Rachel Beard and Purva Kaushal walk through Salesforce Shield and Security Center, tools that monitor events in real time, block risky transactions, encrypt data, and detect sensitive information across multiple orgs.
In the face of social engineering attacks, it's more important than ever to identify your business critical data and treat it with care while adhering to evolving global AI regulations. Welcome back to our Trusted Enterprise Security series. I'm Rachel Beard, a security architect here at Salesforce alongside Purva Kaushal, a Salesforce Security Product manager. In our last video we talked about the configurables or the out of the box controls our customers can take to protect their data. Today we're talking about the enhanceables. These are add on features for customers who need additional levels of security and compliance. So let's start with our popular security add ons, Salesforce Shield and Security Center Porva. I know that you work on these products every day as a product manager, so it would be great to hear what you think about how they work together to proactively detect threats.
Absolutely, Rachel. S.H.I.E.L.D. is all about visibility and action. We don't just provide you logs of what happened with your data. We give you the power to see threats in real time and stop them before any data walks out the door. Shield helps our customers protect sensitive data, find blind spots, address compliance, and act on insights and trends that real time visibility is key.
Customers tell me all the time that they don't want to wait hours to find out what's happening in their org. They want to act the moment something suspicious starts.
Right? And that's where real time event monitoring comes in. In the event manager screen you can see we have the ability to track a lot of events like logins, report, export, API calls, file downloads or uploads, all of them live. So for example, anytime a connected app or a user tries to read a large number of records, you can get API events created in real time and set alerts to notify someone or even block the action if it's suspicious.
Yes. And let's go back to what you said earlier about actually blocking the action, because that's the real win. It's not just visibility in real time, but also added control. Customers don't just want to see the risk, they want to be able to stop it.
Absolutely. And that's where transaction security policy comes into play to help you act instantly on such activities. You can define policies to block an action if it does not comply with your business and security rules. For example, if someone tries to export a report with sensitive data, you can block that action in real time. No waiting for an admin to jump in. And if you look at API events again, every data read is captured and you can set transaction security policies to stop reads that don't comply with your organization's security rules.
So that way, policies don't just flag problems, they can actually stop a risky action before the data ever leaves salesforce. Which helps you with your data loss prevention. But let's be honest, with all that event data, it can get pretty noisy. Customers need to know what's actually suspicious.
Yeah, and that's where event monitoring is powerful again. Its threat detection feature learns normal usage patterns in your Org and flags unusual activity. Imagine a script running at 2am pulling thousands of records at once, Something that's never even happened before. That could be your first sign of data exfiltration, and we can help you catch it soon. So you can take action against it.
Absolutely. And that kind of intelligence closes a huge security blind spot that manual reviews might miss. Monitoring is critical, and protecting the data itself is a must. And when we talk about protection, we should also think about platform encryption and key management, which are also really critical for our customers.
Yes, platform encryption protects sensitive data at risk. But as you alluded to, the real value here is key management. You control when keys are generated, rotated, or even retired. You can even bring your own keys so your compliance and infosec teams know no one else has access without your authorization. That control is a key compliance requirement across the globe.
You're right. And while we're on the theme of compliance, we should also talk about data visibility and the tools that enable our customers to audit changes to data.
Absolutely. Field History Explorer is part of Field Audit Trail within Shield, where you can view historical changes to records over time really easily. So you can dig into who made what change and at what time. Even for updates which were made years ago, which auditors everywhere love.
Yeah, they sure do. It's about saving time and reducing risk overall. No more scrambling to pull together historical data under pressure. So, Porba, another area that customers struggle with is sensitive data ending up where it doesn't belong. And that's not always malicious. Sometimes it's just a really big compliance issue.
Yes, and we actually have a product for that too, Data Detect. It comes included within the Shield bundle. It automatically scans your salesforce Org for sensitive data like health or financial information. Once identified, you can encrypt it, limit access, or adjust your data retention policies. It's a super proactive tool because it removes blind spots and prevents accidental exposures.
And security isn't just about monitoring users. Connected apps can be a major blind spot too. If they're unmanaged, they can become a backdoor for data to leave salesforce That's.
A very great point, Rachel. For example, if there is a sudden spike in connected apps, maybe someone started integrating unsanctioned tools. You can get an alert using Security center to help assess risk and shut down risky access before it's exploited. With connected apps monitoring Security center, you see every app linked to any org.
Yeah. And Security center makes it easy to see your configuration for Security Monitor for drift and send alerts when changes are detected. And also our customers with multiple orgs really appreciate Security center because it brings all these metrics together in one place. So you're not just chasing alerts org by org.
Totally. Usually that would be a cumbersome process for most customers, but. But Security center helps again here we talked about Security Health Check in the prior video, which is available to all customers everywhere. Security center will surface health checks across all of your orgs so you have a sense of your security posture in one place and alert you if anything changes.
Right. So SHIELD and Security center are not just a compliance checkbox. They're active defense mechanisms. You can see events as they happen, you can block risky actions and you continuously improve your security posture and.
Exactly. Join us next time where we'll talk about data protection and governance solution for sandboxes and data cloud.
