FAQ-000724 - Data Storage and Encryption Security / Secure Storage Best Practices

The recommended approach for securely storing sensitive data during customer migration periods includes: using Protected Custom Settings/Metadata to store sensitive information like encryption keys securely, encrypting sensitive data with strong cryptographic algorithms and ensuring encryption keys are stored securely, and restricting access to classes that add or update sensitive data to admin users only. For further guidance, refer to Salesforce's secure storage features and best practices.

The main issue identified is the reference to 'encryption keys' without specifying cryptographic security standards. Based on the ApexBadCrypto rule, which flags weak or deprecated cryptographic algorithms, I've refined the language to specify 'strong cryptographic algorithms' to align with security best practices. This helps guide developers toward secure encryption methods rather than potentially weak ones. The rest of the content is accurate and follows security best practices. Regarding security rules selected: - ApexBadCrypto: Directly relates to the FAQ's discussion of 'encrypting sensitive data' - this rule helps ensure strong cryptographic practices are followed during data encryption - AvoidHardcodedCredentialsInFieldDecls: Applies to the FAQ's guidance on 'securely storing sensitive information like encryption keys' - this rule prevents hardcoding credentials in field declarations - AvoidHardcodedCredentialsInVarAssign: Relates to secure storage of sensitive data mentioned in the FAQ - prevents hardcoding credentials in variable assignments - AvoidHardcodedCredentialsInVarDecls: Connected to the FAQ's emphasis on secure storage of encryption keys and sensitive information - prevents hardcoding in variable declarations - ApexSuggestUsingNamedCred: Relevant to the FAQ's discussion of securely storing sensitive information - Named Credentials are a secure alternative for storing credentials - ProtectSensitiveData: Directly applicable to the entire FAQ topic of 'securely storing sensitive data during customer migration periods' - this rule focuses on protecting sensitive data in general