Set Up and Maintain Your Salesforce Organization Salesforce Security Basics
Salesforce Security Basics
The Salesforce security features help you empower your users to do their jobs safely and efficiently. Salesforce limits exposure of data to the users that act on it. Implement security controls that you think are appropriate for the sensitivity of your data. We'll work together to protect your data from unauthorized access from outside your company and from inappropriate usage by your users.
IN THIS SECTION:
Phishing and Malware
Trust starts with transparency. That’s why Salesforce displays real-time information on system performance and security on the trust site at http://trust.salesforce.com. This site provides live data on system performance, alerts for current and recent phishing and malware attempts, and tips on best security practices for your organization.
Security Infrastructure
Salesforce utilizes some of the most advanced technology for Internet security available today. When you access the application using a Salesforce-supported browser, Transport Layer Security (TLS) technology protects your information using both server authentication and Classic Encryption, ensuring that your data is safe, secure, and available only to registered users in your organization.
Security Health Check
As an admin, you can use Health Check to identify and fix security vulnerabilities in your security settings, all from a single page. A summary score shows how your org measures against the Salesforce-recommended baseline.
Auditing
Auditing provides information about use of the system, which can be critical in diagnosing potential or real security issues. The
Salesforce auditing features don't secure your organization by themselves; someone in your organization should do regular audits to detect potential abuse.
Salesforce Shield
Salesforce Shield is a trio of security tools that admins and developers can use to build a new level of trust, transparency, compliance, and governance right into business-critical apps. It includes Platform Encryption, Event Monitoring, and Field Audit Trail. Ask your
Salesforce administrator if Salesforce Shield is available in your organization.
SEE ALSO:
Security Implementation Guide
Phishing and Malware
Trust starts with transparency. That’s why Salesforce displays real-time information on system performance and security on the trust site at http://trust.salesforce.com. This site provides live data on system performance, alerts for current and recent phishing and malware attempts, and tips on best security practices for your organization.
The Security tab on the trust site includes valuable information that can help you to safeguard your company's data. In particular, be on the alert for phishing and malware.
•
Phishing is a social engineering technique that attempts to acquire sensitive information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. Phishers often direct users to enter details at a fake website whose URL and look-and-feel are almost identical to the legitimate one. As the Salesforce community grows, it has become an increasingly appealing target for phishers. You will never get an email or a phone call from a Salesforce employee asking you to reveal a password, so don’t reveal it to anyone. You can report any suspicious activities by clicking the Report a Suspicious
Email link under the Trust tab at http://trust.salesforce.com
.
•
Malware is software designed to infiltrate or damage a computer system without the owner's informed consent. It is a general term used to cover a variety of forms of hostile, intrusive, or annoying software, and it includes computer viruses and spyware.
487
Set Up and Maintain Your Salesforce Organization Salesforce Security Basics
What Salesforce Is Doing About Phishing and Malware
Customer security is the foundation of customer success, so Salesforce continues to implement the best possible practices and technologies in this area. Recent and ongoing actions include:
•
Actively monitoring and analyzing logs to enable proactive alerts to customers who have been affected.
•
Collaborating with leading security vendors and experts on specific threats.
•
Executing swift strategies to remove or disable fraudulent sites (often within an hour of detection).
•
Reinforcing security education and tightening access policies within Salesforce.
•
Evaluating and developing new technologies both for our customers and for deployment within our infrastructure.
What Salesforce Recommends You Do
Salesforce is committed to setting the standards in software-as-a-service as an effective partner in customer security. So, in addition to internal efforts, Salesforce strongly recommends that customers implement the following changes to enhance security:
•
Modify your Salesforce implementation to activate IP range restrictions. This allows users to access Salesforce only from your corporate
network or VPN. For more information, see Restrict Where and When Users Can Log In to Salesforce on page 553.
•
Set session security restrictions to make spoofing more difficult. For more information, see Modify Session Security Settings
on page
564.
•
Educate your employees not to open suspect emails and to be vigilant in guarding against phishing attempts.
•
Use security solutions from leading vendors to deploy spam filtering and malware protection.
•
Designate a security contact within your organization so that Salesforce can more effectively communicate with you. Contact your
Salesforce representative with this information.
•
Consider using two-factor authentication techniques to restrict access to your network. For more information, see
Two-Factor
Authentication on page 547.
•
Use Transaction Security to monitor events and take appropriate actions. For more information, see
Transaction Security Policies
on page 590.
Salesforce has a Security Incident Response Team to respond to any security issues. To report a security incident or vulnerability to
Salesforce, contact [email protected]
. Describe the issue in detail, and the team will respond promptly.
Security Infrastructure
Salesforce utilizes some of the most advanced technology for Internet security available today. When you access the application using a Salesforce-supported browser, Transport Layer Security (TLS) technology protects your information using both server authentication and Classic Encryption, ensuring that your data is safe, secure, and available only to registered users in your organization.
One of the core features of a multi-tenant platform is the use of a single pool of computing resources to service the needs of many different customers. Salesforce protects your organization's data from all other customer organizations by using a unique organization identifier, which is associated with each user's session. Once you log in to your organization, your subsequent requests are associated with your organization, using this identifier.
In addition, Salesforce is hosted in a secure server environment that uses a firewall and other advanced technology to prevent interference or access from outside intruders.
488
Set Up and Maintain Your Salesforce Organization Salesforce Security Basics
Security Health Check
As an admin, you can use Health Check to identify and fix security vulnerabilities in your security settings, all from a single page. A summary score shows how your org measures against the
Salesforce-recommended baseline.
From Setup, enter
Health Check
in the
Quick Find
box, then select Health Check.
The Salesforce Baseline standard (1) consists of recommended values for settings in the Certificate and Key Management, Login Access Policies, Network Access, Password Policies, Remote Site
Settings, and Session Settings groups (2). If you change settings to be less restrictive than what’s in the Salesforce Baseline standard, your health check score can decrease.
Your high- and medium-risk settings are shown with information about how they compare against the standard value (3). To remediate a risk, edit the setting (4) or use Fix Risks (5) to quickly change settings to the Salesforce-recommended values without leaving the Health Check page. Your settings that meet the standard are listed at the bottom.
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To view Health Check:
•
“View Setup and
Configuration”
Example: Suppose that you changed your password minimum length from 8 (the default value) to 5, and changed other Password
Policies settings to be less restrictive. These changes make your users’ passwords more vulnerable to guessing and other brute force attacks. As a result, your overall score decreases, and the settings are listed as risks.
Fix Risks Limitations
You can only use Fix Risks to change the Login Access Policies, Password Policies, and Session Settings groups. Because all other settings in Health Check (like Network Access) are configured to match org-specific business requirements, you must change them manually using the Edit link on the Health Check page.
489
Set Up and Maintain Your Salesforce Organization Salesforce Security Basics
IN THIS SECTION:
How Is the Health Check Score Calculated?
The Health Check score is calculated by a proprietary formula that measures how well your security settings meet the Salesforce
Baseline standard. Settings that meet or exceed the standard raise your score, and settings at risk lower your score.
SEE ALSO:
How Is the Health Check Score Calculated?
Security Implementation Guide
How Is the Health Check Score Calculated?
The Health Check score is calculated by a proprietary formula that measures how well your security settings meet the Salesforce Baseline standard. Settings that meet or exceed the standard raise your score, and settings at risk lower your score.
Some settings like Minimum Password Length have a heavier weight, so they have a higher impact on your score. For details, see
Salesforce Baseline Standard
on page 490.
If all settings in your setting groups meet or exceed the standard, your total score is 100%. As you update your settings, hopefully your green bar moves to the right!
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
Recommended Actions Based on Your Score
If your total score is...
0–33%
34–66%
67–100%
We recommend to...
Remediate high risks immediately
Remediate high risks in the short term, and medium risks in the long term
Review Health Check periodically to remediate risks
Note: New Salesforce orgs have an initial score less than 100%. Use Health Check to quickly improve your score by eliminating high risks in your Password Policies and other setting groups.
The Salesforce Baseline Standard
Following are the setting values that meet the standard and their risk levels.
490
Set Up and Maintain Your Salesforce Organization
Certificate and Key Management
Setting
Expiration Date
Key Size
Salesforce Security Basics
Standard Value Medium Risk Value High Risk Value
No certificates created, or all certificates have more than 180 days until expiration
Less than 180 days but more than 15 days until expiration of at least one certificate
Less than 15 days until expiration of at least one certificate
No certificates created, or all certificates have a key size of 4096
At least one certificate has a key size of 2048
N/A
Login Access Policies
Setting Standard Value
Administrators Can Log In As Any User
Checkbox deselected
Medium Risk Value High Risk Value
Checkbox selected N/A
Network Access
Setting
Trusted IP Ranges
Standard Value
One or more ranges set
Medium Risk Value High Risk Value
No range set N/A
Password Policies
Setting
User passwords expire in
Standard Value
90 days or less
Enforce password history
3 or more passwords remembered
8
Minimum password length
(see Note)
Password complexity requirement
(see Note) Must mix alpha, numeric, and special characters, or more complex
Password question requirement
Cannot contain password
Maximum invalid login attempts
Lockout effective period
3
15 minutes
Medium-Risk Value High-Risk Value
180 days
1 or 2 passwords remembered
One year or Never expires
No passwords remembered
6 or 7
Must mix alpha and numeric characters
5 or less
No restriction
None
5
30 or 60 minutes
N/A
10 or No Limit
Forever (must be reset by admin)
491
Set Up and Maintain Your Salesforce Organization Salesforce Security Basics
Setting
Obscure secret answer for password resets
Require a minimum 1 day password lifetime
Standard Value
Checkbox selected
Checkbox selected
Medium-Risk Value High-Risk Value
Checkbox deselected N/A
Checkbox deselected N/A
Note: The
Minimum password length
and
Password complexity requirement
settings count twice as much as other settings in the calculation of your Password Policies group score.
Remote Site Settings
Setting
Remote Site
Standard Value
No remote site created, or at least one site created with the
Disable Protocol
Security option deselected.
N/A
Medium Risk Value High Risk Value
At least one remote site created with theDisable Protocol
Security option selected.
Session Settings
Setting
Timeout Value
Standard Value
2 hours or less
Disable session timeout warning popup
Checkbox selected
Force logout on session timeout
Checkbox selected
Lock sessions to the IP address from which they originated
(see Note)
Checkbox selected
Lock sessions to the domain in which they were first used
Checkbox selected
Force relogin after Login-As-User
Enforce login IP ranges on every request
Checkbox selected
Checkbox selected
Enable caching and autocomplete on login page
Checkbox deselected
Enable the SMS method of identity confirmation
Checkbox selected
Enable clickjack protection for Setup pages
Checkbox selected
Medium Risk Value High Risk Value
4, 8, or 12 hours N/A
Checkbox deselected
Checkbox deselected
Checkbox deselected
N/A
N/A
N/A
N/A
N/A
Checkbox deselected
Checkbox selected
N/A
N/A
Checkbox deselected
Checkbox deselected
N/A
N/A
Checkbox deselected
Checkbox deselected
492
Set Up and Maintain Your Salesforce Organization Salesforce Security Basics
Setting
Enable clickjack protection for non-Setup Salesforce pages
Standard Value
Checkbox selected
Enable clickjack protection for customer Visualforce pages with standard headers
Checkbox selected
Enable clickjack protection for customer Visualforce pages with headers disabled
Enable CSRF protection on POST requests on non-setup pages
Checkbox selected
Enable CSRF protection on GET requests on non-setup pages
Checkbox selected
Checkbox selected
Medium Risk Value High Risk Value
N/A Checkbox deselected
N/A
N/A
N/A
N/A
Checkbox deselected
Checkbox deselected
Checkbox deselected
Checkbox deselected
Note: The
Lock sessions to the IP address from which they originated
setting is available in
Enterprise, Performance, Unlimited, Developer, and Database.com Editions.
SEE ALSO:
Security Health Check
Auditing
Auditing provides information about use of the system, which can be critical in diagnosing potential or real security issues. The Salesforce auditing features don't secure your organization by themselves; someone in your organization should do regular audits to detect potential abuse.
To verify that your system is actually secure, you should perform audits to monitor for unexpected changes or usage trends.
Record Modification Fields
All objects include fields to store the name of the user who created the record and who last modified the record. This provides some basic auditing information.
Login History
You can review a list of successful and failed login attempts to your organization for the past six months. See Monitor Login History
on page 728.
Field History Tracking
You can also enable auditing for individual fields, which will automatically track any changes in the values of selected fields. Although
auditing is available for all custom objects, only some standard objects allow field-level auditing. See Field History Tracking on page
739.
Setup Audit Trail
Administrators can also view a Setup Audit Trail, which logs when modifications are made to your organization’s configuration. See
Monitor Setup Changes
on page 736.
493
