→ Read the full article on jitendrazaa.com

By this time, you must have heard many news like this where the Salesforce experience cloud is leaking information. As per this IBM study, the average cost of a data breach is around 10M.

Let me clarify, Salesforce is not leaking the information, but the bad implementation is.

Coincidently, beginning this year, I did a health check for one of my customers, and the biggest flag I raised was in experience cloud security. That analysis is still fresh, and I would like to jot it down in this blog post.

1. Org Wide Default settings for external users

This is no brainer for anyone in the Salesforce ecosystem, The OWD for external users should be set to the most restrictive setting possible to minimize the risk of unauthorized access to sensitive information.

2. Open up Security using standard & recommended way

Take the help of Role to open security for external authenticated users followed by sharing rules or sharing sets. Do not forget each experience cloud site has its dedicated guest user that can be used in Sharing rule, an extremely powerful feature for security.

3. Choosing the Right License

Depending on license type like High Volume Customer Community, Customer Community Plus & Partner Community object access is decided. Therefore profile can be used to control access to objects, fields, etc. Always go with the mindset of least access and then open up the field, record type, etc, access as needed, do not follow the principle of the benefit of the doubt in security.

4. Avoid Saving License Costs Using Customizations

This is the most common reason for security breaches in the experience cloud. Just to save the license cost, developers end up creating custom LWC, Aura, or Visualforce and exposing them publicly. Using this approach, wonders can happen. Like updating an Account without login, however, with some play with the parameter, it could very easily expose data to the external world. Make sure every Apex class that is written follows all security best practices like using with sharing keyword, stripInaccessible method , avoiding dynamic SOQL, enforcing user mode for database operations, filter SOQL queries WITH SECURITY_ENFORCED.

5. Regularly Run Security Scans

Use tools like Salesforce event monitoring, Transaction policy, CheckMarx, IBM Qradar, etc, to regularly scan code, user behavior, etc., to identify potential vulnerabilities and take appropriate action to address them. Monitoring unauthenticated user behavior is extremely complicated, but tools like Google Analytics can help in profiling user patterns and behavior.

Run Portal Health Check frequently and act as per Salesforce recommendations (sample report below).

6. Session Time Out

Setting an appropriate user timeout in Salesforce session settings is an important aspect of securing Salesforce Experience Cloud. By setting a user timeout, you can automatically log users out of the system after a specified period of inactivity, helping to protect against unauthorized access.

7. Enable Multi-Factor Authentication

Multi-factor authentication (MFA) is an important aspect of securing Salesforce Experience Cloud, as it adds an additional layer of security to the login process. MFA requires users to provide two or more forms of authentication, such as a password and a security token, to access the system.

It is important to ensure that every user in the Salesforce org, both internal and external, is using MFA, even if they are using single sign-on (SSO). While SSO provides a convenient way for users to access multiple systems with a single login, it does not provide the same level of security as MFA.

Security breaches don’t announce themselves, but the damage they cause will be loud and clear an could result in the demise of the whole organization.

If you have anything else to add, please feel free to post in the comment below.

For Customer Community , we can use Sharing set or Sharing Group.

For Customer Community Plus & Partner Community we can use role & Sharing rule. Maximum role that community can have is 3 per account and thats limitation there as well.

Now , lets assume below scenario

Let’s assume, user Pat Stumuller wants to see either few or all Opportunity from Account Edge Communications. Point to note here – Org wide sharing default is private and Pat does not belong to Edge Communications.

So, what could be the options ?

Account relationship data sharing rule is perfect solution in this case without writing any code. I’ve created below video explaining how it all fits together.

Resources :

• Account Relationships & Account Relationship Data Sharing Rules

Response was more than expected and questions were high quality. Therefore, I thought to quickly write high level summary of presentation in this blog post along with Youtube video that you can find towards the end of this post.

Firewall, Proxy and Reverse Proxy

Before integrating anything with Salesforce, as per Architect, it is necessary which system components are important for security and may impact with integration pattern to be used.

Firewalls : It controls and protects Malicious Traffics. Firewall can be hardware or software based.

Proxy aka Forward Proxy : Proxy normally configured in your browser or systems like VsCode, data loader, eclipse to hide your actual identity. Every outgoing request transmits through proxy server to make sure external systems unaware about your true origin and identity

Reverse Proxy : Its used by Web Servers and sits before it. It can server any purpose like authentication or perform security related stuff. Best example is Mulesoft where we can configure API proxy which is used to apply throttling, avoiding DoS attacks or applying SLA as per licenses provided to customer

Factors affecting Integration Patterns

At high level, there are five types of integration patterns in Salesforce

1. Request and Reply
2. Fire and Forget
3. Batch Data Synchronization
4. Remote Call In
5. Data Virtualization

1. Request and Reply

Few options available in request & reply integration patterns

• External Services
• LWC, Visual force calling external system
• Callouts from Trigger
• Batch Apex invoking external system

2. Fire & Forget

3. Batch Data Synchronization

4. Remote Call-in

5. Data Virtualization

Youtube Video on Salesforce Integration Pattern

Reference

• Mastering Salesforce DX and VSCode
• Platform Event Basics – Trailhead
• Salesforce Documentation on Integration Patterns
• Implementing External Services – Episode 10 of Path to code
• Integrating Salesforce using Rest API – Episode 8 of Path to code