With a database of over 80 million users, Yahoo! JAPAN utilizes Salesforce’s Service Cloud platform to respond to their vast number of support inquiries that exceed several thousand per day. While the cloud environment is good for productivity, it also has the unfortunate result of opening a virtual Pandora’s Box of cyber security risks for all parties involved - company, customers, and partners alike.

Reducing the risk of malware for YAHOO! JAPAN

"Security measures are very important today and are something that should not be treated lightly.”

Mr. Atsushi Tokuyama, Cloud Operations Leader

Protecting the company against phishing attacks is a top priority for Yahoo! JAPAN. Under the “Shared Responsibility” security paradigm in which cloud service providers operate, the Salesforce platform treats users’ data and files as confidential information to ensure data privacy protection. It doesn’t have a built-in solution to scan or quarantine files.

Yahoo! JAPAN saw an immediate need for a solution that is easy to deploy and that helps deal with file transfers from unidentified addresses – in addition to protecting against operator errors.

Besides ensuring the safety of files and links from external sources, the deployment should be done without installing physical security appliances or antivirus software on the PCs of operators using Salesforce.

To cope with the threat of malware or malicious URLs being uploaded into their Salesforce platform, Yahoo! JAPAN chose to introduce WithSecure's Cloud Protection for Salesforce (CPSF) into their Salesforce.com environment.

CPSF is a solution capable of verifying the safety of files and URL links shared in the cloud without deteriorating performance. This is accomplished through API integration between the WithSecure Security Cloud and the Salesforce cloud.

Cloud centric approach for easy deployment

“The key was cloud collaboration. Installation was completed in minutes!”

According to Mr. Atsushi Tokuyama, Cloud Operations Leader at Yahoo Japan Corporation, his team first tested the solution using a free trial version of CPSF in their Salesforce.com sandbox. They were quickly able to confirm that they had met Yahoo! JAPAN's requirements, which included no decline in performance. The team proceeded with an effortless implementation straight away.

“Introducing a solution capable of scanning several thousand inquiry mails a day typically takes a significant amount of engineering time and effort, including the deployment of hardware and software into your environment,” said Mr. Tokuyama.

“However, with WithSecure’s CPSF solution, there is no need to change your network configuration or install client-side software because of its native cloud architecture. I was amazed the installation was completed in just minutes,” he added.

Yahoo! JAPAN began using CPSF on the customer support Salesforce platform in March 2020. Despite the possibility that having significant customization of their Salesforce environment could cause clashes with the security solution, there have been no reports of unexpected behavior or restrictions on functionality following the implementation of CPSF. Several hundred operators have used CPSF without incidents so far.

 “The administrator screens and notifications are easy to understand, even for our less technically savvy users. There is also virtually zero lag during scanning, making operators unaware of the scanning going on in the background.” said Mr. Tokuyama.

Automating security measures = efficient resource allocation

“Solutions like CPSF reduce our security concerns, establishing a foundation that allows us to concentrate our resources on other tasks.”

The solution scans all the computers within the business, allowing software to be deployed from a central location easily and efficiently; it also handles patching automatically, meaning these installations now meet the IASME requirements of 14 days and can be scheduled to run outside of business hours. The initial installation onto all devices was also automated meaning this was quick with minimum downtime to the business. The solution installs as a package or ad-hoc, depending on SLC’s requirements and needs. WithSecure provided support to SLC throughout, including training and on-call assistance. Originally, SLC tested the solution on a few non-critical servers and then continued the deployment across all staff and student machines. Another substantial benefit for SLC is how they now manage reporting. With WithSecure Business Suite, SLC can report across machines instantly. SLC’s IT teams can track which machines have received the new software as well as receive feedback from any machine from a central location, including lapsed software alerts, new policy updates, and update renewals.