ZTAM-SF: Zero-Trust Access Management for Enterprise Salesforce CRM — Continuous Verification, Least-Privilege Enforcement, and Adaptive Session Control

Lalith Chandra Bandaru

doi:10.62127/aijmr.2025.v03i01.1373

ZTAM-SF: Zero-Trust Access Management for Enterprise Salesforce CRM — Continuous Verification, Least-Privilege Enforcement, and Adaptive Session Control

Author(s)	Mr. Lalith Chandra Bandaru
Country	United States
Abstract	The traditional perimeter-based security model — in which users and devices inside the corporate network are implicitly trusted and those outside are not — is fundamentally incompatible with the architecture of modern enterprise CRM deployments. Salesforce CRM is a cloud-hosted, multi-tenant platform accessed through a standard web browser or mobile application from locations including corporate offices, home networks, coffee shops, and airport lounges, with no meaningful network perimeter separating trusted from untrusted access contexts. ZTAM-SF (Zero-Trust Access Management for Salesforce) is a comprehensive zero-trust security architecture for enterprise Salesforce environments that implements the NIST SP 800-207 zero-trust principles across six dimensions: continuous identity verification through adaptive multi-factor authentication driven by the LTDF behavioural risk score; just-in-time least-privilege access through time-bounded scoped OAuth grants that expire automatically when the business context requiring elevated access resolves; micro-segmentation through object-level and field-level Salesforce permission boundaries enforced through LTDF-integrated session risk scoring; device trust validation through MDM certificate attestation at each session establishment; network-level assume-breach posture through mutual TLS enforcement and session-binding IP restrictions [11]; and data-level protection through Shield Platform Encryption with classification-based access control. Evaluated across eight enterprise Salesforce deployments over sixteen months, ZTAM-SF reduced over-privileged session prevalence from 41.3% to 4.8%, lateral movement detection rate improved from 61.2% to 94.7%, OAuth misconfiguration incidents decreased by 94%, and the API surface exposure score decreased by 62%, while maintaining user satisfaction scores above the pre-ZTAM baseline in six of eight participating organisations. The framework builds on the multi-org Salesforce data architecture and cross-org privacy model established in earlier work [8], which demonstrated that enterprise CRM deployments spanning multiple organisations require dedicated federated access governance to maintain data sovereignty while enabling cross-org collaboration.
Keywords	zero-trust security, Salesforce access management, least-privilege, continuous verification, adaptive MFA, OAuth, micro-segmentation, NIST SP 800-207, CRM security, LTDF integration.
Discipline	Computer > Network / Security
Published In	Volume 3, Issue 1, January-February 2025
Published On	2025-01-10
DOI	https://doi.org/10.62127/aijmr.2025.v03i01.1373

View / Download Full-text Research PDF File

About AIJMR Fees & Payment Current Issue Publication Archive	Submit Research Paper Track Submission Status Publication Guidelines Publication Ethics Peer Review & Plagiarism	Join as a Reviewer Editors & Reviewers Reviewer Referral Program Get Reviewer Membership Certi.	Website/Journal Policies Usage Policy Content Policies Privacy Policy

Contact Us		+91-9687-828-838	editor@aijmr.com

Advanced International Journal of Multidisciplinary Research

An Open Access Peer Reviewed Multidisciplinary Bi-monthly Scholarly International Journal

ZTAM-SF: Zero-Trust Access Management for Enterprise Salesforce CRM — Continuous Verification, Least-Privilege Enforcement, and Adaptive Session Control

Share this