March 12, 2012, 6:07 AM — Trouble Ticket
The sales team is using Salesforce to access sensitive data from any device, anywhere. Action plan: Rein in accessibility by requiring VPN connectivity for SaaS apps.
The access police have struck again.
That would be me, of course. I am forever seeking to control accessibility to the company's sensitive data. Naturally, when I tighten things up, some people get unhappy. Our salespeople, among others, always want access to be as easy as possible, and they want to be able to get to the data they need anywhere and from any device. For me, though, that sort of ease of access just sounds like a disaster waiting to happen.
My latest candidate for more restrictive access is our Salesforce.com deployment. We've been using this software-as-a-service customer relationship management and sales application for more than six months with pretty wide-open accessibility.
I have a policy regulating remote access to our internal infrastructure or sensitive data. It requires encryption (i.e., VPN ) and two-factor authentication (i.e., RSA SecurID tokens ). The problem with SaaS applications like Salesforce is that their use does not really involve our internal infrastructure, but it does involve our sensitive data, though it doesn't reside in our data center. After discussing things with our legal counsel, we decided that the policy should more clearly define sensitive data to include source code and financial, human resources, healthcare, customer and sales data. Salesforce contains quite a bit of this sort of information, especially customer data, sales data and sales forecasting reports. As a publicly traded company, we can't risk unauthorized access to such data, which could be used to make illegal stock trades based on insider information.
With this tighter policy in hand, I decided to take advantage of a Salesforce configuration option that allows companies to restrict access by IP address. That would essentially force all users to be connected to one of the following: a port in one of our offices, a corporate wireless access point or the network via VPN.