1

Let's say you have a system that you want to integrate with Salesforce. You create a new user for the system, set up a trusted ip range, make the profile an API-only user, and then give the username and password to the system. If the worst were to happen and the credentials were compromised, it seems like there is a good level of security in place. The attacker wouldn't be able to login to Salesforce through the ui since the credentials are api-only, and they also wouldn't be able to login through the api since they are at a different ip address and their login attempts would be denied with a error message saying that they need a security token.

Are there other precautions involving the login process that should be taken to ensure Salesfore stays secure?

Improve this question

2 Answers 2

Reset to default
2

I would also recommend 1) setting strict permissions on which objects the API user can access and 2) regularly rotating the API user credentials

Improve this answer
0

@Martin, You can also consider Login Hours. A detailed documentation on setting Login restrictions can be found Here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .