Doug Merrett presents a focus on Salesforce security to the Wellington Salesforce trailblazer community group in cybersecurity month - October 2023.

1. Let’s discuss Salesforce Security
Doug Merrett – Platinum7
Wellington Salesforce User Group Meetup
October 2023

2. What is Zero Trust?
• Zero Trust describes an approach to the strategy, design and implementation of IT
systems.
• The main concept is "never trust, always verify."
• This brings about zero trust data security where every request to access the data
needs to be authenticated dynamically and ensure least privileged access to
resources.
• In order to determine if access can be granted, policies can be applied based on
the attributes of the data, who the user is, and the type of environment
using Attribute-Based Access Control.
• This zero-trust data security approach can protect access to the data.
Besides a buzzword
Source: https://en.wikipedia.org/wiki/Zero_trust_security_model

3. Hmmm… Not all hacks are complicated

4. Shared Responsibility Model
Salesforce does not do all of it for you…
Copyright © 2023 Platinum7
Foundational
International Infrastructure
Hardware Compute Storage
Scalability Availability Datacentre Security
Security
Foundational
Network (inc encryption) Server (inc encryption) Administrative
Capacity High Availability Disaster Recovery
Operational Management Audits Site Reliability CSIRT
Secure SDLC
Security
Foundational
Persona Level Record Level Field Level
Performance Monitor / Audit Backup / Archive
Secure SDLC
Org Level
Privacy / Data Gov Customer

5. Security is never “finished”
Copyright © 2023 Platinum7
Assess
Your Org
Health
Secure Your
Application
Secure Your
Data
Improve
Security
Awareness

6. Assessments
• Health Check
• Portal Health Check
• Optimizer
• Code Scan with Checkmarx/DigitSec S4/AutoRabit/Salesforce’s own Code Scanner
• Third parties (shameless plug)
Copyright © 2023 Platinum7

7. Security is never “finished”
Copyright © 2023 Platinum7
Assess
Your Org
Health
Secure Your
Application
Secure Your
Data
Improve
Security
Awareness

8. Secure your Application
• Reconfigure broad sharing access (Public R/W, Public Read, …)
• Ensure Aura based communities are protected : https://links.platinum7.com.au/Aura-Issue
• Reconfigure API Users that are System Admins
• Especially with the new Integration User license
• Restrict access to Connected Apps with API Access Control
• Raise a case with Salesforce Support to get enabled
• Use Lightning Login to go passwordless
• Fix the code issues found by the Code Scanner
• SOQL injections - Where data from UI/API is put into a SOQL query without protection
• Stored XSS - Where data from the database is shown in the UI without protection
Use Least Privilege principles
Copyright © 2023 Platinum7

9. Security is never “finished”
Copyright © 2023 Platinum7
Assess
Your Org
Health
Secure Your
Application
Secure Your
Data
Improve
Security
Awareness

10. Secure your Data
• Remove permissions not needed (View All Data, API Access, …)
• Use Event Monitoring’s Transaction Security policies to minimise data exfiltration
• Use data masking in sandboxes to lower the attack surface
• Data Mask by Salesforce, DataMasker by Cloud Compliance or Data Masking by Backup tools
• Use archiving/deletion to remove data you no longer need
• Don’t have too many System Admins
• Backup your data
• Look at Privacy and Consent
• Embedded PII and other information
• Look at David Norris’ Medium posts – https://dave-norris.medium.com or Blackthorn.io
Copyright © 2023 Platinum7

11. Security is never “finished”
Copyright © 2023 Platinum7
Assess
Your Org
Health
Secure Your
Application
Secure Your
Data
Improve
Security
Awareness

12. Improve Security Awareness
• Educate users on Cybersecurity for home and work
• Educate Developers and Admins on security best practices
• Look at using new techniques in your development cycles
• Have a playbook for what to do in cyber events
• Look at frameworks – eg NIST Cybersecurity Framework
Copyright © 2023 Platinum7

13. Q&A
Please reach out if you have any questions –
I do not bite! And I am happy to have a chat
about anything security related…
Contact Details
• doug@platinum7.com.au
• +61 404 005 435
• https://www.platinum7.com.au
• https://doug-merrett.medium.com

14. Interesting information
Salesforce Security Information
• Architecture: https://architect.salesforce.com/well-architected/trusted/overview
• Security: https://developer.salesforce.com/developer-centers/security
• Code Scanner from Salesforce blog post:
https://www.linkedin.com/feed/update/urn:li:activity:6986508274858696704/
NIST Framework
• https://www.nist.gov/cyberframework
Platinum7 Salesforce Security Assessments
• https://www.platinum7.com.au/assessments : NFP get 10% discount

15. Companies to investigate
Backup
• OwnData (fka OwnBackup) and Odaseva are the top tier
• Salesforce has re-released their backup tool
Event Monitoring tools
• Imprivata’s FairWarning – prebuilt alerts and dashboards for Salesforce
• Platinum7 Event Storage – keep your logs “forever”
• Platinum7 Transaction Security Policies – complex and capable policies to block
data exfiltration
Let me know if you would like an introduction