Trusted Enterprise Security: Episode 2

With all of today's AI innovation, data is more important than ever. And it's incredibly critical that you strengthen your security around that data. Social engineering attacks are becoming more common and harder to trace. As part of our Trust first culture, we want to help you have confidence that your data is safe. In this multi part security mini series, we're here to highlight how the shared responsibility model comes to life. I'm Rachel Beard, a security architect here at Salesforce and I'm joined by Purva Kaushal, a Salesforce security product manager. We often talk about security in three layers. The invisibles, the configurables, and the enhanceables. In our last video, we unpacked those invisibles, the powerful security controls that Salesforce manages for you. Today, we're going to dive into the configurables and how you can ensure you've enabled all of the key security features built right into the Salesforce platform.

Thanks, Rachel. As a security product manager, I work closely with customers every day on security best practices and how to configure them in Salesforce. Here at Salesforce we have an incredible free resource called Trailhead. So visit the link on your screen to scale up and complete our security trail. When I think about security posture, I always start with what admins and IT professionals can do right now to make their org a safer place. Customers have a lot of options out of the box, but the first place, I point people to a security health check.

Yeah, same here. And Health Check is available to every customer right now. In setup, it benchmarks your org against Salesforce's baseline so you can quickly see where your configurations measure up and where you might need to tighten up.

Exactly. What I like about Health Check is that it's not just a dashboard. It's actionable. It highlights misconfigurations. Attackers target first, like weak password policies or overly long session settings. If you miss those signals, you may already be exposed. For many customers, it's the fastest way to reduce risk without extra investment.

Absolutely. I always recommend customers focus on session settings and and password policies first. Those are easy to misconfigure and they're impactful to fix. I also advise paying attention to the number of objects that have external sharing. That's a common blind spot where sensitive data can leak.

That's exactly right. And those settings may sound basic, but attackers know they're the first things to test. Weak or misconfigured policies are like leaving the front door unlocked. So once customers lock those down, the next step is. Is authentication.

Yes. Strong Authentication is absolutely critical. At a minimum, every org should be enforcing multi factor authentication and ideally single sign on as well. I tell customers all the time these tools work together in an essential way. MFA is your seatbelt, SSO is your airbag and together they reduce your risk of credential based attacks.

I so agree. SSO is especially helpful because logins don't require username and password which reduces the risk of stolen or lost credentials. In addition, I also feel when it comes to tightening authentication, companies need to take more measures to prevent anomalous logins.

Yes, I agree a lot of organizations are using IP ranges and IP allow listing and in the world of Hyperforce we see more emphasis on Mutual Transport Layer security or mtls. MTLS is especially helpful for integrations including connected apps because it requires certificates from both client and server for enhanced authentication.

Now all the things we discussed so far cover prevention, but there is another very important aspect to security monitoring.

Yes, customers need to easily monitor for login access. Login history is available to admins right now in setup, and these events allow admins to see when users are logging in, where they log in from, and which methods they use to log in.

It's such critical visibility that many admins don't even know about. Now I want to switch gears a little bit here and talk about connected apps. We know they're incredibly useful for integrating external tools with Salesforce, but they can also be a threat vector if left unmanaged. Unfortunately, we've seen our approved or untrusted apps become a backdoor for data to leave Salesforce. Rachel, we recently introduced two changes to tighten our security around connected apps.

Yes we did. And these are really going to help our customers enhance security around connected apps. First of all, connected apps integrate external applications with Salesforce APIs. Now you can use the new API Access control to restrict users from Accessing your Salesforce APIs unless they're pre approved through an approved connected app. Using profiles and permission sets, you can then grant users access to the approved apps. You can contact support to enable this API access control. Second, Salesforce will now automatically block users from accessing uninstalled connected apps and will also remove the OAuth device flow from the data loader.

Thanks for that Rachel. These updates enable our customers to get the benefit of stronger default protections while still ensuring their trusted business apps work seamlessly. Coming up in our next video, we'll continue talking about the configurables with some of the powerful Salesforce access controls that can help you follow the principle of least privilege. Join us next time.