Hi, this is Rachel Beard,
Security Architect for Salesforce.
I work with the customers everyday
to address top of mind security and compliance concerns.
Trust is our number one priority at Salesforce,
and my customers also want to be able
to show their stakeholders, that they're applying security
and technical measures to protect their sensitive data.
Today, I'm going to show you
some of the advanced security controls
that you can apply to encrypt data at Rest
to monitor access to data,
and react to suspicious events in realtime
with alerts prevention and threat detection.
I'll also show you how to strengthen security
in compliance for data and sandboxes with Data Mask.
First, let's take a look at Salesforce Shield.
With Platform Encryption you're able to apply
an additional layer of security
to your most sensitive data encrypting it at Rest.
Platform Encryption allows you to control
the life cycle of your key material,
using Salesforce's Tenant Secrets,
or bringing your own keys.
You can rotate your keys on demand
and you can also export, import new keys,
or destroy key material according
to your timeline and requirements.
Encrypting data is easy too.
You can set policies on a field by field basis
with just a few clicks.
We've provided a simple screen
that allows you to quickly audit
how much of your data has been encrypted.
And then to synchronize your data
to encrypt with your latest key version.
Moving on from Platform Encryption,
let's take a look at Event Monitoring.
Companies of any size in industry
are able to use Event Monitoring to track user behavior
and quickly identify anomalous behavior patterns.
You can also use transaction security to create policies
that work in realtime to prevent risky behaviors,
like exporting a large report with a lot of rows.
You can build a policy like that with clicks,
and it will alert the admin,
and prevent the export from being completed.
I'll show you an example of this right now.
When you build a policy,
you have the option to build with Condition Builder
for a lot of simple-use cases.
And we also have the option to build in Apex
when you have more complex logic.
For our use case, we're going to prevent a large download.
So, we're going to select Reporting Event,
and the operation that we're going
to work with here is ReportExport.
When we're thinking about a large report,
we're going to set a criteria
for how many rows can be processed at one time.
And here, we'll set a policy that says
we want to prevent any report
that has more than 100 records, from being downloaded.
Here, we're simply setting the conditions
that the policy is going to look for
and on the next page we say
what we want to have happen
when those conditions are met.
In this case, we're going to block the download,
and we're also going to notify admin about the incident.
And we'll say here, "No Large Download".
So, we've named our policy, and we have enabled it.
Let's take a look at it in action.
Here, we have a report with about 1,000 rows on it,
so now, when a user wants to download the data,
you'll see that our transaction security policy fires,
and it tells us that the operation
that we requested is not allowed,
because of the security policy in this environment.
Transaction Security Policies are really powerful,
because they run in realtime to prevent data loss
and that stops risky behavior rate in its tracks.
You can also subscribe to realtime events
for streaming access to use activity,
so you can get that full picture
of what you users are doing in your environment.
So here, we just see that event around exporting data
and we can get a picture for how much data was included,
what types of data were on the report,
which user was engaging here, the time of day,
a lot of context is provided with this tool.
All right, so, moving on from Shield,
let's talk about data in sandboxes.
When you copy data from production to a sandbox,
it's important to account for the different types of users
who may access the data in those environments.
Developers, third-party contractors,
user-acceptance testers, and training teams
need to be able to access the sandbox.
And they must have production quality data
without exposing PII or customer information.
With Data Mask, you can easily build policies
that add risky sensitive data in a permanent way
so that you no longer have to worry about PII.
You could choose to replace a name
with a pseudonym from the library.
So, for example, take a name like Rachel,
and it could be transformed into Sarah,
or Thomas, or Rebecca, another similar type
of a first name from a library we provide.
Or you could replace a custom value with a pattern,
and you can define the pattern of data
that you'd like to provide.
You can anonymize completely using random characters
or you can even delete the data
from even showing up in the fields at all.
So, you've got quite a few options
that you can figure to meet the needs of your data.
This process is really easy to configure,
and it's easy infinitely repeatable
saving a great deal of developer time
and speeding up your releases.
So, these are all great security controls
that are simple to configure and maintain
all while maintaining your internal
and external compliance regulations at every step.
You can visit Trailhead to get started,
we have great trails on Shield.
I encourage you to complete all of those.
And we also have a trail for Data Mask.
So, you can learn how to keep data
even more secure on the world's most trusted cloud.
Thank you.