Salesforce: Error in configuration allows access to user data

Due to a misconfiguration, many Salesforce servers allow access to sensitive information. The systems are used in banks, authorities and other organizations. Some user data can be accessed without logging in.

From a report by CancerOnSecurity reveals that a “shocking number of organizations” are affected by the problem. Many corporations use Salesforce Community for public websites. The software can be configured so that only authenticated users can access the service. Alternatively, it is possible to activate guest access. Guests can only view certain content and should not be able to view sensitive resources. However, this is not always the case.
Infographic Security on the Internet: Germans are afraid of data misuse

Administrators often inadvertently grant guest users access to internal documents and private information. This has led to potential data leaks. Applicants’ names, social security numbers, addresses, phone numbers, and bank account numbers were accessible on the State of Vermont’s website.

Fault lies with the administrators

Salesforce has announced that the company provides its customers with clear guidelines for securely configuring a community site and protecting against unauthorized access. However, many customers seem to be overwhelmed with the platform and critics emphasize that mistakes are quickly made when setting up the site.

See also:

Security, data protection, security, privacy, encryption, cryptography, key, access, lock, end-to-end encryption, safeguard, encryption software, circuit, cryptography, access protection, data protection model