Thank you for your interest in Obsidian! Please enter your information in the form and we will contact you shortly to schedule a demo.
Just last week, cybersecurity journalist Brian Krebs shared a post to his website detailing how Salesforce misconfigurations were causing several organizations to inadvertently expose sensitive data to the public.
Affected organizations discovered that guest users (accounts that do not require authentication prior to data access) of their Salesforce Experience Cloud websites were able to access private records including full names, Social Security numbers, addresses, and various other forms of personally identifiable information (PII).
Salesforce responded to this story by reassuring customers that the vulnerabilities identified were not inherent to the platform but instead the result of the organizations’ poor configurations of Salesforce Experience Cloud websites and guest user profiles. They also suggested that teams review their guidance around configuration best practices.
While this story made headlines in cybersecurity news, the underlying vulnerability is nothing new—in fact, guest user access to Salesforce sites is something our team covered in a dedicated section of our Salesforce Security Checklist published last year. Krebs’ blog and the subsequent Salesforce response serves to remind teams of a fundamental fact of SaaS security: while SaaS providers work to ensure the integrity of underlying infrastructure, the configuration and security of the tenant remains the customer’s responsibility.
Below, we’ll take a closer look at and provide some guidance around Salesforce Experience Cloud configurations to help security teams minimize these risks. We’ll also discuss the broader challenge of SaaS configuration management at scale, because this issue is by no means exclusive to Salesforce—or any single SaaS platform, for that matter.
Salesforce Experience Cloud enables businesses to build and deliver digital experiences to their customers— websites, portals, storefronts, and forums, for example—that are personalized using data from the Salesforce CRM platform. Specific parts of these sites can be made publicly available to visitors without requiring authentication. In these cases, the level of access is controlled by the guest user permissions associated with that Experience Cloud site.
To ensure the integrity and privacy of sensitive Salesforce data, security teams should tightly control the permission and access levels of these unauthenticated guest users. In the past, there were a number of issues with guest user management—guests could own records, have edit and delete privileges, and potentially be exposed to all records for a given object. While recent Salesforce releases have since attempted to address these glaring issues, there are still important considerations that need to be addressed to ensure guests aren’t privy to more information than intended.
Security teams and Salesforce application owners may be understandably concerned about whether or not their own Salesforce environment is vulnerable to inadvertent public data exposure. To help review and mitigate this risk, we’ve put together a brief checklist of important considerations for your Salesforce sites:
The Salesforce team provides further guidance around guest user configurations in their documentation.
Even with these settings locked down, Salesforce configurations can drift over time whether by an inadvertent modification or an update to the platform itself. Make sure to periodically monitor your guest user access to ensure that this risk doesn’t reemerge down the line.
Although this story is focused on a configuration vulnerability in Salesforce, the fact is that managing potentially thousands of unique SaaS settings effectively at scale is almost impossible without tooling to consolidate and automate your approach. It isn’t just a matter of security hygiene, either—the security of SaaS applications has direct relevance to regulatory compliance increasingly as sensitive data continues to migrate to the cloud.
SaaS Security Posture Management (SSPM) solutions like Obsidian are purpose-built to help organizations address this challenge at scale. By helping security teams identify and address configuration vulnerabilities proactively, SSPM solutions minimize opportunities for both malicious or accidental breaches from occurring. Moreover, they can enable teams to map SaaS configurations directly to complex regulatory frameworks to ensure compliance is both an approachable and continuous effort.
If you’re concerned about the security of Salesforce and other central SaaS platforms such as Microsoft 365, Google Workspace, ServiceNow, and Workday, Obsidian Security is offering a no-cost risk assessment to help teams better understand the risks present in their environment. A member of our team will provide you with a snapshot with powerful security insights that include:
You can learn more about this risk assessment and apply for it here.