I'm very excited to report that we've published a new section of developer.force.com, Force.com Secure Cloud Development. This brings together the complete set of developer resources covering secure development practices on Force.com, and represents our continuing investment in tools and content designed to maintain the security of the entire Force.com ecosystem. In my previous post, I mentioned that we had a number of new and free tools, training and resources for our developer community. I'm...
Read more »

Over the last several years our internal security team at salesforce.com has been hard at work building several fantastic new tools and resources for our developer community. What started off as internal tools and personal projects have grown into much more than that and on April 6th we'll be releasing all of the built up collateral. Some of the resources we've been sharing with different internal and external audiences over the last year and we've...
Read more »

You may have noticed e-mails sent from your Salesforce Org to have no reply in the From field as shown below. The reason that Salesforce does this is to enable Sender ID compliance. Sender ID compliance enables the receiving e-mail server to authenticate the sending e-mail server. If your recipient organization has the Sender ID compliance feature turned on and your sending e-mail server doesn't comply with it your e-mails will not be delivered to...
Read more »

This just in: Ex-Fannie Mae worker charged with planting computer virus By Freeman Klopott Examiner Staff Writer 1/29/09 A fired Fannie Mae contract employee allegedly placed a virus in the mortgage giant’s software that could have shut the company down for at least a week and caused millions of dollars in damage, prosecutors say. Rajendrasinh Makwana, an Indian citizen, was indicted Tuesday on computer intrusion charges. The former Gaithersburg resident is out on $100,000 bail,...
Read more »

There's been some recent discussion on SXIP's decision to build hardware to support Salesforce.com's delegated authentication protocol. Delegated authentication is a process where Salesforce makes a secure web services call to an endpoint that a customer defines. Salesforce can delegate authentication to the customer, which can allow for building web single sign on, integration with two-factor, integration with an LDAP directory, and many other possibilities. What hasn't been discussed is why Salesforce is using a...
Read more »