Salesforce Security Guide
Total Page：16
File Type：pdf, Size：1020Kb
Salesforce Security Guide Version 53.0, Winter ’22 @salesforcedocs Last updated: September 22, 2021 © Copyright 2000–2021 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark of salesforce.com, inc., as are other names and marks. Other marks appearing herein may be trademarks of their respective owners. CONTENTS Chapter 1: Salesforce Security Guide . 1 Salesforce Security Basics . 2 Phishing and Malware . 2 Security Health Check . 4 Auditing . 5 Salesforce Shield . 5 Authenticate Users . 6 Multi-Factor Authentication . 7 Single Sign-On . 8 Custom Login Flows . 9 Connected Apps . 9 Manage User Passwords . 9 Device Activation . 10 Session Security . 10 Give Users Access to Data . 10 Control Who Sees What . 11 User Permissions . 13 Object Permissions . 26 Custom Permissions . 29 Profiles . 31 Create a User Role . 49 Share Objects and Fields . 49 Field-Level Security . 50 Sharing Rules . 56 User Sharing . 68 What Is a Group? . 70 Manual Sharing . 74 Organization-Wide Sharing Defaults . 74 Strengthen Your Data's Security with Shield Platform Encryption . 78 What You Can Encrypt . 79 How Encryption Works . 92 Set Up Your Encryption Policy . 101 Filter Encrypted Data with Deterministic Encryption . 114 Key Management and Rotation . 118 Shield Platform Encryption Customizations . 152 Encryption Trade-Offs . 156 Monitoring Your Organization’s Security . 169 Monitor Login History . 170 Field History Tracking . 172 Contents Monitor Setup Changes with Setup Audit Trail . 178 Transaction Security Policies (Legacy) . 182 Real-Time Event Monitoring . 188 Real-Time Event Monitoring Definitions . 189 Considerations for Using Real-Time Event Monitoring . 189 Enable Access to the Real-Time Event Monitoring . 191 Stream and Store Event Data . 191 Create Logout Event Triggers . 199 How Chunking Works with ReportEvent and ListViewEvent . 200 Enhanced Transaction Security . 202 Threat Detection . 263 Security Guidelines for Apex and Visualforce Development . 290 Cross-Site Scripting (XSS) . 290 Formula Tags . 292 Cross-Site Request Forgery (CSRF) . 293 SOQL Injection . 294 Data Access Control . 295 API End-of-Life . 296 INDEX . 297 CHAPTER 1 Salesforce Security Guide In this chapter ... Salesforce is built with security to protect your data and applications. You can also implement your own security scheme to reflect the structure and needs of your organization. Protecting your data is a joint • Salesforce Security responsibility between you and Salesforce. The Salesforce security features enable you to empower your Basics users to do their jobs safely and efficiently. • Authenticate Users • Give Users Access to Data • Share Objects and Fields • Strengthen Your Data's Security with Shield Platform Encryption • Monitoring Your Organization’s Security • Real-Time Event Monitoring • Security Guidelines for Apex and Visualforce Development • API End-of-Life 1 Salesforce Security Guide Salesforce Security Basics Salesforce Security Basics The Salesforce security features help you empower your users to do their jobs safely and efficiently. Salesforce limits exposure of data to the users that act on it. Implement security controls that you think are appropriate for the sensitivity of your data. We'll work together to protect your data from unauthorized access from outside your company and from inappropriate usage by your users. IN THIS SECTION: Phishing and Malware If you see something suspicious related to your Salesforce implementation, report it to [email protected], in addition to your own IT or security team. Trust starts with transparency. That’s why Salesforce displays real-time information on system performance and security at http://trust.salesforce.com. For security-specific information, go to http://trust.salesforce.com/security. This site provides live data on system performance, alerts for current and recent phishing and malware attempts, and tips on security best practices for your organization. Security Health Check As an admin, you can use Health Check to identify and fix potential vulnerabilities in your security settings, all from a single page. A summary score shows how your org measures against a security baseline, like the Salesforce Baseline Standard. You can upload up to five custom baselines to use instead of the Salesforce Baseline Standard. Auditing Auditing provides information about use of the system, which can be critical in diagnosing potential or real security issues. The Salesforce auditing features don't secure your organization by themselves; someone in your organization should do regular audits to detect potential abuse. Salesforce Shield Salesforce Shield is a trio of security tools that helps admins and developers build extra levels of trust, compliance, and governance right into business-critical apps. It includes Shield Platform Encryption, Event Monitoring, and Field Audit Trail. Ask your Salesforce administrator if Salesforce Shield is available in your organization. Phishing and Malware If you see something suspicious related to your Salesforce implementation, report it to [email protected], in addition to your own IT or security team. Trust starts with transparency. That’s why Salesforce displays real-time information on system performance and security at http://trust.salesforce.com. For security-specific information, go to http://trust.salesforce.com/security. This site provides live data on system performance, alerts for current and recent phishing and malware attempts, and tips on security best practices for your organization. The Security section of the Trust site includes valuable information that can help you safeguard your company's data. In addition to security best practices, the site provides information on how to recognize and report phishing attempts and information on current malware campaigns that could impact Salesforce customers. • Phishing is a social engineering technique that attempts to acquire sensitive information, such as usernames, passwords, and credit card details, by masquerading as a trustworthy person or entity. Phishing can occur via email, text messaging, voice calls, and other avenues. Phishers often direct targets to click a link and enter valuable information or to open an attachment with the goal of downloading malware onto the target’s device. As the Salesforce community grows, it becomes an increasingly appealing target for phishers. You’ll never get an email or a phone call from a Salesforce employee asking you to reveal your login credentials, so don’t reveal them to anyone. Report suspicious activities or emails regarding your Salesforce instance directly to the Salesforce Security team at [email protected]. 2 Salesforce Security Guide Phishing and Malware • Malware is software designed to infiltrate or damage a computer system without the owner's informed consent. It’s a general term used to cover various forms of hostile or intrusive software, including computer viruses and spyware. For a list of current security advisories, go to https://trust.salesforce.com/en/security/security-advisories. What Salesforce Is Doing About Phishing and Malware Security is the foundation of our customers’ success, so Salesforce continues to implement the best possible practices and security technologies to protect our ecosystem. Recent and ongoing actions include: • Actively monitoring and analyzing logs to enable alerts to our customers who have been affected. • Collaborating with.