ZeroTrust:

Securing Your Businessfor TomorrowWe talk a lot about trust at Salesforce.
In fact, it’s our number one value. It’s the bedrock of our company, written in the DNAof our culture, technology, and focus on customer success. Trust is having a culturethat builds security into everything we do, so that our customers know that their data
is safe, and theirs — to be accessed when, where, and how they intend. And we do thatby adopting the latest technology and security best practices available.

The Next Evolutionof That? Zero Trust.
Which might sound like a contradiction.
But is actually how we’re moving our trustfirst culture forward — for our customers
and ourselves.
So what is this latest practice all about?
Zero Trust is a strategy. A framework. One
that throws the idea of a trusted networkout the window in favor of authorization
at every step. Think about it like yourhome. Just because you let someone in
the front door doesn’t mean you wantthem to snoop through your medicine
cabinet. Zero Trust is designed to protect
the network from the inside, so that even
if someone accesses one aspect of thenetwork, they will not have the ability tomove freely inside it.

Perimeter Defense is
No Longer an Option
In the last twenty years, cybersecurity
best practices have gone throughmany iterations. Gone are the days
when we all showed up to thesame office, with heavy desktops allconnected to the same network, did
our jobs, and left it all there — thedata, the devices, the work — to gohome at the end of our shifts. And
with that evolution, gone are
the days of single passwords andsimple cyber threats.

What used to be a comfortableperimeter for security teams tomonitor is now a vast network ofinternational offices, home work
environments, public clouds,
mobile devices, and of course,
more coffee shops than we’d like toadmit. 2020 only accelerated thework from anywhere revolution.
With more people working fromhome than ever before andmore businesses adopting cloudtechnologies, attack surfaces have
expanded and malicious actors
have found new vulnerabilities
to exploit. Overloaded corporate
VPNs, shortcuts to get remoteworkers online, bypassing protocols
to get information to bothcolleagues and customers alike —the risk landscape has completelychanged. While nailing thebasics — patching vulnerabilities,detecting and mitigating threats,
and educating employees on how
to be defenders for security is still
important, staying ahead of today’s
sophisticated threats requires
raising the bar.

You’ve heard about them in the news:
targeted malware and ransomware
threats, countless phishing and vishingattempts, data breaches, and insider
threats. These threats are not only
a problem for the private sector —they deeply affect the public sector
as well. So much so that President
Biden issued a May 2021 Executive
Order mandating Federal agencies
to modernize their cybersecurity
strategies and adopt multi-factor
authentication (MFA), a key
component of achieving Zero Trust.

Verify First, Then Trust
Where traditional network security
verifies permissions at the perimeterthen allows users to have access tomany components inside, Zero Trust isbuilt on the principle of least privilege.
This principle is a fundamental tenet of
information security, and means only
giving users, devices, applications, andsystems the minimum privilege level theyneed to do their job.
In a traditional network environment, aprivileged user will have a high level ofaccess to data and systems. If this user
is compromised by a malicious actor (ahacker), their access could be exploited

to perform unauthorized actions oraccess data — otherwise known as abreach. The possibilities are endless,and potentially extremely harmful to acompany. With Zero Trust, a user only has
access to specific things (applications,services, etc.) through a predefined
pathway, thus preventing a hacker fromdoing a lot of damage in the unlikely
event they are even able to gain accessto the network.

It’s a strategy that can help mitigate
threats such as malware, ransomware,and phishing, along with minimizing
the risk of insider threats, DNS data
exfiltration, and advanced zero-day
attacks. While unwinding legacy security
processes and changing strategies isn’t aneasy task and the ongoing administrationof a Zero Trust model can impact
productivity, the benefits can outweighthe challenges.

POTENTIAL BENEFITS OF ZERO TRUST:• Increased compliance and agility• Faster threat detection and remediation• Simplifying analytics• Fewer accidental high-privilege actions• Prevention of lateral network movement

Our Approach to Zero Trust
At Salesforce, we recognize that theattacks and attackers are getting moresophisticated every day, and our teamcontinuously innovates to stay ahead of
tomorrow’s threat landscape. We build
defense-in-depth into all of our systems— another way of saying we try to limit thepossibility of any single point of failure
by building in a layered approach oftechnology, process and people.
This is all part of our vision for a workfrom anywhere employee experience that
includes seamless access to corporate
resources while also uplifting our overall
security posture. As more of us moveto public cloud and remote work,it’s important that allaccess decisions be madedynamically, accounting forpolicy as well as context about
the current state of the user anddevice making each request.
And we practice what we preach— we don’t ask our customers to
do the things we wouldn’t ask
our own employees to do. This
includes using multi-factor
authentication, one of
the key components toachieving Zero Trust.

A FEW OF OUR ZERO TRUST BEST PRACTICES:• Device credentials should be hardwarebacked or hardware-isolated on a system• All connections use strong, approved
encryption• Authentication and authorization aredone before allowing access to services
and resources• Connections are monitored and closed ifthey have exceeded authorization• Location is not a proxy for device orsole authorizing attribute• Maintain dynamic inventory ofdevices and authorizations• Implementation of multi-factor
authentication (MFA)

Multi-Factor Authentication and Zero TrustAs threats that compromise user credentials grow more common, usernames andpasswords are no longer sufficient safeguards against unauthorized account access.
Multi-factor authentication (or MFA) adds an extra layer of protection against
common threats like phishing attacks, credential stuffing, and account takeovers byrequiring additional factors to prove the identity of a user. That means even if a badactor steals a username and password, they won’t make it past an additional security
check to access critical data.

How does it work? MFA requires a userto validate their identity with two or more
forms of evidence — or factors — when
they log in. One factor is something theuser knows, such as their username andpassword combination. Other factors areverification methods that the user has intheir possession. While there’s a risk that apassword may be compromised, it’s highly
unlikely that a bad actor can also gain
access to a strong verification method likea security key or authentication app.
Not only is implementing multi-factor
authentication (MFA) one of the mosteffective ways your company can increase
its security posture, but it’s a criticalcomponent of a larger Zero Trust strategy.
It’s so effective, in fact, that, as of February
1, 2022, we’re requiring all customers touse MFA to access Salesforce products.

Not to worry, though. Salesforce offers simple, innovative tools and training tohelp you be successful — and secure. This includes extensive resources to assist
in implementing MFA, including:• Salesforce Multi-Factor Authentication FAQ• User Authentication Module• MFA Quick Guide for Admins• And join us on the trail in the MFA - Getting Started Trailblazer Community
Ultimately, the goal of adopting a Zero Trust security posture goes beyond
simply reducing your attack surface. Going borderless is vitalto organizations with global
workforces and remote employees.
It can also help accelerate
integration of acquisitions,enable improved platform
integrations, and provide a
better end user experience.

To learn more about the security features and resources available tohelp your organization work smarter, faster, from anywhere, explore
the Salesforce Security Guide or visit security.salesforce.com.

© Copyright 2000–2021 salesforce.com, inc. All rights reserved. Salesforce.com is a registeredtrademark of salesforce.com, inc., as are other names and marks. Other marks appearing herein
may be trademarks of their respective owners.

    