FAQ-000842 - External Platform Security / External Platform Hosting and AWS

To prepare for security audits of hybrid Salesforce-cloud applications, follow these steps: 1. **Secure Credentials and Secrets**: - Encrypt secrets using AES-256 or higher for server applications and store encryption keys securely. - Use vendor-provided keychains or secure storage for client applications. - Avoid storing secrets in browser apps; rely on password managers instead. - Use Named Credentials for external service authentication instead of hardcoding credentials. 2. **Perform Security Scans**: - Use tools like Salesforce Code Analyzer or Checkmarx to identify vulnerabilities. - Conduct manual testing to catch issues automated tools might miss. - Include external endpoints and components in your testing. 3. **Implement CRUD/FLS Checks**: - Enforce proper CRUD and field-level security (FLS) checks, especially for standard objects. - Assess and address vulnerabilities in custom objects. 4. **Validate Sensitive Data Handling**: - Avoid writing sensitive data (e.g., API tokens, passwords) to debug logs. - Encrypt and securely store sensitive data. 5. **Prepare Documentation**: - Provide detailed documentation, including security policies, test results, and explanations for false positives. - Include user documentation and tailored information security policies. 6. **Test External Components**: - Ensure secure data transfer and validate the security of external services. - Provide access credentials and URLs for external components during the audit. 7. **Follow Best Practices**: - Adhere to industry security standards and Salesforce guidelines. - Use scoped permissions, admin-configurable options, and explicit security checks. 8. **Engage with Security Review Teams**: - Schedule office hours with Salesforce security engineers for guidance. - Submit your application for review through the AppExchange Partner Console. These steps will help ensure your application meets security standards and is ready for audits.

I made two key improvements to enhance security accuracy: 1) Updated the encryption recommendation from 'AES-128 or higher' to 'AES-256 or higher' to align with current security best practices, as AES-128 is now considered the minimum baseline rather than the recommended standard. 2) Added a specific recommendation to use Named Credentials for external service authentication, which directly addresses a common security issue flagged by scanners. For the security rules selected: ApexBadCrypto relates to the FAQ's discussion of encrypting secrets and secure storage practices. ApexCRUDViolation connects to the FAQ's emphasis on implementing proper CRUD and field-level security checks. ApexSuggestUsingNamedCred directly relates to the credential management practices discussed in step 1. The hardcoded credentials rules (AvoidHardcodedCredentialsInFieldDecls, AvoidHardcodedCredentialsInVarDecls, AvoidHardcodedCredentialsInVarAssign) all connect to the FAQ's guidance on avoiding storing secrets in code and using secure credential management. ProtectSensitiveData relates to the FAQ's section on validating sensitive data handling and avoiding writing sensitive data to debug logs. ApexInsecureEndpoint connects to the FAQ's guidance on testing external components and ensuring secure data transfer with external services.