What the Shiny Hunters breaches teach us about portal security

My talk on secure external portal architecture today on Salesforce Security Hours, with Melissa Hill Dees, MBA, ended up being very timely given recent news of the Shiny Hunters breaches. Video coming soon.

Shiny Hunters exploited common oversights in Salesforce Experience security configuration, the equivalent of locking your front door but leaving the side door wide open. When you build a portal outside of Salesforce, the responsibility is even weightier as you also must ensure appropriate row-level data access.

Today I reviewed how Codality CTO Ryan McCloskey guaranteed that row-level security in Apex, how JWTs ensure user authorization across your portal tech stack with a single authentication, the importance of obscuring record Ids, and reviewed common drivers for building an external portal. I also shared the tools we used to secure a client portal for a $2.7B wealth management company, including an interesting comparison of Mulesoft versus AWS for the API based on our CPO Amit Kulkarni's experience.

Special thanks to Tristan Lombard for coordinating and providing amazing Stage Mom support.

If you're embarking on an external portal app or any development demanding more security expertise than you have in-house, reach out to me about a fractional architect engagement to ensure you don't become another security didactic tale.

#SalesforceSecurity #CyberSecurity #DataSecurity #APISecurity #CloudSecurity