@raishin/vanguard-frontier-agentic 2.3.0 → 2.5.0

package/skills/salesforce/salesforce-infrastructure-audit-skill/references/hyperforce-deployment-controls.md

@@ -0,0 +1,181 @@
+# Hyperforce Deployment Controls Reference
+
+Reference for Salesforce Hyperforce
+deployment controls covering
+region selection, data residency commitments, and Infrastructure Access boundary
+management.
+
+---
+
+## What Hyperforce Is
+
+Hyperforce is Salesforce's public cloud-based infrastructure built on top of
+major cloud providers (AWS, Azure, GCP, Alibaba Cloud — varies by region).
+
+Hyperforce is distinct from legacy Salesforce infrastructure ("Classic") in
+that:
+- Customer data is hosted within defined cloud regions with contractual data
+  residency boundaries.
+- Compute and storage are on public cloud infrastructure with Salesforce's
+  security controls applied on top.
+- Upgrades and scaling occur at the public cloud layer.
+
+---
+
+## Region Selection
+
+### Available Hyperforce Regions
+
+Region availability changes as Hyperforce expands.
+Verify current available regions with Salesforce documentation or account team.
+
+As of the last validated date, Hyperforce regions include (not exhaustive):
+
+| Region | Cloud Provider | Data Residency Boundary |
+|--------|---------------|------------------------|
+| US East | AWS | United States |
+| US West | AWS | United States |
+| EU (Frankfurt) | AWS | European Union (Germany) |
+| EU (London) | AWS | United Kingdom |
+| APAC (Tokyo) | AWS | Japan |
+| APAC (Singapore) | AWS | Singapore/ASEAN |
+| India | AWS | India |
+| Australia | AWS | Australia |
+
+### Region Selection Criteria
+
+1. **Regulatory requirement:** GDPR requires EU personal data to remain in EEA
+   or countries with adequacy decisions. Select an EU region for EU-resident data.
+2. **Data sovereignty:** Government and financial regulators in some countries
+   require in-country data storage. Verify with legal counsel.
+3. **Latency:** Select the region closest to the majority of end users.
+4. **Availability:** Not all Salesforce products are available in all Hyperforce
+   regions on the same timeline.
+
+### How to Identify Your Org's Hyperforce Region
+
+```bash
+# Check the org's instance name and location
+sf org display -o your-org-alias --json | jq '.result.instanceUrl'
+# e.g., https://mycompany.my.salesforce.com
+
+# Cross-reference instance name with Salesforce Trust status page instance list
+# to identify the hosting region
+```
+
+Salesforce Trust (trust.salesforce.com) lists all instances with region labels.
+Hyperforce instances are typically labeled with their cloud region
+(e.g., `CS102` for a US instance, `EU64` for an EU instance).
+
+---
+
+## Data Residency Controls
+
+### What Hyperforce Guarantees
+
+Hyperforce provides:
+- Data-at-rest encrypted and stored within the contracted region.
+- Metadata (configuration, schema) may also be region-bound depending on the
+  product and contract.
+- Salesforce support access controls via the Customer Trust Access Management
+  feature.
+
+### What Hyperforce Does NOT Guarantee by Default
+
+- Prevention of data flowing to Salesforce support systems outside the region
+  during incident investigation (unless Customer Trust Access Management is enabled).
+- Restricting CDN edge nodes to a specific region (traffic routing optimizations
+  may traverse geographic boundaries at the network layer).
+
+### Verifying Data Residency via Contract
+
+Data residency is a contractual commitment, not purely a technical one. Review:
+- Order Form for the "Data Residency Option" or "Hyperforce region" specification.
+- Data Processing Addendum (DPA) for region binding commitments.
+- Business Associate Agreement (BAA) if HIPAA-regulated data is processed.
+
+---
+
+## Infrastructure Access Controls
+
+### What Infrastructure Access Means
+
+Infrastructure Access refers to whether Salesforce support engineers and
+infrastructure teams can access customer org data for troubleshooting.
+
+By default, Salesforce support has time-limited access to org data for support
+purposes. This is detailed in the Salesforce Privacy and Security Documentation.
+
+### Customer Trust Access Management
+
+Hyperforce customers can enable Customer Trust Access Management to require
+explicit customer approval before Salesforce support personnel access production
+org data.
+
+Controls available (subject to contract and product tier):
+- Require customer approval for all Salesforce support access to production data.
+- Access requests expire after a defined time window (e.g., 4 hours).
+- Access events are logged and visible to the customer.
+
+To review access logs (if enabled):
+```sql
+SELECT Id, Action, ActorName, ActorType, EventDate, Summary
+FROM SetupAuditTrail
+WHERE Action LIKE '%Access%' OR Action LIKE '%Support%'
+ORDER BY EventDate DESC
+LIMIT 200
+```
+
+### Admin Lockout Controls
+
+Hyperforce includes the ability to restrict Salesforce admin-level access to
+specific named individuals. This is part of the Enterprise Key Management and
+Infrastructure Access offering.
+
+---
+
+## Shield Encryption and Key Management
+
+Salesforce Shield Platform Encryption
+provides encryption
+at-rest for selected fields and files. On Hyperforce, encryption key management
+options include:
+
+| Option | Description | Key Custody |
+|--------|-------------|------------|
+| Salesforce-managed keys | Default; Salesforce manages key lifecycle | Salesforce |
+| Customer-managed keys (Bring Your Own Key) | Customer uploads and rotates keys | Customer |
+| External Key Management (EKM) | Keys stored in customer's external HSM or KMS | Customer HSM/KMS |
+
+### Key Management Audit Points
+
+- [ ] Verify encryption tenant secret rotation schedule (recommended: 90 days).
+- [ ] Confirm key derivation history shows at least one manual rotation in the
+  last 12 months.
+- [ ] If using BYOK, confirm the master HSM/KMS is geographically co-located
+  with the Hyperforce region.
+- [ ] Verify Shield encryption covers all regulated field types (PII, PHI, financial).
+
+```sql
+// Query encrypted field configuration (requires Shield)
+SELECT EntityDefinition.QualifiedApiName, QualifiedApiName, Label,
+       IsEncrypted
+FROM FieldDefinition
+WHERE IsEncrypted = true
+ORDER BY EntityDefinition.QualifiedApiName, QualifiedApiName
+```
+
+---
+
+## Hyperforce Deployment Readiness Checklist
+
+- [ ] Org instance confirmed as Hyperforce (not legacy Classic infrastructure).
+- [ ] Hyperforce region documented and matches regulatory data residency requirement.
+- [ ] Contract includes Data Residency Option for the required region.
+- [ ] Data Processing Addendum (DPA) executed with correct region binding.
+- [ ] Customer Trust Access Management evaluated and configured if required.
+- [ ] Salesforce Shield Platform Encryption coverage reviewed for regulated fields.
+- [ ] Encryption key rotation schedule documented and tested.
+- [ ] BYOK/EKM configured if customer-controlled keys are contractually required.
+- [ ] Salesforce Trust status subscriptions configured for the org's specific instance.
+- [ ] Incident response plan includes Hyperforce region-specific escalation contacts.

package/skills/salesforce/salesforce-infrastructure-audit-skill/references/network-policy-reference.md

@@ -0,0 +1,200 @@
+# Network Policy Reference
+
+Reference for Salesforce network access controls including IP allowlists,
+login IP ranges, CSP Trusted Sites, and connected app network policies.
+
+---
+
+## IP Restriction Layers in Salesforce
+
+Salesforce provides multiple independently configurable IP restriction layers.
+They are not equivalent and must all be reviewed.
+
+| Layer | Where Configured | Scope | Enforcement Point |
+|-------|-----------------|-------|------------------|
+| Org-wide trusted IP ranges | Setup > Network Access | All users | Login block if not in range |
+| Profile login IP ranges | Setup > Profiles > Login IP Ranges | Users on that profile | Login block |
+| Connected App IP restrictions | Setup > Connected Apps > [App] > IP Ranges | OAuth API sessions for that app | API call block |
+| Named Credential IP | Not configurable at Named Credential level | N/A | Controlled by callout destination |
+
+---
+
+## Org-Wide Trusted IP Ranges
+
+Path: Setup > Security > Network Access
+
+Trusted IP ranges affect the SMS/email verification challenge. If a user logs
+in from a non-trusted IP, Salesforce sends a verification challenge. Trusted
+ranges bypass this challenge.
+
+```
+Recommended: Do NOT add overly broad ranges such as 0.0.0.0-255.255.255.255
+This disables the verification challenge for all users globally.
+
+Acceptable: Office IP ranges, VPN egress IPs, CI/CD pipeline IPs.
+Review: Any entry covering a /8 or /16 subnet needs justification.
+```
+
+### Query trusted IP ranges via Metadata API
+```bash
+sf org retrieve metadata \
+  --metadata NetworkAccess \
+  -o my-org \
+  --target-dir /tmp/network-policy/
+cat /tmp/network-policy/force-app/main/default/networkAccess/NetworkAccess.networkAccess-meta.xml
+```
+
+### Audit script (anonymous Apex)
+```apex
+// Network access ranges cannot be queried via Apex — use Metadata API
+// as shown above or review via Setup UI.
+// However, you can inspect Profile-level login IP ranges:
+for (Profile p : [SELECT Id, Name FROM Profile WHERE UserLicense.Name != 'Guest']) {
+    System.debug('Profile: ' + p.Name + ' | Id: ' + p.Id);
+}
+// Then use Metadata API to extract LoginIpRanges per profile
+```
+
+---
+
+## Profile Login IP Ranges
+
+Path: Setup > Profiles > [Profile Name] > Login IP Ranges
+
+Login IP ranges restrict which IPs a user on that profile can log in from.
+Profiles with no login IP ranges configured allow login from any IP (subject
+to trusted IP challenge for untrusted IPs).
+
+### High-Risk Profile Findings
+
+| Finding | Risk Level |
+|---------|-----------|
+| System Administrator profile with no login IP range | HIGH |
+| Integration user profile with no login IP range | HIGH |
+| Integration user profile with IP range 0.0.0.0/0 | CRITICAL |
+| Guest User profile with login IP range (misconfigured — Guest login not IP restricted at profile level) | MEDIUM |
+
+### Recommended Login IP Ranges by Profile Type
+
+| Profile Type | Recommended Range |
+|-------------|------------------|
+| System Administrator | Specific corporate IPs + VPN egress only |
+| Integration User | Middleware server IPs only (no user interactive login) |
+| Standard internal user | Corporate VPN range acceptable |
+| External Community user | No restriction (users are globally distributed) |
+| Guest User | No effective restriction via login IP ranges |
+
+---
+
+## CSP Trusted Sites
+
+Path: Setup > Security > CSP Trusted Sites
+
+Salesforce enforces a Content Security Policy on all Lightning pages. External
+resources (images, scripts, fonts, API endpoints, WebSockets) must be listed
+in CSP Trusted Sites or the browser will block them.
+
+### CSP Directive Mapping in Salesforce
+
+| CSP Directive | Controls |
+|---------------|----------|
+| `connect-src` | XHR/fetch API calls, WebSocket connections |
+| `img-src` | Images loaded from external URLs |
+| `style-src` | External stylesheets |
+| `font-src` | External fonts |
+| `frame-src` | Embedded iframes |
+| `script-src` | External scripts (Salesforce blocks most external scripts by default) |
+
+### CSP Trusted Site Audit Checklist
+
+- [ ] No wildcard domains (`*.example.com` acceptable; `*` or `*.com` is a finding).
+- [ ] HTTPS enforced for all entries (no `http://` in CSP Trusted Sites).
+- [ ] Entries for localhost or internal staging domains removed before production.
+- [ ] `frame-src` includes only explicitly required embedding origins.
+- [ ] Review annually; remove origins for decommissioned integrations.
+
+### Retrieve CSP Trusted Sites via SOQL
+```sql
+SELECT Id, EndpointUrl, IsActive, Context, Description
+FROM CspTrustedSite
+WHERE IsActive = true
+ORDER BY EndpointUrl
+```
+
+---
+
+## Session Security Settings
+
+Path: Setup > Security > Session Settings
+
+### Critical Settings to Review
+
+| Setting | Secure Configuration | Risk if Misconfigured |
+|---------|---------------------|----------------------|
+| Session Timeout | 15 min (admin), 2-8 hours (standard) | Longer = session hijacking risk |
+| Lock sessions to IP | Enabled | Prevents session token reuse from different IP |
+| Lock sessions to domain | Enabled | Prevents cookie leakage across subdomains |
+| Force logout on session timeout | Enabled | Ensures clean session termination |
+| Clickjack Protection | Enabled for all pages | Prevents UI redress attacks |
+| Content Sniff Protection | Enabled | Prevents MIME-type sniffing |
+| HSTS | Enabled | Prevents SSL-stripping attacks |
+| XSS Protection | Enabled | Browser-level XSS mitigation |
+| Require HTTPS | Enabled | Prevents plaintext session cookies |
+
+### High Assurance Session Requirements
+
+High Assurance sessions are required before accessing certain sensitive areas
+(certificates, Auth. Providers configuration, Connected App settings).
+
+Configure which operations require High Assurance:
+Path: Setup > Security > Session Settings > Session Security Levels
+
+Recommended High Assurance operations:
+- Manage Users
+- Manage Connected Apps
+- Manage Auth. Providers
+- Manage Remote Sites
+- Manage Certificates
+
+---
+
+## Connected App Network Controls
+
+For each Connected App:
+- Set IP Relaxation to "Enforce IP restrictions" (not "Relax IP restrictions").
+- OAuth Token Timeout: set to minimum required for the integration use case.
+- Review Callback URL — should be HTTPS only.
+
+```sql
+SELECT Id, Name, OptionsAllowAdminApprovedUsersOnly,
+       MobileStartUrl, StartUrl
+FROM ConnectedApplication
+ORDER BY Name
+```
+
+Detailed OAuth policy review requires Metadata API retrieval of `ConnectedApp`
+metadata type.
+
+---
+
+## Remote Site Settings
+
+Path: Setup > Security > Remote Site Settings
+
+Remote Site Settings control which external URLs Apex code and Visualforce
+can make HTTP callouts to.
+
+```sql
+SELECT Id, EndpointUrl, IsActive, Description, DisableProtocolSecurity
+FROM RemoteProxy
+WHERE IsActive = true
+ORDER BY EndpointUrl
+```
+
+**HIGH finding:** Any record where `DisableProtocolSecurity = true`.
+This disables SSL certificate verification for that endpoint — equivalent to
+`TrustManager.TRUST_ALL` in Java.
+
+**Review:** All HTTP (non-HTTPS) endpoints. All endpoints on the pattern
+`http://localhost` or `http://127.0.0.1` (only acceptable in developer orgs
+for local Salesforce Functions development).

package/skills/salesforce/salesforce-infrastructure-audit-skill/references/session-policy-reference.md

@@ -0,0 +1,219 @@
+# Session Policy Reference
+
+Reference for Salesforce session security configuration including timeout values,
+clickjack protection, high-assurance session requirements, and HTTPS enforcement.
+
+---
+
+## Session Settings Location
+
+Path: Setup > Security > Session Settings
+
+All settings in this section apply org-wide unless overridden at the connected
+app or profile level.
+
+---
+
+## Timeout Configuration
+
+### Session Timeout Values
+
+Salesforce allows timeout values from 15 minutes to 24 hours.
+
+| User Type | Recommended Timeout | Maximum Acceptable |
+|-----------|--------------------|--------------------|
+| System Administrator | 15 minutes | 30 minutes |
+| Integration API user | N/A (use server-to-server OAuth, not interactive session) | N/A |
+| Standard internal user | 2 hours | 8 hours |
+| External Community user | 2 hours | 12 hours |
+| Guest User | 15 minutes (read-only context) | 30 minutes |
+
+**Finding:** Org-wide session timeout > 8 hours is a MEDIUM finding.
+**Finding:** System Administrator session timeout > 30 minutes is a HIGH finding.
+
+### Timeout Behavior Settings
+
+| Setting | Recommended Value |
+|---------|------------------|
+| Timeout Action | Lock (not Logout, to preserve user work) |
+| Force Logout on Timeout | Enabled for Admin profiles |
+| Disable Session Timeout Warning Popup | Disabled (users should see warning) |
+
+---
+
+## Lock Sessions Settings
+
+### Lock Sessions to IP Address
+
+When enabled, a session token is bound to the IP address used at login. The
+session is invalidated if a request arrives from a different IP with the same
+token.
+
+**Recommended:** Enabled for all user types.
+
+**Exception:** Mobile users on carrier networks may have rotating IPs. For mobile
+use cases, evaluate the trade-off between security and usability.
+
+**Setting location:** Session Settings > Lock sessions to the IP address from
+which they originated.
+
+### Lock Sessions to Domain
+
+When enabled, session cookies are bound to the specific Salesforce subdomain.
+Cross-subdomain cookie reuse is blocked.
+
+**Recommended:** Enabled.
+
+---
+
+## Clickjack Protection
+
+Clickjack (UI Redress) attacks embed Salesforce pages in an iframe on an
+attacker-controlled page and trick users into clicking buttons they cannot see.
+
+### Protection Levels
+
+
+| Setting | Description | Recommendation |
+|---------|-------------|----------------|
+| Allow framing by any page | No protection | Never use in production |
+| Allow framing by the same origin only | Allows same-domain embedding | Minimum |
+| Don't allow framing by any page | Strict X-Frame-Options: DENY | Recommended |
+
+Path: Setup > Security > Session Settings > Clickjack Protection Level
+
+**Additional settings to enable:**
+- Enable clickjack protection for non-setup Salesforce pages (standard pages)
+- Enable clickjack protection for setup Salesforce pages
+
+**Visualforce clickjack protection:**
+Each Visualforce page can override with the `showHeader` attribute interaction
+with `<apex:page>`. Review VF pages that embed external content.
+
+---
+
+## HTTPS Enforcement
+
+### Require Secure Connections (HTTPS)
+
+Path: Setup > Security > Session Settings > Require secure connections (HTTPS)
+
+**Recommended:** Enabled. This setting forces all Salesforce traffic over HTTPS.
+
+### HTTP Strict Transport Security (HSTS)
+
+HSTS instructs browsers to only connect to Salesforce over HTTPS for a defined
+period, preventing SSL-stripping attacks.
+
+Salesforce enables HSTS by default on all production orgs. Verify it is not
+disabled in custom domain configurations.
+
+**Custom domain HSTS verification:**
+```bash
+curl -I https://yourcustomdomain.my.salesforce.com 2>/dev/null | grep -i strict
+# Expected: strict-transport-security: max-age=31536000; includeSubDomains
+```
+
+---
+
+## High-Assurance Session Requirements
+
+A High Assurance session requires the user to authenticate with a stronger
+method (MFA hardware token, certificate) before accessing sensitive areas.
+
+### How High Assurance Works
+
+Salesforce defines two session security levels:
+- **Standard:** Regular username/password or SSO.
+- **High Assurance:** MFA required (hardware key, Salesforce Authenticator app,
+  TOTP authenticator).
+
+### Required High Assurance Operations (Recommended)
+
+Path: Setup > Security > Session Settings > Session Security Levels
+
+| Operation | Risk If Not High Assurance |
+|-----------|--------------------------|
+| Manage Users | Account takeover via compromised admin session |
+| Manage Connected Apps | OAuth token theft |
+| Manage Auth. Providers | Identity provider tampering |
+| Manage Certificates | PKI compromise |
+| Manage Remote Sites | Add malicious callout targets |
+| View Setup Audit Trail | Audit log access |
+| Manage Encryption | Shield encryption key access |
+
+### Assigning High Assurance to Permission Sets
+
+You can require High Assurance for any Permission Set:
+```
+Setup > Permission Sets > [Set] > Session Activation Required = High Assurance
+```
+
+Users who activate this permission set in a Standard session will be prompted
+to step up to High Assurance.
+
+---
+
+## OAuth Token Security Settings
+
+Path: Setup > Security > OAuth and OpenID Connect Settings
+
+| Setting | Secure Value |
+|---------|-------------|
+| Allow OAuth Username-Password Flows | Disabled (deprecated, no MFA support) |
+| Allow OAuth User-Agent Flows | Disabled (implicit flow deprecated in OAuth 2.1) |
+| Token Expiration for web apps | 2 hours maximum |
+| Refresh Token Policy | Expire on first use or set fixed expiry |
+
+**HIGH finding:** OAuth Username-Password Flow enabled in production.
+This flow transmits credentials in the request body and bypasses MFA.
+
+---
+
+## Audit Settings
+
+### Login History Retention
+
+Salesforce retains login history for 6 months. For compliance requirements
+beyond 6 months, export and store in a SIEM.
+
+```sql
+SELECT UserId, LoginTime, LoginType, LoginUrl, SourceIp,
+       Status, Application, Browser, Platform
+FROM LoginHistory
+WHERE LoginTime = LAST_N_DAYS:90
+ORDER BY LoginTime DESC
+LIMIT 1000
+```
+
+### Setup Audit Trail
+
+Path: Setup > Security > View Setup Audit Trail
+
+Salesforce retains the Setup Audit Trail for 180 days. For compliance, export
+regularly.
+
+```bash
+sf data query \
+  --query "SELECT CreatedDate, CreatedByUser, Action, Section, Display \
+           FROM SetupAuditTrail \
+           ORDER BY CreatedDate DESC \
+           LIMIT 2000" \
+  -o my-org \
+  --result-format csv > audit-trail.csv
+```
+
+---
+
+## Session Security Review Checklist
+
+- [ ] Session timeout <= 8 hours for standard users, <= 30 min for admins.
+- [ ] Lock sessions to IP: Enabled.
+- [ ] Lock sessions to domain: Enabled.
+- [ ] Clickjack protection: Enabled for all pages.
+- [ ] HTTPS required: Enabled.
+- [ ] High Assurance required for: Manage Users, Connected Apps, Auth. Providers.
+- [ ] OAuth Username-Password Flow: Disabled.
+- [ ] OAuth User-Agent Flow (implicit): Disabled.
+- [ ] Login history exported to SIEM if retention > 6 months required.
+- [ ] MFA enforced via profile or org-wide policy.