Use this link to share with your colleagues:
About Salesforce Health Check: https://help.patronmanager.com/a/2134269
Salesforce may send you an email with the subject line "Action Required: Salesforce Security Health Check Score Decreased."
If you receive this, there are some actions you can take to increase your score without impacting PatronManager functionality. There are also some actions Salesforce recommends that will break your ability to sell tickets and process donations with PatronManager.
In this article, we'll outline:
What you should never do
There are some settings you should never touch. Doing so will impact your ability to use PatronManager, including selling tickets and taking donations.
With this in mind, you should never touch the following settings:
- Enforce login IP ranges on every request
- This should always be unchecked
- Lock sessions to the IP address from which they originated
- This should always be unchecked
- Require a minimum 1 day password lifetime
- This should always be unchecked
- Guest User Profile Edit Access to objects
- These should not be adjusted, especially for PatronManager Site Guest Users
- Guest User Profile Read Access to objects
- These should not be adjusted, especially for PatronManager Site Guest Users
If you adjust any of the settings above, you will need to revert them ASAP to prevent issues selling tickets!
If your organization uses PatronPortal to let members or special patrons log into the Public Ticketing Site (PTS), then there are a few additional settings you should never touch:
- User passwords expire in
- This should be set to One year
- Password complexity requirement
- This should be set to "Must include alpha and numeric characters"
- Minimum password length
- This should be set to 8 characters
If you adjust any of the settings above and use PatronPortal, you will need to revert them ASAP to prevent issues for your patrons!
What you can do to increase your score
There are many actions you can take to increase your Salesforce Security Health Check Score!
To get here, head to Setup using the gear icon.
Then find and select "Session Settings"
Enable clickjack protection for Setup pages
Check Enable clickjack protection for Setup pages.
Enable clickjack protection for non-Setup Salesforce pages
Check Enable clickjack protection for non-Setup Salesforce pages.
Lock sessions to the domain in which they were first used
Check Lock sessions to the domain in which they were first used.
Terminate all of a user's sessions when an admin resets that user's password
Check Terminate all of a user's sessions when an admin resets that user's password.
Enable CSRF protection on GET requests on non-setup pages
Check Enable CSRF protection on GET requests on non-setup pages.
Enable CSRF protection on POST requests on non-setup pages
Check Enable CSRF protection on POST requests on non-setup pages.
Enable Stricter Content Security Policy
Check Enable Stricter Content Security Policy.
Enable Content Sniffing protection
Check Enable Content Sniffing protection.
To get here, head to Setup using the gear icon.
Then find and select "Password Policies"
Maximum invalid login attempts
Set the Maximum invalid login attempts to 3.
Enforce password history
Set Enforce password history to 3 passwords remembered.
Obscure secret answer for password resets
Check Obscure secret answer for password resets.
Lockout effective period
Set the Lockout effective period to 30 minutes.
Password question requirement
Set the Password question requirement to Cannot contain password.
To get here, head to Setup using the gear icon.
Then find and select "Identity Verification"
Require identity verification during multi-factor authentication (MFA) registration
Make sure that "Require identity verification during multi-factor authentication (MFA) registration" is checked.
Optional additional steps
If you'd like to take further action, you may do so with special considerations.
Custom remote sites may have the "Disable Protocol Security" option selected. It's best practice to not have any remote sites with this setting, but some custom remote sites for third-party integrations may have this set.
Special Consideration: Only check remote sites for third-party integrations (i.e., not PatronManager) and ensure that you can test the integration(s) after making the changes.
All remote sites used by PatronManager have protocol security enabled.
To get here, head to Setup using the gear icon.
Then search for and select "Remote Site Settings"
Click through each Remote Site
Ensure that "Disable Protocol Security" is unchecked.
If you find one where "Disable Protocol Security" is checked, click Edit.
Uncheck "Disable Protocol Security" and Save!
Certificates and keys are used by third-party integrations. Therefore, before making any changes, ensure that you fully understand what the certificate is used for.
Special Consideration: Ensure that you know what the certificate or key is used for before making any changes.
If you don't know what a certificate or key is used for, we recommend leaving it alone.
Certificates and keys are not used for anything native to PatronManager.
To get here, head to Setup using the gear icon.
Then search for and select "Certificate and Key Management"
Key Size
If you're setting up a new key, set the Key Size to 4096.
Certificate Expiration
If you're setting up a new key, set the Certificate Expiration to 179 days.
You can also delete expired certificates that you know are unused by clicking the name of the certificate from the list and then clicking "Delete."
Salesforce recommends that your account have only 5% of active internal Users (i.e., employee logins) with the System Administrator Profile.
We recommend that at least 2 active internal Users at your organization have a Profile set to System Administrator. This will ensure that if one System Administrator gets locked out, another can help them get logged back in.
Special Consideration: Check the Profiles of your active internal Users to see if any should have their Profiles adjusted for access to an alternate Profile.
The PatronTech Admin User must always be active with the System Administrator Profile!
Deactivating or changing the Profile for this User could break essential functions in PatronManager, including your ability to process transactions.
To check Users' Profiles, head to Setup using the gear icon.
Then search for and select "Users"
Select the Active Users View from the dropdown
Check the Profiles for the Users
Click Edit
Under "Step 3. Select Fields to Display", select Profile from Available Fields and use the Add arrow to move it to Selected Fields
You can also use the Up and Down arrows to adjust where the Profile column appears!
Click Save
Voilà! The Profiles now appear in the list.
Let's go and change it!
1. Click Edit next to the User
2. Use the dropdown to adjust the Profile
3. Save!
