セールスフォースのセキュリティ対策 Trust Platform Infrastructure Services Sales...

21
セールスフォースのセキュリティ対策 2015/12/16 クラウド・セキュリティ・アライアンス 勉強会 株式会社セールスフォース・ドットコム セールスエンジニアリング本部 リード・ソリューション・エンジニア 高橋 悟史

Transcript of セールスフォースのセキュリティ対策 Trust Platform Infrastructure Services Sales...

  • 2015/12/16

  • Safe harbor statement under the Private Securities Litigation Reform Act of 1995:

    This presentation may contain forward-looking statements that involve risks, uncertainties, and assumptions. If any such uncertainties materialize or if any of the assumptions proves incorrect, the results of salesforce.com, inc. could differ materially from the results expressed or implied by the forward-looking statements we make. All statements other than statements of historical fact could be deemed forward-looking, including any projections of product or service availability, subscriber growth, earnings, revenues, or other financial items and any statements regarding strategies or plans of management for future operations, statements of belief, any statements concerning new, planned, or upgraded services or technology developments and customer contracts or use of our services.

    The risks and uncertainties referred to above include but are not limited to risks associated with developing and delivering new functionality for our service, new products and services, our new business model, our past operating losses, possible fluctuations in our operating results and rate of growth, interruptions or delays in our Web hosting, breach of our security measures, the outcome of any litigation, risks associated with completed and any possible mergers and acquisitions, the immature market in which we operate, our relatively limited operating history, our ability to expand, retain, and motivate our employees and manage our growth, new releases of our service and successful customer deployment, our limited history reselling non-salesforce.com products, and utilization and selling to larger enterprise customers. Further information on potential factors that could affect the financial results of salesforce.com, inc. is included in our annual report on Form 10-K for the most recent fiscal year and in our quarterly report on Form 10-Q for the most recent fiscal quarter. These documents and others containing important disclosures are available on the SEC Filings section of the Investor Information section of our Web site.

    Any unreleased services or features referenced in this or other presentations, press releases or public statements are not currently available and may not be delivered on time or at all. Customers who purchase our services should make the purchase decisions based upon features that are currently available. Salesforce.com, inc. assumes no obligation and does not intend to update these forward-looking statements.

    Forward-Looking Statement

  • : 22

    : 19992000 : 20002001

    FY15 (2015131) 537000 ( 32%)

    FY16(20151119) 66.4 66.5 ( 24% )

    (20151031) 18,726

    150,000

    3

    FY05 FY06 FY07 FY08 FY09 FY10 FY11 FY12 FY13 FY14 2015731 ( FY16 2 )

    FY15

    3541465564728391105118130144162177192217248263276290305316331

    354377394429457504

    546584632695

    732788835893

    9571080

    11501230

    132013801440

    15101630

    1710

  • 6The Customer Success Platform

    API

    2,700

    UI

    CRM

  • Salesforce Trust Platform

    Infrastructure Services

    Analytics Community Marketing Service Sales Apps

    Network Services

    Application Services

    Secure Data Centers

    Backup and Disaster Recovery

    47

    HTTPS Encryption

    Penetration Testing

    Advanced Threat Detection

    Identity & Single Sign On

    Two Factor Authentication

    User Roles & Permissions

    Field & Row Level Security

    Secure Firewalls

    Real-time replication

    Password Policies

    Third Party Certifications

    IP Login Restrictions

    Customer Audits

    150,000 2,000,000

    16

  • SSL

    Web

    CRUD

  • -

    l ISO27001l SysTrustSSAE16 SOC-3

    l PCI-DSS

    l FedRAMP, GSA

    l

    l

    l

    l

    l

    l N+1l 99%

    l 1 217

    l trust.salesforce.coml SSAE16 / ISAE 3402 SOC-1, 2

    l ASP SaaS

    l 8

    R&D99% 50/1 217

    (C) (I) (A) (A)

  • 92011

    : 2014

    : 2016

    : 2015

    : 2011 : 2016

    2 1 6

  • 9

    (/)

    /

    ()

  • Salesforce

    SHA-256 hash with salt

    //

    ()

    Org ID Object ID Record ID Field1 Field2 Field3 Field400D100000005qRW 01I100000008ymS 00110000005Xrjl 1235685 8320222 62500 12153351

    00D100000018AsK 01I100000002tzz 00310000002yQgz 12345 120000256 20092526 00310000002yQh1

    00D100000024Wte 01I100000004u04 00Q10000001w9gn 03456235 12354961 50

    00D100000022Tae 01I10000000TfZ9 00Q100000041LZO 122586 0120330968 20050

    00D100000012Ate 01I10000000TfZA 00Q100000041Lby 55697 01I10000000TfZA 00D100000019Qte Jim

    00D100000015Qte 01I100000008tzv 00Q10000001w9ar 36987584 122586 01I100000008tzw

    00D100000033Bte 01I100000008tzw 00610000005jtOA 1258963 122586 12254956

    00D100000008fpj 01I100000008ubL 00610000005jtUO e1250ee 12235896 0925596332 12354468

    500

    ()

    ()Salesforce.com

    )XYZ

    Salesforce

    XYZ 12345

  • IP

    (CRUD)

  • SSO

    IP

    VPN

    VPN

    IP

    /

    IPIP

    PC

    Salesforce.com6 /IPCSV

  • n

    n

    n

    n Salesforce AuthenticatorGoogle Authenticator

  • SSO

    n SAML 2.0, OpenID Connect 2.0

    n IdPSPRP)

    n IDID Provisioning

    n Google Apps, Microsoft Office 365, Active Directory Federation Service, Facebook, Twitter

  • n AES128bit

    n Salesforce Shield AES256bit

    HSM

  • n HTTP, HTTPS, SMTP

    n TLS 1.2+AES256bitHTTP, SMTP

    n PCI DSS 3.1TLS 1.0

    n IDS/IPS

    n VPN

    n IP

    n IDS/IPSID

  • n

    n 24 365

    n N+1UPS 48

    n N+1HVAC

    n

    n

  • n

    n

    n SHA-256 Hash

  • ISO 27001 Certified SSAE16 SOC1

    : 3 : 4

    SSAE16 SOC3

    PCI DSS 3.1 Compliant

    Federal Authority to Operate Moderate Baseline

  • Transparency

    n

    n trust.salesforce.com (up/down)