- The document outlines security best practices for Salesforce admins, including running a Health Check to identify at-risk security settings, enabling two-factor authentication, and educating users about phishing. - It recommends actions admins can take immediately like using Health Check or OrgMonitor, as well as actions for the year like running Health Checks after releases and enabling IP whitelisting at the profile level. - Resources for admins and developers are provided, including security tools, trails, and forums for getting help from experts.

1. Security Basics for Admins
Salesforce World Tour, 2019
Suzie Smelyansky, Sr Manager - Platform Security & Emerging Technology
Mark Wigham, Lead Solution Engineer - Platform Security & Compliance

2. Agenda
● Security in 2019
● Health Check
● Demo & security controls overview
● Key actions you can take, today/this year
● Admin tools & resources
● Developer tools & resources
● Q&A

3. Security in 2019
What does Security mean to Salesforce?
Salesforce Customers
Trust

4. Security in 2019
Why is security
important?

5. Health Check and OrgMonitor
Give your security settings a check up
Measure your Org’s security against Salesforce’s
standard baseline
Easily identify at-risk security settings
Fix with one click for immediate results
Customize based on your company’s
compliance/reporting needs
Managing multiple orgs? Try OrgMonitor!

6. Demo: Health Check
Learn how to run Health Check and fix at-risk
security settings in your Org.

8. OrgMonitor
Our own security team was challenged
with the task of monitoring a large
number of orgs
Health Check for all your orgs!
We needed a tool that could quickly
scan all orgs and consolidate the
findings into one view
As a result, our team created and open
sourced OrgMonitor!

9. How can I start securing my org?
Things you can do TODAY
Use Health Check or OrgMonitor as a starting point to assessing each of
your orgs
Know where to configure security controls in Setup
Earn security badges on Trailhead relevant to your role (or to
expand your security knowledge)
Evaluate adding two-factor authentication (2FA) to your Salesforce
orgs/users

10. How can I start securing my org?
What is two-factor authentication?
Something
you know
Something
you have

11. How can I start securing my org?
Setting up 2FA
➔ Provides an extra layer of
security for your users beyond a
password
➔ Protects account access even if
a user’s password is
compromised!

12. How can I start securing my org?
Setting up 2FA
Step 2: At login, users will be
invited to use 2FA
Step 1: Set up a 2FA
permission set Step 2:
At login, users will be invited
to use 2FA

13. How can I start securing my org?
Setting up 2FA
Need more info? Take the
User Authentication badge
on Trailhead!

14. How can I start securing my org?
Actions you can take this year
Run Health Check after every release
Enable IP whitelisting, and set up login IP ranges at the profile level
Educate your users about phishing
Become a security advocate at your company!

15. Resources
For Administrators
Developer Tools &
Resources
Educational resources for
Admins, Developers and users at
salesforce.com/security
Tools
Protect Your Salesforce Data
Security Superbadge
Trails
Stay up to date by reading
security posts on the Admin
Blog and Salesforce Blog
Community

16. Resources
For Developers
Developer Tools &
Resources
Code Security Scanner
Partner Security Portal
OrgMonitor (GitHub)
Tools
Develop Secure Web Apps
Trails
Get help from security experts
in the Developer Forum on the
Success Community
Community

17. Security Basics for Admins: Trailmix!
Learn how to keep your company and your customers’ data safe
through security controls and enhanced user and access
management.
https://trailhead.salesforce.com/users/00550000006Gs4NAAS/trailmixes/
security-basics-for-admins