12.3 Salesforce Shield, Field Audit Trail & Platform Encryption

12.3 Salesforce Shield, Field Audit Trail & Platform Encryption

Exam Focus: In public sector IT, data breaches, unauthorized snooping by internal staff, and loss of historical records carry grave legal, financial, and political ramifications. To achieve compliance with CJIS, HIPAA, IRS Publication 1075, and state public records preservation laws, agencies rely on Salesforce Shield. This section covers the Shield triad: Platform Encryption (BYOK, probabilistic vs. deterministic encryption), Field Audit Trail (FAT, 10-year Big Object archiving), and Real-Time Event Monitoring (threat detection and Transaction Security Policies).

---

The Salesforce Shield Triad in Government Governance

Salesforce Shield is not a single tool; it is a suite of three integrated enterprise security technologies designed to provide native defense-in-depth:

+-----------------------------------------------------------------------------------+
| Salesforce Shield Governance Triad                                                |
+-----------------------------------------------------------------------------------+
| 1. Shield Platform Encryption: Cryptographic protection at rest                   |
|    * AES-256 bit encryption preserving platform logic                             |
|    * Salesforce-managed Tenant Secrets vs. Bring Your Own Key (BYOK)              |
|    * Probabilistic vs. Deterministic (Case-Sensitive / Case-Insensitive)         |
+-----------------------------------------------------------------------------------+
| 2. Field Audit Trail (FAT): Statutory compliance & historical records             |
|    * Tracks up to 60 fields per object (vs. 20 standard)                          |
|    * Retains history up to 10 years in Big Objects (FieldHistoryArchive)           |
|    * Automated FieldHistoryRetentionPolicy lifecycle governance                   |
+-----------------------------------------------------------------------------------+
| 3. Real-Time Event Monitoring: Forensics & threat mitigation                      |
|    * Real-time streaming of login, API, and report export events                  |
|    * Automated Transaction Security Policies (TSP)                                |
|    * Real-time block, notify, or step-up MFA intervention                         |
+-----------------------------------------------------------------------------------+

---

Shield Platform Encryption: Securing Data at Rest

Government mandates frequently require data encryption at rest using FIPS 140-validated cryptographic modules. Shield Platform Encryption provides native, granular encryption at the database layer while allowing business logic (workflows, validation rules, formulas, and search indexing) to function seamlessly.

Platform Encryption vs. Classic Encryption

A common exam trap involves confusing Classic Encryption with Shield Platform Encryption.

Key Lifecycle Management & Bring Your Own Key (BYOK)

Shield uses an advanced envelope encryption architecture:

1. Master Secret: Generated by Salesforce once per major release using a hardware security module (HSM).
2. Tenant Secret: Generated per org. In the standard model, Salesforce generates the tenant secret. In Bring Your Own Key (BYOK), the agency generates and controls the secret in an external Key Management Service (e.g., AWS KMS, Azure Key Vault, or an on-premises HSM) and uploads or streams it via the Salesforce KMS REST API.
3. Key Derivation Function (KDF): The Master Secret and Tenant Secret are combined using PBKDF2 to derive the operational Data Encryption Key (DEK) in memory. The DEK is never persisted to disk, ensuring that even if physical storage media were compromised, the data remains unreadable.
4. Key Revocation (Crypto-Shredding): If an agency detects a security compromise or terminates a contract, revoking the Tenant Secret immediately renders all encrypted data in the org cryptographically unreadable—a capability essential for government data destruction mandates.

Probabilistic vs. Deterministic Encryption: Architectural Trade-Offs

Choosing the correct encryption scheme is one of the most critical design decisions on the AP-222 exam.

[!TIP] AP-222 Exam Rule: If an exam question states that caseworkers must search or filter records by constituent Social Security Number, National ID, or License Number while encrypted at rest, you must select Deterministic Encryption. If filtering is not required and data represents free-text medical notes, select Probabilistic Encryption.

---

Field Audit Trail (FAT): 10-Year Public Records Governance

Government agencies are subject to statutory public records preservation mandates (e.g., Federal Records Act, state Sunshine Laws, and legal litigation holds) requiring historical records of all administrative actions.

Standard Field History Tracking vs. Field Audit Trail (FAT)

Standard Salesforce field history tracking is fundamentally inadequate for public sector regulatory compliance:

• Standard History Tracking: Tracks up to 20 fields per object; history records are automatically purged after 18 to 24 months.
• Field Audit Trail (FAT): Tracks up to 60 fields per object; retains history for up to 10 years (120 months).

The Big Object Archiving Lifecycle

FAT automates data lifecycle management by migrating aged historical data into Big Objects:

1. Active Storage: Field history records reside in standard history tables (e.g., IndividualApplicationHistory) for an operational window defined by the agency (e.g., 6 months or 12 months). During this window, users view history directly in the standard record History related list.
2. Archival Migration: A background batch process automatically migrates records older than the active threshold into FieldHistoryArchive—a standard Big Object.
3. Retention Policy Definition: Configured in metadata via FieldHistoryRetentionPolicy:
   • archiveAfterMonths: Number of months history remains in active storage before archiving (e.g., 6 months).
   • archiveRetentionYears: Total number of years the archived data is preserved in Big Objects (up to 10 years).
4. Querying Historical Archives: Auditors and compliance officers query the FieldHistoryArchive Big Object using SOQL, Async SOQL, or pre-built audit reports, providing immutable evidence for grand jury subpoenas and statutory appeals.

---

Real-Time Event Monitoring & Threat Detection

Public sector organizations are prime targets for malicious external actors and insider threats. Real-Time Event Monitoring provides real-time visibility into user behavior and programmatic threat intervention.

Core Streaming Event Objects

• ReportEventStream / ReportEvent: Captures when users view, run, or export reports. Tracks row counts, exported columns, and user source IP.
• ApiEventStream / ApiEvent: Monitors all REST, SOAP, and Bulk API queries, detecting unauthorized mass data scraping.
• LoginEventStream / LoginEvent: Tracks login geographic anomalies, impossible travel, and brute-force attempts.
• SessionHijackingEvent: Employs machine learning to detect stolen session cookies and unauthorized browser fingerprint shifts.

Transaction Security Policies (TSP)

Transaction Security Policies allow architects to evaluate streaming events in real time and execute immediate, automated actions:

• Evaluation Mechanism: Built declaratively using Condition Builder or programmatically by implementing the TxnSecurity.EventCondition Apex interface.
• Available Actions:
  1. Block: Terminate the transaction immediately (e.g., abort report export).
  2. Two-Factor Authentication (MFA): Challenge the user with immediate step-up identity verification before allowing the download.
  3. Notifications: Dispatch immediate in-app alerts and SMS/email notifications to the agency CISO and SOC.
  4. Session Termination: Instantly freeze the compromised user session.

+---------------------------+
| User attempts bulk export |
| 10,000 constituent SSNs   |
+-------------+-------------+
              | Triggers ReportEvent
              v
+---------------------------+
| Transaction Security      |
| Policy Interceptor        |
| Criteria: Rows > 2,000    |
+-------------+-------------+
              | Meets Criteria
              v
+---------------------------+
| Enforcement Actions:      |
| 1. BLOCK Download         |
| 2. Freeze User Session    |
| 3. Send Real-Time Alert   |
|    to Agency CISO & SOC   |
+---------------------------+

---

💡 Real-World Exam Scenarios & Case Analysis

Scenario 1: Preserving Child Welfare Case History for Litigation

A county child and family services agency is sued in federal court over benefit distribution adjudications spanning the prior eight years. The court issues a subpoena demanding every modification, timestamp, and user ID associated with benefit recalculations on the BenefitAssignment and IndividualApplication objects. The agency's existing standard field history only retains changes from the last 18 months.

How should the Lead Architect design the solution to comply with future 10-year discovery mandates?

• Deploy Salesforce Field Audit Trail (FAT).
• Define a FieldHistoryRetentionPolicy on the target objects with archiveAfterMonths = 12 and archiveRetentionYears = 10.
• Field modifications up to 1 year remain visible in standard related lists, while historical modifications from years 2 through 10 are safely archived in FieldHistoryArchive Big Objects, accessible via SOQL queries for legal discovery.

Scenario 2: Preventing Insider Theft of Citizen Tax Disclosures

An agency Information Security Officer discovers that a rogue employee in the municipal revenue department downloaded a spreadsheet containing 25,000 citizen tax identification numbers and bank account details prior to resigning.

What real-time defensive architecture should be deployed on AP-222 to prevent this vulnerability?

• Deploy Salesforce Shield Event Monitoring.
• Create a Transaction Security Policy on the ReportEvent object.
• Configure the policy condition: If RowsProcessed > 1000 and the report contains fields tagged as PII or Financial, execute the Block action and send an immediate email/notification to the Information Security Operations Center (ISOC).