With recent Cyber Attack incidents at big corporations like Google, Cisco, and Workday on their Salesforce CRM instances, Salesforce has become prime targets for sophisticated cyber attack using third-party apps and predominantly using social engineering. Here, we will see how we can Secure Your Salesforce org while taking essential first steps against cyber attacks and social engineering.
Common Attack Patterns targeting Salesforce Orgs
Attackers targeting salesforce pursue various innovative techniques to get access into salesforce orgs, with Social engineering being the most prevalent.
- Phishing emails : Emails designed to look like official salesforce notifications which prompt users to click on malicious links and enter their login credetials.
- API Exploitations: Poorly secured or overly permissive API integration can allow attackers to extract large amounts of data or perform unauthorized actions.
- Session Hijacking: Attackers intercept active user sessions ( like dummy chrome extension to be used for salesforce)
- Custom Connected Apps : Rogue connected apps with excessive OAuth scopes can exfiltrate sensitive data if not properly vetted.
- Social Engineering : this is the most trickiest way to prevent where attackers trick users or admins into revealing credentials or approving unauthorized access via phone calls, fake tech support messages or impersonation.
Essential Steps as First Guards
Enable MFA (Multi-Factor Authentication)
MFA is really non-negotiable now. IF ever your password is stolen, MFA adds an extra layer of security.
Enable MFA in Salesforce via Set up -> Search ‘identity verification‘ on quick find box -> find and tick checkbox for MFA
Review and Harden Login Access Policies
Control when and from where users can log in :
- Trusted IP Ranges : Enter the Org-wide range of valid IP addresses from which user logins are trusted. Set up this from Setup -> Network Access.
- Login Hours : Restrict logins to working hours for users based on their profile. Set up this inside at Profile level.
- Session Timeout : Configure session expiration after inactivity to minimize risk of session hijacking. Define this inside Profile -> Session Setting
- Restrict Login IPs : Restrict specific user profiles to certain IPs only. Set up this inside Profile -> Login IP Ranges
Implement Strong Password Policies
Implement strong password policies for each type of users in salesforce. We can set up this inside Profile -> Password Policies. Enabling following password features will minimize the risk of compromised credentials.
- enforcing minimum password length (recommended 12+ chars)
- enforcing password complexity requirement (include special chars + numbers)
- enforcing maximum password retry count and so on.
Apply Principle of Least Privilege Access
Principle of least privilege access states that users should only have access to things that is necessary to perform their actions nothing more at all. this will essentially prevents any user from any unwanted access preventing accidental misuse or security breaches.
- Profiles : always start with baseline permissions and keeping it at minimal
- Permission Sets & Management : Assign only when it’s necessary. If required, add time-based permission assignment. Create Granular permission sets or custom permission to open-up the accesses later on.
- Avoid Broad Permissions : Limit use of ‘Modify All Data’ or ‘View All Data’ permissions.
- Flows : Make sure your flows should be running in User mode instead of System mode
- APIs : Limit API access to essential users only & Disable bulk API access unless required.
- Avoid Public Sharing : If possible, Keep ‘private’ access in the sharing rules or limit. ‘Public read/write’ access.
Secure API integrations and Connected Apps
Salesforce APIs and connected Apps are common for connecting third-party systems with salesforce. However, they can also become potential attack vectors if not secured properly. Attackers often exploit weak OAuth Configurations, excessive permissions or unused integration to get unauthorized access.
1. Restrict And Review Connected Apps:
- Pre-Authorized Apps only: Maintain a allowlist of approved apps, block any unauthorized OAuth requests.
- Grant Minimum required Access : Only provide the scopes needs for app’s functionality. Never provide Full Access scope (unless absolutely necessary)
- Monitor Scope Changes : Regularly check for any scope changes in connected apps.
- Verify App sources : Make sure all connected apps are from trusted vendors and verified sources.
- Remove unused Apps : Delete or deactivate any connected apps no longer in use to minimize your attack surface.
- Disable Self-Authorized Connected Apps : configure org policies so users can not create or authorize any connected apps without proper approvals
2. Monitor API usages and anomalies :
- Event monitoring for API calls : track API calls for any unusual patterns like accessive request or access from unknown IPs or outside business hours
- Revoke Access for any suspicious Apps : Immediately revoke OAuth tokens if app behaves unexpectedly
- Set Token Expiry : Configure tokens to expire after short periods.
Regular Health Checks & Audit Trail checks
Salesforce provides a Health Check feature in Set up that scores your org security. it also provide audit trail where you can track all the changes done in setup.
- Make sure to look at this Health Check at regular intervals and perform any required action to keep each security setting under complaint status. Aim to score 90+ all time.
- Regularly check Audit trail records in set up to track any anomalies in changes like unauthorized security changes in set up.
Hardest Attack to Prevent : Social Engineering
Social engineering attacks are the hardest ones to prevent or defend because attackers here target Human behaviour rather than technology. for technological breaches, we can have a well-defined standard operating procedures (SOP) to prevent/defend it.
However, when it comes to Social engineering, Standard operating procedures don’t work all the times because Attackers always find creative ways to exploit trust, urgency or lack of awareness to trick employees into inadvertently revealing sensitive info. But there is always a lesson learning and improving.
How we can prevent Social engineering attacks :
In order to prevent social engineering cyber attacks, Employees are the first line of defence. Technology alone can not prevent these attacks. it requires a strong security culture across the organization.
- Proper Cyber Security Training and Awareness : Train users to spot and report phishing or suspicious requests.
- Stay Informed of latest threats : always be aware of regular security updates and latest cyber threats to learn from other’s mistakes.
- Simulate Phishing Attacks : Test employee readiness with internal phishing simulations.
- Establish proper security reporting: In event of any incidents, there should be proper reporting channel to escalate suspicious attempts immediately to prevent further damages.
- Always use official company channels: always verify requests through official channels only for any communications.
Ultimately, preventing social engineering is about enabling people as much as protecting systems. A vigilant, well-informed employees are most effective security asset.
Salesforce Security Cheat Sheet – Quick Reference Guide
There is no magic wand when it comes to securing your Salesforce Org. It is on going process. However, having quick reference guide always helps you and your team stay prepared. You can download and print this cheat sheet to keep it on your desk or office.
