// 01Executive summary
**Executive Summary: Salesforce Security Posture Review**
This Salesforce Security Guide (Spring '26) highlights immediate threats such as phishing, malware, and unauthorized data access, emphasizing the constant risk posed by weak authentication and overly permissive access configurations. Key indicators of compromise or vulnerability include deviations from strong authentication policies and broad user permissions. We must immediately leverage Salesforce's auditing features and Security Health Check for continuous detection, alongside monitoring authentication logs and granular access changes. Urgent response actions include enforcing Multi-Factor Authentication (MFA) and Single Sign-On (SSO), and conducting a comprehensive review to tighten user permissions and data sharing defaults. Proactive implementation of these hardening measures is critical to mitigate high-risk vulnerabilities and prevent potential data breaches.
// 02Key metrics
// ttps
5
ATT&CK techniques
// iocs
126
indicators
// actors
0
threat groups
// kwords
10
keywords
// 03MITRE ATT&CK
// 04Threat actors
// no actors matched
// 05Indicators of compromise
// ips8
- 12.34.56.78
- 1.1.1.1
- 96.43.144.26
- 201.17.237.77
- 182.64.210.144
- 96.43.144.30
- 96.43.144.28
- 96.43.144.27
// domains102
- security.salesforce.com
- force.com
- database.com
- featuremanagement.checkpermission
- 10.for
- 11.click
- 12.in
- 13.select
- 14.select
- 15.for
- 16.click
- 10.click
- 10.select
- 11.save
- 10.save
- event.isgroupevent
- recordtype.name
- user.id
- user.userroleid
- user.profileid
- user.department
- database.batchable
- database.batchablecontext
- event.eventidentifier
- eventidentifier.contains
- event.eventdate
- database.executebatch
- trigger.new
- event.userid
- event.username
- event.relatedeventidentifier
- event.sessionkey
- event.loginkey
- reportevent.records
- txnsecurity.eventcondition
- login.salesforce.com
- mydomainname.my.salesforce.com
- lisa.johnson
- apievent.rowsprocessesd
- loginevent.sourceip
- 10.enter
- 11.optionally
- 12.click
- 10.optionally
- loginevent.userid
- results.isempty
- loginevent.sourceip.equals
- apievent.queriedentities
- apievent.rowsprocessed
- reportevent.queriedentities
- reportevent.rowsprocessed
- listviewevent.queriedentities
- listviewevent.rowsprocessed
- queriedentities.contains
- reportevent.name.contains
- loginevent.platform.contains
- loginevent.browser.contains
- string.valueof
- loginevent.country
- country.equals
- loginevent.platform
- platform.contains
- platform.compareto
- txnsecurity.asynccondition
- this.apievent
- system.enqueuejob
- testevent.queriedentities
- testevent.rowsprocessed
- system.assert
- eventcondition.evaluate
- system.assertequals
- system.nullpointerexception
- profile.name
- profile.id
- testevent.userid
- system.debug
- window.navigator.platform
- reportanomalyevent.userid
- reportanomalyevent.eventdate
- reportanomalyevent.securityeventdata
- reportanomalyevent.sourceip
- apianomalyevent.userid
- apianomalyevent.eventdate
- apianomalyevent.securityeventdata
- apianomalyevent.sourceip
- servlet.filedownload
- currentpage.parameters.userparam
- document.location
- cookie.cgi
- 2bdocument.cookie
- xss-faq.html
- currentpage.parameters.userinput
- location.search
- document.write
- object.attribute
- request.title
- hello.html
- request.returl
- redirect.html
- csrf-faq.html
- apexpages.currentpage
- database.query
// urls16
- https://trust.salesforce.com
- https://trust.salesforce.com/security
- https://trust.salesforce.com/en/security/security-advisories
- https://shieldlearningmap.com
- https://instance.salesforce.com/services/data/vXX.X/jobs/query/750R0000000zxr8IAA/results
- https://mycompany.my.salesforce.com/servlet/servlet.FileDownload?file=0ATRM000000dcbH0A0
- https://developer.salesforce.com/page/Security
- http://www.attacker.com/cgi-bin/cookie.cgi?'%2Bdocument.cookie;var%20foo='2
- http://www.owasp.org/index.php/Cross_Site_Scripting
- http://www.cgisecurity.com/xss-faq.html
- http://www.owasp.org/index.php/Testing_for_Cross_site_scripting
- https://yourInstance.salesforce.com
- http://www.yourwebpage.com/yourapplication/createuser?email=attacker@attacker.com&type=admin
- http://www.owasp.org/index.php/Cross-Site_Request_Forgery
- http://www.cgisecurity.com/csrf-faq.html
- http://shiflett.org/articles/cross-site-request-forgeries
// sha2560
none
// md50
none
// emails5
- noreply@salesforce.com
- admin@company.com
- lisa.johnson@company.com
- standarduser@testorg.com
- attacker@attacker.com
// cves0
none
// 07YARA rule
// Failed to generate YARA rule
// 08Keywords
{'keyword': 'salesforce', 'score': 333.6938}
{'keyword': 'user', 'score': 298.8228}
{'keyword': 'users', 'score': 269.7565}
{'keyword': 'available', 'score': 246.269}
{'keyword': 'event', 'score': 229.358}
{'keyword': 'data', 'score': 207.9443}
{'keyword': 'access', 'score': 205.2551}
{'keyword': 'field', 'score': 203.4331}
{'keyword': 'sharing', 'score': 188.5239}
{'keyword': 'security', 'score': 182.2644}