Data Privacy: Ensuring Compliance and Security in Marketing Cloud

Thousands of cyberattacks occur every day. For any brand, a data breach results in a loss of customer trust. Salesforce Marketing Сloud Engagement undoubtedly has advanced security and data privacy mechanisms. However, it’s important to remember that data must be protected not only by Salesforce but also by the users themselves.

The most obvious and mandatory step is to carefully review and configure the security settings. Some users do not follow all of these recommendations, which puts the security of Salesforce Marketing Cloud at risk. I will list a few of the most important ones; you can review the rest of the settings in the documentation.

How long is your password? Is the multi-factor authentication (MFA) installed? Can all Marketing Cloud users export data?

Recommendations:

• Session timeout – controls how long the application remains open in a browser before the system automatically logs out. Recommendation – 20 minutes timeout.
• Login expires after inactivity – prevents users from logging in after the number of days that you select. This setting helps prevent unauthorized users from exploiting old accounts. Recommendation – 90 days maximum.
• Minimum password length – the longer the password, the more difficult it becomes to guess. Recommendation – minimum password length of 8 characters or more, including numbers and special characters.
• Enforce export email allowlist – forces the application to export data to only those email addresses on the export email allowlist. A strong recommendation – enable.
• Enable multi-factor authentication. This is an additional barrier of defense that an attacker needs to get past. With MFA, even if hackers steal the password, they won't be able to log in because they don't have a mobile device with Salesforce Authenticator installed.

How often do you check that only users working in your organization have access to Marketing Сloud? Do you immediately disable quitters or do they have access to your organization for a long time?

Do you use the principle of least privilege, or do you automatically grant the administrator and Marketing Сloud administrator roles to all users?

Recommendations:

• Regularly check the list of users, grant access only to relevant ones.
• Only assign the administrator and Marketing Сloud administrator roles to those who need them.
• If you can give less privileges to some of the users, use it.

How many of your users have a checkbox with the user API? Do you know what features this checkbox provides? Do you store API credentials in postman?

The username and password-based authentication method was replaced by the introduction of the OAuth authentication flow. While the old method remains available, it is strongly recommended to disable it, as API user passwords are excluded from expiration by default (in password policies).

Recommendations:

• Enable the API user checkbox only for those who really need it.
• Do not store API credentials in Postman.
• Rotate API credentials periodically.
• All access to the API must be authenticated via OAuth2.

You can also install the free Native Health Check tool specifically for Marketing Cloud, where you'll get a safety assessment of your organization.

By the way, don't forget that installed packages contain components that include essential configuration information and it is very important :

• Install packages only from trusted sources.
• Configure permissions and roles carefully.

Do you use SFTP and, if so, do you use a SSH key? Do you know what an SSH key is?

When an SSH key is generated, it is created in a pair: a public key that is copied to the SSH server(s). Anyone with a copy of the public key can encrypt the data, which can then only be read by someone with the corresponding private key.

Recommendations:

• Minimize the amount of sensitive data stored in Marketing Сloud.
• Define a strict data retention policy and back up your data regularly.
• Where possible, use both SSH key and password authentication.
• When transferring files to and from Marketing Cloud using SFTP, use file encryption with PGP.

Recommendations:

• Keep in mind that most leaks are caused by insider threats.
• The weakest and most vulnerable are the people.
• Don't trust people, no matter how it sounds.
• Conduct regular training sessions for employees to remind them not to leave work devices unattended, avoid connecting to untrusted Wi-Fi networks, and scan files with antivirus software before installing them on their computers.

Remember that you, as the Marketing Cloud Admin, are responsible for ensuring security. While Salesforce provides robust security tools, it is important for users to utilize these customizations. Each setting contributes to minimizing the risk of leaks.

Don't forget to review and update your security settings regularly, and you, in collaboration with Salesforce, will be able to protect your organization from leaks and threats.