Sign Rhode Island Travel Agency Agreement Secure

Document type sign travel agency agreement rhode island secure

hey everyone how's it going those of you walking around the hallways the talk is right here you can sit down I see a few empty seats over there while people are waiting for their friends or people are trying to look for a seat I'm going to stall a little bit so I'm going to talk about myself hi everyone I'm Ryan flood some of you may have seen me before I've been speaking with Salesforce for about three years now I've been reviewing app exchange since 2014 so you may have been on an office hours with me if you're one of our Salesforce partners we've seen a lot of change in Salesforce since 2014 we've seen a lot of change frankly since 2018 you saw our great mule soft booth I'm sure most of you have heard that news we've acquired a lot of companies we've launched a lot of great awesome products Einstein lightning there's been a lot of awesome stuff happening and one of the things that we want to share with all these lessons learned was our company has grown a lot we've had to scale we have these this wonderful trail head X which didn't exist when I started and we want to take those lessons learn and give those to you how do we scale like this but securely because I think that if there was news of a breach we wouldn't be in the same boat we wouldn't all have this love and trust for Salesforce and so we've invested very heavily in that so I what one minute two minutes over I can stall a little longer and make the lawyers happy Salesforce is a publicly traded company please make any purchasing decisions based on what is currently available not the content of this talk I'm not really going to talk a lot about Salesforce besides some of the processes and practices we follow I'm not going to talk about products I'm not gonna talk about what to buy or any of our strategic partnerships this is mostly a high-level talk but really this talk is all thanks to you we wouldn't be here today if it wasn't for all of our amazing customers all of our Trailblazers our partners who helped enable the Salesforce economy to grow the app exchange has been one of the best things I consider in my career to work on I've seen so many businesses grow and thrive through the app exchange and for those of you who may have had a hard time passing the security review to get listed we've seen a lot of uplift in the security scene between all these different varying sizes of companies from small shops with just maybe 5-10 employees to big industry companies 10,000 plus employees I was walking around the audience earlier today well earlier this hour trying to gauge the size of the of your companies and I think my odds are about correct I think about 40% of you are within the 500 to 5,000 range is that true can we get a show of hands for 5,000 to 500 employees yeah I am very bad at math bigger than 10,000 I'm gonna put up my hands a few times smaller than 100 okay smaller than 100 you guys win maybe you can all group together and then you can outnumber everyone else but cool as we scale we really need to figure out who are our big enablers and who's this talk garrets towards so executives you're the people who steer the cruise ship you set the direction and then you know that you're going to be traveling that direction for five to ten years you can't take a hard left or a hard right to quickly at a big scale we want to make sure we're going in the right direction together the ground level managers there's a lot of tools and tactics you can do to uplift the security of your area and what's actually really where this talk started and where my expertise is is in the automation system owners the actual architects and the folks who build and maintain the systems we use every day this is where security happens at the end of the day is when we do things so there's a lot for you them to take away from this talk to but I want to start by setting a ground level question why is security important kind of a silly question right everyone thinks oh yeah security in fact everyone does it right I went on Google News earlier today and just typed in the phrase security to see what came up of the top 10 articles eight were about computer security one was about national security and one was about a security guard cyber security is becoming one of the most important things in our modern world the fourth Industrial Revolution as we've all heard really has put the emphasis on the customer and protecting the customers data we all don't want to be in the news for these computer security breaches we all want to have compliance with these great regulations with GDP our with sock - with whatever compliance you have and frankly Security's assumed for most of our businesses I don't sell a secure spreadsheet I saw a spreadsheet you assume security but then that begs the question ok I can build a thing securely once and then I sell it and then we're done right well everything has a lifespan so we need to figure out how to scale it why are we up here talking about scaling security and one of the things that we found as a software company that works really well is embedding it everywhere we call this the Salesforce secure development lifecycle you may have heard of other companies having secure development life cycles I hope your company has a secure development lifecycle if you're a software company but this is our take this has a little bit of our spin so we really want to embed security into every step of the process and this doesn't only apply for software I talked to a few of you out there who are admins and this actually applies to admins too so whenever we release a new thing we have to figure out what's the thing we're gonna release you want to roll out Einstein activity capture to all of your users so that you can pull in your emails show contextually on those records enable your sales people to understand who has the closest relationship to this lead well first we need to understand that that's what we're doing and why we're doing it we want to enable salespeople to sell better to leads okay so what are the requirements of that I heard salespeople I heard leads I know it involves email we want to set the ground rules what are the system requirements if we're pulling in emails we shouldn't put our CEO in that group our CEO probably has payroll information which we wouldn't want shown in Salesforce so we need to define our threat model we need to define what are the things we currently care about as well let's say as most of you are familiar with we have this amazing permissioning platform crud FLS sharing if I don't have FLS or I don't have access to see the email contact of a record so I look at Joe sales he's a hot lead he's from Microsoft but I don't have access to his email should I see the email correspondence 2 & 4 to and fro from him that's a hard question I personally would say no for my company you're a company you may have different rules but that's what you need to define here in the design stage then we build it we actually implement the things we take a look at if we're an admin our profiles and permission sets and who has access to this if we're a developer we want to make sure that we're building with secure design patterns all the systems we use are the most recent versions have no security bugs and then actually come time to test or verify this is where we actually find out what we did and what we didn't do verification is great we've all heard and all seen shows like mr. robot where people are going in poking holes and companies and hacking them verify allows us to do that before they do we want to go ahead and act to actively test that but the last part of this is release and monitoring take a look taking a look at your logs taking a look and listening to your user feedback to make sure that if something fishy's going on you're aware of it or if something seems a little bit off to your users you understand what their threat model is because those two don't always align so that's what we do from a process standpoint but how do we get there to where we're operating within this process we do three things here at Salesforce security is everyone's job we are a 10,000 plus company we're pretty big our security team is not a 10,000 plus security team otherwise we wouldn't have as many sales as we do we have a lot of salesmen that's the point we can't invest everything in security we have to empower everyone to do security you want deploy specialists and champions we do have a security team our security team is the specialist in champions that kind of guide the way we set the goals we show you what secure looks like and we have deployed champions which are embedded within each area to orient the teams towards that goal and automate the scale nobody likes doing boring work nobody likes manually checking version numbers so we should move on we should have a machine do that for us so that us humans can focus on the important stuff all right let's dive into this make security everyone's job people scale with companies so we want to scale with people everyone's part of our solution so like I said define goals and conventions this book by Adam Shaw stack is probably one of the best books on threat modeling out there we have a whole library of it we give to our internal security engineers and we have simple guidelines we want to do we want to find the principles and conventions for example here at Salesforce we always respect the admin security settings your crud your FLS your sharing if a feature doesn't comply with that that feature isn't done we want to document what is expected so here at Salesforce we have internal docs on how to do security also if you visited our security booth or seen any of our security talks we have external on how to build security on top of Salesforce as well as what is the security Salesforce provides security documentation isn't only just for you and your users it's actually for your sales team too customers want security if you have documentation to show them we've thought about this we've thought about what you want here is documentation on how to do it that will really empower your salesmen to close a lot of deal breakers unless the threat modeling um as part of the design so formalize what we talked about formalized my CEO shouldn't be showing his emails on leads that's okay we just want to write that down figure out why we don't want to do that and prioritize the work that needs to get done accordingly so we don't we want to make sure that our admin doesn't assign the permission set with Einstein activity capture to the CEO and just like functionality security as part of working as designed if it doesn't respect our principles and conventions if the security model is not documented we're not done we can't release the product we can't roll out the feature to our customers the define set of tasks comes out of threat modeling threat modeling helps you prioritize what gets you there and we found that one of the best ways to do this is to make this fun and so we let people be the bad guy we let them use evil user stories as a evil hacker I want to read all of my CEOs emails what do we do to prevent that or as an evil hacker I want to bypass the authentication of the system so that I can read all of the data abuse cases are another common use case use to get us to a fun place and other non-functional requirements you have performance requirements we should have security requirements as well the last part of this is training most people want to do the right thing but sometimes we don't know how documentation is one part of that but hands-on training is another getting people to actually sit down with someone understand what's important why is it important how do I do the important things really actually light the spark in most people's heart we see oh I didn't know you could do that how do I stop that here at Salesforce we have documentation we have our security dev Center we have trailheads interactive we have Salesforce University there's actually an organization out there not affiliated in any way with Salesforce not affiliated in a nonprofit way with Salesforce either called safe code they do have a lot of documentation and security trainings as well I'd highly recommend them if you don't have a specialized security unit for your company but if you do have that special high security unit this is for you when we have want to deploy specialists and champions to actually guide us to what is done so here at Salesforce I'm on the security team so we build the tools and define done we know what the new things are what's the hot topics in the research and how do I enable everyone to do it we're building the tools just as the automation owners are we just build security specific tools and lastly office hours Salesforce partners have access to app exchange office hours with me or with other security engineers we hold internal office hours to four people to four engineers at Salesforce to come talk to our team just get general advice and training we also have deployed security champions does anyone here know what a security champion is I see one I like it so security champions this is kind of a new topic within the security space this is a deputized member of each team who then using their context as well as the security training that you give them enables them to self-serve on security they'll still come to you through office hours through documentation through one-on-one conversations to understand the more complex issues or to understand what the next steps are for them to learn their own security but really it's a lot of fun one thing we've done with our security champions program is we hold capture-the-flag competitions I would like to use the term hackathon because it was actually eight hours come hack this thing see what you get we have prizes for the people who win the most whether it's little USB dongles that'll take over a person's computer hoodies or more interactive trainings down the line that really empowered our security champions to come and self teach as well as next year we have way more security champions they wanted to take part in these activities but really security champions help us build security skills within to the organization outside of our specialists subject matter expert area but ok so we have the organizational strength and security that's great we know that everyone is part of the solution security it actually is everyone's job everyone has some role to play whether it's reporting phishing or actually being on a security team fine finally let's have the robots do the work so with security it's always a little hard because there's so much out there so we want to use the right tool for the job I want to talk about three things here that are all tied to the Salesforce ecosystem so Providence is our fast and contextual security scanner Providence is a check-in based scanner for those of you who are admins when we write source code we make incremental changes very small but when they get pushed to production this scanner will they'll pull those small incremental changes look for bugs in them look for known miss configurations look for those anti patterns and alert immediately this is really good because the user doesn't lose a lot of context the person who made the mistake can go and fix it without having their research what they did last month but if any of you have worked with the app exchange before and I'm hate to keep harping on it but I love the app exchange and I loved answer questions about it you've probably heard of check marks this is our slower more thorough source code analysis tool we use it to scan every app on the app exchange it goes through all the source files links them all together and traces every possible code path looking for security vulnerabilities this takes a lot longer but provides a lot more results that those small incremental code changes can't see this doesn't only work for Salesforce this actually wasn't built for Salesforce in the first place this is a source code analysis tool which works on Java Python Scala I don't know the rest of their product line they're a great company I'd highly recommend them we offer free trials you can get if you're a member of the public we have a general scanner if you're a member of the partne community we have another scanner with three scans for every security review you do lastly PMD PMD isn't a security tool it was a code analysis tool code linter when you were writing your code if you made a simple mistake during the time when you were writing your code at alert you say hey something's wrong here this is even faster and even were contextual than Providence which I really like we put some security rules on top of it which has caused some philosophical issues with the whole concept of a linter but we did we're constantly improving it I wouldn't call it done by any stretch of the imagination it is very much experimental but I encourage you all if you're writing Apex visualforce download PMD and install it into your environments you'll see a lot you'll see a lot of alerts in the beginning and you'll be able to weed those down and knock those bugs out of your systems but I talked a lot I was interrupted by the speaker in case then if you didn't hear the big three things I want you to walk away from security is everyone's job you can have these specialists and champions to empower the organization and make everyone a higher multiplier on security but it needs to be everyone's job and if you don't automate people are in gonna end up resenting security for the less interesting work they do I think I have some time for questions off in the hallway and I am going to also say I'm going to leave this up there while we're talking for questions these are the rest of our the security talks throughout the day we have a booth over at right on the right of the waterfowl feeder if you get the rightmost seat and take a look to your right there we are I'll be there waving at you well yeah question definition of done slide for those of you who are worried about seeing these slides no need to take a picture of every single one we these will be recorded these will be posted on the trailhead X 2018 site later this year I don't know when we have a lot of Av to go through to cut out the before and afters but it will be released if anyone has any questions that they don't want to say publicly I'll be standing down here by the monitor or you can come talk to us at the security booth thank you all for coming if you want some more tactical hands-on experience I'm gonna leave this slide up for a few minutes while they offer me off stage thanks so much