Salesforce Security: Preventing Breaches and Malware Threats

Understanding Salesforce Security

Many organizations don’t consider the risk that Salesforce exposes them to and the importance of Salesforce security. Different Salesforce clouds and modules allow access to external customers, partners, suppliers and contractors, leaving the organization vulnerable to threats.

In this guide, we will cover the use cases that expose organizations to potential risks, and how to best protect against them.

Salesforce security measures are made up of three parts: security measures built into the Salesforce platform, general security best practices, and malware protection.

Salesforce security measures built into the platform include:

• Infrastructure: Replication, backup, and disaster recovery.
• Network services: Encryption in transit and advanced threat detection for network services.
• Granular access controls: Secure access through object-level, field-level, and record-level protection.
• Data security (SalesForce Sharing Model): Salesforce provides a layered, secure process for sharing confidential information between multiple users of an organization.
• Salesforce Shield: An add-on module that encrypts data with AES 256-bit encryption at the field-level

Additional best practices and security controls you should use to strengthen the security of your Salesforce instance:

• Activate multi-factor authentication (MFA)
• Restrict access by using IP ranges
• Apply granular access control using profiles and permission sets
• Establish secure password management policies
• Limit the number of failed logins
• Use a dedicated third-party Salesforce security solution

Protect against malware and content-borne threat vectors:

While the above best practices are important, they cannot protect against the most severe threat—malware infecting content within Salesforce. This is why antivirus scanning and advanced threat protection are a crucial addition to your Salesforce protection strategy.

  

Salesforce Security Threats

Any digital-first enterprise requires the processing of data; a lot of data, even more so for B2C companies which manage up to millions of customers. To do so they must rely on client management platforms – and foremost, Salesforce, the gold standard of CRM apps, used by over 150,000 companies, with multiple solutions and integrations for customer and partner management. 

With new open digital access, a new entry point has been created for 21st century attackers. Malicious actors, whether they are disgruntled customers or partners, or simply a hacker, can easily upload content with a malicious payload and trigger a malevolent attack chain sequence, causing severe damage to their target – either in the form of data theft or financial gains.

Data Breaches and Data Leakage

Salesforce is a business critical system, and is at risk of data breaches, unauthorized access, or data leakage. These threats can come from various sources, including rogue employees, hackers, and cybercriminals.

Data breaches occur when unauthorized individuals gain unauthorized access to sensitive data within a Salesforce instance. This can result in the loss of crucial business information and can damage a business’s reputation. Because Salesforce contains customer data, it can also lead to compliance violations and hefty fines. 

Data leakage refers to data being unintentionally exposed or shared. This often occurs due to poor security practices or misconfigurations. A data leak can have consequences no less severe than a malicious data breach.

The Risk of Malicious Content

Salesforce allows external parties to interact and collaborate with your employees through cloud environments such as Experience Cloud, Sales Cloud, and Service Cloud. Inside these environments, multiple modules (e.g. Chatter, “Email to Case”, web forms, and other systems feeding Salesforce information) allow external parties to add potentially malicious content in the form of text, URLs and files to your Salesforce instance. 

If you are using these environments without the proper protections, you are increasing the risk for malicious content to infiltrate your organization, which can result in severe damages in the form of data theft, ransomware and reputational damage. Native Salesforce security solutions do not protect you from these nefarious activities.

 4 Content-borne Threat Vectors in Salesforce

Here are a few examples of how external parties can upload content to your Salesforce, thus exposing your organization to external threats. 

1. Chatter – Salesforce real-time collaboration application lets users talk to each other and share information, and is often open to external parties, where they can send content that goes into Salesforce which instantly reaches company employees and other parties that are part of the chatter group.
2. Open tickets via email – the “Email-to-Case” Salesforce functionality allows the organization to automatically turn customer emails into cases in Salesforce. External parties will use the organization’s designated email address to send an email, which results in the opening of a Salesforce ticket with any file or URL that was included in the email. 
3. Web forms – Salesforce web forms allow capturing and importing information from external parties to Salesforce. For example, “Web-to-Case” will allow customers to submit support requests through web forms. Landing pages on the company’s website which include these forms, allow uploading of information into Salesforce by partners and suppliers. Portals like Salesforce Community (Experience Cloud) also have different types of externally-available forms.
4. Third-party applications integrated with Salesforce – A simple Rest API integration can connect Salesforce to any other system. In this manner, external systems can integrate with your Salesforce and feed it any type of data. 

Built-In Security Measures in Salesforce

Here are the primary built-in security measures provided by the Salesforce platform.

Infrastructure Security

Salesforce’s infrastructure security includes: 

• Automatically replicating data to ensure its availability in case of a data loss incident. 
• Automatically backing up data to a separate location in the Salesforce cloud for recovery purposes. 
• Implementing disaster recovery planning to enable restoration of operations following a significant disruption or disaster.

Network Security

Salesforce’s network services include encryption in transit and advanced threat detection measures. Encryption in transit ensures that data is secure while it is being transferred from one location to another. Advanced threat detection involves the use of technologies to identify and block threats at the network level. However, it is important to note these technologies do not include malware detection or protection.

Object-Level, Field-Level, and Record-Level Protection

Salesforce provides object-level, field-level, and record-level protection. This means that it secures data at every level, preventing unauthorized access and privilege escalations, and ensuring that data is only accessible to individuals with the necessary permissions.

Data Security with the Salesforce Sharing Model

The Salesforce Sharing Model is a feature that enhances data security by controlling who can access data. It allows businesses to define and enforce data access policies, ensuring that data is only accessible to authorized individuals.

Salesforce Shield

Salesforce Shield is an add-on to the Salesforce platform that lets you encrypt both standard fields and custom fields within Salesforce. You can also encrypt files and attachments and search indexes. Salesforce Shield’s encryption uses a unique tenant secret that the customer controls, and a master secret that’s maintained by Salesforce. These secrets are combined to create an organization’s data encryption key.

Best Practices for Improving Salesforce Security

The Salesforce platform provides security measures, but it is critical for businesses to configure them correctly. Follow these best practices to ensure your Salesforce instance is secure:

Activate Multi-Factor Authentication (MFA)

Multi-factor authentication is a security measure that requires users to provide multiple forms of identification to verify their identity. This adds an extra layer of security and makes it harder for unauthorized individuals to gain access to the platform.

Restrict Access by Using IP Ranges

IP range restrictions allow businesses to control access to Salesforce based on the IP addresses of users. This can prevent unauthorized access from specific locations or networks.

Use Profiles and Permission Sets

Profiles and permission sets are tools provided by Salesforce to control user access to data. They allow businesses to define the permissions of each user, ensuring that they can only access the data they need for their role. Ensure all sensitive data in Salesforce is appropriately protected.

Establish Secure Password Management Policies

Secure password management policies involve the use of strong passwords and regular password changes. These policies can prevent unauthorized access due to weak or compromised passwords.

Limit the Number of Failed Logins

Salesforce allows you to limit the number of failed login attempts. It is important to turn on this setting, because it can prevent brute force attacks, where hackers attempt to gain access by guessing passwords.

Use a Dedicated Third-party Salesforce Security Solution

Salesforce security solutions help organizations detect all types of malicious threats in real-time and instantly respond and remediate threats. Perception Point’s Salesforce Security Solution, for example, dynamically scans 100% of content including embedded files and URLs uploaded into Salesforce with a multi-layered patented platform that intercepts any threat type before it reaches the end user.

Add Antivirus Scanning and Advanced Threat Protection

Salesforce native security controls do not scan any of the content being uploaded to the platform. It is critical to add security solutions that can protect against the threat of malware and malicious content:

• Antivirus scanning – Antivirus software solutions that connect to Salesforce perform static scanning only, which uses code analysis tools to inspect the code for indications of common vulnerabilities. They also compare against a malware database with signatures of known malicious files. However, attackers know how to employ different evasion techniques that are not detected by antivirus software. They bury the malicious content inside another file, or slightly change a known malicious file so the hash of the file is different. Therefore, an antivirus only provides only partial protection, mostly against previously seen threats which leaves your organization vulnerable.   
• Advanced threat protection – an advanced threat protection solution will protect against any Salesforce content-borne security threat – known or unknown, simple or complex. In addition to using static analysis and threat intelligence, it leverages advanced detection techniques, such as machine learning and other novel algorithms. It also employs anti-evasion algorithms to identify buried threats, to identify complex attacks and unknown threats, such as advanced persistent threats, such as zero-days. Most importantly, advanced threat protection solutions dynamically scan in real-time all content uploaded to Salesforce, detonating files & URLs inside an isolated environment (a next-gen sandbox) in order to detect malicious code execution. 

Organizations preparing their Salesforce security strategy need to take into consideration that only a next-generation advanced threat protection solution can provide the required  protection against all Salesforce content-borne threats and provide a seamless user experience.

Perception Point’s Salesforce Security Solution

Perception Point’s Salesforce Security Solution, Salesforce Advanced Threat Protection, scans in real-time, all content uploaded to Salesforce from any module, to intercept malicious content before it reaches your employees.  

Perception Point’s Salesforce Advanced Threat Protection offers unprecedented protection against all types of content-borne attacks including APTs, zero-days, malware and phishing that can penetrate organizations through Salesforce. 

The SaaS solution scans every piece of content (including files and URLs) through its multi-layered platform, dynamically scanning 100% of content uploaded to Salesforce in near real-time in both Windows and Mac environments, up to 40x faster than other solutions. 

Perception Point’s solution also includes a 24/7, free-of-charge Integrated Incident Response service that efficiently analyzes, manages and remediates incidents, and drives continuous optimization of the security solution.

Here is a quick overview of how it works:

Perception Point has partnered with Salesforce to offer a solution that seamlessly integrates the Salesforce environment in just a few clicks, and adheres to Salesforce security standards. The solution is available in the Salesforce AppExchange.

To learn more about Perception Point’s salesforce security solution, download the Salesforce Advanced Threat Protection solution brief.