New in Summer '16 with Event Monitoring and Transaction Security

Event Monitoring with Transaction Security has expanded the support for policy options from API based report export events to cover also UI triggered report exports. You may have seen the updated Apex class for Data Export Policy for Leads? This means any type of report export for specific resources like Leads or Accounts or Opportunities can be set to a specific trigger to apply the appropriate security condition according your security policies. In the stock policy we have defined the condition for more than 2,000 records or more than 1000 ms which would indicate a large data download. You're free to customize the resource and condition in your own policy.

global class DataLoaderLeadExportCondition implements TxnSecurity.PolicyCondition {
    public boolean evaluate(TxnSecurity.Event e){
        // The event data is a Map<String, String>.
        // We need to call the valueOf() method on appropriate data types to use them in our logic.
        Integer numberOfRecords = Integer.valueOf(e.data.get('NumberOfRecords'));
        Long executionTimeMillis = Long.valueOf(e.data.get('ExecutionTime'));
        String entityName = e.data.get('EntityName');

        // Trigger the policy only if and export on leads, where we are downloading more than 2000
        // records or it took more than 1 second (1000ms).
        if('Lead'.equals(entityName)){
            if(numberOfRecords > 2000 || executionTimeMillis > 1000){
                return true;
            }
        }

        // For everything else don't trigger the policy.
        return false;
    }
}

This helps security teams to stay in the know with realtime actions for large data export events or shield from unwanted data loss.

You can use various triggers, such as time, geolocation, IP, profile etc to customize the report export criteria. Simply choose the Data Export event from the dropdown menu and select Account, Case, Contact, Lead or Opportunity from from the resource name and apply your wanted action, in-app notification, email notification, two factor authentication or block.

Please see the following short demo for applying policy condition on report export with Accounts.

Time For Your Security Health Check

As a Salesforce administrator, have you ever spent to much time researching security for your cloud applications? Ever felt frustrated trying to find the security setting you need? That's why Salesforce created the Security Health Check, available to you in Spring '16 release. 

Why we built Security Health Check

Security Health Check was built to bridge the gap with security requirements and actual implementations of security:

• Difficulty understanding and staying up-to-date with everything security related and how it relates to your business and cloud applications.
• Configuring security requires security understanding of the business and application environment
• Due to changing business landscape, security requirements also keep changing and customers need information how security has been configured
• Administrators need to validate compliance across their application portfolio
• Identify needs for ISV or add-on security services like Salesforce Shield

Using Security Health Check

Security Health Check shows an overall score reflecting how well different security settings in your Salesforce application meet the Salesforce standard baseline. This baseline is the Salesforce recommended practice for implementing highest level of security. 

Under the hood

The typical Salesforce "org" has about 20 different security nodes in Setup. Each node consists of many different security settings. We've simplified this experience by elevating popular setting groups to the Health Check page. We evaluate each setting's security implication, its implementation, and apply proprietary risk scoring and weights to each security setting.

What’s Next for Health Check?

We are continuously expanding the scope and functionality of the Health Check on the Security roadmap. Future features include (under Safe Harbor):

• Exposing Health Check API for ISVs and security audits
• Adding more setting groups like Certificate and Key Management, Single Sign On and Login Access Policies
• Viewing Health Check across multiple Salesforce applications (org’s)

Try It!

In Setup, find Security Health Check by typing "Health Check" in the Quick Find box to find it under Security Controls.

We hope you use the Health Check and that it becomes a favorite security destination for you.

Please feel free to leave your comments, suggestions and feedback below. Thank you!