A Salesforce security-focused video discussion (Trusted Enterprise Security series) where Purva Kaushal and Rachel Beard review data protection beyond production environments. Key topics include securing sandboxes (full-copy risks, relaxed controls, and data obfuscation/datamask), backup and recovery capabilities for restoring modified/deleted records, and newly released Data Cloud governance features (metadata tagging, policy-based access, and dynamic masking).
Chapters
Data protection is vital to the success of all organizations. And it's not just your production org that needs to be managed. Your data exists in other environments and it's crucial to have security controls across your entire salesforce footprint. Welcome back to our Trusted Enterprise Security series. I I'm Purva Kaushal, a security Product Manager here at Salesforce alongside Rachel Beard, a Security Salesforce architect. In the last video, we highlighted key capabilities from SHIELD and Security center that provide our customers with advanced levels of data protection.
That's right, and today we're going to expand on some of our enhanceables or add on products beyond the more traditional use cases. So, Purva, let's start with developmental environments today.
You read my mind, Rachel. Organizations put a lot of effort into securing their production orgs. However, I've noticed that sandboxes can be a bit of a blind spot. Often organizations have loosened up their security policies in their full copy sandboxes, which are typically a complete copy of their production data and metadata. They may have users logging in with username and passwords instead of sso. They have many more super users and admins in those environments, and they often have third party contractors and developers who would typically not have a login to the production org. Yet these users can access the same production data in that full copy sandbox. That's exactly why we need to help customers extend the same protections to their sandboxes as they do in production.
Yes, and I see this at many of the companies that I work with. Organizations should think about what types of data exist in their sandboxes and which security controls are in place to protect it. I also want to see that they have a strategy around data obfuscation because a full copy sandbox contains production data that's critical for testing. Admins can reduce risk by using tools like datamask to transform their testing data into something meaningful but safe. By anonymizing PII and sandboxes, I'm thinking about fields like names, birth dates, ID numbers, things like that.
So true. And we know users make mistakes all the time. Data gets lost, corrupted or overridden. Data recovery is not something every customer plans for. But they should.
Yes, and as security professionals, we're obviously a little biased, but I totally agree. And that's why backup and recover is such a game changer. Not every customer has a plan B when something happens to their data. With backup and recover, you can be alerted when records are modified or deleted, and from there you can see what's changed and restore the data back to its original state, allowing you to quickly resume business operations.
Backup and recover is such a fan favorite across Salesforce and it came over from the own acquisition. Customers always tell us how much peace of mind they have, knowing if anything happens to their data they can quickly restore it. Now Rachel, as we talk more broadly about governance of your org, we have to talk about Data Cloud.
We do, and the new Data Cloud governance capabilities were recently released, so I'm excited to share that We've enhanced Data Cloud by offering native security and governance features that are designed to meet the evolving needs of structured, unstructured and zero copy data that's flowing into Data Cloud. Data from zero copy and third party integration systems remains securely protected as our metadata exchange enables you to enforce governance without requiring direct data access. By tagging metadata and data, admins can label and classify unstructured or structured data. Like marking records as financial or personal?
Absolutely. Those tags naturally feed into policy based governance where admins can quickly author access policies and enforce them across objects, fields or even records.
Yes, admins can author, enforce and manage policies to ensure that only the right data is surfaced to the right people or the right agents at the right time. And this can be applied consistently to all surface areas in Data Cloud, including AgentForce Plus. Data Cloud now has the ability to dynamically mask policies based on the user context. For example, a service agent may need to verify a Social Security number to take action on a request, but the full value can remain hidden, ensuring that the data remains protected while still enabling the necessary workflows.
That's a very helpful example, Rachel. We covered a lot in this video, from data recovery to data cloud governance like policy based tagging and dynamic masking. I'm sad to say this is our last conversation for now, Rachel, but let's do it again soon, shall we?
Definitely. Purva. I'm up for it anytime and we hope you enjoyed watching. If you want to learn more about any of the features or products we showed in this series, skill up with our Security Mini Series Trail Mix. Thank you.
