Quick Check To Protect Yourself Against Vulnerabilities [White House Warning]

In March 2022, The White House issued a statement relating to the war in Ukraine. The focus was around the potential for Russia to increase cyberattack threats.

A series of recommendations were included to help companies fortify themselves against cyberattacks and reinforce their data security strategies.

Many of these guidelines speak directly to potential issues within Salesforce DevOps, such as:

“Check with your cybersecurity professionals to make sure that your systems are patched and protected against all known vulnerabilities, and change passwords across your networks so that previously stolen credentials are useless to malicious actors.”

Let’s look into how this relates to your Salesforce DevOps environment and what you can do about it. The first step is to understand the potential vulnerabilities because you can’t guard against something you aren’t aware of.

How This Relates to Challenges Within Salesforce

Organizations often struggle with managing their number of profiles and roles. Profile gaps can be confusing and challenging to debug. The complex mix of sharing architecture in Salesforce leads to users adopting practices that create security risks which can be exploited by both insider and outsider threats.

Shortcuts are often used to overcome complexity which leads to increased risk. One example of this is when users are given the Modify All role when all they need is Read Access or to edit one field.

Password exposure and malware risk are a constant concern for every environment, including Salesforce.

While we’re familiar with malware and ransomware coming through a browser, it can actually be distributed in multiple ways such as documents that have been uploaded as attachments. This puts everyone who opens that file at risk.

Stolen passwords continue to be a threat, especially if you don’t have good endpoint protection.

You are responsible for your security in the Salesforce environment. Salesforce does a lot to protect the platform, but you’re responsible for your own security within your particular org or instance.

Vulnerabilities in the Salesforce Sharing and Security Architecture

The sharing architecture within Salesforce is very complex. Org-wide defaults are currently transitioning away from profiles toward permission sets. So, when should you be applying more precision versus wider sharing?

Viewing this in totality can be confusing. Users often create profiles—which don’t encompass all types of named credentials, password policies, certificates, and keys—to cover various aspects of permissions.

Here are some questions you should ask yourself to assess your vulnerabilities:

• What are your org’s sharing settings for commonly used objects?
• Do you have more profiles than users?
• Do you use Guest Sharing Rules?
• When was the last time you audited the connected apps and auth providers?
• When was the last time you ran a Health Check?

These scenarios are unfortunately common and should be examined for vulnerabilities. Something as simple as offering guest sharing capabilities introduces the possibility of information being exfiltrated through guest users. And as we’ve seen with the recent Heroku breach, auth providers have the potential to create backdoors for cybercriminals.

Profile Deployment and the Risks Associated

Profiles are a complex matrix of permissions. Multiple profile metadata types are confusing and often misunderstood because they frequently overlap.

For example, a profile that is deployed from one sandbox to another will be cloned off the standard profile by default. This introduces differences between the two sandboxes unless you have the right tools in place to check the settings and enforce those changes from one sandbox to another. If not, this will also grant all sorts of unintended permissions which will be exposed in the process.

Salesforce recognizes that this is challenging. The roll out of Permission Set Groups started in 2019, which is a way of creating organizational roles. It’s highly recommended to transition away from profiles to role-based Permission Set Groups. It will give you better integrity across your sharing architecture and your permissions policies.

Embrace Multi-Factor Authentication

Salesforce adopted multi-factor authentication on February 1st of this year, but not for all products. In fact, many products won’t support MFA until 2023. As of right now, it only applies to the core Salesforce platform and not the other Salesforce cloud products.

Familiarize yourself with the MFA roadmap so you understand which aspects of Salesforce are covered and which are not.

Strong Passwords

In the meantime, continue to emphasize the importance of strong passwords. Encourage your users and team members to adhere to the Department of Defense recommendation of a minimum of 15 characters for each password.

Update Permissions, Avoid Technical Debt

It’s very easy to create technical debt when it comes to profiles and permissions. Audit your current settings to ensure user permissions are up to date. Salesforce’s Health Check tool can be used to identify gaps.

Be Aware of Phishing Attempts

Many environments are targeted not only daily, but hourly. Bad actors are always looking to gain access to your Salesforce environment through malware—potentially infecting an endpoint—or ransomware.

Summary

Protecting yourself against the potential vulnerabilities outlined by the White House necessitates constant attention and an honest look at your current processes. Cybercriminals are constantly growing more sophisticated. Our defenses against them need to evolve as well.