Salesforce Security

Front 1

What are the main features that support SF Identity?

Back 1

1. Single Sign-on
2. Connected apps
3. Social Sign-on
4. Two-factor authentication
5. My domain
6. Centralized User Account Mgmt
7. User Provisioning
8. Identity Connect
9. App Launcher

Hint 1

9 features, different ways to provide unique views

Front 2

What is Single Sign-on (SSO)?

Back 2

Allows users to access all authorized resources without logging in separately to each one—and without having to create (and remember) different user credentials for each app.

Connect users to several accounts and applications running in other Salesforce orgs and even in other clouds.

For example, a call center rep with Salesforce Identity can click a link and be logged in immediately to other apps, like Google Apps, Office365, or Box.

Hint 2

one and done

Front 3

What are "connected apps"?

Back 3

The "authorized resources" for users. Connected apps bring Salesforce orgs, third-party apps, and services together. If a connected app is created without implementing SSO, it acts like a bookmark. Users can get to the app from the App Launcher or drop-down app menu, but they sometimes have to sign in again to use it.

So to get the most out of connected apps, configure them for SSO. With SSO, admins can set security policies and have explicit control over who uses which apps. You can also use connected apps to manage authentication and policies for mobile applications.

Hint 3

value of SSO set up

Front 4

What is "social sign-on"?

Back 4

users log in to a Salesforce org with their username and password from an external authentication provider, like Facebook, Twitter, LinkedIn, or Google.

You can set up any of these providers with a few clicks. With a little bit of work, you can set up other providers, like PayPal and Amazon.Social sign-on is especially useful when you want customers to be able to log in to a community without having to create (and remember) a new username and password. Customers can log in to a Salesforce Community site using their Facebook or LinkedIn account.

Hint 4

Facebook

Front 5

What is "two factor authentication (2FA)"?

Back 5

users have to provide a second “factor,” or proof of identity, in addition to their username and password. The second factor can be a verification code that the user gets from a mobile authenticator app like Salesforce Authenticator. Or users can have a code sent to them by text message or email.With the newest version of the Salesforce Authenticator app, the second factor can be a response to a push notification on the user’s mobile device.

helps ensure that even if an attacker acquires a user’s password, the attacker can’t log in and do harm.

Hint 5

2x as secure

Front 6

What is "centralized user account mgmt"?

Back 6

single place to manage all user mgmt tasks - access or lack to other apps, freeze access, login policies, etc

for users single password to remember

Hint 6

one stop shopping

Front 7

What is "user provisioning"?

Back 7

create, manage, and secure user accounts across all your orgs and connected apps

Hint 7

for connected apps

Front 8

What is "identity connect"?

Back 8

synchronizes users and their attributes from Active Directory (AD) to Salesforce. When a user is created in AD, that same user account can also be created automatically in Salesforce. When a user is deleted from AD, the user account in Salesforce is deactivated at the same time.

let users sign in to Salesforce using their AD username and password. In some circumstances, you can configure Identity Connect to automatically sign users in to Salesforce—users can click a bookmark or link to Salesforce and they’re authenticated and taken to Salesforce without even seeing a login page

Hint 8

quick access

Front 9

Why is app launcher part of the feature list for SF Identity?

Back 9

if you are connecting other apps, they can be included in the app launcher no login necessary if already logged into SF

Hint 9

one stop shopping

Front 10

Key benefits of SF Identity for partners and customers

Back 10

1. User Registration
   
2. Brand control
3. social sign on
4. seamless web experience
5. one comprehensive picture of the user

Hint 10

5 benefits, related to communities

Front 11

What does user registration have to do with SF Identity benefits?

Back 11

customizable process, collect relevant info, launch workflows right from registration

Hint 11

customizable

Front 12

What are the 3 identity protocols related to SF identity?

Back 12

1. SAML/XML
2. OAuth 2.0
3. OpenID Connect

Hint 12

used by service and identity providers like FB or app exchange apps

Front 13

What is SAML protocol and when is it used?

Back 13

Allows SSO to happen between orgs and apps

Hint 13

one and done

Front 14

What is OAuth 2.0 protocol and when is it used?

Back 14

allows secure data sharing between apps, such as SF1 app accessing SF data

Hint 14

sharing is good

Front 15

What is the OpenID Connect protocol and when is it used?

Back 15

allows for social sign ons like FB and Google, doesn't create a new account and new password

Hint 15

social is fast

Front 16

When Can Users Be Prompted for Two-Factor Authentication?

Back 16

1. Every time they log in to Salesforce, including API logins.
2. When they access a connected app, dashboard, or report. This process is known as step-up or high-assurance authentication.
3. During a custom login flow or within a custom app, for example, before reading a license agreement. More on this topic later in the trail.
   

Hint 16

3 times

Front 17

What features require a custom domain?

Back 17

1. Work in multiple Salesforce orgs at the same time
2. Customize your login page
3. Set up single sign-on (SSO) with external identity vendors
4. Set up authentication providers, such as Google and Facebook, to enable users to log in to your Salesforce org with their social account credentials
5. Use Lightning components in Lightning component tabs, Lightning Pages, the Lightning App Builder, or standalone apps
   

Hint 17

5 features

Front 18

What are the 2 My Domain Policies that can be set?

Back 18

1. login policy (only from custom domain)
2. Redirect policy

Front 19

What are the 3 redirect policy options for My Domain?

Back 19

1. Redirect to the same page within the domain. Lets users continue to log in from your URL as well as your domain name. This option might be convenient, but doesn’t enhance security for your org.
2. Redirected with a warning to the same page within the domain. Reminds users to use your domain name when logging in from your URL, but it still redirects them to your org. This option is good for a few days to help users transition to your new domain name, but it doesn’t enhance security for your org.
3. Not redirected. Requires users to use your domain name when viewing your pages. This option provides the greatest level of security.
   

Front 20

What is the Federation ID?

Back 20

• unique user ID in the industry
  
• can be the same for that specific user in multiple orgs

Hint 20

ID

Front 21

What permissions are needed to query event log files?

Back 21

1. API Enabled
2. View Event Log File permissoin

Hint 21

2

Front 22

What is Event Monitoring?

Back 22

• ability to view user activities, or "events"

Hint 22

activities

Front 23

How many different types of events can be monitored? Provide 8 examples

Back 23

30 types of events

1. logins
2. logouts
3. UITracking (mobile clicks
4. VF page loads
5. API calls
6. Apex executions
7. report exports

Hint 23

access,web & SF1,dev stuff, reporting

Front 24

What is an event log file and when is it generated?

Back 24

• all user events are stored in event log files
• when the event occurs
• available to view in 24 hours

Hint 24

tracking real time

Front 25

Name 3 benefits of event monitoring

Back 25

1. monitor data loss - spot issues before big problems
2. increase adoption - track areas not functioning well
3. optimize performance -track where issues lie

Hint 25

data and users

Front 26

Where in Setup can the event log files be accessed?

Back 26

• API only - not in setup
• Workbench is a tool to access the API object ("EventLogFile")

Hint 26

only advanced admins...

Front 27

How can you download event log files for easy viewing?

Back 27

1. direct download via Event Log Browser application
2. cURL script
3. Python script

Hint 27

3 approaches, script

Front 28

What is the advantage of using the Event Log File browser app to download files?

Back 28

more straightforward - converts to Excel or Sheets

Hint 28

Google

Front 29

What is the advantage of using cURL to download event log files?

Back 29

• allows for scheduling of downloads
• option to select format
• best suited for Mac and Linux

Hint 29

purple button, my way

Front 30

What is the advantage of using Python to download Event Log Files?

Back 30

• need more programmatic way to download
• best for Windows
• easy to understand

Front 31

What is encryption?

Back 31

scrambling of information so that only those with the right decoder can unscramble it

Hint 31

decoder rings

Front 32

When does Shield Encryption do the encrypting?

Back 32

when the data is stored (saved) in SF, "at rest"

Hint 32

peaceful

Front 33

Encryption vs other options for security

Back 33

1. field-level - who can access and edit fields on specific records
2. page layout settings
3. validation rules
4. roles and profiles
5. authentication and authorization - control who sees what data, at what time, from which locations and from which devices
6. Security Health Check and Event monitoring - monitor user events

Hint 33

3 overreaching options (there are more)

Front 34

when to use Shield Encryption

Back 34

• regulation requirements
• contractual obligations
• internal compliance policies

Hint 34

circle of trust

Front 35

What is an (encryption) key?

Back 35

• takes data and unscrambles to make it readable
  
• sometimes one is needed, sometimes more than one key is required
• some keys in pairs - one scrambles the task and the other unscrambles the task

Hint 35

open doors

Front 36

what is an (encryption) secret?

Back 36

• keeps keys safe and working properly
  
• pieces of keys, combine to create encryption keys
• allow servers to verify key up to date and request for access is from authorized key holder

Hint 36

hiding place

Front 37

What are tentant and master secrets?

Back 37

keys for keys (like teller and vault guard when accessing safety deposit box)

Hint 37

bank tellers

Front 38

How often does SF generate a new master secret?

Back 38

3 x a year, with each release

Hint 38

new stuff in SF

Front 39

How does the tenant secret work?

Back 39

• you create it, on demand
• stored securely in the database
• key derivation process - partners with master secret to create keys that encrypt and decrypt data

Hint 39

link to keys

Front 40

What level of encryption is included in the base SF license?

Back 40

• encrypt for special type of custom text fields
• classic encryption - 128 bit Advanced Encryption Standard (AES) keys
  

Hint 40

custom and standard

Front 41

What level of encryption is included with Shield Platform Encryption (free only to developer orgs and sandboxes)?

Back 41

• encrypt variety of data at rest- stored in fields, spreadsheets, standard and custom fields, databases and data warehouses
• stronger 256 bit AES key
• wider range of keys and permissions
• data is searchable

Hint 41

what, how, benefits

Front 42

What is "key rotation"?

Back 42

generating a new tenant secret and archiving the old one

Hint 42

refresh

Front 43

Steps to target critical needs for encryption when implementing Shield

Back 43

1. Define threat model - identify most likely threats, then create data classification scheme to decide Set No Sale Disposition Timer (25 seconds) to encrypt
2. Not all data is sensitive - focus on regulatory, security, compliance and privacy requirements...too much can slow down performance
3. Create data classification scheme early - work with stakeholders, find balance between functionality and security/risk

Hint 43

not all borders can be defended with walls

Front 44

Tips for assigning Permissions and key access

Back 44

1. create strategy early for backing up and archiving keys and data - can't be reset, always back up tenant secrets..otherwise no access
2. Grant Manage Encryption Keys to authorized users only , also monitor their activities with audit trail
3. Encryption applies to all users, regardless of permissions - when they enter or update data it will be encrypted every time, use View Encrypted Data Permission, along with roles and profiles, to control who has access

Hint 44

backup, admin, access

Front 45

True or False

If a user is granted the "view encrypted data" permission, he can view all data that is encrypted

Back 45

False

Depends on all other access points, such as roles and profiles, field level security, page layouts, validations, etc.

Hint 45

many ways to secure

Front 46

True or False

All apps in the App Exchange are compatible with Shield

Back 46

False

Many but not all, and some would prevent enabling Shield

Hint 46

"always" is a fantasy