1. BMC Remedyforce CMDB & Asset Management
3/22/2018
BMC Remedyforce CMDB & Asset Management
Overview
Virginia Leandro, Technical Product Manager
July 11, 2017

2. Legal Notice
The information contained in this presentation is the confidential information of BMC Software, Inc. and is being provided to you with the express understanding that without the prior written consent of BMC, you may not discuss or otherwise disclose this information to any third party or otherwise make use of this information for any purpose other than for which BMC intended.
All of the future product plans and releases described herein relate to BMC’s current product development considerations, which are at the sole discretion of BMC and are subject to change and/or cancellation at any time. BMC cannot and does not provide any assurance as to whether these plans will result in any future releases of the nature described. These future product plans should not be viewed as commitments on BMC’s part and thus should not be relied upon in customer purchase decisions.
No presentation is complete without our safe harbor statement. We may discuss future plans, however all purchasing decisions should be made on what is generally available today.

3. Today’s Agenda What is Asset Management? Enhanced CMDB Approach
Capabilities
Q&A

4. What is IT Asset Management (ITAM)?
IT Asset Management (ITAM) entails collecting inventory, financial and contractual data to manage the IT asset through its lifecycle.
ITAM depends on robust processes, with tools to automate manual processes. Capturing and integrating auto-discovery/inventory, financial and contractual data in a central repository for all IT assets enables the functions to effectively manage vendors and a software and hardware asset portfolio from requisition through retirement, thus monitoring the asset’s performance through its lifecycle.
(Gartner IT Glossary, 2015)
What is IT Asset Management also known as ITAM? Well, it’s a foundation of integration, process, and data. It’s the collection of inventory and financial and contractual data to manage assets through their lifecycle.
ITAM relies on robust processes and tools to automate manual processes.

5. Enhanced CMDB and ITAM ITAM Enhanced CMDB 3/22/2018
Lifecycle Management
Enhanced CMDB with Co- Existence of Assets with CIs
Data & Security Driven Views
Rules-Based Asset Classes
Expanded CMDB Explorer
Dashboard and Reports
Agentless Discovery and Client Management
New Configuration Options
Improved Searching
Improved Auditing
List View Customization
Normalization and Models
Standardization and New Fields
Expanded Navigational Capabilities
We’ve done a lot of work to enhance our CMDB as well as add the tools you need to manage your Assets.
For CMDB we’ve improved searching and auditing. We introduced list view customization. Additionally, normalization and models help you ensure the integrity of your data.
ITAM was introduced to help with asset lifecycle management. AM lives within the CMDB giving you a common and familiar interface. We’ve also expanded the CMDB Explorer to also incorporate your assets. And most importantly we’ve added a component to support Agentless Discovery and Client Management.

6. Enhanced CMDB Data Driven Views
3/22/2018
Enhanced CMDB
Data Driven Views
Based upon the user’s rights and configurable rules, users can see CIs and/or Assets
Little to No Impact to Existing Customers
Asset Management is a configurable option which has no impact on existing integrations.
Automated Classification
With the new rules-based classes, administrators can classify any records as CIs and/or Assets.
The CMDB really consists of two items now. CIs and Assets….both of which live within the single Base Element object. With the introduction of Asset Management there was little to no impact on existing customers who may have already been using the CMDB. Additionally we introduced new rules-based classes so that admins can classify any record as a CI or an Asset.
The design allows customers to leverage CIs and/or assets depending on their maturity and requirements.

7. New Configuration Options
3/22/2018
New Configuration Options
General CMDB Settings
Options to enable or disable CI and/or Asset Management and CI Management
Auditing
Intuitive screen to select which fields to audit (unlimited)
List View Customization
Custom list views for any class
Enhanced Class Management
Create CI, Asset and joint class types with rules-based classes
Additional configuration options were added to Remedyforce Administration so the administrator has one place to go to set up general CMDB settings, configure auditing (which is unlimited), manage list view customization and we introduced class management. Allowing you to redefine existing classes as a CI, Asset or both, and allowing you to create custom classes.

8. Additional Configuration Options
3/22/2018
Additional Configuration Options
General CMDB Settings
Options to enable or disable CI and/or Asset Management and CI Management
Auditing
Intuitive screen to select which fields to audit (unlimited)
List View Customization
Custom list views for any class
Enhanced Class Management
Create CI, Asset and joint class types with rules-based classes
Taking a closer look, in General CMDB Settings you have the option to enable or disable Asset Management and/or CI Management.

9. Additional Configuration Options
3/22/2018
Additional Configuration Options
General CMDB Settings
Options to enable or disable CI and/or Asset Management and CI Management
Auditing
Intuitive screen to select which fields to audit (unlimited)
List View Customization
Custom list views for any class
Enhanced Class Management
Create CI, Asset and joint class types with rules-based classes
Auditing of your CI/Asset fields is now unlimited allowing you better insight into changes of the asset or CI over its life.

10. Additional Configuration Options
3/22/2018
Additional Configuration Options
General CMDB Settings
Options to enable or disable CI and/or Asset Management and CI Management
Auditing
Intuitive screen to select which fields to audit (unlimited)
List View Customization
Custom list views for any class
Enhanced Class Management
Create CI, Asset and joint class types with rules-based classes
You now can customize the list view for any class. This means the list view for one class can be different from another class.

11. Additional Configuration Options
3/22/2018
Additional Configuration Options
General CMDB Settings
Options to enable or disable CI and/or Asset Management and CI Management
Auditing
Intuitive screen to select which fields to audit (unlimited)
List View Customization
Custom list views for any class
Enhanced Class Management
Create CI, Asset and joint class types with rules-based classes
Under Enhance Class Management you can now create CI, Asset, and Joint class types using rules-based classes.

12. Advanced CMDB Navigation – CI Tab
3/22/2018
Advanced CMDB Navigation – CI Tab
Dynamic Tab Filters
Authorized users can see CIs and/or Assets with the new Tabs. Customers without access to CIs or assets will not see these tabs as they would not be necessary.
Quickly See All Records
“All Records (Base Element)” has been added to the top of the list to quickly and intuitively see all records.
Change View
Now available by selecting the button to toggle between views or select from a dropdown.
New Instance Type List Field
The new Instance Type field differentiates between CI, Asset and “CI and Asset” records.
We augmented the CMDB UI to better help distinguish between CIs, Assets, or if you choose to, to see all items within the CMDB.

13. Advanced CMDB Navigation – Asset Tab
3/22/2018
Advanced CMDB Navigation – Asset Tab
Dynamic Tab Filters
Authorized users can see CIs and/or Assets with the new Tabs. Customers without access to CIs or assets will not see these tabs as they would not be necessary.
Quickly See All Records
“All Records (Base Element)” has been added to the top of the list to quickly and intuitively see all records.
Change View
Now available by selecting the button to toggle between views or select from a dropdown.
New Instance Type List Field
The new Instance Type field differentiates between CI, Asset and “CI and Asset” records.
You can easily switch from one view to another and you can quickly view all records.

14. Advanced CMDB Navigation – All Tab
3/22/2018
Advanced CMDB Navigation – All Tab
Dynamic Tab Filters
Authorized users can see CIs and/or Assets with the new Tabs. Customers without access to CIs or assets will not see these tabs as they would not be necessary.
Quickly See All Records
“All Records (Base Element)” has been added to the top of the list to quickly and intuitively see all records.
Change View
Now available by selecting the button to toggle between views or select from a dropdown.
New Instance Type List Field
The new Instance Type field differentiates between CI, Asset and “CI and Asset” records.
We added an instance type field so that when you are viewing all records, you can easily distinguish it’s type.

15. Advanced CMDB Search Filter
3/22/2018
Advanced CMDB Search Filter
More Precise Search
Select any field(s) to define a more precise search.
Quick and Easy
Quickly create a one time search or save your search, remembering your last search with an icon to identify if the search is active.
Flexible
Users can chose between the new advanced search or the global search.
The new CMDB Advanced Search filter allows for more precise searching as well as saving favorite queries for use later.

16. Locations New Management Screen Leverages Existing CI Class
3/22/2018
Locations
New Management Screen
A simplified screen to view and manage the locations is available under Administration.
Leverages Existing CI Class
For existing customers, it utilizes the existing CI class “Physical Location”.
New Field on Instance
Dropdown available on general tab to quickly view and assign a location with the option to drill in to view all location details.
Locations have always been a part of the CMDB, but we saw a need for a more simplified screen to view and manage locations. This leverages the existing CI class “Physical Location”.

17. Locations New Management Screen Leverages Existing CI Class
3/22/2018
Locations
New Management Screen
A simplified screen to view and manage the locations is available under Administration.
Leverages Existing CI Class
For existing customers, it utilizes the existing CI class “Physical Location”.
New Field on Instance
Dropdown available on general tab to quickly view and assign a location with the option to drill in to view all location details.
And on the CIs and Assets we’ve added a new Location field which you can now set vs. having to set up a complicated relationship. This makes it even easier to see CIs and Assets per location when combined with the advanced search.

18. Enhanced Navigation Navigate Between Objects 3/22/2018
New objects and options to navigate to related information. The new navigations include:
Instance ↔ Location (screen shot)
Instance ↔ Model
Instance ↔ Primary Client
Instance ↔ Support By
We’ve enhanced navigation and provide new navigations such as Instance and Location, Instance and Model, Instance and Primary Client, and Instance and Support By.

19. Enhanced and Renamed CMDB Explorer
3/22/2018
Enhanced and Renamed CMDB Explorer
Renamed to CMDB Explorer
Formerly named “CI Explorer”, with the introduction of “assets”, authorized users have the option to see CIs and/or Assets
Advanced Filters
To see assets and/or CIs
We improved (and renamed) the CI Explorer to CMDB Explorer allowing you to see All items, just CIs, or just Assets.

20. Dynamic CI and Asset Screen
3/22/2018
Dynamic CI and Asset Screen
Dynamic
Based upon the user and selected view, asset specific fields (ex. Asset Status) and common fields will be visible.
Secure
Multiple levels of security across the CMDB including:
CI and Asset Management Options
User permissions for CIs and Assets (read-only, update and update & delete)
Profiles for Field Level Security
Depending on a user’s focus, you can dynamically control what they can see. For example, an Asset Manager most likely only wants to see asset records With a simple user configuration, the Asset Manager will only see those records (i.e. assets) most relevant to them, but maybe the Service Desk agent needs to see all (i.e. CI and asset) records.

21. Dashboard and Reporting
Asset Management Metrics and Reports
Targeted for this release are:
Asset Count (option to filter, ex. by status, class, …)
Asset Status (option to filter, ex. by class, location, …)
Asset Aging (by timeframe)
Data Quality (missing data by class)
Warranty expiration (X days prior and expired)
Exceptions (trending)
Highest Number of Incidents by Model (option to define timeframe)
Assets associated with Sev 1 issues (incidents, business services)

22. Models

23. Models What is it? Why do I care?
3/22/2018
Models
What is it?
Model are a new optional object used to create CIs and/or assets. Think of them as catalog items or templates to create CIs and assets.
Why do I care?
Models drive consistency and reduces the time creating CIs and assets. If enabled, users can quickly select a model from a new lookup field to auto-populate a configurable set of fields at the instance level to ensure consistency.
Imagine users and numerous data feeds populating and updating your CMDB. Now image every source creating the same record a different way. Models and Normalization help drive data consistency which improves reporting and searching, ultimately improving confidence in the data the their Service Management program.

24. Models Optional Standardize Simplify Control and Consistency
3/22/2018
Models
Model
Instance CI
Asset
CI and Asset
Optional
Customers can choose to use or not use models.
Standardize
Models are catalog items of what can become a CI or Asset
Simplify
Users can search and select from within the CMDB to create a consistent record
Control and Consistency
Control which model fields are inherited from the model to instance (ex. model name, manufacturer).
Instance Examples Today
Instance Examples Summer 15 with Models
Dell Latitude D800
Dell D800
Dell Latitude D800
Latitude D800
iPhone 6
Apple iPhone 6
Apple iPhone 6
Models allow you to standardize catalog items of what can become a CI or an Asset. It simplifies and adds consistency to creating a record. Additionally the models can control which fields are inherited such as model name, manufacturer, to name a few.
An example of this would be to create a model for a Dell Latitude E You can then set standard properties such as the CMDB Class, if the model is virtual or not, it’s primary capability, and it’s total physical memory.
iPhone6

25. Normalization

26. Normalization What is it? Why do I care?
3/22/2018
Normalization
What is it?
Normalization is the process of organizing objects and attributes to minimize, ideally avoid redundancy.
Why do I care?
Service Management can accept from many sources and users. Data can be inconsistent and inaccurate. The normalization capabilities introduced in Summer 15 empower customers to define the rules for accepting and reviewing data. The new features provide a simple and intuitive way to handle the exception and minimize inconsistent and inaccurate data.
“How consistent is your data (ex. CI Manufacturer, CI Model Name)?”
Normalization is the process of organizing objects and attributes to minimize redundancy. Normalization provides a simple and intuitive way to handle exceptions and minimize data disparity.

27. Normalization The Simplified Continuous Process Improvement Flow
3/22/2018
Normalization
The Simplified Continuous Process Improvement Flow
Define Normalization Value(s)
Select Field(s) to Normalize
View Exceptions
Manage Exceptions
Enter and/or Import Data
Normalization is a continuous process of entering or importing data, viewing the exceptions and then managing those exceptions. A great example of Normalization is having multiple computers where one may be a Dell, the other is Dell, Inc. and yet another may be Dell Corporation. Normalization can be used to standardize all of these to simply Dell.

28. Normalization Continuous Data Consistency Improvement
Configurable rules-based exceptions to increase consistency and reduce exceptions.
Intuitive and Flexible Design
Easily identify the fields and rules to normalize. Ex. Any new asset status values must be approved or mapped.
Manage by Exception
Only see those records which create exceptions based upon your rules.

29. Normalization – View Rules
Continuous Data Consistency Improvement
Configurable rules-based exceptions to increase consistency and reduce exceptions.
Intuitive and Flexible Design
Easily identify the fields and rules to normalize. Ex. Any new asset status values must be approved or mapped.
Manage by Exception
Only see those records which create exceptions based upon your rules.

30. Normalization – Define and Manage Rules
Continuous Data Consistency Improvement
Configurable rules-based exceptions to increase consistency and reduce exceptions.
Intuitive and Flexible Design
Easily identify the fields and rules to normalize. Ex. Any new asset status values must be approved or mapped.
Manage by Exception
Only see those records which create exceptions based upon your rules.

31. Normalization – View Exceptions
Continuous Data Consistency Improvement
Configurable rules-based exceptions to increase consistency and reduce exceptions.
Intuitive and Flexible Design
Easily identify the fields and rules to normalize. Ex. Any new asset status values must be approved or mapped.
Manage by Exception
Only see those records which create exceptions based upon your rules.

32. Normalization – Manage Exceptions
Continuous Data Consistency Improvement
Configurable rules-based exceptions to increase consistency and reduce exceptions.
Intuitive and Flexible Design
Easily identify the fields and rules to normalize. Ex. Any new asset status values must be approved or mapped.
Manage by Exception
Only see those records which create exceptions based upon your rules.

33. Normalization – Accept New Value or Map to Approved Value
Continuous Data Consistency Improvement
Configurable rules-based exceptions to increase consistency and reduce exceptions.
Intuitive and Flexible Design
Easily identify the fields and rules to normalize. Ex. Any new asset status values must be approved or mapped.
Manage by Exception
Only see those records which create exceptions based upon your rules.

34. Normalization – Map to Approved Value
Continuous Data Consistency Improvement
Configurable rules-based exceptions to increase consistency and reduce exceptions.
Intuitive and Flexible Design
Easily identify the fields and rules to normalize. Ex. Any new asset status values must be approved or mapped.
Manage by Exception
Only see those records which create exceptions based upon your rules.

35. Agentless Discovery and New Client Management Options

36. Agentless Discovery What is it?
Included in the Remedyforce base license (i.e. no additional cost for existing and new customers).
Customers have the option to enable “Agentless Discovery” to quickly discover devices in their environment.
Simple and Powerful
From new administration screens, an Administrator can easily enable, configure and collect device data to populate their Remedyforce CMDB. Also included is a new admin screen with enhanced logging to track activity and assist with troubleshooting potential connectivity issues.

37. 3/22/2018
Agentless Discovery
Automatically delivers a wealth of device details including:
Device type
Key identifiers (ex. serial number)
Operating system
Hardware configuration
Installed software
No software is being imported into the CMDB….we can table and have a follow up discussion on how to manage software.

38. Remedyforce Agentless Discovery
3/22/2018
Remedyforce Agentless Discovery
How does it work?
Scan configurations are defined in Rf to determine data and frequency.
At least one on premise “scanner” is installed to perform the agentless scans.
The scanner passes the data to the “Discovery Server” hosted in the cloud by BMC.
Depending on your scanner configuration(s), you determine when and which classes to pass to the Remedyforce CMDB.
We offer options to host the Discovery server in EMEA (Amsterdam) or NA (Chicago) depending on the location of your Remedyforce org.

39. Remedyforce Client Management
What is it?
Remedyforce Client Management goes beyond “discovery” to automate system administration and support functions that would otherwise be done manually.
Compelling value statements for our Remedyforce customers:
Empower Support Team to be proactive
Increase first call resolution rates
Reduce support call time
Automate and reduce support calls
Agentless Discovery (base)
Premium
Premium Plus
Device type
Operating system
Hardware configuration
Relationships
Installed software
Agent discovery
Remote management
Compliance management
Premium Capabilities “plus”
Patch Management
Deployment Management

40. Remedyforce Client Management
Maturity Based Model
Those who require more advanced discovery and client management capabilities can easily upgrade to two new options – Premium and Premium Plus:
Capabilities
Remedyforce
Base
Remedyforce Client Management
Premium
Premium Plus
Inventory Management (Agentless Discovery) √
Inventory Management (Agent Discovery)
Remote Management
Compliance Management
Patch Management
Deployment Management

41. Agentless Discovery Setup –
Easy and Intuitive

42. Agentless Discovery – Easy Setup
Enable Discovery
Request Discovery Server
Install Scanner(s)
Configure Scanner(s)
Configure Import
Step 1: Enable Discovery
Simply select “Enable Remedyforce Discovery” to start the setup.
Under Remedyforce Administration -> Configure CMDB 2.0 -> (“New”) Discovery Setup & Configuration

43. Agentless Discovery – Easy Setup
Enable Discovery
Request Discovery Server
Install Scanner(s)
Configure Scanner(s)
Configure Import
Step 2a: Request Discovery Server
Step Up First Remote Site (manual or automated) to authorize an external connection (a Salesforce requirement).
…and
Request Discovery Server to automate the assignment of a hosted server to collect the discovery data.
Note: The first remote site is required to access provisioning server.

44. Agentless Discovery – Easy Setup
Enable Discovery
Request Discovery Server
Install Scanner(s)
Configure Scanner(s)
Configure Import
Step 2b: Request Discovery Server
Step Up Second Remote Site to authorize access to the discovery server.
This screen will then refresh to allow you to see the license details and scanner links.

45. Agentless Discovery – Easy Setup
Enable Discovery
Request Discovery Server
Install Scanner(s)
Configure Scanner(s)
Configure Import
Step 3: Install Scanner(s)
Install scanner(s) depending on your network (note: most customers will only need to install one or a few scanners).
Scanners can be installed on Windows and Linux platforms.

46. Agentless Discovery – Easy Setup
Enable Discovery
Request Discovery Server
Install Scanner(s)
Configure Scanner(s)
Configure Import
Step 3: Install Scanner(s)
Install scanner(s) depending on your network (note: most customers will only need to install one or a few scanners).
Scanners can be installed on Windows and Linux platforms.

47. Agentless Discovery – Easy Setup
Enable Discovery
Request Discovery Server
Install Scanner(s)
Configure Scanner(s)
Configure Import
Step 4: Select and Configure Scanner(s)
Configure scanner(s) by defining what, how and when to scan (ex. platforms, credentials, IP ranges and schedule)

48. Agentless Discovery – Easy Setup
Enable Discovery
Request Discovery Server
Install Scanner(s)
Configure Scanner(s)
Configure Import
Step 4: Select and Configure Scanner(s)
Configure scanner(s) by defining what, how and when to scan (ex. platforms, credentials, IP ranges and schedule)

49. Agentless Discovery – Easy Setup
Enable Discovery
Request Discovery Server
Install Scanner(s)
Configure Scanner(s)
Configure Import
Step 5: Configure Import
Identify which classes to import and the frequency to perform the import to the Remedyforce CMDB.

50. CMDB Mobility for
End Users and Agents

51. Expanded CMDB Mobility for End Users
Empowers End Users to:
See which CMDB records are assigned to them
View CMDB record details
Dynamically create a ticket from an assigned CMDB record
Note: Administrators can configure the order of self service options along with which CMDB fields appear in the list and detailed views.

52. Expanded CMDB Mobility for Agents
Empowers Agents to:
View related CMDB records from an incident
Link or unlink CMDB records to an incident
View CMDB record details and relationships
Edit CMDB records
Note: Administrators can configure which CMDB fields appear in the list and detail views.

53. Enhanced Request Management

54. Streamline Request and Fulfillment
New filter added to Service Request Definitions to identify available CIs and/or Assets
Note: Also includes the ability to associate a model or models (introduced in Summer 15) to SRDs.

55. Streamline Request and Fulfillment
New menu option for approved Service Requests to perform a “Fulfillment”

56. Streamline Request and Fulfillment
Prompts Fulfiller with records based upon filter defined in SRD

57. Streamline Request and Fulfillment
Enables Fulfiller to assign and update record(s) (ex. Asset Status = Assigned)
Selecting “Save” will update and link the associated CMDB records to the service request.

58. Salesforce Platform Encryption

59. Salesforce Platform Encryption
3/22/2018
Salesforce Platform Encryption
Salesforce Platform Encryption gives data a new layer of security while preserving critical platform functionality. It enables customers to encrypt sensitive data at rest, and not just when transmitted over a network so companies can confidently comply with privacy policies, regulatory requirements, and contractual obligations for handling private data.
A few years ago, in response to customers needing an additional layer of security, Salesforce introduced a new product called Platform Encryption. Platform Encryption allows customers to selectively encrypt data at rest. Data at rest is data that is stored physically in any digital form. Customers who utilize or may be interested in Platform Encryption are usually in highly regulated industries such as Financial Services, Heath & Life Sciences, Government, etc.

60. Features of Salesforce Platform Encryption
3/22/2018
Features of Salesforce Platform Encryption
Strong encryption of data at rest
Preserve critical business functionality
Control the lifecycle of encryption keys
Customers can encrypt standard & custom fields (including Managed Package fields such as Remedyforce) as well as files and attachments.
The encryption preserves key functionality such as Search, Lookups, validation rule, and Chatter.
Platform Encryption offers flexible key management providing more control and ownership of data security.

61. Defense in Depth Strategy
3/22/2018
Defense in Depth Strategy
Platform Encryption Facilitates
Regulatory Compliance
Prevention of Unauthorized Access to Database
Contractual Obligations
PII & Data privacy
Does NOT replace
Sharing Model
Object/Field Level Security
Data Residency Solution
Encryption for Non-Salesforce Data
Protection against Social Engineering
Platform encryption is an additional layer to the Salesforce Defense Strategy. It helps customers meet regulatory compliance, prevents unauthorized access to the database, and facilitates the securing of PII & Data Privacy.
Platform Encryption is not intended to replace the sharing model, or object/field level security. Platform encryption is NOT data masking. Salesforce already provides an Encrypted field data type for customers who need data masking.

62. Salesforce Driving Principles
3/22/2018
Salesforce Driving Principles
Salesforce needed to balance security demands with customers’ functional requirements so a set of principles drove their solution design and architecture:
Encrypt data at rest.
Natively integrate encryption at rest with key Salesforce features
Use strong encryption
Enable customers to drive key lifecycle
Protect keys from unauthorized access
Encrypt as little as possible
Salesforce has a number of driving principles that they laid out as they were designing Platform Encryption. The most important one for you to be aware of is that customers should not take a “encrypt everything” approach. That is not possible with the product today and Salesforce doesn’t have plans to ever support that thinking. Salesforce’s take is to encrypt as little as possible. Customers should only encrypt what is absolutely necessary.

63. 3/22/2018
Delivery
Salesforce Platform Encryption (PE) is an additional cost to customers. They must purchase Salesforce Platform Encryption. They can reach out to their Remedyforce Business Relationship Manager or Account Manger for pricing information.
Once the customer purchases PE, and depending on their needs, we’ve equipped Remedyforce Summer 17 with an Encryption Library.
The Encryption Library allows us to support Platform Encryption and the encryption of managed package fields or critical Salesforce out of the box fields, such as the Account Name, that customers may encrypt.

64. Salesforce Platform Encryption – What can be Encrypted?

65. Salesforce Platform Encryption – What can be encrypted?
3/22/2018
Salesforce Platform Encryption – What can be encrypted?
Files and Attachments
Account
Account Name
Phone
Fax
Website
Description
Contact
Name
Mailing Address (only Mailing Street and Mailing City)
Mobile
Home Phone
Other Phone
Case
Subject
Case Comment
Body
Platform Encryption can encrypt all Files and Attachments as well as certain fields of the Account, Contact, Case and Case Comment objects.

66. What can be encrypted? Custom Fields (Data Types)**
3/22/2018
What can be encrypted?
Custom Fields (Data Types)**
Phone
Text
Text Area
Text Area (Long)
URL
Date
Date/Time
** Remedyforce falls into this bucket
What we’re really interested in is if Platform Encryption is enabled, how does that affect Remedyforce? Well, in addition to Platform Encryption, customers can request that managed package fields be eligible for encryption. Note this is not enabled by default and customers will need to submit a case to support to request the feature be enabled.
Once enabled, managed package fields of the listed data types can be encrypted.
But would you want to?
As we built out the Remedyforce solution to support Platform Encryption, we realized we needed to separate Data from Metadata. We’ll talk about that more in a bit.

67. 3/22/2018
What else?
Encrypt fields belonging to a managed package (Must request Salesforce to enable after the customer purchases PE)
Use encrypted fields in formula fields (This has a very narrow scope)
Beta: Access encrypted data in Flows (Must request Salesforce to enable)
Beta: Access encrypted data with Flows and Process Builder (Must request Salesforce to enable)
Once encryption is enabled it only applies to new or updated records! So for existing records, customer can submit a request to Salesforce asking for a Mass Encryption action. Same goes for if a field is encrypted and then the customer later decides to remove the encryption…they will need to have a case submitted to Salesforce to run the Mass Encryption action to decrypt.
So just a few more notes around Platform Encryption. In order to encrypt fields that belong to a managed package, a request must be submitted to Salesforce to enable.
Encrypted fields can be used in formula fields; however it has a very narrow scope that we’ll cover a bit later.
There’s two Betas going on utilizing encrypted data in Flows and Process builder. In both cases, a request has to be made to Salesforce to have these enabled.
Finally, once Platform Encryption is enabled and customers have marked their fields for encryption, they can submit a request to Salesforce to have a Mass Encryption action carried out on their org. This will go through and encrypt all data that currently exists in the customer’s system.

68. Implementation Checklist and Best Practices

69. Implementation – Sandbox Implementation – Production
3/22/2018
Planning
Read Salesforce documentation
Identify specific fields to encrypt (Excel works well to track information)
Compare the fields to what is supported - Analysis
Purchase Salesforce Platform Encryption from Salesforce
Contact Remedyforce to submit a case to Salesforce to enable Managed Package Encryption (assuming they want to encrypt RF fields)
Configure a Sandbox for Testing
Implementation – Sandbox
Create a Permission Set for “Manage Encryption Keys” permission and assign to the Security Officer.
Security officer generates Tenant Secret or uploads CA Signed Secret/Key
Enable Remedyforce to Support Platform Encryption
Encrypt fields identified during planning phase
Run Remedyforce Encryption Report. Review and take action if necessary.
Contact Remedyforce to submit a case to Salesforce to perform a Mass Encryption action on the Org.
Test
Revise list of fields to be encrypted based on testing and discovery
Implementation – Production
Notify all Salesforce users of the plan to enable Encryption
Create a Permission Set for “Manage Encryption Keys” permission and assign to your Security Officer.
Security officer generates Tenant Secret or provide CA Signed Secret/Key
Encrypt fields identified and documented during Sandbox testing phase
Run Remedyforce Encryption Report. Review and take action if necessary
Monitoring
Monitor and manage your Encryption Keys
Monitor for fields you may want to encrypt later
Put a Plan and Process in place to make sure Keys are backed up and stored safely.
We’ve helped a couple of customers implement encryption and this is a living plan that we can make available. Encryption requires careful planning and testing.
Our recommendation is to first Plan out your encryption strategy which includes purchasing Salesforce Encryption and having it enable to encrypt managed package fields. You’ll want to identify all the fields you want to encrypt and cross reference against documentation.
Once you are ready, implement and test in a Sandbox. This includes things like testing reports, quickviews, list views, and usage on the form to ensure there are no issues.
Once you’ve tested everything in Sandbox and updated your documentation, you can then implement within Production.
Finally you’ll want to monitor for fields that could be added later than may fall under your encryption guidelines. If you opt to manage your keys, you’ll want to make sure you have your Key Monitor program worked out and fully tested. Regardless of whether you have Salesforce generate the tenant secret for you or you bring your own, you are responsible for the backup and safe keeping of your keys. Loosing a key or accidently having it deleted can cause serious problems as Salesforce will not be able to restore any key information.

70. Checklist
Project Plan: Determine and document specifically which fields they want to encrypt.
Customer purchases Salesforce Platform Encryption.
Submit a case to Remedyforce Support for
Encrypt fields part of a managed package (required if customer has identified Remedyforce fields to encrypt)
Create a Permission Set, turn on the “Manage Encryption Keys”, and assign to the one or two people who are responsible for securing Salesforce. Ideally should not be the Admin but the Security Officer.
Security Controls | Platform Encryption
Either Generate Tenant Secret or Upload Tenant Secret
Enable Fields and Attachments (if part of plan)
Enable encryption on identified fields
Enable Remedyforce support for Encryption
Run Encryption Impact Report and evaluate results and take corrective measures if necessary
Submit case to Remedyforce Support for Mass Encryption action. Once encryption is enabled for a field, only new or updated data going forward is encrypted. By submitting a request to support to have the Mass Encryption action run, Salesforce runs scripts that encrypts the data for you.
Key Management Plan and Process

71. Best Practices Define threat model for your organization
Encrypt only where necessary
Create a strategy for backing up and archiving keys and data
Understand that encryption applies to all users, regardless of permissions
Read the Shield Platform Encryption considerations and understand their implications on your organization
Analyze and test AppExchange apps before deploying them (this can impact other 3rd part apps)
Platform Encryption is not a user authentication or authorization tool
Grant the “Manage Encryption Keys” user permission to authorized users only
Mass-encrypt your existing data
Don’t use Currency and Number fields for sensitive data
Communicate to your users about the impact of encryption
Encrypt your data using the most current key and have a backup strategy for your key

72. Resources

73. Resources Salesforce Shield Platform Encryption Architecture
Salesforce Security Guide
Salesforce Shield Platform Encryption Implementation Guide
Salesforce Shield Platform Encryption Online Help

74. 3/22/2018