Salesforce Admins Can Reduce Risk With Proactive Security

Today on the Salesforce Admins Podcast, we talk to Kate Lessard, Lead Admin Evangelist at Salesforce.

Join us as we chat about why security is the foundation for how data, automation, and AI work together.

You should subscribe for the full episode, but here are a few takeaways from our conversation with Kate Lessard.

Why strong security is proactive, not reactive

Security can often feel like the elephant in the room. Everyone knows it's important, but the amount of work needed to do it right can feel daunting. Thorny problems like accumulated tech debt and organizational inertia can make you feel like you're better off not talking about it.

That's why I sat down with Kate Lessard. This month, she ran a workshop called Security in Action to highlight the simple steps you can take to strengthen the security posture of your org. She got hands-on with an example org to demonstrate how to use Health Check to identify and fix security problems.

It's all about taking a proactive approach to security, rather than waiting for something to happen to you.

Your Health Check score is a security action plan

"Health Check is no longer just a list of settings for you to review," Kate says, "it's your dynamic risk mitigation dashboard." Issues are sorted into four categories: high-risk, medium-risk, low-risk, and informational. There is also a status to rate the level of urgency for each issue: critical, warning, or compliant.

Health Check is also customizable. If your organization's security policies are different than the Salesforce Baseline Standard, you can download an XML file and tweak the criteria. You can compare your policies to what's recommended by Salesforce, and maybe identify some low-hanging fruit.

In short, your Health Check score gives you a prioritized list of which security issues need to be addressed first so you can walk into a meeting with stakeholders with a solid plan of action.

Helpful reports for user management

Security and user management go hand in hand, and Kate recommends some reports that admins can run to help with governance.

First of all, the Active System Administrator Report can help you find users who might have more access than they need. This can often be an issue in older orgs where it was easier to give someone admin access than to sit down and solve the permission problem. Kate also likes to run a report on Reports, to keep track of what her users are interacting with the most.

As Kate says, it's all about making a shift towards a security model built around permission set best practices. As admins, we need to find a way to fit security seamlessly into our organization's business processes, and vice versa. There may be an upfront cost, but it's all about making security easy in the long run.

Listen to the full conversation for more from Kate about security and Health Check. And don't forget to subscribe to the Salesforce Admins Podcast so you never miss an episode.

Podcast swag

Salesforce Admins on the Trailhead Store

Learn more

Salesforce Admins Blog: Securing Your Org: From Reactive to Proactive
Kate Clicks Through It: Protect Your Salesforce Org With Health Check

Admin Trailblazers Group

Admin Trailblazers Community Group

Social

Full show transcript

Mike: This week on the Salesforce Admins podcast, I sit down with Salesforce Evangelist Kate Lessard to unpack why security is really no longer a side conversation for admin, but the foundation to how data, humans, automation and AI all work together. We're going to cover her new security workshop that she led last week, and talk about health check upgrades, permission set security models, and of course how Salesforce admins can move from reacting to security problems to proactively designing trusted systems. We do touch on a little bit of governance, user access, and why secure data is the backbone of every successful AI implementation. So if you've ever wondered how modern Salesforce admins evolve from feature builders into stewards of trust, this episode is for you. And with that, let's get Kate on the podcast. Kate, welcome back to the podcast.

Kate Lessard: Hey, thanks for having me back. Excited to be here.

Mike: Well, it feels like a lot of relevant things for admins are coming out of your camp lately from True to the Core Deep Dive to last week's security and action. I feel like there should be like a thunderclap after that. Security and action. Dun, dun, dun.

Kate Lessard: Yeah, absolutely. Data and access.

Mike: Right. Mm-hmm. Yep. Like a comic book hero. And then you got to do the comic book land. Anyway, totally off topic. Look at that. 30 seconds into the podcast, we're already in comic books. People-

Kate Lessard: I mean, I am here for it. Admins are superheroes, especially when they are securing their orgs.

Mike: We are. So let's talk about what that first workshop was, and what you covered, and how it went. So tell me a little bit more, tell everybody a little bit more about what that workshop was.

Kate Lessard: So in the Security and Action workshop, we were really focused on data and access and using HealthCheck as our guide. So essentially we started off with some security basics knowing that much of our audience was at different levels. So we had people joining us that are brand new admins that are working on their first certification. And then we had people joining us that have been in the ecosystem and in a Salesforce role for more than 10 years. So wanted to make sure that we had a strong foundation and that we had reviewed some security foundational knowledge base points for everybody to get on the same level. And then we got hands-on in an org that just didn't have a great health check score and had some security concerns that we went through, and hands-on adjusted together until we improved our score, we better secured our org, and just increased our security posture.

Mike: Cool. I didn't hear Agentforce in there and we're in the age of AI.

Kate Lessard: Yeah. So I do think we didn't specifically touch on Agentforce in this first workshop. We really wanted to focus on that strong security base where it applies to all of your org. And that might mean that it applies to your users, both human and agent, but really focusing in on that prime security. And then we do have plans in the future to enhance this and take this to the next level and really expand on some of those agentic guardrails. But I think that it's just really important to have that foundation first.

Mike: Yeah. I mean, all of it bases around good, clean data and secure data.

Kate Lessard: Absolutely. And you're not going to have a successful Agentforce implementation without that. That is the foundation point that's going to set your organization up for success using AI.

Mike: I did the Agentforce Now workshop that week, and I always emphasize the importance of filling in description and metadata fields as well.

Kate Lessard: Yes, hugely important.

Mike: So one of the things, it's really cool the workshop pivots all around HealthCheck. And I know having worked some of the Q&A, people were like, "Wait a minute, I thought HealthCheck went away."

Kate Lessard: Yeah, HealthCheck has not gone away. It is free for admins to use and it actually recently got some pretty impressive and exciting upgrades that we spend some time on in the workbook. So it's no longer just a list of settings for you to review. It is really dynamic and serves as your risk mitigation dashboard. So you can do things like not only configure the specific settings for your org security, but you can also set up email notifications for system admins or anyone who that you would like to receive notifications when your security score changes. So maybe members of yo...