Author Archives: Allen Rodriguez

ServiceNow ACL evaluation becomes confusing when administrators expect one matching rule to answer the whole authorization question. Access can depend on the secured object, operation, decision type, table and field rules, roles, data conditions, security attributes, scripts, and the user context in which the request runs. The practical skill is learning to trace that decision […]

ServiceNow platform engineering is the work of keeping an enterprise instance dependable while many teams build workflows, integrations, data models, security rules, analytics, and operational processes on top of the same platform. The difficult part is not learning one module. It is understanding how decisions in one layer change the behavior of the others: a […]

Password spraying is difficult to detect because the attacker deliberately avoids the noisy pattern that makes a conventional brute-force attack obvious. Instead of sending hundreds of guesses at one account, the same small set of weak passwords is tried across many accounts. The result is a broad, low-rate authentication pattern that can hide inside normal […]

A ServiceNow instance clone can make a non-production environment look much more like production, which is exactly why cloning is useful and why it is dangerous. The operation copies data and metadata from a source instance into a target. Without deliberate exclusions, preservers, cleanup actions, and post-clone validation, the target can inherit production-only settings while […]

ServiceNow update sets are deceptively simple: they group configuration changes so those changes can move between instances. The governance challenge begins when many developers, administrators, application scopes, releases, emergency fixes, and parallel projects use the same transport mechanism. An update set can be technically valid and still be operationally unsafe because its contents are incomplete, […]

Power over Ethernet changes a switch port from a data connection into a power-delivery circuit. That is convenient for access points, cameras, phones, sensors, badge readers, and other edge devices, but it also introduces an electrical planning problem: the switch can have enough physical ports for the design and still lack enough available power to […]

Service Graph Connectors solve a difficult CMDB problem: important infrastructure facts already exist in cloud platforms, endpoint tools, observability products, security systems, and other operational sources, but importing those facts without creating duplicates or conflicting ownership requires more than an API call. A connector has to preserve source identity, map external objects into the correct […]

Terraform state is the shared record that connects resource addresses in configuration to real infrastructure objects. When several engineers or automation jobs use the same state, concurrent writes become dangerous: two runs can calculate plans from similar starting data and then race to update both infrastructure and the state record. The current HashiCorp Terraform Associate […]

CMDB identification rules decide whether incoming information describes a configuration item that already exists or a new CI that should be created. That single decision controls one of the most expensive failure modes in configuration management: duplicate records that look individually plausible but split ownership, incidents, relationships, and automation across several representations of the same […]

ServiceNow Discovery needs credentials to log in to devices and infrastructure, but repeatedly trying every possible credential on every target is slow, noisy, and operationally risky. Credential affinity improves that behavior by remembering which credential successfully accessed a device so later discovery runs can try the known match first. Platform engineering must treat credential affinity […]

Reconciliation rules answer a question that appears only after identification succeeds: when several trusted sources describe the same CI, which source is allowed to change each attribute? Without that policy, the CMDB can become a competition between integrations where the latest write wins, values oscillate between sources, and nobody knows which field to trust. In […]

Terraform providers are independent software dependencies that translate Terraform operations into API calls for cloud platforms, SaaS products, Kubernetes, networking systems, and other services. Because providers evolve on their own release schedules, an unchanged Terraform configuration can initialize with a different provider release unless the team defines compatibility constraints and preserves the selected versions. The […]

Terraform engineering begins where a small configuration stops being a personal script and becomes shared infrastructure machinery. At that point, provider versions, state storage, locking, module boundaries, drift, imports, credentials, policy, and delivery pipelines all become part of the design. The hard problems are less about remembering HCL syntax and more about keeping changes predictable […]

NTLM relay is a credential-relay problem, not a password-cracking problem. An attacker who can influence where a Windows system authenticates may capture an NTLM authentication exchange and present it to another service that accepts the same form of authentication without sufficiently binding the exchange to the intended server or secure channel. The attacker does not […]

Kerberos attack paths are easiest to understand by following trust relationships rather than memorizing attack names. In an Active Directory environment, Kerberos uses tickets so users and services can authenticate without sending a password to every resource. That design is strong when identities, service accounts, delegation, time, name resolution, and domain controllers are well managed, […]