Three Steps to Verify Your Community Cloud Security Settings

In our last two articles, we first discussed the three steps to reviewing your data security in Community Cloud and then continued into the advanced configuration of security in Community Cloud. Now that your data is prepared, what’s next? Measurement. Evaluating the security of your Community Cloud implementation is essential to ensuring your previous work was successful, and here are three steps to do just that.

1. Validate Your User’s Experience

You know what experience you want your users to have, based on the profile permissions you defined. After configuring Organization-Wide Defaults, Object and Field Level Security, and Sharing Rules and Sets, check the access of each profile and ensure it aligns with your expectations. You can do this via the UI by:

1. Creating a test account for every profile that has access to your communities
2. Logging in with each test account
3. Navigating through each community page to ensure you can only access the data that is expected.

If you can access more data than you should or if you cannot access data that you should, make the necessary adjustments to each profile and try again. And while you’re at it, we recommend reviewing each page layout, using Field Level Security to hide or set fields as read-only as needed.

A few more things to note:

• If you’re using custom pages, get additional information about securing your portal and limiting access to any standard pages that you’re not using (like the standard 404 page and standard search page). You can do this by setting the values for allowStandardPortalPages and allowStandardSearch in the list of CustomSite fields to False.
• To check for URL hacks, log into your community as both an authenticated user and an anonymous user and append the following to the end of the domain name in your browser’s address bar.
  • /001 (Accounts)
  • /003 (Contacts)
  • /005 (Users)
  • /500 (Cases)

  They should all generate a Page Not Found error. If they don’t, review your object and field level settings as well as your organization wide sharing defaults and sharing rules to ensure that any records that are displayed are supposed to be accessible.

• If your Community uses any Visualforce pages, confirm that the default page layout to an EMPTY layout.

2. Custom Code Compliance

Warning: A lot can go wrong when using custom code! In particular, Apex classes can be written using the without sharing keyword, which will essentially render all the checks and settings we’ve covered so far useless. Because the risks are high, consider asking a Certified Salesforce Developer to perform reviews of any Apex code prior to moving it to production if you decide to use without sharing in your Apex code.

3. Additional Checks

To confirm your Community security meets your expectations, there are two additional tools you can run.

First, Checkmarx is especially helpful if you’re using custom code because it views both the UI pages and the Apex classes that support them. This tool identifies pages that do not check for the level of access by the running user, or have input fields that allow escape special characters, which could allow an injection attack.

Second, Portal Health Check shows what your users have access to after you have completed your configuration. Because the check does not expose vulnerabilities introduced by custom pages/code, you should use it in conjunction with other tools outlined in this document.

Additional Resources

• Salesforce Security Implementation Guide
• Lightning Communities Content Security Policy

This is the final blog of a three part series. (In case you missed it, the earlier posts were Three steps to reviewing your data security in Community Cloud and advanced configuration of security in Community Cloud. Register for the webinar on July 16 as our Architects present on security topics discussed in this blog series.

WATCH THE WEBINAR

This blog is part of our larger “Ask an Architect” content series. To learn more about engaging a Salesforce.org Customer Success Architect in your organization, please contact your Account Executive.

About the Authors
Tom Leddy is a Senior Principal Customer Success Architect at Salesforce.org based in the Chicago area. He helps nonprofit and higher education organizations integrate Salesforce into their IT landscapes so they can serve their communities more effectively. He is also an author, public speaker, marathon runner and the president of Pawsitively Famous, Inc. You can connect with Tom on LinkedIn or Twitter.

Carlos Villalpando is a Senior Manager Advisory Services at Salesforce.org based in the Twin Cities area. He has been working on IT strategy for the last several years architecting, developing and re-engineering processes to make them efficient and aligned with the business that they serve.