For many years in the past, one primary reason many enterprises were hesitant about cloud services usage was security. This also had driven an increasing demand for CASB adoption. However, suppose we look at the stats out of the recent surveys. In that case, most technology decision-makers and IT security professionals think that cloud-based systems are as secure as the on-premise systems. Surprisingly, there is an increase among security professionals thinking that the cloud can even be more secured than on-premise in the future. Considering various factors leading this fundamental change, we can see that most of this trust-building can be attributed to leading service providers’ efforts in the cloud spectrum like Salesforce in terms of securing customer data and offering stable security features.
Security threats for Salesforce
The first place you need to explore to know about Salesforce security is Salesforce’s Trust, a unique customer-facing website, which will give you a comprehensive overview of the security issues that the customers may face and the fixes for the same. This is where Salesforce users can find all updates on the latest malware, phishing attacks, and other security threats that the Salesforce users must be cautioned about. The website also provides necessary remediation steps to mitigate all such security risks.
For example, the most recently identified malware adverse affecting the Salesforce users are Vawtrak. It is a typical malware variant delivered by Pony through phishing emails. Vawtrak works by stealing Salesforce users’ login credentials and attempt unauthorized logins to steal the data on Salesforce accounts. Like much other malware targeting cloud services, Vawtrak also works not by leveraging the scope of any Salesforce vulnerability. Still, it resides on the user system and is trying to access various cloud services they are into by stealing the login credentials.
Salesforce security compliance
Salesforce propagates a shared responsibility model in terms of security and data privacy. In case of regulated confidential data like Protected Health Information or Personally Identifiable Information, Salesforce will take up a data processor’s role, which means Salesforce stays responsible for offering technical and physical security measures for the same. In contrast, the users are accountable for a data type, quality, integrity, and usage. Salesforce satisfies the compliance needs for many rigorous security standards and certifications as:
- ISO 27001/27018
- SOC 2 & 3
- Safe Harbor
- PCI-DSS
- FedRAMPetc
You can see that the Salesforce contracts consist of clauses that prohibit Salesforce as a provider from accessing any of their user accounts or releasing any customer data stored on any of the platforms. However, there are a few exceptions to this. While Salesforce performs any technical updates to fix the service outages or technical issues or are legally compelled to release the data under law enforcement.
Salesforce as a multi-tenant platform
Multi-tenancy means that Salesforce acts as a collection of many variants of computing resources by providing a wide range of services from different tenants. This can also raise some security concerns around customers accidentally accessing the data stored in other customers’ instances on Salesforce. This significant threat is solved by providing each company on Salesforce a unique identifier, which further gets associated with various sessions initiated by individual users in the enterprise.
Health Check on Salesforce
Another most useful and vital tool for the Salesforce administrator is the Health Check. This is a unique feature that allots a security score for various Salesforce settings based on the settings. It allows the administrators to understand the strength of configuration from a security viewpoint. This health check security score covers various aspects like:
- Length of the password. The recommendation for password length is 8 characters minimum.
- Number of attempts for invalid logins (recommendation is 3)
- Session timeout forced logout (this must be enabled as security best practice)
- Forced re-login on administrator logging in as a different user (enabling this too is recommended as security best practice)
Built-in security features on Salesforce
There are many ways for Salesforce admins to protect data security and tackle internal and external security threats. Here are some of the baseline approaches.
-
Auditing
Salesforce can keep track of all login attempts for a time of over six months. This includes a log of the IP address and location of login etc. You can also turn on the history tracking to gain easy visibility to any field value changes and details of the users who made these changes.
-
Two-factor authentication
Admins can turn on 2-factor authentication company-wide. Salesforce also allows creating custom IP restrictions, which will prevent unauthorized access from untrusted IP ranges. It is also possible to set the login restrictions based on timings or days. While accessing Salesforce using an API, the users must also add a security token to their password.
-
Object-level permissions
As FLOSUM points out, there are different layers of control offered by Salesforce over which the data records are visible to the users and made editable to the authorized ones. Administrators can also set organization-wide rules for sharing specific data sets and define the baseline level of access for each user.
-
Custom login flows
This is another brilliant access control feature on Salesforce. Suppose a user attempts to log in to Salesforce from a restricted IP or at restricted timings. In that case, admins may still let the users get access, but only after going through various authentication levels beyond the default 2-factor.
-
Role hierarchy
The organization-wide rules set by the admins can be further extended by setting role hierarchy. This mode will let the admins configure the user hierarchy to which level of data can be made visible or editable to different users. This does not control which fields are made available to the users, but rather controls which report records and dashboards are accessible.
-
Exceptions
When it comes to setting hierarchy and access control, some enterprises may require more flexibility beyond the default organization-wide rules. In such cases, admins can implement sharing rules to increase data access to those exceptional users further.
-
Field-level permission
The profiles set by admins will give them better control over access restrictions to various fields within an object or record. While creating a new field, admins can make it read-only or read/write or entirely hidden based on multiple profiles. Each user on Salesforce must be custom set to be associated with anyone of these user profiles.
-
Permission sets
This is another way to ensure secured access. Permission sets will let the admins customize the data access for various users. Using permission sets, you can create a well-crafted set of permissions, consisting of only those subsets of access that a specific user needs. While a user is added to any given permission set, the restriction applied by their default profile will be replaced by this permission set rules.
-
Public groups
Public groups are a custom group of Salesforce users, enabling the sharing of data and knowledge among Salesforce users. The users can specify which all available groups should see what leads explicitly and within the given lead object. Being this the primary objective, there are various other uses also on creating public groups.
-
Classic encryption
Salesforce also offers an option called Classic Encryption. With this, admins can encrypt the custom fields using 128-bit AES (Advanced Encryption Standard), which comes as default.
-
Salesforce Shield
Salesforce Shield was introduced back in 2015, offering three add-on security layers as audit trails, event monitoring, and platform encryption.
- Audit trails: It is possible for organizations to track the field history by going back even up to 10 years across various accounts, custom objects, contacts, cases, opportunities, and leads, etc. This is a handy feature for the highly regulated industries as financial services, healthcare facilities, government agencies, etc.
- Event monitoring: Event monitor is for admins and IT security people to view the user behavior and application performance. Logs are generated on the same and delivered through SOAP and REST API. Event monitoring also works the best on using Salesforce’s Analytics Cloud to visualize all the events or third-party tools that combine the event logs to identify insider threats.
- Platform encryption: Salesforce Shield platform encryption is another comprehensive security feature. The organizations can encrypt data that is at rest, including those which are stored in fields and also the files which are uploaded to the Salesforce platform. All the below types of files and attachments can be encrypted using this option.
- Files attached to different feeds and records
- Files in Libraries, Content, and the files apps
- Salesforce File Sync managed files
- Notes and email attachments
- Files attached to comments, chatter posts, etc.
- Account name and account description
- Phone numbers, Fax, Website
- Names as first, middle, and last
- Subject, Descriptions, and Body
Here we have covered many of the basic features and Salesforce instances admins need to know to ensure optimum security. We will discuss many other advanced security features too for specific Salesforce use cases in the forthcoming articles.
Author Bio:
Kelly Wilson is an experienced and skilled Business Consultant and Financial advisor in the USA. She helps clients both personal and professional in long-term wealth building plans. During her spare time, she loves to write on FLOSUM. She loves to share her knowledge and Experts tips with her readers.