Salesforce Gets Serious About Its Security Ecosystem

Security Ecosystem

Salesforce is one of the fastest growing enterprise software companies in history and while security is a major roadblock for many cloud projects, the company’s extensive security investments appear to be paying off. Salesforce is one of just 9.4% of cloud providers that store data encrypted and they support a wide range of security controls including IP address whitelisting, device pinning, and multi-factor authentication. If there’s a concern about data going to Salesforce’s cloud, it’s a concern about how users treat that data, not the integrity of the platform.

Under a shared responsibility model, Salesforce takes care of platform security, while customers are responsible for taking precautions to ensure their users don’t expose that data to risk. That means the end customer is responsible for ensuring their salespeople don’t download all the company’s sales contacts before quitting to join a competitor, or that users have appropriate application permissions that don’t give them access to data they shouldn’t be able to access based on their role at the company.

One of the primary concerns of companies with large Salesforce deployments is a rogue employee taking sales contacts when leaving the company for a competitor. One study found that half of employees took data with them when they left their job and 40% planned to use that data at their next job. Key indicators that something is amiss can include an employee downloading an unusual amount of data. Let’s say this employee typically views 50-100 opportunities each day, and then downloads a report with 1,500 opportunities. That could indicate there’s a problem.

Another threat faced today is the possibility that a user or administrator will sell sensitive data. A shocking survey recently found that 25% of employees would sell company data for less than $8,000. Many companies store a vast amount of sensitive data in Salesforce including customer credit card numbers, Social Security numbers, patient information, and other sensitive or regulated data. Even if a rogue employee is at fault, a company can still be fined and sued if this data is stolen.

Such “insider threats” are increasingly common. Skyhigh recently analyzed data across its customers and found that companies, on average, experience 9.3 insider threat incidents each month. Not all of these events are malicious, they also include users mistakenly sharing data when they shouldn’t. All told, 89.6% of companies experience at least one insider threat each month on average. Salesforce recognizes these concerns and is making investments to support the development of security solutions that help address these concerns.

To help support customers in identifying these types of negligent or malicious activities, Salesforce has made available new event monitoring APIs that provide a record of user and administrator activity within Salesforce. The volume of these events is enormous. In the most recent quarter, Salesforce’s core platform processed 234 billion transactions, including logins, edits, and downloads. That’s an average of 3.7 billion events each business day – quite the haystack to search for a few needles.

For customers looking for unusual user or account activity, the sheer number of events in Salesforce would be impossible to manually review. In making these new APIs available, Salesforce is making a significant investment to support its security ecosystem to build solutions that help Salesforce customers understand and manage user activity. Also, these APIs provide a near real-time feed of events that can be captured by security solutions and archived, rather than forcing customers to go to their Salesforce account manager and request logs for a post-incident investigation.

Salesforce is already one of the most secure cloud services available. Owing to its investment in platform security, Salesforce is one of the 8.1% of cloud services that meet the security standards of enterprises today. With the introduction of new APIs to support third party security solutions that give greater visibility into usage and the ability to detect threats, the company is well positioned to continue its leadership position in the cloud market.

By Harold Byun

Non-Fungible Tokens

Non-Fungible Tokens (NFTs) As Digital Artwork

NFTs As Digital Artwork NFT stands for Non-Fungible Token. Anything fungible is replaceable with something that is of an equal value. A basic example would be money. A $10 note is fungible as it can ...
Gary Bernstein

Infographic: The Data That Never Sleeps

Here’s What Happens Every Minute on the Internet in 2020 In 2020, the world changed fundamentally – and so did the data that makes the world go around. As COVID-19 swept the world, nearly every ...
Big Data Explosion

Developing Machine Learning-based Approach for Optimizing Virtual Agent (VA) Training

Optimizing Virtual Agent (VA) Training Achieve NLU model’s precision, recall & accuracy up to 78% The success of any Virtual Agent (VA) depends on the training of its Natural Language Understanding (NLU) model prior to ...
Gary Bernstein

5 Popular Telemedicine Software Services

Telemedicine Software Since the beginning of the Covid-19 pandemic, telemedicine software services have become extremely popular, and every day more people are using this service instead of going to hospitals and emergency departments as they ...
Data Web Accessibility

Data Centres Of The Future

Data Centres Of The Future As humans require more and more computing power and more and more cloud storage, we’re going to need more and more data centres. So what do the data centres of ...

PROXY SERVICES

The CloudTweaks technology lists will include updated resources to leading services from around the globe. Examples include leading IT Monitoring Services, Bootcamps, VPNs, CDNs, Reseller Programs and much more...

  • Smartproxy

    Smartproxy

    Smartproxy is a rising star in the constantly growing proxy market. Smartproxy offers awarded customer service, impressive performance, and is serious about your anonymity (yes, cybersecurity matters). The latest features developed by Smartproxy are 30 minute long sticky sessions and Google Proxies. Rumor has it, the latter guarantee 100% success rate

  • Bright Data

    Bright Data

    Bright Data’s network is one of the most robust of its kind globally. Here are its stark advantages: Extremely stable connection for long sessions (99.99% uptime guaranteed). Free to integrate with our Proxy Manager which allows you to define custom rules for optimized results. Send unlimited concurrent requests increasing speed, cost-effectiveness, and overall efficiency.

  • Rsocks

    Rsocks

    RSocks team offers a huge amount of residential plans which were developed for plenty of tasks and, most importantly, has been proved to be quite efficient. Such variety has been created on purpose to let everyone choose a plan for a reasonable price, online, rotation and other parameters.

  • Storm Proxies

    Storm Proxies

    Storm Proxies' network is optimized for high performance and fast multi-threaded tools. You get unlimited bandwidth. No hidden costs, no limits on bandwidth. Try Storm Proxies 100% Risk Free. If you are not happy with the service email us within 24 hours of purchase and we will refund you.