How to Protect Your Data in Salesforce

From startups to Fortune 100 companies, Salesforce has become the go-to CRM for businesses worldwide. This cloud-based software provides valuable tools for finding prospects, closing deals, and delivering exceptional customer service. However, with the rise of real-time data-driven insights and remote work, organizations face heightened security risks when deploying and using collaborative applications like Salesforce.

In a shocking revelation, a significant number of public Salesforce sites have been found to be unintentionally leaking sensitive and private data, raising serious concerns about data security and privacy. This alarming discovery underscores the pressing need for organizations to prioritize robust security measures and highlights the potential risks associated with inadequate data protection practices.

In this blog post, we will explore the security issues inherent in Salesforce and shed light on the data exposure risks businesses may encounter. We will also discuss how a best-of-breed Data Loss Prevention (DLP) solution can help safeguard your sensitive data, mitigate potential breaches, and ensure compliance with regulations.

The Cost of Data Exposure

Data exposure in Salesforce can have severe consequences for your business. The average Salesforce production org contains over 2,000 fields with sensitive data, and shockingly, more than 80% of exposed sensitive data remains available for misuse. These instances of misuse can lead to data breaches, causing reputational harm and financial loss. Regulatory bodies impose fines ranging from $5,000 to $100,000 per month, 4% of annual revenues, or even up to $20 million until compliance is achieved. It's crucial to prioritize protecting your sensitive data to prevent both reputational and monetary harm to your business.

Compliance and security in Salesforce

Salesforce is designed as an environment where customer Personally Identifiable Information (PII) is shared and stored. However, compliance regulations like PCI DSS, HIPAA, GDPR, and CCPA restrict the storage and usage of customer data to what is necessary for organizations to fulfil their duties. These regulations also impose requirements on how data should be stored, such as encryption protocols. To ensure compliance and protect sensitive data, security administrators, compliance officers, and operations teams must understand how to safeguard the data ingested and generated within Salesforce. Implementing a comprehensive DLP solution can help identify and mitigate potential vulnerabilities, safeguarding your data against exposure risks. One might ask: “How and why would Salesforce be a potential application for sensitive data leak?”

Potential vectors of attack in Salesforce

Some common data exposure risks in Salesforce include:

1. User Error: User error poses a significant risk, including accidental sharing of sensitive data with unauthorized parties or misconfiguration of permissions, roles, or access controls. Examples of user error include sales reps or support personnel updating records, email-to-case workflows, and real-time file uploads during chats, which can become gateways for malicious attacks.
2. Malicious Insider: A malicious insider can include employees, contractors, or partners who intentionally expose sensitive data to unauthorized parties or steal data for personal gain.
3. Third-party Apps: Third-party apps and integrations may access or store sensitive data in ways that are not fully understood or controlled by the organization, leading to unintended data exposure.
4. Data Migration: If data migration is not done carefully, sensitive data may be inadvertently exposed during the migration process.
5. Access Controls: If users have more access privileges than needed, or if access controls are not regularly reviewed and updated, sensitive data may be inadvertently exposed.

Salesforce workflows and sensitive data exposure

Salesforce also offers various built-in workflows that can facilitate data exposure if not managed properly. A few of these workflows are:

1. Web-to-Lead: This built-in workflow allows users to automatically create leads from web forms, capturing customer information from websites and creating leads in Salesforce. Ensuring the secure handling of customer data during this workflow is essential.
2. Email-to-Case: Email-to-Case enables users to create cases in Salesforce from customer emails. Proper configuration and monitoring of this workflow are crucial to prevent unauthorized exposure of sensitive data contained in customer emails.
3. Social Customer Service: Social Customer Service workflow enables users to monitor social media channels for customer inquiries and complaints, automatically creating cases from social media posts and messages. Organizations must ensure that sensitive data shared via social media is protected from exposure risks.
4. Knowledge Management: Knowledge Management in Service Cloud allows users to create and manage a knowledge base of articles, documents, and resources. This workflow can reduce the number of cases created but requires careful handling of sensitive data contained within the knowledge base.

Sensitive data exposure in Salesforce

Based on policy incidents we have seen in production environments across Salesforce Sales, Service, Health and Community Cloud, the three most commonly shared items in Salesforce are:

1. US Driver’s License;
2. API keys; and
3. Routing numbers with ABA.

These findings confirm that Salesforce is an attractive application for hackers and bad actors seeking to exploit sensitive data. One of the challenges organizations face is that employees often unknowingly share sensitive information. It can be buried in attachments, support tickets in Service cloud, customer forums in Community cloud, any standard or custom objets within Sales cloud or shared inadvertently with third parties, further increasing the risk of data exposure.

The status quo for Salesforce data security

Given potential vectors of attack in Salesforce, organizations need to answer: “How do I effectively and proactively protect customer data that aligns with my security standards?” While Salesforce provides native security tools and other vendors offer security solutions, these approaches can be flawed due to three key reasons:

1. The inability to enforce consistent data security policies across all your SaaS applications and cloud infrastructure services where sensitive data may exist.
2. The lack of an automated approach to classify and secure any standard, custom object or field, including all file types in Salesforce.
3. The reliance on simple regex-based pattern matching is limited to just five different types of sensitive data patterns.

That is why the need for an alternate, best-of-breed sensitive data discovery and security solution is clear.

The Nightfall approach

Any vendor an organization chooses should view security as an enabler for business teams by increasing, not impeding, worker productivity. Thus, Nightfall’s focus is on coaching end-users on acceptable usage of sensitive data instead of inline blocking. With the ability to perform both historical and real-time scans, organizations can instantly discover and secure the most sensitive data and eliminate all data exposure risks. An agentless installation, API-only integration with cloud services, and a AI-based detection engine make it the easiest-to-use and operationally effective data security solution. Key capabilities of Nightfall include:

1. Proactive sensitive data discovery: Nightfall allows organizations to proactively discover highly sensitive data across any standard or custom object, field in Salesforce Sales, Service, Health and Community Cloud. As an example, this includes real-time or historical scanning support for objects such as Accounts, Case, Task, Feed Comments, Feed Item, Attachments and Email messages. Nightfall can scan attachments across all objects with support for more than 100+ file types including xls/xlsx, doc/docx, csv, plain text, ppt/pptx, PDF, HTML and more.
2. Standard machine-learning trained detectors: Nightfall comes with ML-trained detectors out of the box, with the ability to add in custom detectors, rules, keywords, and regexes as well. The full list of the Nightfall detectors can be found here.
3. Intelligent policy engine: Organizations can utilize detectors, detection rules and policies to discover and secure sensitive data in real time or perform periodic historical audits. You can select any organization in Sales, Service, Health or Community cloud. The policy scope auto-discovers standard and custom objects, and fields across all Salesforce organizations. Detection rules provide flexibility to combine detectors across categories with confidence thresholds and occurrences for highly accurate results. Automated actions ensure instantaneous remediation.
4. Eliminate data exposure risks with a unified view across all organizations and out of the box SIEM support. Nightfall’s data security and compliance for Salesforce provides a unified view across all sandbox and production organizations. With an API-only, two-step installation process. Utilize any alerting platform of your choice such as Slack, Email or a SIEM/SOAR tool to meet the varied needs of personas across CRM, InfoSec and Compliance teams responsible for managing data security in Salesforce.
5. Classify and secure sensitive data with automated actions and stay audit ready. Nightfall supports compliance efforts for PCI, GDPR, HIPAA, CCPA, SOX, and various other regulatory regimes. You can utilize built-in, real-time, evidence-based reporting capabilities to establish compliance with these regimes, along with the ability to customize and get granular insights on where sensitive data exists in your organization.

How to identify sensitive data in Salesforce

Nightfall’s approach is not only complementary to Salesforce Shield but can also significantly improve security hygiene through proactive, end-user coaching, overall visibility, and operational efficiency. Nightfall’s goal is to empower organizations with the most effective, lightweight cloud data security platform to be compliant with industry regulations and security standards. Below are the sensitive data protection benefits customers will achieve:

Customer PII

Collecting customer information such as SSNs, names, and street addresses is often input into a CRM tool like Salesforce. However, with increasing regulations such as GDPR and CCPA, it is important that you minimize the amount of PII stored. Nightfall can help find and remove superfluous PII by instituting the following simple rules:

• Select the person name detector and combine it with one of the following detectors: US social security number, US driver's license, US passport, US Individual Taxpayer Identification Number (ITIN), set the Minimum Confidence level to Very Likely, and ******the ******set alerts to trigger on Any Detectors

Patient PHI (HIPAA)

If you provide health services, your CRM may contain patient information. However, PHI is subject to HIPAA rules and must be protected via DLP. With Nightfall, you can:

• Use the Protected Health Information (PHI) detector, set the Minimum Confidence level to Likely, and set the alerts to trigger on Any Detectors

Payments & PCI

If you accept customer payments then it is vital you don’t store any bank account information or payment information within Salesforce. To set up automated protection in Nightfall simply:

• Select applicable Financial detectors, set the Minimum Confidence level to Very Likely, and ******set alerts to trigger on Any Detectors

Maintain compliance with standards such ISO 27001

As your business grows you will likely become subject to leading compliance standards such as ISO 27001, SOC 2, HI-TRUST, and more. These standards all come with complex requirements about how data is stored and protected. Detailed instructions on how to set up continuous compliance with these standards are contained here.

Conclusion

Maintaining the security of sensitive data is not new. What is new is that the volume of attacks and resources, and efforts going into security attacks on at-home employees has increased significantly. What’s happening is people are becoming more creative in the last year to exploit it.  But the good news is Nightfall provides the fastest and easiest way to secure Salesforce data.

Want to learn more about Nightfall’s user-friendly DLP integration with Salesforce? Book a demo with our team today, or book a free risk assessment to ensure your Salesforce instance is secure.

‍