B2C Commerce sites and platforms are attractive cyber attack targets. Cyber
attackers look for locations where they can try to exfiltrate sensitive data, such
as credit cards, personally identifiable information (PII), and credentials. The
ordering workflow also offers an attractive attack surface for cybercriminals to try
to enrich themselves. They can create fake orders, adjust coupons and promotions,
and deny service to legitimate customers.
Salesforce takes security seriously and provides multiple security controls and
settings that mitigate these risks. B2C Commerce uses a shared
responsibility model in which the B2C Commerce platform and the customer
have clearly defined roles and responsibilities.
As our customers’ trusted adviser in data security, we use and make available the
following tools and practices to help strengthen their security.
| Salesforce |
Customers |
- Promote the secure design and implementation
of Salesforce infrastructure, platform, and
applications.
- Manage outbound and inbound firewall rules.
- Enforce two-factor authentication (2FA) on
sensitive Salesforce assets.
- Enforce data isolation per tenant.
- Run proactive code scans and pen tests.
- Perform third-party security assessments and
audits.
- Enforce controls to comply with industry
standards.
- Ensure continuous monitoring and incident
responses on Salesforce assets.
|
- Enforce secure communication protocols such
as HTTPS and Secure File Transfer Protocol (SFTP).
- Restrict application-level access controls,
for example, using IP allowlisting and identity
validation.
- Enforce 2FA on sensitive customer-managed
interfaces.
- Assign proper roles and permissions along
with robust user provisioning processes.
- Consume and analyze audit logs in a timely
manner.
- Promote the secure design and implementation
of custom code.
- Promote the secure sourcing, deployment, and
maintenance of third-party integrations and
extensions.
- Comply with relevant security standards and
regulations.
- Ensure continuous monitoring and incident
response on customer and custom third-party
integration assets.
- Deploy anti-abuse, fraud detection, and
prevention measures.
|
