Salesforce Security Best Practises

-

Recommended Security Best Practices

Implementing security best practices in Salesforce is crucial to protect sensitive data, maintain compliance with regulations, and safeguard your organization's reputation.

Salesforce Security

Multi-factor authentication (MFA)

MFA is a secure method of authentication where users must provide multiple pieces of evidence to log in. It can include a combination of username/password, security keys, or authentication apps. These apps generate unique codes for added security. Mobile devices can also use biometric authentication like fingerprint scans or facial recognition.

Implement precise access control using profiles and permission sets

Using profiles and permission sets in Salesforce is essential for implementing security controls to ensure that users have appropriate access to data and functionality within the system.

Profiles: Control access to objects by assigning appropriate object-level permissions to profiles. You can specify whether users can create, read, edit, or delete records for each object.

Permission Sets: Extend object-level permissions for specific users or groups by assigning permission sets. This allows you to grant additional access to certain objects without modifying profiles.

Secure password management policies: a must

A secure password should have a mix of uppercase and lowercase letters, numbers, and symbols, with a length of 8-10 characters. Salesforce suggests setting passwords to expire after 90 days. Also, enforce a password history policy that prevents reuse of the last 5 passwords.

Manage Password Expiration with Password Policies

IP Ranges and Session Restrictions

Salesforce IP ranges and session restrictions are security features that help control access to Salesforce instances and enhance data protection.

Salesforce IP ranges allow you to specify the IP addresses or ranges from which users can access your Salesforce instance. By restricting access to specific IP addresses or ranges, you can enhance security and prevent unauthorized access.

Session restrictions in Salesforce allow you to control various aspects of user sessions, such as session timeout settings and restrictions on concurrent sessions.

Shield Platform Encryption

Salesforce Shield Platform Encryption is a powerful feature that allows organizations to encrypt sensitive data stored within Salesforce. This encryption occurs at rest, meaning the data is encrypted while it's stored in Salesforce's databases.

Salesforce Shield Platform Encryption encrypts sensitive data such as Personally Identifiable Information (PII), financial information, and healthcare data.

Encryption occurs using industry-standard encryption algorithms, such as AES 256-bit encryption, ensuring robust security for sensitive data.

Audit Trails

Salesforce Audit Trails, also known as Setup Audit Trail, is a feature that allows administrators to track changes made to their Salesforce organization's setup configuration. It provides a record of changes made to critical settings, such as user permissions, security configurations, customizations, and more.

Event Monitoring

Salesforce Event Monitoring is a feature that provides detailed insights into user activity, API usage, and login events within a Salesforce organization. It offers administrators visibility into how users interact with the system, helping to identify security risks, optimize performance, and ensure compliance with regulatory requirements

Salesforce Data Security

Salesforce data security is critical for protecting sensitive information and ensuring compliance with regulations such as GDPR, HIPAA, and PCI-DSS.

Role-Based Access Control

Implement role-based access control to restrict access to data based on users' roles and responsibilities.

Assign profiles and permission sets with granular object and field-level permissions to ensure users only have access to the data they need to perform their job functions.

Apex Class and Visualforce Page Access

Control access to Apex classes and Visualforce pages by assigning appropriate permissions to profiles. You can specify whether users can execute or modify Apex code.

Grant additional access to specific Apex classes or Visualforce pages using permission sets. This is useful when users need access to custom functionality beyond what's allowed by their profiles.

Object-Level Security

Control access to objects by assigning appropriate object-level permissions to profiles. You can specify whether users can create, read, edit, or delete records for each object.

Extend object-level permissions for specific users or groups by assigning permission sets. This allows you to grant additional access to certain objects without modifying profiles.

Field-Level Security

Determine which fields users can view and edit within each object by configuring field-level security settings in profiles.

Grant access to additional fields beyond what's allowed by profiles using permission sets. This is useful when users need access to specific fields for reporting or data analysis purposes.

Record-Level Security

Implement record-level security mechanisms such as Organization-Wide Defaults (OWD), role hierarchies, sharing rules, and manual sharing to control access to individual records.

Configure sharing settings to ensure that only authorized users can view or modify specific records based on their role or relationship to the record owner.

Encrypted Fields:

Leverage Salesforce Shield Platform Encryption to encrypt sensitive data at rest, ensuring that it remains protected even if unauthorized access to the underlying database occurs.

Use encrypted custom fields or the built-in encrypted standard fields (e.g., encrypted text, encrypted email) to securely store sensitive data.


Salesforce References 

Choose the Right Salesforce Security Settings


Comments

Post a Comment

Popular posts from this blog

Introduction to Salesforce Agent Script: Build Predictable AI Agents

-
Image
Please visit here for more details - https://ayaninsights.com/guestblogs/introduction-to-agent-script/ In my latest blog, I introduce Salesforce Agent Script and explain how it helps teams build AI agents that are more predictable, controlled, and aligned with business processes. Large language models are flexible, but relying only on natural-language instructions can sometimes produce inconsistent results. Agent Script addresses this challenge by combining the conversational capabilities of an LLM with structured business logic. The blog explains how developers can use conditions, variables, actions, topics, and transitions to control how an Agentforce agent behaves. Agent Script supports familiar logic such as if/else conditions, value comparisons, sequential actions, and checks for missing data. I also cover its core structure, including system settings, configuration, global variables, languages, connections, and topic blocks. The start_agent topic acts as the entry point for each...
Read more

Anti-Patterns in Salesforce Agentforce: What to Avoid When Building AI Agents

-
Image
Salesforce Agentforce is powerful because it allows teams to build AI agents that can understand user intent, retrieve grounded information, execute actions, and support business workflows across Salesforce. But like any powerful platform, the quality of the implementation matters. A good Agentforce implementation does not start with “How many things can the agent do?" It starts with “What problem should the agent solve reliably?” That is where anti-patterns come in. Anti-patterns are common implementation habits that look useful at first but eventually create confusion, poor user experience, inconsistent answers, or hard-to-maintain agents. Below are some of the most common Agentforce anti-patterns and how to avoid them. 1. Trying to Build One Agent That Does Everything One of the biggest mistakes is designing a single agent to handle every business process, every department, and every possible customer question. At first, this feels efficient. One agent, many use cases. Bu...
Read more

MCP vs. Traditional APIs: Choosing the Right Integration Approach

-
Image
Enterprise integration has traditionally been built around APIs. Applications send structured requests, services process them, and predictable responses are returned. This model has supported everything from payment processing and customer portals to mobile applications and large-scale system integrations. The rise of AI agents introduces a different integration challenge. An AI agent does not always follow a fixed sequence designed in advance. It may need to determine which system to use, discover the operations available to it, gather relevant context, and select the appropriate action based on a user’s request. This is where the Model Context Protocol, or MCP, becomes relevant. MCP and traditional APIs are related, but they solve different problems. APIs expose system capabilities. MCP provides a standardized way for AI applications to discover and use those capabilities as tools and contextual resources. Understanding this distinction is important when designing enterprise AI solut...
Read more