What is a Configuration Security Audit?
A configuration security audit is a comprehensive review of your Salesforce org's security settings, access controls, and data protection mechanisms. While custom code vulnerabilities are important, misconfigured security settings can expose your data and systems to significant risks.
Our audit examines all aspects of your Salesforce configuration including org-wide security settings, profiles, permission sets, sharing rules, field-level security, login security, and data access controls. We identify misconfigurations, overly permissive settings, and gaps in your security posture.
What We Audit
Org-Wide Security Settings
- Default record access (OWD) settings
- Sharing model configuration
- Public group and role hierarchy structure
- Account and contact sharing settings
- Case and opportunity sharing
- Custom object sharing defaults
Profile & Permission Set Security
- Profile object and field permissions
- Permission set assignments and usage
- Overly permissive access grants
- Unused or redundant permissions
- System permissions and administrative access
- IP restrictions and login hours
Field-Level Security (FLS)
- Field accessibility settings
- FLS enforcement in profiles
- Sensitive field protection
- PII field access controls
- Financial data field security
Sharing Rules & Manual Sharing
- Public group membership
- Sharing rule criteria and logic
- Manual sharing practices
- Sharing rule bypasses
- Overly broad sharing rules
Login & Session Security
- Login IP restrictions
- Session timeout settings
- Multi-factor authentication (MFA) enforcement
- Password policies
- OAuth and SAML configuration
- Trusted IP ranges
Data Security & Encryption
- Platform encryption configuration
- Field-level encryption
- Shield Platform Encryption usage
- Data residency and compliance
- Backup and recovery settings
- Data export and import controls
API & Integration Security
- Connected app security settings
- OAuth scopes and policies
- API access controls
- External service integration security
- Webhook security configuration
Audit Trail & Monitoring
- Field history tracking configuration
- Login history and monitoring
- Setup audit trail settings
- Event monitoring configuration
- Compliance reporting settings
Common Configuration Issues We Find
Critical Issues
- Org-wide defaults set to Public Read/Write
- System Administrator profile assigned to too many users
- Missing MFA enforcement for privileged users
- Overly permissive sharing rules exposing sensitive data
- Hardcoded credentials in configuration
High-Risk Issues
- FLS not enforced on sensitive fields
- Permission sets with excessive permissions
- Missing IP restrictions for API access
- Insecure OAuth configurations
- Insufficient audit logging
Medium-Risk Issues
- Unused profiles and permission sets
- Weak password policies
- Missing field history tracking
- Inadequate session timeout settings
- Poor role hierarchy design
Our Audit Process
We use automated tools and manual analysis to discover and catalog all security-related configurations in your org, including profiles, permission sets, sharing rules, and security settings.
We analyze each configuration against Salesforce security best practices, compliance requirements, and your business requirements to identify misconfigurations and security gaps.
We review user access patterns, permission assignments, and data access controls to identify overly permissive settings and potential privilege escalation risks.
We assess your configuration against industry compliance requirements (SOC 2, GDPR, HIPAA, etc.) and Salesforce security best practices.
We prioritize findings based on risk level, business impact, and exploitability, providing clear guidance on which issues to address first.
We provide detailed remediation plans with step-by-step instructions, configuration changes, and best practice recommendations for each finding.
Deliverables
Configuration Audit Report
Comprehensive report documenting all security configuration findings with risk ratings, current settings, and recommended changes.
Access Control Matrix
Visual representation of user access patterns, permission assignments, and data access controls across your org.
Remediation Guide
Step-by-step remediation instructions with configuration changes, screenshots, and best practice recommendations.
Compliance Gap Analysis
Assessment of your configuration against relevant compliance requirements with gap identification and remediation steps.
Security Baseline Documentation
Documentation of recommended security baseline configurations for your org to maintain ongoing security.
Benefits of Configuration Security Audit
- Data Protection: Ensure sensitive data is properly protected through appropriate access controls and encryption.
- Compliance: Meet regulatory and industry compliance requirements through proper security configuration.
- Risk Reduction: Identify and remediate configuration-based security risks before they can be exploited.
- Access Optimization: Optimize user access controls to follow the principle of least privilege.
- Best Practices: Align your configuration with Salesforce security best practices and industry standards.
- Documentation: Create comprehensive documentation of your security configuration for audits and compliance.