Security requirements from regulations, critical assets and threat models
Key Takeaway
Start security design from requirements. First determine which regulations apply and choose the security framework that best meets them, then identify critical assets and threats. Configure specific controls, such as encryption and sharing, after that.
Security design for a financial institution starts by working out what must be protected and why. You ask which regulations apply, which assets are most critical and which threats are most likely. The answers become the security requirements, and the requirements drive which Agentforce Financial Services features you use. For example, an information barrier calls for Compliant Data Sharing, and encryption and monitoring call for Salesforce Shield.
How to design security from requirements
Security design starts from requirements, not features. Work through these steps in order.
- Determine which regulations the organization must comply with, based on its industry. Then choose the security framework that best meets them.
- Identify the critical assets the organization wants to protect by mapping the environment.
- Prioritize the highest value systems for further review. Few organizations have the resources to review every system, so focus on the systems where a loss of confidentiality, integrity or availability (CIA) would have high impact.
- Create threat models for the systems you prioritized.
- Design and deploy controls that safeguard the most sensitive information.
For step 1, common examples include the General Data Protection Regulation (GDPR), the Payment Card Industry Data Security Standard (PCI DSS) and the National Institute of Standards and Technology (NIST) Cybersecurity Framework.
Set security requirements and success metrics early, working with team members across the business, so everyone understands the type of controls the business needs. The goal is to solve business challenges with the simplest, most secure technology.
Configuring specific controls, such as encryption or sharing settings, comes at the end, because the requirements from the earlier steps decide which controls you need.
Lena is the new security architect at a wealth management firm that is moving to Agentforce Financial Services. On her first day, a project lead asks her to start setting up encryption and sharing rules. Lena holds off. She first lists the regulations the firm must comply with and picks the framework that best meets them. Next, she maps where client data lives, ranks the systems by CIA impact and builds threat models for the top ones. Only then does she choose which encryption and sharing controls to configure.