I have completed a review of the following aspects of our organization
a) Authentication
b) Verifying profile based permissions are inline
c) IP restrictions
d) Timeout on unattended sessions
e) Code review using the scanner
f) Logon history and identifying old browsers
g) Verified the config change was not done by non-auth users via "View Setup Audit Trail"
h) Verified there are no licenses being wasted on ex-users (sadly this is not done before)
i) Authorization check in the form of who has "view all" & "modify all" on which objects etc
Are there any other places that I should be checking further to seek for vulnerabilities ?
Would appreciate any pointers.
