The detailed insight lenses display a set of scores. The scores are based on risk rating for each security insights finding and help in prioritizing what comes first when it comes to remediation activities.
Risk-Weighted Scoring
There are two components to scoring. The first is a scoring algorithm used to determine the base score for an insight. The second is a risk rating value, which is applied to the base score. The risk rating is a numerical value that reflects the operational security risk of each insight within a Salesforce org. Risk ratings have an associated value, ranging from “Informational” (0) to “Very High” (4). Hovering over each score displays both information and guidance to assist with increasing scores. Insights can be customized to better fit the needs of an org.
Lens Insight Information
Each insight within a lens has an Information light-bulb button, which provides detailed information on its risk rating, what the insight represents, the risks it poses to org security, and common scenarios to avoid for a better security post. Click the Information light-bulb button on the insight card then click the drop-down arrow for each section to review the detailed information related to the insight the default risk rating for the insight as well as:
- What is this? A description of the insight
- What is the risk? The common risk associated with the insight
- Common Scenarios: Examples of what we typically see in environments that relate to the insight
- Scoring Policy Configuration provides a scenario-based breakdown of how the individual insight is scored
Configuring the Insight Scoring Policy
The Scoring Policy Configuration enables an admin to tailor insight scoring to better fit day-to-day operations and concerns.
Select an insight lens and click Scoring Configuration. A modal is displayed with the scoring configuration options. Each insight provides configuration options specific to that insight and should be carefully reviewed before configuration.
- Insight: Click the Information lightbulb button to provide detailed information on a specific insight.
- Risk Rating: Each insight has the option of setting a custom risk rating based on the requirements of the org. The risk rating can also be set from the Options menu of an insight.
- Scoring Policy: The scoring policy is made up of several values and target thresholds that can be customized to better fit the requirements of the org. Previously used scoring policies can be accessed through the Time Machine.
Guided Risk Assessment
The Guided Risk Assessment is a three-part survey, designed to assess at a high level whether there's risk to an org. The most common use for this feature is to decide how much or little an organization should spend on security solutions and efforts. The Security Insights feature helps find security problems within an organization, so they can be fixed quickly. The Guided Risk Assessment focuses on whether an organization should spend money on security solutions. This is achieved through periodic, scheduled, and automated analysis jobs. Security Insights requires an org to spend more time and effort in data classification and adjusting risk scoring policies to provide the best possible risk analysis. See Perform a Guided Risk Assessment .
Security Insights Reports
There are three reports available from Security Insights. The plans can be downloaded directly from the Security Insights tab, using the Download Plan button:
- Risk Summary
- Trend Data
- Detailed Risk Report
The detailed reports describe each Security Insight and the score achieved. Information and recommendations provide the necessary steps for improving the scores of each insight and category.