I have completed a review of the following aspects of our organization

a) Authentication

b) Verifying profile based permissions are inline

c) IP restrictions

d) Timeout on unattended sessions

e) Code review using the scanner

f) Logon history and identifying old browsers

g) Verified the config change was not done by non-auth users via "View Setup Audit Trail"

h) Verified there are no licenses being wasted on ex-users (sadly this is not done before)

i) Authorization check in the form of who has "view all" & "modify all" on which objects etc

Are there any other places that I should be checking further to seek for vulnerabilities ?

Would appreciate any pointers.

  • 2 cents from me,help.salesforce.com/apex/… make sure manage permission and profiles is disabled. I once had an issue where a user had this flag enabled and he was able to edit his profile and assign modify all data. Fortunate for us he did not know he could login as another user – Rao Nov 3 '15 at 23:00

This is a good resource for checking security vulnerabilities. http://security.force.com/security/tools/forcecom/assessment

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.