The prospect of an internal audit can fill even the most seasoned CISOs with a sense of dread, but it doesn’t have to be that way. Audits are only a daunting proposition because of how often they reveal unsettling security gaps, which is why one of your most important priorities should be confronting a few unknowns and turning them into well-defined commodities.
If your company relies heavily on Salesforce, don’t take the security of the platform for granted. It’s up to you
to understand how Salesforce is being used to support different aspects of your firms' business, identify the sensitive information that is used or collected in your Salesforce org(s), and then consider how exposed that information is and what controls can be used to mitigate those risks.
An audit always feels like an inconvenient interruption, but it’s important for cross-functional teams to occasionally step back from business-as-usual activities. Building and deploying new business capabilities, supporting existing functionalities, and assisting end users are all vital practices, but teams also need to allocate time to identify areas of developing risk. Audits expose technology and product ownership teams to security and compliance topics they might not be familiar with, while governance personnel gain a better understanding of how an application like Salesforce is being utilized.
The result is an organization that’s better equipped to secure the platform, reach compliance goals, and ultimately reduce the risk exposure of the firm.
Knowledge Equals Security
From a constantly evolving suite of capabilities to a near-limitless capacity for diverse data storage, the same characteristics that make Salesforce an attractive business platform also make it a compliance nightmare. Your company could be using Salesforce in completely new ways from one audit to the next, and you might have as many orgs as your company has departments, making assessments incredibly complex for compliance professionals. As the risk mitigation landscape has become more and more unwieldy, fewer in-house risk assessment and auditing departments are up to the task.
Whether you choose to take on compliance and audits internally or you opt to work with a third-party specialist such as Own, there are three essential steps to improve upon the security posture(s) of the Salesforce org(s) used in your business:
- Build data classification into the DevOps process
To store data securely, you first have to define or classify each type of data and specify who should (or shouldn’t) have access. If you already have a classification framework but security personnel are the only ones familiar with it, that framework isn’t accomplishing its goal. By making data classification part of the DevOps process, you ensure developers know how each kind of data should be treated, allowing them to build the foundation for risk mitigation directly into their code. - Conduct static code analysis
Manual reviews can help your developers spot vulnerabilities in code before a program is ever run, but automated tools are a much more cost-effective means to perform static code analysis. These tools will ensure that code complies with certain guidelines such as MISRA or other standards specific to your industry. By incorporating static code analysis into the DevOps cycle, developers will be able to spot and fix problems in code before they pose a security risk in their production environment(s). - Implement a SecOps process for Salesforce
SecOps or DevSecOps removes the barriers commonly found between development and security teams. They also make security an integral part of application delivery requirements development and release processes. By putting the same DevOps principles of continuous development and testing to work with regard to security measures, DevSecOps creates a culture of risk mitigation and thorough security testing.
What started as a simple CRM has turned into something else entirely. Salesforce made it into the Fortune 500 by creating a powerful suite of enterprise applications designed to help companies do almost anything.
Unfortunately, those myriad powerful capabilities combined with the current deluge of data regulation legislation have made it increasingly difficult for organizations to achieve compliance.
We created Own Secure to help audit leaders take control of Salesforce and implement and track security configurations that reduce risk and meet industry requirements. By giving you a holistic view of your organization’s data, managing SFDC’s protective capabilities, and providing field-level audit trails in real time, Own can transform your next audit from an exercise in frustration to a case study in corporate data governance and security.
Interested in learning more? Request a free Guided Risk Assessment for Salesforce today, or schedule a demo below.
