salesforce_security_impl_guide
salesforce_security_impl_guide
salesforce_security_impl_guide
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Security Overview<br />
Trust and Salesforce.com<br />
Trust and Salesforce.com<br />
Trust starts with transparency. That’s why <strong>salesforce</strong>.com displays real-time information on system performance and <strong>security</strong> on the trust<br />
site at http://trust.<strong>salesforce</strong>.com. This site provides live data on system performance, alerts for current and recent phishing and malware<br />
attempts, and tips on best <strong>security</strong> practices for your organization.<br />
The Security tab on the trust site includes valuable information that can help you to safeguard your company's data. In particular, phishing<br />
and malware are Internet scams on the rise.<br />
Phishing is a social engineering technique that attempts to acquire sensitive information such as usernames, passwords and credit card<br />
details by masquerading as a trustworthy entity in an electronic communication. Phishers often direct users to enter details at a fake<br />
website whose URL and look-and-feel are almost identical to the legitimate one. As the <strong>salesforce</strong>.com community grows, it has become<br />
an increasingly appealing target for phishers. You will never get an email or a phone call from a <strong>salesforce</strong>.com employee asking you to<br />
reveal a password, so you should refuse to reveal it to anyone. You can report any suspicious activities by clicking the Report a Suspicious<br />
Email link under the Trust tab at http://trust.<strong>salesforce</strong>.com.<br />
Malware is software designed to infiltrate or damage a computer system without the owner's informed consent. It is a general term<br />
used to cover a variety of forms of hostile, intrusive, or annoying software, and it includes computer viruses and spyware.<br />
What Salesforce.com is Doing<br />
Customer <strong>security</strong> is the foundation of customer success, so <strong>salesforce</strong>.com will continue to <strong>impl</strong>ement the best possible practices and<br />
technologies in this area. Recent and ongoing actions include:<br />
• Actively monitoring and analyzing logs to enable proactive alerts to customers who have been affected.<br />
• Collaborating with leading <strong>security</strong> vendors and experts on specific threats.<br />
• Executing swift strategies to remove or disable fraudulent sites (often within an hour of detection).<br />
• Reinforcing <strong>security</strong> education and tightening access policies within <strong>salesforce</strong>.com.<br />
• Evaluating and developing new technologies both for our customers and for deployment within our infrastructure.<br />
What Salesforce.com Recommends You Do<br />
Salesforce.com is committed to setting the standards in software-as-a-service as an effective partner in customer <strong>security</strong>. So, in addition<br />
to internal efforts, <strong>salesforce</strong>.com strongly recommends that customers <strong>impl</strong>ement the following changes to enhance <strong>security</strong>:<br />
• Modify your Salesforce <strong>impl</strong>ementation to activate IP range restrictions. This will allow users to access Salesforce only from your<br />
corporate network or VPN, thus providing a second factor of authentication. For more information, see Setting Session Security on<br />
page 83 and Restricting Login To Trusted IP Ranges for Your Organization on page 81.<br />
• Educate your employees not to open suspect emails and to be vigilant in guarding against phishing attempts.<br />
• Use <strong>security</strong> solutions from leading vendors such as Symantec to deploy spam filtering and malware protection.<br />
• Designate a <strong>security</strong> contact within your organization so that <strong>salesforce</strong>.com can more effectively communicate with you. Contact<br />
your <strong>salesforce</strong>.com representative with this information.<br />
• Consider using two-factor authentication techniques, such as RSA tokens, to restrict access to your network.<br />
Salesforce.com has a Security Incident Response Team to respond to any <strong>security</strong> issues. To report a <strong>security</strong> incident or vulnerability to<br />
<strong>salesforce</strong>.com, please contact <strong>security</strong>@<strong>salesforce</strong>.com. Describe the issue in detail, and the team will respond promptly.<br />
2