.
      • This might also require integration with external threat intelligence or behavioral analytics platforms, adding further complexity.
    • Verdict: Challenging, requires highly advanced scripting and potentially external tools. A bespoke, script-based solution might struggle to match the sophistication of dedicated adaptive authentication engines.
  2. Agent Workflow Streamlining:
    • ServiceNow's Capabilities: ServiceNow is designed for workflow automation and has a flexible UI.
    • Scripting Impact: Custom UI pages, forms, and client scripts would be used to create the optimal agent experience, guiding them through verification steps and presenting information clearly.
    • Verdict: Highly Achievable with scripting and UI configuration.
  3. User Self-Service Options (Controlled):
    • ServiceNow's Capabilities: ServiceNow excels at self-service portals.
    • Scripting Impact: Scripting would be used to enable and secure self-service options, integrating them with the core verification logic.
    • Verdict: Highly Achievable.
  4. Customizable Verification Workflows:
    • ServiceNow's Capabilities: ServiceNow's Flow Designer and Workflow engine, combined with scripting, provide immense flexibility for workflow customization.
    • Scripting Impact: Scripting would be integral to defining different paths based on conditions (e.g., VIP user, specific request type).
    • Verdict: Highly Achievable.
  5. Compliance Reporting Capabilities:
    • ServiceNow's Native Capabilities: Strong reporting and dashboarding tools.
    • Scripting Impact: As with general auditing, scripting ensures the right data is captured for compliance. Custom reports would then display this data in a compliance-friendly format.
    • Verdict: Achievable, depends on diligent data capture via scripting.
  6. Integration with Security Information and Event Management (SIEM) Systems:
    • ServiceNow's Native Capabilities: ServiceNow can integrate with SIEMs (e.g., Splunk, Microsoft Sentinel) via its Integration Hub or direct API calls.
    • Scripting Impact: Scripting would be used to format and send verification logs to the SIEM in the required format.
    • Verdict: Achievable with scripting and Integration Hub.

Could-Have (Medium Priority):

  1. AI/ML-Powered Fraud Detection:
    • ServiceNow's Capabilities: ServiceNow has invested in AI/ML capabilities (e.g., Predictive Intelligence, Virtual Agent).
    • Scripting Impact: Implementing sophisticated fraud detection purely through scripting would be extremely difficult and likely insufficient for a large organization. It would require significant data science expertise to build and train models within ServiceNow, and performance could be a concern. More realistically, this would involve integrating with a specialized external fraud detection service, which then involves scripting for that integration.
    • Verdict: Very Challenging to achieve purely with scripting, likely requiring external specialized services.
  2. Biometric Verification (Mobile/Desktop Integration):
    • ServiceNow's Capabilities: ServiceNow's mobile apps can leverage device biometrics for logging into the ServiceNow app itself.
    • Scripting Impact: Integrating real-time biometric verification during a help desk call (e.g., prompting the user on their phone to verify their identity via Face ID) would be extremely difficult, if not impossible, with standard ServiceNow scripting. It would require deep integration with a mobile SDK or specialized biometric verification provider, well beyond typical ServiceNow development.
    • Verdict: Extremely Challenging/Unlikely with standard ServiceNow scripting.
  3. Voice Biometrics:
    • ServiceNow's Capabilities: No native voice biometrics.
    • Scripting Impact: Would require deep and complex integration with a third-party voice biometrics solution. This is not something you'd build with ServiceNow scripting from scratch.
    • Verdict: Unachievable with scripting alone; requires specialized third-party integration.
  4. Peer Verification/Manager Approval Workflows:
    • ServiceNow's Capabilities: ServiceNow workflow engine and approvals are very robust.
    • Scripting Impact: Scripting would easily support these approval flows.
    • Verdict: Highly Achievable.
  5. Offline Verification Capabilities (Limited):
    • ServiceNow's Capabilities: ServiceNow is primarily an online platform. Limited offline capabilities exist for specific mobile scenarios but are generally not for complex verification flows.
    • Scripting Impact: Very difficult to achieve securely and robustly for help desk verification, as it inherently relies on real-time data access. Would likely involve highly complex data synchronization and security considerations.
    • Verdict: Highly Challenging/Unlikely for secure verification.

II. Technical Requirements

Must-Have (Critical):

  1. Scalability:
    • ServiceNow's Capabilities: ServiceNow is a highly scalable platform designed for large enterprises.
    • Scripting Impact: While the platform scales, poorly written or inefficient scripts can severely impact performance and scalability. Extensive custom scripting, especially with inefficient GlideRecord queries or client-side heavy operations, can lead to performance bottlenecks.
    • Verdict: Achievable, but highly dependent on excellent scripting practices to avoid performance degradation at scale.
  2. Security Standards & Certifications:
    • ServiceNow's Capabilities: ServiceNow as a platform holds numerous security certifications (ISO 27001, SOC 2, etc.) and adheres to robust security practices.
    • Scripting Impact: While the platform is secure, custom scripting introduces new attack vectors. Developers must adhere to secure coding practices (e.g., input validation, preventing injection attacks, secure handling of sensitive data) to maintain the overall security posture. Vulnerabilities in custom scripts could compromise the entire solution.
    • Verdict: Achievable, but requires strict adherence to secure development guidelines and regular security audits of custom code.
  3. Reliability and Uptime:
    • ServiceNow's Capabilities: ServiceNow offers high availability and disaster recovery.
    • Scripting Impact: Custom scripts that are buggy or inefficient can cause system instability, errors, and affect the reliability of the verification process.
    • Verdict: Achievable, but contingent on rigorous testing and high-quality scripting.
  4. Performance:
    • ServiceNow's Capabilities: The platform is generally performant.
    • Scripting Impact: As noted under scalability, performance is a major risk with extensive custom scripting. Unoptimized queries, complex loops, or too much client-side processing can lead to slow response times for agents, hindering efficiency.
    • Verdict: Challenging, requires significant focus on performance optimization in scripting.
  5. API Accessibility and Documentation:
    • ServiceNow's Capabilities: ServiceNow offers robust APIs (REST, SOAP) and its Integration Hub for external integrations.
    • Scripting Impact: Scripting is the primary way to consume and interact with these APIs within ServiceNow. Documenting custom scripts and their intended API interactions is crucial.
    • Verdict: Achievable, scripting is the enabler.
  6. Data Privacy and Compliance:
    • ServiceNow's Capabilities: ServiceNow provides features to support data privacy (e.g., encryption, data residency options).
    • Scripting Impact: Developers must ensure that custom scripts handle sensitive verification data (e.g., KBA answers) in a compliant manner, respecting data retention, anonymization, and access controls. Mistakes in scripting could lead to privacy violations.
    • Verdict: Achievable, but demands careful design and secure coding practices for data handling within scripts.
  7. Deployment Flexibility:
    • ServiceNow's Capabilities: ServiceNow is primarily a SaaS platform.
    • Scripting Impact: The custom scripts are deployed within ServiceNow instance, adhering to its cloud-based model.
    • Verdict: Achievable (within ServiceNow's SaaS model).

Should-Have (High Priority):

  1. Maintainability and Support:
    • ServiceNow's Capabilities: The platform itself is supported by ServiceNow.
    • Scripting Impact: This is a major challenge for highly scripted solutions. Custom code requires internal expertise to maintain, debug, and update. Reliance on a few developers, lack of clear documentation, and "spaghetti code" can make the solution difficult and expensive to support in the long run. Future platform upgrades can also break custom scripts, requiring ongoing effort.
    • Verdict: Challenging to maintain long-term due to reliance on internal expertise and potential technical debt.
  2. Monitoring and Alerting:
    • ServiceNow's Capabilities: ServiceNow has system monitoring and alerting.
    • Scripting Impact: Custom scripts should include robust error logging and the ability to trigger alerts for failures or suspicious activities to leverage ServiceNow's monitoring features.
    • Verdict: Achievable, requires proactive design in scripting.
  3. Customizability and Extensibility:
    • ServiceNow's Capabilities: ServiceNow is highly customizable through its platform features and scripting.
    • Scripting Impact: This is a strength, as scripting allows for almost any custom workflow or UI.
    • Verdict: Highly Achievable.
  4. Vendor Lock-in Mitigation:
    • ServiceNow's Capabilities: As a proprietary platform, there is inherent vendor lock-in.
    • Scripting Impact: Custom scripts are tied directly to the ServiceNow platform's APIs and data model, increasing the lock-in. Extracting logic or data to another platform would be a significant re-development effort.
    • Verdict: Low, scripting increases lock-in.

Could-Have (Medium Priority):

  1. Containerization Support (e.g., Docker, Kubernetes):
    • ServiceNow's Capabilities: Not applicable as ServiceNow is a SaaS platform. You don't manage its underlying infrastructure in containers.
    • Scripting Impact: N/A.
    • Verdict: Not applicable.
  2. Infrastructure as Code (IaC) Compatibility:
    • ServiceNow's Capabilities: Limited for platform configuration itself.
    • Scripting Impact: Custom application development within ServiceNow generally doesn't fit the traditional IaC model. While you can manage update sets programmatically, it's not the same as provisioning infrastructure with Terraform or Ansible.
    • Verdict: Limited applicability within the ServiceNow model.
  3. Centralized Management Console:
    • ServiceNow's Capabilities: ServiceNow is a centralized management console for its own applications.
    • Scripting Impact: Custom scripts contribute to the functionality managed within this console.
    • Verdict: Achievable, as ServiceNow provides this.

Summary and Key Considerations for a Script-Heavy ServiceNow Solution:

Pros:

  • Leverages Existing Investment: If the organization already heavily uses ServiceNow for ITSM, building within it can save on new platform costs and integrate naturally into existing agent workflows.
  • High Customization: Scripting in ServiceNow offers immense flexibility to tailor the solution to very specific needs and complex workflows.
  • Rapid Development (for some parts): For developers experienced in ServiceNow, initial setting up of some basic verification flows might be quicker than a completely new application.
  • Native ITSM Integration: Seamlessly integrates with existing incident, request, and user management processes.

Cons and Major Risks (Especially for Large Organizations):

  • Security Complexity for Custom Code: Every line of custom script is a potential vulnerability. Ensuring secure coding practices, regular code reviews, and penetration testing of the custom solution is paramount and resource-intensive.
  • Performance at Scale: Unoptimized scripting can severely degrade platform performance, impacting the help desk's efficiency. Large organizations demand extremely low latency.
  • Maintainability and Technical Debt: A heavily scripted solution can become a "black box" if not meticulously documented and maintained. Upgrades to ServiceNow's core platform can break custom scripts, leading to significant re-work.
  • Lack of Specialized Security Features: Features like sophisticated adaptive authentication, advanced fraud detection, or real-time biometric integration are difficult (or impossible) to build from scratch with scripting. Dedicated identity and access management (IAM) solutions excel here.
  • Development Expertise: Requires highly skilled ServiceNow developers with a strong understanding of security, performance optimization, and integration patterns.
  • Limited "Out-of-the-Box" Security Assurance: Unlike a purpose-built identity verification product, a script-heavy ServiceNow solution means the organization itself is largely responsible for the security efficacy and certification of the verification logic.
  • Auditability of Custom Logic: While ServiceNow logs, ensuring every decision point and data interaction in a complex custom script is adequately logged for audit purposes requires meticulous development.

 

Recommendation:

For a large organization, a purely script-based ServiceNow solution for secure user verification at the IT help desk is risky and generally not recommended as the primary approach for high-assurance identity verification.

While ServiceNow can be the platform where the help desk operates, the core identity verification should ideally leverage:

  1. ServiceNow's native platform security features: For MFA on agent logins, RBAC.
  2. Integration with dedicated, enterprise-grade Identity and Access Management (IAM) solutions: These solutions specialize in secure MFA, adaptive authentication, identity proofing, and integration with various identity sources (AD, HR systems). ServiceNow can then act as the orchestrator, calling these external services via its APIs (potentially using Integration Hub or custom script integrations).

This hybrid approach leverages ServiceNow's workflow and ITSM strengths while offloading the complex and highly sensitive identity verification logic to purpose-built security platforms that are designed, tested, and certified for that function at enterprise scale. Custom scripting in ServiceNow should then focus on integrating these robust external services and tailoring the help desk workflow around them.

Appendix 3: FastPass IVM Requirements Fulfillment

FastPassCorp's Identity Verification Manager (IVM) is specifically designed to address the secure user verification challenges at IT help desks, contrasting sharply with a generic ServiceNow scripting approach. It aims to provide a purpose-built solution that integrates with ITSM platforms like ServiceNow.

Here's an overview of how FastPass IVM fares against the prioritized functional and technical requirements for a large organization:

I.Functional Requirements

  1. Must-Have (Critical):
    1. Multi-Factor Authentication (MFA) Support:
      • FastPass IVM's Capabilities: This is a core strength. IVM supports a wide range of strong MFA methods including authenticator apps (Okta, Duo, Google Authenticator, Microsoft Authenticator), TOTP, RSA tokens, SMS/Email PINs, and can leverage corporate tokens/cards. It can also integrate with existing IdPs for MFA. It explicitly focuses on using these methods for help desk verification, not just login to the platform itself.
      • Verdict: Highly Achievable. FastPass IVM is built to manage and orchestrate various MFA methods specifically for help desk identity verification.
    2. Identity Verification Methods:
      • Knowledge-Based Authentication (KBA) leveraging secure, non-public employee data: FastPass IVM utilizes dynamic and contextual data from various sources (HR systems, Active Directory, internal corporate data) to generate questions. It's designed to go beyond easily discoverable public information. It also mentions collecting user data during SSPR enrollment for reuse in IVM.
      • Employee ID/Badge Number Verification: Supported.
      • Call Contextual Data Verification: IVM explicitly uses contextual data like user location, device presence (usual PC), time of day, IP address, and recent activity patterns to build an initial score.
      • Verdict: Highly Achievable. This is a key differentiator of IVM, providing robust, dynamic, and contextual verification methods.
    3. Integration with Existing IT Systems:
      • Active Directory (AD) / Azure Active Directory (Entra ID) Integration: FastPass IVM integrates with both for user data and management.
      • IT Service Management (ITSM) Platform Integration: FastPass IVM has a certified integration with ServiceNow, available on the ServiceNow Store. It's designed to work seamlessly within the ITSM workflow, allowing agents to initiate verification directly from their tickets. It can also integrate with most other ITSM tools like BMC and TOPdesk.
      • Human Resources (HR) System Integration: IVM can pull data from multiple sources, including HR systems, for KBA and identity verification.
      • Verdict: Highly Achievable. Strong native integrations with critical enterprise systems, particularly ServiceNow.
    4. Role-Based Access Control (RBAC) for Help Desk Agents:
      • FastPass IVM's Capabilities: IVM manages the verification process, guiding agents through steps and only revealing sensitive information (like passwords for reset) after successful verification. It centralizes privileged rights for password resets within IVM, rather than requiring agents to have standing privileged access. This inherently enhances RBAC by controlling what agents can do and see during verification.
      • Verdict: Highly Achievable. The solution's design inherently enforces secure RBAC.
    5. Audit Logging and Reporting:
      • FastPass IVM's Capabilities: FastPass IVM automatically records every individual step of the verification process, including passed/failed items and their scores. This provides detailed logs for compliance, audits, and forensic investigations. It explicitly states that "all information related to the verification will be logged for monitoring and analysis."
      • Verdict: Highly Achievable. Comprehensive and automated logging is a stated feature.
    6. Secure Password Reset/Account Unlock:
      • FastPass IVM's Capabilities: FastPass IVM is part of a broader solution often paired with FastPass SSPR. IVM's primary function is to securely verify identity before a password reset, TAP reset or account unlock can occur. It aims to ensure that passwords are only issued once all verification criteria are met and can release a new password to be passed to the user.
      • Verdict: Highly Achievable. This is a core use case that IVM is designed to secure.

     

  2. Should-Have (High Priority):
    1. Adaptive Authentication/Risk-Based Authentication:
      • FastPass IVM's Capabilities: This is a major strength. IVM uses dynamic and contextual data (e.g., user's usual device, location, time of day, recent activity, account status) to assess risk and build a "score" for the verification process. It can dynamically adapt the verification workflow and required proofing levels based on this score, user group, and the sensitivity of the operation.
      • Verdict: Highly Achievable. This is a key differentiating feature that enhances security and user experience.
    2. Agent Workflow Streamlining:
      • FastPass IVM's Capabilities: IVM is designed to guide agents through a managed and forced workflow, removing human error and emotion. Its seamless integration with ITSM tools (like ServiceNow) means agents stay within their familiar environment. It aims to speed up verification processes by automating steps.
      • Verdict: Highly Achievable. A core design principle of IVM.
    3. User Self-Service Options (Controlled):
      • FastPass IVM's Capabilities: FastPass also offers Self-Service Password Reset (SSPR). IVM can work in conjunction with SSPR, allowing users to self-serve for less sensitive operations, effectively offloading the help desk while maintaining a secure framework.
      • Verdict: Highly Achievable, as part of the FastPass suite.
    4. Customizable Verification Workflows:
      • FastPass IVM's Capabilities: IVM provides highly customizable proofing levels, dynamic scoring scenarios, and templates (simple, average, heavily secure) that can be altered or expanded upon. Different verification processes can be defined for different user groups or operations.
      • Verdict: Highly Achievable.
    5. Compliance Reporting Capabilities:
      • FastPass IVM's Capabilities: Provides detailed, automatic logs of every verification step, which is crucial for demonstrating compliance with security policies and audit trails.
      • Verdict: Highly Achievable.
    6. Integration with Security Information and Event Management (SIEM) Systems:
      • FastPass IVM's Capabilities: While not explicitly detailed in every public feature list, a mature enterprise security product like IVM would typically offer logging and API capabilities to integrate with SIEM systems for broader security monitoring. The strong audit logging suggests this capability.
      • Verdict: Likely Achievable (via standard logging/API integration).

     

  3. Could-Have (Medium Priority):
    1. AI/ML-Powered Fraud Detection:
      • FastPass IVM's Capabilities: While it uses dynamic and contextual data for risk scoring, the extent of "AI/ML-powered" in the data science sense is not explicitly detailed beyond rule-based adaptive authentication. It does warn operators of possible fraud calls based on its analysis. All aborted or rejected password reset transaction can result in notification being forwarded to users, managers SIEM systems and others.
      • Verdict: Likely achievable. Its risk-based scoring system provides a foundation together with the build-in notification service.
    2. Biometric Verification (Mobile/Desktop Integration):
      • FastPass IVM's Capabilities: Mentions supporting "biometric" as a strong type of proofing. This likely refers to leveraging MFA providers that use biometrics (e.g., Okta/Duo push with device biometrics) rather than direct, raw biometric capture and analysis by IVM itself.
      • Verdict: Achievable through integration with MFA providers.
    3. Voice Biometrics:
      • FastPass IVM's Capabilities: Not explicitly mentioned as a native feature. Would likely require integration with a specialized third-party voice biometrics solution.
      • Verdict: Unlikely natively, would require integration.
    4. Peer Verification/Manager Approval Workflows:
      • FastPass IVM's Capabilities: Explicitly supports "Manager/Colleague Approval" as a verification option, including the ability to automatically email a manager and reassign tickets based on escalation.
      • Verdict: Highly Achievable.
    5. Offline Verification Capabilities (Limited):
      • FastPass IVM's Capabilities: Not a core focus for an online verification system.
      • Verdict: Unlikely/Not applicable.

     

II.Technical Requirements

  1. Must-Have (Critical):
    1. Scalability:
      • FastPass IVM's Capabilities: Designed for large enterprises, with claims of being able to handle current volume and scale for future growth. Available as both cloud and on-premises solutions, offering deployment flexibility that supports scalability. A multi-tenant version aimed at Managed Service Providers is available too
      • Verdict: Highly Achievable.
    2. Security Standards & Certifications:
      • FastPass IVM's Capabilities: Explicitly mentions being "Cyber Essentials Plus certified (for cloud operations)" and "FIPS 140-2 compliant (from version 4.0 onwards, using 256-bit AES encryption and PBKDF for hashing)." It states that FastPass is annually penetration tested by external certified organizations using PCI/OWASP standards. Data in transit is protected via SSL/TLS.
      • Verdict: Highly Achievable. Strong focus on established security standards.
    3. Reliability and Uptime:
      • FastPass IVM's Capabilities: As a commercial, purpose-built solution for enterprises, high availability and reliability are expected. The certification for ServiceNow Store also implies a certain level of robustness.
      • Verdict: Highly Achievable.
    4. Performance:
      • FastPass IVM's Capabilities: Claims to make verification processes "over 50% faster than traditional methods" due to automation and dynamic verification, indicating a focus on performance.
      • Verdict: Highly Achievable.
    5. API Accessibility and Documentation:
      • FastPass IVM's Capabilities: While not extensively detailed, its deep integration with ITSM platforms and other systems implies robust APIs. For a certified ServiceNow integration, comprehensive APIs are a necessity.
      • Verdict: Achievable (expected for enterprise integration).
    6. Data Privacy and Compliance:
      • FastPass IVM's Capabilities: Emphasizes protecting sensitive information and user identities, aligning with data privacy concerns. It states that "no personal data is passed, just scores" to the ITSM ticket, indicating a focus on minimizing sensitive data exposure in logs. It also mentions adherence to GDPR principles in its marketing.
      • Verdict: Highly Achievable.
    7. Deployment Flexibility:
      • FastPass IVM's Capabilities: Available as both a cloud solution, as a multi-tenant version and on-premises deployment, offering flexibility to suit organizational IT strategy and data residency requirements.
      • Verdict: Highly Achievable.

     

  2. Should-Have (High Priority):
    1. Maintainability and Support:
      • FastPass IVM's Capabilities: As a commercial product, it comes with vendor support, regular updates, and maintenance. This is a significant advantage over a custom-scripted solution.
      • Verdict: Highly Achievable.
    2. Monitoring and Alerting:
      • FastPass IVM's Capabilities: Automatic logging supports monitoring. It explicitly states it can "alert the agent" to suspicious activity.
      • Verdict: Highly Achievable.
    3. Customizability and Extensibility:
      • FastPass IVM's Capabilities: Highly configurable with customizable proofing levels, rules, questions, and workflows.
      • Verdict: Highly Achievable.
    4. Vendor Lock-in Mitigation:
      • FastPass IVM's Capabilities: While it's a proprietary product, its strong API and integration capabilities (especially with major ITSM platforms) offer some mitigation. Data is logged and accessible.
      • Verdict: Medium (inherent in a proprietary product, but integrations help).

     

  3. Could-Have (Medium Priority):
    1. Containerization Support (e.g., Docker, Kubernetes):
      • FastPass IVM's Capabilities: If deployed on-premises, it would likely support standard enterprise deployment models, which may include containerization, but this isn't a primary feature highlight for a solution that sits on top of existing infrastructure.
      • Verdict: Likely configurable if on-premise.
    2. Infrastructure as Code (IaC) Compatibility:
      • FastPass IVM's Capabilities: Not a direct feature of the application itself, but its deployment processes might be compatible with IaC tools if deployed on-premises.
      • Verdict: Indirectly compatible for on-premise deployment.
    3. Centralized Management Console:
      • FastPass IVM's Capabilities: As a dedicated solution, it would certainly provide its own centralized administration console for managing verification policies, users, and reports.
      • Verdict: Highly Achievable.

Conclusion for FastPassCorp IVM:

FastPassCorp's Identity Verification Manager (IVM) appears to be a highly suitable and recommended solution for a large organization seeking secure user verification at their IT help desk. It directly addresses the critical functional and technical requirements with purpose-built features, deep integrations (especially with ServiceNow), and a strong emphasis on security, automation, and compliance.

Key Advantages over ServiceNow Scripting:

  • Purpose-Built Security: IVM is designed from the ground up for help desk identity verification, incorporating advanced security features like adaptive authentication, strong MFA orchestration, and robust fraud prevention mechanisms that would be extremely difficult and risky to build and maintain purely through custom scripting in ServiceNow.
  • Reduced Risk and Technical Debt: As a commercial product, IVM comes with vendor support, regular updates, and pre-built security assurances. This significantly reduces the internal development burden, potential for technical debt, and security vulnerabilities associated with extensive custom scripting.
  • Faster Deployment & ROI: With pre-built integrations and customizable templates, IVM can likely be deployed much faster and deliver value quicker than a ground-up scripting project.
  • Specialized Expertise: IVM embodies specialized expertise in identity verification workflows, social engineering prevention, and compliance, which a generic ServiceNow scripting team may lack.
  • Maintainability & Upgrades: Being a product, IVM is designed to be maintained and compatible with platform upgrades, unlike custom scripts that can often break with new ServiceNow versions.

While a ServiceNow scripted solution offers ultimate flexibility, FastPass IVM provides a secure, efficient, and reliable "productized" approach that aligns much better with the demands of a large organization for a critical security function. It frees the organization from the significant ongoing burden of developing, maintaining, and securing a bespoke verification system, allowing them to leverage an off-the-shelf solution specifically designed for this complex challenge.

Contact FastPass image

Contact FastPassCorp to discuss solutions to your situation

Scroll to Top