Skip to content

Commit 9c5cd24

Browse files
maxvpmaxvp
authored
[CASB] Salesforce FedRAMP integration (#19580)
1 parent 67322bb commit 9c5cd24

File tree

12 files changed

+131
-111
lines changed

12 files changed

+131
-111
lines changed

‎src/content/docs/cloudflare-one/applications/casb/casb-integrations/index.mdx‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,5 +25,6 @@ You can integrate the following SaaS applications and cloud environments with Cl
2525
- [SharePoint](/cloudflare-one/applications/casb/casb-integrations/microsoft-365/sharepoint/)
2626
- [Outlook](/cloudflare-one/applications/casb/casb-integrations/microsoft-365/outlook/)
2727
- [Salesforce](/cloudflare-one/applications/casb/casb-integrations/salesforce/)
28+
- [Salesforce (FedRAMP)](/cloudflare-one/applications/casb/casb-integrations/salesforce-fedramp/)
2829
- [ServiceNow](/cloudflare-one/applications/casb/casb-integrations/servicenow/)
2930
- [Slack](/cloudflare-one/applications/casb/casb-integrations/slack/)

‎src/content/docs/cloudflare-one/applications/casb/casb-integrations/salesforce-fedramp.mdx‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
pcx_content_type: reference
3+
title: Salesforce (FedRAMP)
4+
rss: file
5+
head:
6+
- tag: title
7+
content: Salesforce (FedRAMP) - CASB
8+
---
9+
10+
import { Render } from "~/components";
11+
12+
:::note[Limited access]
13+
The Salesforce (FedRAMP) CASB integration is available in limited access. To request access, contact your account team.
14+
:::
15+
16+
<Render
17+
file="casb/salesforce-integration"
18+
params={{
19+
integrationName: "Salesforce (FedRAMP)",
20+
environmentName: "FedRAMP-compliant Salesforce environment",
21+
slugifiedName: "salesforce-fedramp",
22+
}}
23+
/>

‎src/content/docs/cloudflare-one/applications/casb/casb-integrations/salesforce.mdx‎

Lines changed: 6 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -10,69 +10,10 @@ head:
1010
import { Render } from "~/components";
1111

1212
<Render
13-
file="casb/integration-description"
14-
params={{ one: "Salesforce", two: "Salesforce environment" }}
13+
file="casb/salesforce-integration"
14+
params={{
15+
integrationName: "Salesforce",
16+
environmentName: "Salesforce environment",
17+
slugifiedName: "salesforce",
18+
}}
1519
/>
16-
17-
## Integration prerequisites
18-
19-
- A Salesforce environment (most editions are compatible)
20-
- Permissions to a Salesforce organization with either:
21-
22-
- System Administrator permission
23-
- Permissions for View Setup and Configuration, Customize Applications, and Modify All Data
24-
25-
## Integration permissions
26-
27-
For the Salesforce integration to function, Cloudflare CASB requires the following Salesforce permissions via a Connected App:
28-
29-
- `Manage user data via APIs (api)`
30-
- `Manage user data via Web browsers (web)`
31-
- `Perform requests at any time (refresh_token, offline_access)`
32-
- `Access unique user identifiers (openid)`
33-
34-
These permissions follow the principle of least privilege to ensure that only the minimum required access is granted. To learn more about each permission, refer to the [Salesforce OAuth Tokens and Scopes documentation](https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_tokens_scopes.htm).
35-
36-
## Security findings
37-
38-
<Render
39-
file="casb/security-findings"
40-
params={{ one: "Salesforce", two: "salesforce" }}
41-
/>
42-
43-
### File sharing
44-
45-
Identify uploaded content, files, and attachments that have been shared in a potentially insecure fashion.
46-
47-
| Finding type | FindingTypeID | Severity |
48-
| ----------------------------------------------------------------------------------- | -------------------------------------- | -------- |
49-
| Salesforce: Content Document publicly accessible without a password | `4cde56ed-19db-4cdb-a6c6-3aede5e17785` | Critical |
50-
| Salesforce: Content Document publicly accessible with weak password | `68c43ab8-733d-4798-b25f-202f6fcf435f` | High |
51-
| Salesforce: Content Document publicly accessible and password protected | `75194f6b-5a95-48fa-b485-37181d2d19c8` | Medium |
52-
| Salesforce: Content Document shared and not viewed in 12+ months (stale permission) | `7125e209-234a-4f10-89d2-1af0601c277f` | Medium |
53-
| Salesforce: Content Document larger than 2 GB | `3d21de13-4b9f-483c-921a-44cdef7a58c5` | Medium |
54-
55-
### Account misconfigurations
56-
57-
Discover account and admin-level settings that have been configured in an insecure way.
58-
59-
| Finding type | FindingTypeID | Severity |
60-
| --------------------------------------------------------- | -------------------------------------- | -------- |
61-
| Salesforce: Domain without HTTPS | `20916e32-442e-4622-9e54-e1f37eb7d79f` | High |
62-
| Salesforce: Default Account record access allows edit | `316f1d9a-447e-432c-add7-7adde67c4f19` | Medium |
63-
| Salesforce: Default Case record access allows edit | `a7c8eb3e-b5be-4bfc-969a-358186bf927a` | Medium |
64-
| Salesforce: Default Contact record access allows edit | `e7be14f0-24d6-4d6c-9e12-ca3f23d34ba9` | Medium |
65-
| Salesforce: Default Lead record access allows edit | `12fde974-45e8-4449-8bf4-dc319370d5ca` | Medium |
66-
| Salesforce: Default Opportunity record access allows edit | `2ab78d14-e804-4334-9d46-213d8798dd2a` | Medium |
67-
| Salesforce: Organization with active compliance BCC email | `43e5fd20-1cba-4f1d-aa39-90c7ce2e088a` | Low |
68-
69-
### User access
70-
71-
Flag user access issues, including account misuse and users not following best practices.
72-
73-
| Finding type | FindingTypeID | Severity |
74-
| ----------------------------------------------------------- | -------------------------------------- | -------- |
75-
| Salesforce: User sending email with different email address | `a2790c4f-03f5-449f-b209-5f4447f417af` | Medium |
76-
| Salesforce: Inactive user | `57e44995-c7ad-46fe-9c55-59706e663adf` | Low |
77-
| Salesforce: User has never logged in | `a0bf74df-c796-4574-ac1c-0f239ea8c9ac` | Low |
78-
| Salesforce: User has not logged in for 90+ days | `8395c824-bc44-4c12-b300-40f2477384d4` | Low |

‎src/content/docs/cloudflare-one/policies/gateway/lists.mdx‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,9 @@ pcx_content_type: how-to
33
title: Lists
44
sidebar:
55
order: 13
6-
76
---
87

9-
import { Render } from "~/components"
8+
import { Render } from "~/components";
109

1110
With Cloudflare Zero Trust, you can create lists of URLs, hostnames, or other entries to reference when creating [Gateway policies](/cloudflare-one/policies/gateway/) or [Access policies](/cloudflare-one/policies/access/). This allows you to quickly create rules that match and take actions against several items at once.
1211

@@ -16,12 +15,12 @@ Before creating a list, make note of the [limitations](#limitations).
1615

1716
Lists can contain a single type of data each. Supported data types include:
1817

19-
* URLs
20-
* Hostnames
21-
* Serial numbers
22-
* User email addresses
23-
* IP addresses
24-
* Device ID numbers
18+
- URLs
19+
- Hostnames
20+
- Serial numbers
21+
- User email addresses
22+
- IP addresses
23+
- Device ID numbers
2524

2625
<Render file="gateway/lists" />
2726

@@ -31,10 +30,10 @@ Lists can contain a single type of data each. Supported data types include:
3130

3231
2. Select **Edit**. This will allow you to:
3332

34-
* Edit list name and description by selecting on the three-dots menu to the right of your list's name.
35-
* Delete the list by selecting the three-dots menu to the right of your list's name.
36-
* Delete individual entries.
37-
* Manually add entries to your list.
33+
- Edit list name and description by selecting on the three-dots menu to the right of your list's name.
34+
- Delete the list by selecting the three-dots menu to the right of your list's name.
35+
- Delete individual entries.
36+
- Manually add entries to your list.
3837

3938
3. Once you have edited your list, select **Save**.
4039

@@ -46,7 +45,7 @@ Your lists can include up to 1,000 entries for Standard plans and 5,000 for Ente
4645

4746
### Duplicate entries
4847

49-
Lists cannot have duplicate entries. Because hostnames are converted to [Punycode](https://www.rfc-editor.org/rfc/rfc3492.txt), multiple list entries that convert to the same string will count as duplicates. For example, `éxàmple.com` converts to `xn—xmple-rqa5d.com`, so including both `éxàmple.com` and `xn—xmple-rqa5d.com` in a list will result in an error.
48+
Lists cannot have duplicate entries. Because hostnames are converted to [Punycode](https://www.rfc-editor.org/rfc/rfc3492.txt), multiple list entries that convert to the same string will count as duplicates. For example, `éxàmple.com` converts to `xn—xmple-rqa5d.com`, so including both `éxàmple.com` and `xn—xmple-rqa5d.com` in a list will result in a duplicate error.
5049

5150
### URL slashes
5251

‎src/content/partials/cloudflare-one/casb/integration-description.mdx‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,7 @@
11
---
2-
inputParameters: integrationName;;integrationAccountType
3-
2+
params:
3+
- integrationName
4+
- integrationAccountType
45
---
56

6-
import { Markdown } from "~/components"
7-
8-
<div class="special-class" markdown="1">
9-
107
The {props.one} integration detects a variety of data loss prevention, account misconfiguration, and user security risks in an integrated {props.two} that could leave you and your organization vulnerable.
11-
12-
</div>

‎src/content/partials/cloudflare-one/casb/integration-perms.mdx‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
---
2-
inputParameters: parentIntegration;;parentSlug
2+
params:
3+
- parentIntegration
4+
- parentSlug
35
---
46

57
Refer to <a href={`/cloudflare-one/applications/casb/casb-integrations/${props.two}/#integration-permissions`}>{props.one} integration permissions</a> for information on which API permissions to enable.

‎src/content/partials/cloudflare-one/casb/salesforce-integration.mdx‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
---
2+
params:
3+
- integrationName
4+
- environmentName
5+
- slugifiedName
6+
---
7+
8+
import { Render } from "~/components";
9+
10+
<Render
11+
file="casb/integration-description"
12+
params={{ one: props.integrationName, two: props.environmentName }}
13+
/>
14+
15+
## Integration prerequisites
16+
17+
- A {props.environmentName} (most editions are compatible)
18+
- Permissions to a Salesforce organization with either:
19+
- System Administrator permission
20+
- Permissions for View Setup and Configuration, Customize Applications, and Modify All Data
21+
22+
## Integration permissions
23+
24+
For the {props.integrationName} integration to function, Cloudflare CASB requires the following Salesforce permissions via a Connected App:
25+
26+
- `Manage user data via APIs (api)`
27+
- `Manage user data via Web browsers (web)`
28+
- `Perform requests at any time (refresh_token, offline_access)`
29+
- `Access unique user identifiers (openid)`
30+
31+
These permissions follow the principle of least privilege to ensure that only the minimum required access is granted. To learn more about each permission, refer to the [Salesforce OAuth Tokens and Scopes documentation](https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_tokens_scopes.htm).
32+
33+
## Security findings
34+
35+
<Render
36+
file="casb/security-findings"
37+
params={{ one: props.integrationName, two: props.slugifiedName }}
38+
/>
39+
40+
### File sharing
41+
42+
Identify uploaded content, files, and attachments that have been shared in a potentially insecure fashion.
43+
44+
| Finding type | FindingTypeID | Severity |
45+
| ------------------------------------------------------------------------------------------------ | -------------------------------------- | -------- |
46+
| {props.integrationName}: Content Document publicly accessible without a password | `4cde56ed-19db-4cdb-a6c6-3aede5e17785` | Critical |
47+
| {props.integrationName}: Content Document publicly accessible with weak password | `68c43ab8-733d-4798-b25f-202f6fcf435f` | High |
48+
| {props.integrationName}: Content Document publicly accessible and password protected | `75194f6b-5a95-48fa-b485-37181d2d19c8` | Medium |
49+
| {props.integrationName}: Content Document shared and not viewed in 12+ months (stale permission) | `7125e209-234a-4f10-89d2-1af0601c277f` | Medium |
50+
| {props.integrationName}: Content Document larger than 2 GB | `3d21de13-4b9f-483c-921a-44cdef7a58c5` | Medium |
51+
52+
### Account misconfigurations
53+
54+
Discover account and admin-level settings that have been configured in an insecure way.
55+
56+
| Finding type | FindingTypeID | Severity |
57+
| ---------------------------------------------------------------------- | -------------------------------------- | -------- |
58+
| {props.integrationName}: Domain without HTTPS | `20916e32-442e-4622-9e54-e1f37eb7d79f` | High |
59+
| {props.integrationName}: Default Account record access allows edit | `316f1d9a-447e-432c-add7-7adde67c4f19` | Medium |
60+
| {props.integrationName}: Default Case record access allows edit | `a7c8eb3e-b5be-4bfc-969a-358186bf927a` | Medium |
61+
| {props.integrationName}: Default Contact record access allows edit | `e7be14f0-24d6-4d6c-9e12-ca3f23d34ba9` | Medium |
62+
| {props.integrationName}: Default Lead record access allows edit | `12fde974-45e8-4449-8bf4-dc319370d5ca` | Medium |
63+
| {props.integrationName}: Default Opportunity record access allows edit | `2ab78d14-e804-4334-9d46-213d8798dd2a` | Medium |
64+
| {props.integrationName}: Organization with active compliance BCC email | `43e5fd20-1cba-4f1d-aa39-90c7ce2e088a` | Low |
65+
66+
### User access
67+
68+
Flag user access issues, including account misuse and users not following best practices.
69+
70+
| Finding type | FindingTypeID | Severity |
71+
| ------------------------------------------------------------------------ | -------------------------------------- | -------- |
72+
| {props.integrationName}: User sending email with different email address | `a2790c4f-03f5-449f-b209-5f4447f417af` | Medium |
73+
| {props.integrationName}: Inactive user | `57e44995-c7ad-46fe-9c55-59706e663adf` | Low |
74+
| {props.integrationName}: User has never logged in | `a0bf74df-c796-4574-ac1c-0f239ea8c9ac` | Low |
75+
| {props.integrationName}: User has not logged in for 90+ days | `8395c824-bc44-4c12-b300-40f2477384d4` | Low |

‎src/content/partials/cloudflare-one/casb/security-findings.mdx‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
---
2-
inputParameters: integrationName;;slugRelativePath
2+
params:
3+
- integrationName
4+
- slugRelativePath
35
---
46

57
The {props.one} integration currently scans for the following findings, or security risks. Findings are grouped by category and then ordered by [severity level](/cloudflare-one/applications/casb/manage-findings/#severity-levels).

‎src/content/partials/cloudflare-one/casb/shared-links.mdx‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,4 @@
22
{}
33
---
44

5-
<div class="special-class" markdown="1">
6-
75
To access some file findings, you may need to review shared links. For more information, refer to [View shared files](/cloudflare-one/applications/casb/manage-findings/#view-shared-files).
8-
9-
</div>

‎src/content/partials/cloudflare-one/gateway/response.mdx‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,8 @@
11
---
2-
inputParameters: type1;;example2;;example3
3-
2+
params:
3+
- type1
4+
- example2
5+
- example3
46
---
57

6-
import { Markdown } from "~/components"
7-
8-
<div class="special-class" markdown="1">
9-
10-
If a condition in an expression joins a {props.one} attribute (such as *{props.two}*) and a response attribute (such as *{props.three}*), then the condition will be evaluated when the response is received.
11-
12-
</div>
8+
If a condition in an expression joins a {props.one} attribute (such as _{props.two}_) and a response attribute (such as _{props.three}_), then the condition will be evaluated when the response is received.

0 commit comments

Comments
 (0)