New Security Enhancements
Most of you should have recently received the email below outlining the new security enhancements that Salesforce.com is rolling out. These security measures are similar to those deployed by many leading banks to manage access to their online banking applications. For over a year now my bank has required me to go through a process of identifying who I am whenever I log in from a new location by sending a key to my email address and then having me enter it via their site. Although sometimes a frustrating process,
I am happy to do it because of the sensitive nature of the information made available to me via their site. My feelings are pretty much the same about the changes Salesforce.com is making. Security is not always pleasant but necessary and appreciated when a threat occurs.
Dear Salesforce Administrator,
At salesforce.com, we're actively delivering new security enhancements to protect customers against known threats.
One such enhancement will be “Identity Confirmation;” which is a set of features to help reduce the risk of phishing by requiring users to confirm their identity when accessing Salesforce from a different computer and from an unrecognized location for the first time. Before such users can log in, they will have to complete additional steps to confirm their identity—the exact steps will depend on whether they are using a browser or logging on via an API client, such as Connect for Outlook, Connect Offline, Apex Data Loader.
Please be prepared to explain these steps to your users—they are outlined below and explained in detail in this webinar (https://www.salesforce.com/security/)
Our goal is to minimize the impact of these features on users by allowing established patterns of usage to continue unchallenged. You will be able to designate a list of trusted IP ranges for your organization in Salesforce. Users who access Salesforce from IP addresses included in this list will not be affected by these changes. *
To facilitate the process for administrators, salesforce.com will pre-populate a list of trusted IP ranges for your company once, based on an analysis of the last four months of your organization's login data.
Please check the schedule (https://trust.salesforce.com/security.html#identity) to find out when Identity Confirmation will be activated for your company. Next, review the list of pre-populated trusted IP ranges for accuracy and completeness as soon as possible. It will be your responsibility to update the list of trusted IP ranges by adding new ranges as needed. To manage the list, go to Setup->Administration Setup->Security Controls -> Network access.
New login procedure for first log in from an untrusted network:
When users try to log in from a new browser and a new IP address, login will fail and an error message appears. Users can take the following steps to activate their computers:
1. In response to the error message, click the Send Activation Link button to trigger an email message. Remind users that salesforce.com will never ask them for their login information via email.
2. Open the email message that contains the activation link
3. Copy the link and paste it into the browser within 24 hours. A message confirms that the computer has been activated.
4. Once activation is complete, users can log in to Salesforce as usual. They will not be required to activate that location or browser again.
To access Salesforce from an untrusted network using a desktop application, users will be required to replace their current password with a combination of their password and a security token by taking the following steps:
1. Log in to Salesforce via the browser to reset request their security token.
2. Go to Setup->My Personal Information->Reset Security Token.
3. Click the Reset Security Token button to trigger an email that will contain their security token.
4. Select and copy the token from the email and use it to log in.
5. In the application, replace their password with combination of the password and the security token. For example, if the password is “MyPassword” and the security token is “XXXXXX”, they would enter “MyPasswordXXXXXX” into the password field.
Summary: Next Steps
1. Important! View the Webinar (https://www.salesforce.com/security/) to be prepared to answer your users' questions. You can also refer users to the Webinar.
2. Check the schedule (https://trust.salesforce.com/security.html#identity) to find out when Identity Confirmation will be implemented for your company and notify your users.
3. Check the pre-populated list of trusted IP addresses for completeness and accuracy.
4. Maintain this list to ensure a smooth login experience for your users. To manage the list, go to Setup->Administration Setup->Security Controls ->Network Access.
*Notes:
* The Identity Confirmation features are backwardly compatible with existing software—there should be no need to upgrade or patch software to use the security token.
* Users with profiles with login IP range restrictions will be exempt from having to take additional steps.
* These features will not be enabled for organizations that implemented single sign-on using delegated authentication.
Thank you for your help in keeping your company and your users safe from phishing attacks. If you have additional questions, please contact salesforce.com support.
Sincerely,
Parker Harris
EVP Technology
Salesforce.com
