How to help earn customer trust by securing data in Salesforce

6-minutes read | November 29, 2021

Download PDF

At Salesforce’s Dreamforce 2021, CEO Marc Benioff spoke about a number of crises facing the world today that organizations must reckon with. One of them is a trust crisis: people simply have less trust in organizations than they used to. 

This is worth paying attention to: according to a recent PwC survey, 52% of executives of mid-size to very large companies across US sectors agree that higher customer trust is demonstrably associated with higher revenues and profitability¹.

Another PwC survey asked US customers and employees about foundational elements that define trust. Customers, employees, and business leaders agree that protecting data and cybersecurity is the top priority². 

In order to gain consumer confidence in your organization, you have to “walk the walk.” You’ll need to thoughtfully and intentionally configure security measures throughout your organization - including your Salesforce implementation. Salesforce must be integrated into your organization’s broader cybersecurity architecture and be aligned with your cybersecurity policies and standards. 

Key Considerations

Adoption of Salesforce SaaS does not change a company’s obligation to protect customer and stakeholder data. In fact, the shared responsibility model is clear that the business is responsible for data integrity rather than the vendor. And according to Gartner, 99% of cloud security failures through 2025 will be the customer’s fault⁴. 

The stakes are high. Here are a number of security-related considerations to address during a Salesforce implementation: 

• Gaining visibility into the overall security state within the organization: Before beginning a Salesforce implementation, it’s important to have a baseline of what security and technology architecture and policies are in place. 
• Engaging the C-Suite: Security and data privacy must be c-suite topics, given the stakes. In particular, the CISO needs to be involved early on in the design process so they can guide implementation with an eye on the long, strategic view to drive digital customer experiences that are both convenient and secure. 
• Complying with regulatory requirements: Salesforce contains a significant amount of mission critical data about your customers, employees, and partners. By doing business with you, these stakeholders are inherently trusting you to keep their data safe, and upholding this trust in your brand is more important than ever. Your products and security settings must be appropriately configured to maintain data security and comply with GDPR, CPRA/CCPA, and other global and domestic requirements.
• Salesforce cybersecurity options: Salesforce has made significant investments in cybersecurity. The key is to implement and fine-tune the available tools for your organization. Pair cybersecurity subject matter experts within your organization with a development partner who has expertise and experience customizing Salesforce security configurations. 
• Proactively preventing unauthorized use: Employees may inadvertently circumvent security policies - for example, a sales representative or support agent may input sensitive information into open text fields. There is also risk that employees may purposely use data inappropriately - for example, an employee may export and download data like customer lists or sales leads prior to leaving the company. Your organization must have policies and tools in place to ensure overall visibility into the use of and access to data within Salesforce. 
• Secure App-2-App communication: When integrating multiple, external data sources with Salesforce for a single and comprehensive view of transactions, the communication between apps must be secured. 

A Path to Success

Designing and maintaining an environment where customer and stakeholder data is secure is a big job with many considerations - but you’re not alone. PwC and Salesforce have many capabilities, methodologies and accelerators to help you succeed at keeping data protected and earning your customer trust. 

• Configuration management: One of the most important keys to success is to perform regular reviews of Salesforce security configurations with respect to permissions and preferences. With Salesforce, your team can move fast and add new business functionality all the time. Each time new features or functionality are introduced, however, there are key security considerations to take into account. Checking in on a regular basis helps ensure that as you’ve added new functionality for the business, your desired security posture remains intact. As you probably already know, new cybersecurity threats are discovered all the time. Regular reviews can help to adjust your configuration as needed for recently identified cybersecurity threats. Salesforce Security Center helps simplify configuration management, especially for multi-tenant environments.
  • Your first step: assess your configuration settings and develop a schedule for performing regular reviews. You may also consider leveraging NIST and MITRE Attack Framework as a foundation for designing security configurations for the Salesforce platform. 
• Encryption: Salesforce offers encryption in transit as a core and mandatory feature. Salesforce offers Platform Encryption to allow you to encrypt sensitive data at rest. It’s designed to improve your company’s confidence in complying with privacy policies, regulatory requirements, and contractual obligations for handling private data. 
  • Your first step: design a sensitive data management plan in alignment with existing data classification and encryption policies, Privacy impact assessment, data inventories, customer expectations, and global and domestic privacy requirements. A data classification exercise (made easier by using Salesforce’s Einstein Data Detect offering) can help identify where sensitive data resides in your environment, informing which data needs the additional protection provided by encryption at rest.
• Key management: Platform Encryption lets you control and rotate the key material used to encrypt your data. You can also use the Bring Your Own Key (BYOK) service to upload your own key material, or store key material outside of Salesforce, so your organization has even greater control over the access to sensitive information. Industry best practices indicate that encryption keys should be rotated on a regular basis to decrease the likelihood of a bad actor being able to decrypt your data. 
  • Your first step: assess existing processes and review your organization’s governance model for key management and BYOK. 
• Identity and access management: Choosing the data that each user or group of users can access is one of the key decisions that affects data security. Find a balance between limiting access to data, thereby limiting risk of stolen or misused data, versus the convenience of data access for users. Prioritize implementing Multi-Factor Authentication (MFA), especially given that most of the IT market will be mandated to use MFA for all IT systems and cloud access by February 2022 following an executive order from the Federal government.
  • Your first step: Assess current state infrastructure and architecture for SSO/Federation including User Identity Store.
• Threat monitoring: Real-Time Event Monitoring helps you monitor and detect events in Salesforce quickly and efficiently. It’s critical to understand how users are interacting with your environment, so you can know which controls should be implemented and keep an eye on anomalous behavior. You can store the event data for auditing or reporting purposes. 
  • Your first step: assess and document Salesforce events for event logging and monitoring. Set up a repository to store the logs and enable native Salesforce event storage. Determine what use cases you want to monitor and who is responsible for monitoring. 
• Incident response: Any business can be hacked. Your security teams must implement processes, tools and practices to manage, mitigate, and remediate cyber incidents. The security monitoring enabled through Salesforce Event Monitoring plays a vital role in this, as more transparency allows for better incident response.
  • Your first step: Design and document an incident response process for your Salesforce environment. This should include understanding of roles and responsibilities, contractual obligations, and clear handoffs between your organization and Salesforce. Based on our (PwC) experience, some organizations have considerably increased their incident response planning to include joint simulation, forensics, and information sharing.
• Securing lower environments: Sensitive data in a production Salesforce application can be protected with proper access controls and security settings. Lower environments often hold a mirror of the sensitive data, but require different access controls and security settings to enable development and testing. Salesforce Data Mask product can anonymize sensitive data in lower environments to avoid exposure while preserving the utility of the environments to developers and testers.
  • Your first step: identify lower environments that contain mirrored production data, and determine whether that data is properly protected. If it is not protected to the same extent that it is in production, set up a policy to anonymize the data whenever it is refreshed from production into the lower environments.

_{Sources:
¹ PwC, Building Digital Trust: The Partnership of Leadership and Operations, 2021
² PwC, The Complexity of Trust: PwC’s Trust in US Business Survey, 2021
³ McAfee, The Hidden Costs of Cybercrime, Zhanna Malekos Smith and Eugenia Lostri, 2020
⁴ Gartner, Is the Cloud Secure? October 10, 2019}