Salesforce is a highly configurable platform. You can configure its security in different ways according to your Salesforce instance. One-size-fits-all security measures are ineffective in such situations. You need security tools and practices that are most suitable for your level of complexity in Salesforce.
In this article, we'll deeply dive into understanding some of the standard Salesforce security practices and discover new technologies to help you address Salesforce security challenges.
Why Salesforce Data Needs Security
Salesforce stores critical customer data in objects, fields, and records. This data is confidential, and any loss can significantly damage a company's reputation and finances.
Customer data contains personally identifiable information (PII), like addresses or names. This information leads to fraud or identity theft if not kept safe. Sometimes, you may find Salesforce guarding a company's financial insights, giving it a competitive advantage. Although Salesforce offers robust security, some gaps encourage users to rely on dedicated security tools. For example, Salesforce doesn't automatically back up or archive your data; if it does, it's too slow and infrequent. Moreover, backups don't include metadata.
Customer data is valuable; they trust you to keep it safe and secure. Failure to offer the required security would unnecessarily attract legal penalties for non-compliance with regulatory standards.
How Salesforce Ensures Security of Data
Salesforce offers security at each data storage level. The platform stores data at object, field, and record levels, and Salesforce delivers controls to ensure security across these levels.
Salesforce assesses which objects a user can access at an object level. Accordingly, the platform manages access to different tables in your database. This access is managed using permission sets and profile settings. The latter manages access to object—and field-level security, while the former helps configure access in your profiles.
Field-level security controls the columns that a user can access in objects. The profile settings allow you to control who can access and edit set fields. Lastly, record-level security configures how each user can access records in your database.
You can set record-level security to share ownership of records among multiple users.
Some sharing settings manage how access permissions are shared among users at a record level. If sharing settings are private, you won't see the record unless you own it. Suppose the sharing settings are "Public Read." Here, you can see the record without editing. The Public Read/Write sharing setting allows users to see and edit documents even when they don't own them.
Salesforce allows you to personalize this record-level security for every user with the help of rules.
Below are a few options Salesforce delivers to ensure the platform's security and the data stored within it.
- Salesforce Health Check. Admins can use it to identify and fix potential vulnerabilities in your Salesforce settings.
- Custom login flows. Suppose a user tries to access Salesforce from a restricted IP or at a specified time; the admin would implement a flow that would still allow the user to access Salesforce, but only after they have authenticated and proven their identities multiple times. This keeps the platform flexible for business-critical activities while meeting crucial security requirements.
- Role hierarchy. Allows admins to control how information is available and editable to users, subordinates, and superiors. The controls are placed at the record level rather than the field level.
- Audit trail. Salesforce field history tracking is available to a certain level. Salesforce Shield, a security solution that offers advanced monitoring and data retention, expands this tracking, making it available for 10 years across custom objects. It benefits highly regulated industries such as healthcare, financial services, and government agencies.
Salesforce maintains a customer-facing website, Salesforce Trust. It details the platform's performance and security issues affecting Salesforce customers, helping users find updates on various social engineering attacks or malware.
Salesforce Security Checklist: How to Protect Salesforce Data Using Native Services
There are a few built-in features that you can use to ensure the security of your Salesforce data. These features include access management, password security, encryption, data center protection, and network security.
Common Salesforce Security Best Practices
Below are a few best practices to protect Salesforce against attack vectors.
- Enable IP restrictions on logins to reduce unauthorized access.
- Add extra layers of protection through multi-factor authentication.
- Set sharing rules based on role hierarchy and set permissions accordingly.
- Encourage users to use at least eight characters in passwords, including uppercase and lowercase letters, numbers, and symbols.
- Limit incorrect attempts to log in to 3 or 5 times.
- Show session timeout warnings and ask users to log in again if the timeout extends.
- Turn off caching and autofill while entering user credentials on the login page.
- Encourage users to change their passwords every 90 days. Avoid reusing the same passwords, and do not allow passwords that contain the word "password."
- Periodically generate a new tenant secret to create a new encryption key if you adopt encryption on the platform.
- Ensure all devices that access Salesforce use the latest web browser version, operating system (OS), and anti-malware software.
- Ensure physical security of data centers by controlling access and verifying user identity using biometric scanning and video surveillance. Maintain a reliable and constant power supply with backup systems such as uninterruptible power supplies (UPS) or power distribution units (PDUs).
- Use firewalls and edge routers to block unused protocols. Leverage internal firewalls to separate traffic between service and database tiers.
- Use advanced intrusion detection and prevention systems to scan for any unusual activity.
- Leverage external vendors' expertise in pen testing and code reviews to detect vulnerabilities.
Best Practices for Ensuring Salesforce Security
Although Salesforce offers many essential features required to maintain the platform's security, they might not be enough if your human element isn't adequately trained to operate them.
Educate Employees
Most security incidents have a human element that got compromised, intentionally or unintentionally. You must train and familiarize your staff with social engineering tactics or phishing attempts. For example, employees must be able to recognize emails coming from illegitimate domains that mimic Salesforce's official website.
Here are a few standard things that your staff can verify:
- Ensure that web pages have the hypertext transfer protocol secure (HTTPS) on their web address.
- Please don't click on any link in an email or text message until you have verified that it has come from a trusted sender. Do not open attachments, too, without verifying.
- Be suspicious and vigilant toward emails that expect or encourage you to act instantaneously. For example, an attacker might impersonate your client, urgently asking for their user credential over email as they cannot log in.
- Keep all systems patched and updated, ensuring all new vulnerabilities have been effectively remediated.
- Deploying email filtering tools is beneficial to prevent phishing or spam from reaching your inbox.
Restrict IP and Ensure Secure Sessions
Implement IP restrictions across your Salesforce implementation to prevent external computers from logging in to your systems. For remote employees, tools like Virtual Private Networks (VPNs) offer a secure way to connect to the system, creating robust protection.
You can restrict this IP address to a profile level to help you manage external requests outside the approved network.
Encourage users to set a strong password. A new password is:
- Above eight characters in length.
- The answer to the secret question shouldn't contain the password.
- Passwords, which use a complex mix of numbers, characters, and special symbols, are highly tricky to guess or crack through brute-force attacks.
- It's good to decrease the session timeout value.
Adopt Multi-Factor authentication
Consider 2-factor or multi-factor authentication to encourage users to prove their identity more than 2 times. The first challenge can be to check username and password. Accompany this with the 2nd challenge, where the company can send over a one-time password for email verification.
The second factor can be a security token or a verification code sent to an SMS message with a registered phone number.
Apply The Least Privileges Principle
Users should be permitted to access only the data they need daily. The privileges they are allocated should be the least privileges they would need.
This allows you to protect your system and data from unauthorized access requests.
Backup Salesforce Data
Salesforce data is prone to accidental or purposeful deletions. You need a reliable backup to restore your system when an incident has occurred. Flosum offers backup features that record data frequently at a faster pace. If there's an existing tool already, they may not cover all Salesforce records. Moreover, even if they do, it won't include metadata.
Flosum offers a comprehensive solution for securely backing up Salesforce data. It ensures that critical customer information is not lost during incidents or development. Additionally, Flosum helps address the Zero Trust security challenges.
Want to implement an authentic zero-trust architecture?
Encourage Secure App Development and Manage API
Customizations bring out the absolute powers of the Salesforce platform but also make it prone to security risks. These risks welcome cyber attacks like cross-site scripting (XSS), SQL injection, or Cross-Site Request Forgery (CSRF). When developing, ensure you don't leave attack surfaces for threat actors who are looking for the right opportunity.
Salesforce offers flexibility by leveraging the expertise of external entities that sync via APIs. To secure these sources, Salesforce offers some guidelines, such as granting permission to users with API-only access and giving read-only access only if necessary. Salesforce also provides several other guidelines for managing security while working with APIs.
Adopt The Right Technology: Enforce Zero-Trust Architecture With Flosum
Flosum delivers an all-in-one solution for DevOps, backup and archive, data seeding, and security orchestration on Salesforce. It gives your business a safety net with high backup frequency and minimal data loss, encouraging high-velocity Salesforce development.
Your Salesforce data remains private while the platform ensures it is accessible only to those with the required access permissions. This simplifies access control and helps adopt a zero-trust architecture, where the platform gives the least privileges needed to the users.
Learn about Flosum and understand its role in keeping Salesforce data safe and reliable.
Salesforce security FAQs
1. How does Salesforce ensure security?
Salesforce ensures security by using multiple layers of protection for data and applications. It encrypts data both during transmission and when stored. The platform also uses role-based access controls to restrict user permissions and prevent unauthorized access. Salesforce uses more minute details to ensure platform security. Talk to an expert to learn more.
2. What are the levels of security in Salesforce?
There are different levels of security, such as physical, application, object, or record-level security, in Salesforce.
