This short transcript features Brad Arkin, Chief Trust Officer at Salesforce, describing current security challenges—notably a rise in voice-based social engineering attacks—and outlining Salesforce’s security philosophy built on four pillars: trust as a core value, a trusted foundation, integrating security into innovation, and continuously raising the security bar. He emphasizes vigilance, adapting defenses, and a shared responsibility model between Salesforce and customers.
Chapters
As defenders, we need to adapt in order to figure out how to best defend against these new types of threats. The good news is there's a lot of tools out there that are going to help us do a good job in defending against this, but it requires us to be vigilant and take action in order to adapt and tune our environment. Hi, I'm Brad Arkin. I'm the chief trust officer at Salesforce. We are operating in a dangerous world. I want to talk about some of the things that are happening now that are new threats that we have to contend with as defenders. One of the biggest things that has happened in the recent environment that I've seen is a shift towards very effective uses of voice based social engineering. These are examples where an attacker will reach somebody over the phone and talk to an employee of a customer or a target or organization that they're trying to attack, and then try to convince that employee within the environment to take actions that are against the interest of the system. This is something that they do without the employee realizing the scam that's afoot. But they're really, really good at basically bullying through these victims over the phone and taking actions that are ultimately against the interests of the organization. And so whether it's logging into a fake website controlled by the attacker or taking other actions that somehow give the attacker access into the environment, what the bad guys have realized is that as our defenses grow and more robust, getting the person who's legitimately connected to the system to take the actions on behalf of the adversary is what ends up being the winning strategy. So there are four key pillars that inform security at Salesforce in our approach. The first one is the fact that trust is our number one value. When we approach anything at Salesforce, we talk about how we can approach this with the biggest trust outcome. How do we integrate trust into this? How do we maximize trust in what we're doing? Almost every meeting I'm in, every day of the week, the topic of trust and how do we maximize trust for our customers comes up in the meeting. And so it informs everything we do. And we're constantly focused on what we can do to drive these trust outcomes. The second pillar is the trusted foundation. Making sure that we've built a secure foundation that is then the base for everything else that we do for our customers. And that this is a foundation that needs to integrate security and everything that we're going to build on top of that. The third pillar is thinking about what we're doing when it comes to integrating security into the innovation that we're delivering for our customers. Thinking about how will this feature be potentially misused? What are the risk scenarios associated with this cool new idea that we've got? Those are the types of things that come up whenever we're focused on driving innovation, but doing so in a way that'll sustain and enhance the trust that we have between Salesforce and our customers. And the last piece, number four, is focused on how do we raise the bar? We need to think about how do we integrate security, learnings and experience into everything that already exists within the environment? And what can we go back and improve and enhance in order to make it more secure than ever before, given the changing threat environment that we're all operating in? I want to talk about the shared responsibility model that exists between Salesforce and our customers. And I think of this in three buckets. The first one is what I call.
