The State of Salesforce Security 2024

For Salesforce Admins and users, understanding the best practices and industry standards around platform security is a critical part of the job. Strong security practices help to protect sensitive customer data, maintain customer trust, and ensure regulatory compliance. They also minimize the risk of data breaches, protecting companies from reputation damage and financial loss.

As the Salesforce platform itself is robust, with excellent platform security, companies can often forget about it in terms of a security risk. However, there’s still a need to consider the configurations and practices within your own organization that contribute to securing all of the confidential data housed within your Salesforce org.

In this document, we present our findings from a comprehensive survey on Salesforce Security practices. We have heard from Salesforce Admins across North America, and have analyzed the data to bring you key insights into the current state of Salesforce Security measures, data protection protocols, and the distribution of security responsibilities across organizations.

• Regular Backup: While most respondents back up their Salesforce data, there are still organizations who are skipping this critical step. Regular backup of Salesforce data is crucial to secure valuable data.
• Use of Restriction Rules: While most organizations use sharing rules, only 19% use restriction rules. These rules can provide flexibility and increase security by limiting access.
• Regular Review of Access and Permissions: Over half of the respondents updated access and permissions based on changes in job roles or responsibilities either monthly or quarterly. This practice should be adopted by all organizations to ensure that only authorized personnel have access.
• IP Restrictions: 35% of organizations did not have any IP restrictions to control access to Salesforce from specific locations. Implementing IP restrictions can prevent unauthorized access and protect the data.
• Regular Review of Sharing Settings and Use of Encrypted Fields: Most organizations reviewed sharing settings per object monthly or quarterly and used encrypted fields to protect sensitive data. This practice needs to be adopted by all organizations to ensure data privacy and protection.
• Regular Review and Analysis of Audit Logs: Two-thirds of organizations regularly reviewed and analyzed audit logs to look for unusual patterns or unauthorized access attempts. This practice can help detect and prevent potential security incidents.
• Phishing Simulation Exercises: 63% of organizations conducted phishing simulation exercises. This practice can help to assess and improve the susceptibility of Salesforce users to social engineering attacks.
• Communication and Responsibility: Clear communication and defined responsibility are important. Most organizations communicated security updates through email notifications and internal communications. Moreover, it is crucial to regularly conduct reviews and assessments to ensure adherence to security governance guidelines within Salesforce.