Ensuring Security on a Cloud-Based Platform – 5 Ways Salesforce and ComplianceQuest Nail the Challenge

Flexibility, accessibility, and capacity are often cited as the best features of the Cloud. A limited budget, ease of use, and a great user interface have ushered many legacy system users into the new age, with many of them adopting a cloud and/or mobile-first strategy.  IT in any organization prefers the cloud due to ease of deployment, upgrades that the vendor manages, use of the application from anywhere, and from any device.  This begs the question, how secure is the application, and even more, the data that is considered critical for the company’s success?  Security is rarely highlighted as a Cloud attribute, and in many instances, is mentioned with scepticism. It is often cited as the biggest barrier to Cloud adoption, especially amongst enterprise customers.

The 2015 Volumetric Insider Threat Report highlights some important data about security. Though consumers perceive traditional databases to be more secure than the Cloud, this is not the case. The actual risk of breaches to Cloud storage is 36% as compared to 47% in traditional storage.  Clearly, there is a knowledge gap between perceived Cloud security or lack thereof, and what Cloud has to offer.

Salesforce.com (SFDC) has pioneered the Cloud since the 90’s. With the passage of time, SFDC’s security measures have evolved greatly. When selecting a Cloud service provider, there’s no such thing as too much emphasis on security. With ComplianceQuest built on the Salesforce.com cloud platform and fully leveraging the power of the cloud, the security of Salesforce infrastructure, database and the platform is crucial for ComplianceQuest to be embraced.

Here’s how Salesforce has stayed on top of ever-demanding security challenges.

1. Datacenters

Data centers are used for the remote storage, processing, or distribution of large amounts of data. They ensure that businesses run efficiently. Thus, datacenter security is one of the most important aspects of Cloud security. It is understandable why so many companies invest so many resources into keeping their facilities and data secure. Data centers need to ward off physical threats, be protected against natural disasters, and comply with the law. Salesforce physically secures its data centers through 24-hour manned security, biometric scanning for access, dedicated concrete-walled data center rooms, computing equipment in access-controlled steel cages, video surveillance throughout the facility and perimeter, etc. In addition, SFDC takes into account environmental controls (humidity, temperature, etc.), power, etc.  Disaster recovery, secure transmission and sessions, backups, internal and third-party testing and assessments are all incorporated as a part of the datacenter continuity.   Finally, to secure the data, the information is replicated securely in real-time to secondary data centers, thus ensuring business continuity in case of catastrophic failures.

2. Platform

From initial architecture considerations to post-release, all aspects of platform development factor in security. Salesforce.com incorporates security into its platform development processes at all stages of the development life cycle. For example, at the design phase, guiding security principles and security training are put in place to help ensure Salesforce.com technologists make the best security decisions possible. Threat assessments on high-risk features help to identify potential security issues as early in the development lifecycle as possible. At the coding phase, SFDC addresses standard vulnerability types through secure coding patterns and uses static code analysis tools to identify security flaws. Proprietary tools and manual testing are used to identify potential security issues at the testing phase. Before release, SFDC validates whether the functionality being developed and maintained meets internal security requirements. Post release, independent security service providers analyse potential security issues.

3. Audit

Administrators (admins) in an organization have unlimited access. Unwittingly, the people with the most data access are perceived to be the most likely to exploit that data access. On the other hand, restricting admin access is counterproductive. An audit trail helps monitor admin user activity. An organization can be aware of who made what changes when and where. SFDC has integrated an audit trail to monitor all activities executed by the admin. This is especially useful in the case of multiple admins. Also within a Salesforce.com organization, activities performed by other users can be monitored through field history tracking, debug logs, event monitoring, and through customized tools.

4. Event Monitoring

Process, security, and usage data are critical to understanding the overall performance of a system. Signalling event occurrence in a timely manner is critical to security.SFDC’s event monitoring makes available the granular details of user activity in an organization. Events include logins and logouts, API calls, report extracts, and more. A log file is generated when an event occurs and can be downloaded. Tracking trends helps spot abnormal behavior, which can be a security threat. Every interaction is tracked and accessible via API; therefore, one can view any data visualization app of choice. User experience can be improved by troubleshooting and optimizing performance.

5. Awareness

The importance of awareness can’t be stressed enough. While no one expects employees to be security experts, they must be vigilant and know the company policies. Some common threats include scam emails (phishing and malware) and phone calls attempting to gather information. Storing information online, sharing permissions, and password protection are some of the topics that employees need to be trained on to reduce the risk associated with using Cloud services. Salesforce has a dedicated website to educate users on security. At Trust.salesforce.com, you can find real-time information on system performance and security, information on how Salesforce safeguards data, system status regarding service availability and performance, and information on the technology and legal compliance. Employee awareness about existing security features could potentially save the company millions. The Salesforce community of partners, developers, and users is strong as well. It’s a place to discover new trends in the industry, find like-minded individuals, share new information, and help find quick solutions to problems.

In the 2015 Volumetric insider threat report, the global survey results show that 56% of respondents will be looking to increase their security spend to deal with insider threats in the following year, and the remaining 37% will be spending at least as much as they are now.

Companies need the assurance that their data is safe and is managed well. SFDC has prioritised security from its inception and continues to invest in keeping its systems protected. Through server and network security, platform security, and creating user awareness, Salesforce anticipates Cloud needs ahead of time and builds solutions to cater to these needs.

ComplianceQuest chose the Salesforce platform because it offers all the benefits of the Cloud. In addition, with Salesforce comes the benefits of audit, event monitoring, and overall enhanced security over an on-premise system.