Forcetalks

Tag: Shield Platform Encryption

  • Key Management in Shield Platform Encryption | Salesforce Security Guide

    Key Management in Shield Platform Encryption | Salesforce Security Guide

    Shield Platform Encryption licenses Salesforce head to deal with the life cycle of their information encryption keys while shielding those keys from unapproved access. To guarantee this degree of insurance, data encryption keys are never endured on disk.

    dont miss out iconDon’t forget to check out: Salesforce Security Model – An Overview

    The master secret is conveyed by a master hardware security module (HSM) toward the beginning of each release. The master HSM is “air-gapped” from Salesforce’s production affiliation and put away safely in a bank security store box. only assigned Salesforce security specialists can get to the safety store box and the master HSM set it aside inside.

    Key material is either made on request utilizing HSMs installed in the Shield KMS, or given by the client utilizing the Bring Your Own Key (BYOK) administration.

    The Bring Your Own Key service, introduced in Winter ’17, gives customers more control and versatility for managing key material through an API service. Customers can use open-source crypto libraries, their present HSM establishment, or third-party key expediting administrations to make and manage tenant secrets and information encryption keys outside of Salesforce. They would then be able to give Salesforce’s KMS admittance to that key material. Clients can deny this access whenever.

    The Shield KMS approaches the release-explicit secrets for each Salesforce release. As a matter of course, when an data encryption key is expected to scramble or unscramble client information, the Shield KMS gets the key from the master and tenant secrets. Clients can stop key derivation on a key-by-key explanation and move a last information encryption key, or store their keys in an outer key administration structure for on-request recovery. By controlling the lifecycle of your affiliation’s key material, you control the lifecycle of the gathered information encryption keys. Your Salesforce administrator indicates a user to deal with the key material for your association and appoints that user the Manage Encryption Keys client consent. This client authorization permits the key administrator to create, supply, archive, import,export and destroy key material.

    It’s feasible to have more than one dynamic tenant secret  in an association. You can apply explicit keys to data put away in various spaces of Salesforce. For instance, search index files are put away independently from other Salesforce information, so clients can apply key material to explicit data in those records. Just the latest tenant secret or data encryption key of a given sort is active, which means just that key material is utilized to determine the information encryption key used to encode information of a predefined type. At the point when you create or supply key material, the active secret gets archived. Archived key material is utilized to unscramble information that was last encoded when the archived key material was dynamic.

    You can erase an idle tenant secret. On the off chance that you destroy a tenant secret it’s not, at this point, conceivable to determine the encryption key needed to unscramble the data that was scrambled utilizing that key. Essentially, when you destroy a client provided data encryption key, you can’t get to data encoded with that key. Take exceptional consideration to back up and secure both archived key material and encoded data. When you destroy key material, it’s completely eliminated from the persevering layer and encoded key cache, and can’t be recovered.

    dont miss out iconCheck out another amazing blog by Shweta Choudhary here: All You Need to Know About Reports in Salesforce

    Per Release Secret Generation

    Around the beginning of each release, the master HSM is related with the disconnected PC and used to make the per-release secrets and keys (on the HSM itself). 

    Following secrets are created: 

    • Master secret 
    • Master salt 
    • Master wrapping key 
    • Tenant wrapping key 

    Every secret is hashed utilizing SHA-256.

     For implications of each secret and key, imply Keys and Secrets.  

    1. The master wrapping key (MWK) is encoded with the master HSM public encryption key and put away locally on the PC nearby its hash.
    2. Different secrets are encoded with the master wrapping key and put away on the PC with their hashes.
  • Salesforce Shield Platform Encryption Guide

    Salesforce Shield Platform Encryption Guide

    Shield Platform Encryption

    As organizations store more sensitive data, like actually recognizable data (PII), in the cloud, they need to guarantee the protection and classification of that information to meet both outside and inner consistence prerequisites. Shield Platform Encryption permits you to locally scramble your most delicate information at rest across the entirety of your Salesforce applications. Encoding information at rest adds another layer of insurance to PII, delicate, private, or exclusive information. 

    Salesforce offers two different ways to scramble information

    • Classic Encryption 
    • Shield Platform Encryption

    Before you encode

    Before the encoding of information in Salesforce — or in any cloud administration — first, you need to be sure that you’re using the correct security solution for the kind of threat you encounter. For example, on the off chance that you are generally worried about ensuring against end-client or regulatory record takeover attacks, which are typically accomplished through social engineering and malware bugs, data encryption may not be a proper control against such a danger. 

    dont miss out iconDon’t forget to check out: 9 Tips to Keep Your Data Secure in Salesforce

    Salesforce Shield Platform Encryption secures information at rest. It shouldn’t be mistaken for control that scrambles information on the way, like Transport Layer Security.

    Shield  Platform Encryption is most appropriate for: 

    • Protecting against information loss because of unauthorized data access.
    • Bolstering consistence with administrative necessities or inside security approaches.
    • Satisfying authoritative commitments to deal with sensitive and private information for clients.

    Shield Platform Encryption Process:

    At the point when clients submit information, the application worker searches for the org-specific data encryption key in its cache. If it isn’t there, the application worker gets the encoded tenant secret from the data set and asks the key inference worker to speculate the key. The Shield Platform Encryption organization then scrambles the information on the application server.

    Shield Platform Encryption utilizes a novel tenant secret that you oversee and a master secret that is dealt with by Salesforce organization. Naturally, we consolidate these secrets to make your unique data encryption key. We can provide the final data encryption key from our side.

    data encryption

    Before information is encoded, a Salesforce head needs to empower encryption first and produce or supply key material. For each field, record, attachment, and data element which are encoded, the connected metadata in the UDD is refreshed to show the new encryption setting.

    • At the point when a client saves encoded data, the runtime engine decides from metadata whether the field, file, attachment, or data element ought to be scrambled prior to putting away it in the database. 
    • If encryption has to be done, the encryption administration checks for the encryption key in the encryption key reserve. 
    • The encryption administration check for the key exists already or not. 
    • In the event that indeed, the encryption administration recovers the key. 

    dont miss out iconCheck out an amazing Salesforce video tutorial here: Security for Salesforce Developers: Data Security

    • On the off chance that key doesn’t exist, a request has been sending to the Shield KMS and returns to the encryption organization running on the Lightning Platform. data moving between the Shield KMS and the encryption organization is scrambled by the TLS convention, which utilizes an authentication endorsed by a submitted Salesforce authority. This current validation’s private key is taken care of locally in an encoded structure. The authentication’s public and private keys are rotated consistently.
    • Subsequent to recovering or inferring the key, the encryption organization makes a discretionary initialization vector (IV) and scrambles the information using JCE’s AES-256 execution. 
    • The ciphertext is saved in the database. The IV and related ID of the key material utilized for the determination of the data encryption key will be gotten in the database.
  • Encrypt Sensitive Data in Salesforce and Comply with Security Regulations

    Encrypt Sensitive Data in Salesforce and Comply with Security Regulations

    A Multitude of Data Regulations

    Nowadays, data storage and processing are heavily regulated by numerous protection laws, and businesses dealing with sensitive information are forced to comply with them. Data encryption is the most common requirement. Below are some common data types and applicable regulations, all of which require data encryption.

    Financial Data

    • NYCRR 500 Cybersecurity
    • PCI DSS
    • GLBA

    Health Data

    • HIPAA

    Personal Data Online

    • GDPR
    • CCPA
    • PIPEDA

    Any platforms or tools businesses use to process data have to comply with security regulations. Salesforce, which enjoys popularity across industries such as finance, health care, e-commerce, etc., is not an exception. According to the Brimit Salesforce team, nine out of ten customers have a product regulated by a data protection law. Failure to adhere to such regulations may result in legal and financial penalties, compromised data, as well as reputational damage.

    dont miss out iconDon’t forget to check out: Data Security in Salesforce

    Encryption Available in Salesforce

    Under existing regulations, organizations are required to securely store and process information such as:

    • Account usernames and passwords
    • Passphrases
    • Security and access tokens
    • Credit/debit card numbers and account data
    • Personal information: name, phone number, e-mail, address, income, gender, age, ethnicity, and education
    • Health data
    • Media access control address, serial numbers, and IP addresses

    Salesforce provides several tools for encrypting data:

    • Encrypted text fields (classic encryption)
    • Salesforce Shield
      • Event monitoring
      • Field Audit Trail
      • Shield Platform Encryption
    • Protecting data in Apex
      • Apex encryption (Crypto class)

    Footnotes:

    1. Salesforce most likely stores them separately and doesn’t provide control over the keys.
    2. Requires a third-party solution, which stores software on a 0.
    3. Features out-of-the-box functionality to ensure regulatory compliance.
    4. Not available out of the box, but there’s a workaround.
    5. There are no explicit requirements for encryption. What’s required is pseudonymization. If pseudonymization is performed by means of encryption, that’s fine. The developers need to choose the most common encryption method.

    Encrypted Text Fields (Classic Encryption)

    Salesforce provides encrypted text fields out of the box, at no extra cost.

    This classic encryption method allows for protecting a custom text field, which a user creates for a particular purpose. The encrypted text field is called Text (Encrypted).

    custom field

    dont miss out iconCheck out another amazing blog by Brimit here: How Salesforce Work.com Can Help Your Business Reopen Safely After or During the Pandemic

    How the encrypted text fields work in Salesforce

    Encrypted custom text fields may contain letters, numbers, or symbols, which will be stored and transmitted in an encrypted format with AES 128-bit keys. The encrypted fields have value for users who have View Encrypted Data permission. We do not recommend storing authentication data in the encrypted custom fields. However, these fields are suitable for storing other types of sensitive data (credit card information, social security numbers, etc.).

    Encrypted text fields have the option of “masking” parts of sensitive information, for example, showing the last four digits of a credit card number while hiding the rest.

    Encrypted text fields
    Using encrypted text fields to mask a card number

    The following masking options are available in encrypted text fields:

    • All digits
    • All digits except for the last four
    • A credit card number (as shown in the example above)
    • A national insurance number
    • A social security number
    • A social insurance number

    Reference: Brimit

  • HIPAA Compliant Salesforce Health Cloud – Why Healthcare Organizations Must Consider It

    HIPAA Compliant Salesforce Health Cloud – Why Healthcare Organizations Must Consider It

    In this fast-paced world, healthcare consumers want their personalized information at a great speed. 71% of millennials want doctors to provide mobile applications for actively managing their health information which the Salesforce health cloud does very well. Salesforce Health Cloud is fabricated to combine the power and security of cloud with social and mobile technologies.

    Let us first see what is HIPAA’s story and then move forward to how Salesforce Health Cloud meet HIPAA guidelines!

    A) HIPAA’s Story

    During the ’90s, the government of the United States decided to bring up new norms and regulations because the intervention of Information Technology was extensive. This gave rise to HIPAA which is Health Insurance Portability and Accountability Act.

    This act of HIPAA was formulated in 1996 by the United States Congress under the leadership of President Bill Clinton. Here is a few listing of HIPAA:

    A1) List Of Rules

    1. It states a list of norms, rules, and regulations which need to be followed in software used by the healthcare industry or medical institution. State-specific conditions need to be satisfied while using the medical information of citizens of the country.
    2. The rules were generalized by HIPAA in order to make the process simple for software developers and cloud service providers.
    3. HIPAA comprises of two sections, Title I and Title II. Title I holds rules and regulations which are aimed at protecting and safeguarding the rights of employees which are in respect to insurance policies and claims. Title II takes care of the integrity and security of medical health records, privacy policies, and other information security norms.

    Thereby HIPAA norms are prepared to keep in mind the following points:

    • Security of medical information
    • The integrity of medical information
    • Enforcement of right of privacy
    • Security of patient interest

    dont miss out iconDon’t forget to check out: Fight Against COVID-19: How is Salesforce Helping?

    B) Salesforce Meeting HIPAA Standards

    The cost benefits and operational efficiencies which are achieved by using cloud services like Salesforce are simply too important to ignore. Although Salesforce’s own security measures which are scalable and robust but still HIPAA compliance is an ultimate mandate for your organization, of course by following best practices. Let us see how Salesforce is meeting HIPAA compliance standards and streamlining processes.

    1. Privacy, Integrity, and Availability

    The U.S. Department of Health and Human Services describes PHI – protected health information of individuals as “individually identifiable health information.” HIPAA regulations aim at offering complete protection, privacy, integrity, and availability of such information. (PHI comprises of names, addresses, social security numbers, birth dates, information related to their payment for healthcare).

    Well, when it comes to Salesforce meeting HIPPA compliance, just do not bother about electronic versions of data which is ePHI. This is why the first step will be to examine the data you send to Salesforce and identify every field which contains or might contain ePHI.

    2. Data Monitoring, Controlling and Implementing Access Controls

    Here, when you know what ePHI you must protect, you can now lock the data. This you can do by crafting a strict access control policy for limiting access to data to only the employees and applications which truly need them. Here is where your DLP policy (Data Loss Prevention- is a strategy for making sure that end users do not send sensitive or critical information outside of a corporate network) and appliances comes into the picture. When you have identified what data must not be leaked, you can easily take steps to minimize the chance of unauthorized access. Data Discovery & Monitoring module of CipherCloud helps in exposing user activity. It helps in catching potential violators before their actions cause problems. CipherCloud’s Cloud Information Protection platform offers DLP modules that can identify HIPAA/HITECH violations henceforth protecting data.

    3. Encryption and Tokenization

    CipherCloud is a secure gateway that acts as a gatekeeper of sensitive information ensuring its integrity no matter where the ePHI resides. By giving your organization exclusive access to encryption keys, CipherCloud offers full control over the decryption of your data. Even if the data is leaked, no one will be able to read it or access it without your participation. CipherCloud’s cloud information protection platform is a great selection of encryption and tokenization options. Encryption is a standard approach to ePHI protection and the key to Salesforce HIPAA compliance.

    dont miss out iconCheck out another amazing blog by Algoworks here: Native vs Non-native Salesforce App: Which One is Better?

    4. Salesforce Shield

    Salesforce Health Cloud supports Salesforce Shield which enhances security. Shield Platform Encryption offers a whole new layer of security to your data, which preserves critical platform functionality. Shield Platform Encryption offers data encryption options that Salesforce offers out of the box. It is protected even when other lines of defense have been compromised. Event Monitoring offers user action visibility which allows security teams to quickly identify and track malicious use. Also, platform encryption safeguards data at rest while preserving functionality like workflow, validation rules, or search. The Field Audit Trail feature allows the state and value of data at any moment.

    Salesforce Health Cloud protects every element with its built-in HIPAA compliance features which comprises of Salesforce Shield, Field Audit Trail, Platform Encryption, Data Archive, and Event Monitoring. It offers a new dimension in the provider-patient relationship along with many platform features and resources.

    Looking for the Top Salesforce Consultant? Choose the best from here.

    Reference: Algoworks

  • What is Salesforce financial services cloud?

    What is Salesforce financial services cloud?

    This blog post takes into account the in and outs of Salesforce financial services cloud. The blog paves the way for you to understand everything about the particular topic and how you can use it to grow your business. We have tried to illustrate the methods by way of real-time screenshots. I hope you will enjoy reading it. The blog covers the following sections-

    Let us discuss the points in detail:

    1. Introduction

    Financial Services Cloud, powered by lightning is an integrated platform designed to drive stronger client relationships that last generations. It helps advisors to spend less time gathering client information and more time doing what they do best, such as providing holistic, goal-based advice that puts their clients at the center of everything they do. In other words, we can say,  Salesforce for financial services helps advisors to deliver a concierge level of service with the personalized, proactive advice clients expect.

    2. How can you grow your business using Salesforce financial services cloud?

    It has made the business easy- going. Salesforce financial services help you to turn your client base into an active referral network by tracking referrals from Centers of Influence or from within your own firm. Using this strategy, you’ll get to know more about your clients than just their investment strategy, and will have access to the networking tools needed to grow your book of business.

    3. How secure is my client data with Salesforce financial services cloud?

    Very- very secure! Salesforce Shield capabilities Along with the Financial Services Cloud, offer an extra layer of security/ safety including tools that monitor data access and usage and prevent suspicious activity.

    Along with the security features, you’ll have access to Event Monitoring, Field Audit Trail, and Platform Encryption to ensure your clients’ financial account information is kept confidential and secure.

    4. How can I export my existing data to the Salesforce financial services cloud?

    Don’t worry; you don’t need to know all the hard rule basics of Salesforce to export the data and to run financial services cloud. Salesforce already consists of several fruitful resources for data integration. It also provides a complete solution that addresses all your business needs. Not only this but also Salesforce ensures a level of scalability that promotes continuous innovation.

    5. How will Financial Services Cloud help me address fiduciary regulations?

    Financial Services Cloud, along with Salesforce Shield, provides an amazing suite of compliance features. It clearly means advisors, agents, and firms can adhere to new regulatory standards at scale. Also, it easily drives repeatable and visible collaboration across the entire firm. Keep a record of client relationships and communications. And establish consistent onboarding tasks to ensure the client’s best interests are always at the center of each interaction.

    6. How is Financial Services Cloud different from other wealth management tools?

    With the unique Client Data Model at the center of Financial Services Cloud, industries have access to all the important information needed to grow and nourish every client engagement opportunity. Also, Salesforce, as we know, releases three updates a year. Thus, financial services cloud benefits from it as well. It indicates that you are going to have access to three new updates every single day! And woahh! You can add them to strengthen and enhance your business growth.

    Time to sum up:

    Financial services cloud is available in all, Professional, Enterprise, and Unlimited editions. It even supports bulk actions and APEX steps. So, these were some of the in and outs of the Salesforce financial services cloud. Hope, you enjoyed reading. If you have any questions, do let us know in the comments section below.