Home /Blog/ Did You Know Salesforce Vulnerabilities Are Your Responsibility?

Did You Know Salesforce Vulnerabilities Are Your Responsibility?

Josh Rank
November 29, 2023

Every Salesforce user is responsible for securing their own environment. This includes accounting for Salesforce vulnerabilities.

Why It Matters: Salesforce is secure. However, the way we interact with orgs has the potential to introduce vulnerabilities. And if you rely on Salesforce to secure your org, you’re leaving yourself open to costly outages and data exposures.

Planned and unplanned outages lead Salesforce users to lose connectivity with their environment.
A comprehensive data security strategy is critical to remaining secure in the face of evolving cybersecurity threats.
Consumer trust, regulatory compliance, and costly losses can all result from failing to account for Salesforce vulnerabilities.

Here are five things you need to know about Salesforce vulnerabilities and your responsibilities related to them:

Identify Salesforce Security Vulnerabilities
Understand Your Salesforce Data Security Responsibilities
Learn How to Protect Yourself from Threats
Realize the Benefits of Working Off-Platform
Find Out How to Prepare for the Future

1. Identify Salesforce Security Vulnerabilities

These security vulnerabilities were recently reported in Salesforce:

CVE-2023-34362 and CVE-2023-35036: These two vulnerabilities could lead to unauthorized access to the MOVEit file transfer product and environment. However, there is no impact to Salesforce customer data at this time.
CVE-2022-22128: This issue affected the Tableau Server Administration Agent.
Tableau Security Update: This was an issue with Tableau Server logging Personal Access Tokens into internal log repositories.
CVE-2022-22127: This was a broken access control vulnerability in Tableau Server.
Heroku Security Notification: There was an issue with GitHub repositories connected to Heroku.
Spring4Shell Security Update: The Spring4Shell vulnerability published in March 2022 affected multiple Salesforce products, including Tableau, Slack, Service Cloud, Salesforce Einstein, Salesforce Core, Sales Cloud, Quip, Pardot, MuleSoft, Marketing Cloud, Hyperforce, Heroku, Experience Cloud, Commerce Cloud, and ClickSoftware.

Back to top

2. Understand Your Salesforce Data Security Responsibilities

The delineation of responsibilities between platform and user is important to understand. Failing to account for your responsibilities creates gaps that can be exploited by bad actors or simply leave your organization open to costly mistakes.

The shared responsibility model illustrates where the onus of security lies for both Salesforce as well as those who use the platform.

Salesforce is responsible for everything on the platform side—physical infrastructure, application-level security, and network security—whereas users are responsible for anything that happens within their orgs—access controls, permission settings, and the overall success of their data security strategy.

Back to top

3. Learn What You Can Do to Protect Yourself

An overabundance of caution is always beneficial when considering data security. When in doubt, assume it’s your responsibility and put together a plan to account for any potential security risks. A complete analysis of your current approach, potential vulnerabilities, and a flexible plan should follow.

Utilize automated scanning tools to address existing threats while also verifying the proper structure of updates and new applications to avoid introducing vulnerabilities.

Static code analysis and policy management are two critical aspects of addressing these problems. Open communication is also essential. All of your team members need to work together to find, flag, and address potential data security issues.

Back to top

4. Realize the Benefits of Working Off-Platform

Working outside the Salesforce platform clears up a lot of confusion about where responsibility falls for data security considerations. When it comes to DevOps, most environments exist directly within the Salesforce platform. And while this might seem like an advantage, it opens organizations up to outages—both planned and unplanned—from Salesforce itself.

Working outside the Salesforce platform ensures continuous connectivity—even when Salesforce itself goes down.

Outages cost companies around $5,600 per minute on average. Avoiding the loss of connectivity to your system is a major win for data security teams, and this can largely be accomplished by working off-platform.

Back to top

5. Find Out How to Prepare for the Future

Data security threats are constantly evolving. The best thing organizations can do is implement a continuously updated approach to data security. This is accomplished by frequently auditing your current approach and making adjustments as they are needed.

A flexible approach, strong communication, and the utilization of automated tools give organizations the best chances at remaining operational and secure in the face of evolving threats.

Salesforce offers its users amazing benefits. But when it comes to data security, you can’t rely on the platform to save you and your data. Take the time to ensure your bases are covered—your future self will thank you.

Back to top

Next Step…

Now that you have a better understanding of what you need to do to solidify Salesforce security, let’s look at your options for tooling. It’s tempting to source generic tools because of their low cost and ease of access, but you’ll be leaving yourself open to a lot of mistakes.

Read our blog, The Problem with Generic Code Quality Tools in Salesforce, to learn more.

Back to top

FAQs

How do external factors, such as third-party integrations, impact the management of Salesforce vulnerabilities?

Third-party integrations and other customizations can significantly impact how Salesforce vulnerabilities threaten your org. Additional layers of complexity are introduced alongside third-party applications, which also adds security risks. These customizations have the potential to house their own vulnerabilities, which are then connected to your Salesforce environment. Thorough security assessments should always be conducted for any new integrations.

What is the shared responsibility model in Salesforce security?

The shared responsibility model describes the distribution of security responsibilities between the platform provider—in this case, Salesforce—and its customers. Salesforce is responsible for the security of the platform itself, including its physical infrastructure, network security, and application-level security controls. Customers, on the other hand, are responsible for things like configuring access controls, setting user permissions, applying data security settings, as well as monitoring and managing their data and application configurations. This model emphasizes that, while Salesforce maintains a robust and secure platform, customers must actively engage in configuring and managing their Salesforce instance to ensure the security of their specific data and applications.

How do compliance and regulatory requirements factor into Salesforce security?

Compliance and regulatory requirements set the standards and guidelines that organizations must adhere to when handling sensitive data and conducting business operations. These requirements, which can vary by industry and geography, often dictate specific security measures, data protection protocols, and audit procedures that must be integrated into Salesforce deployments. Meeting these standards not only helps safeguard sensitive information but also helps organizations avoid legal liabilities and fines.

Back to top

Did You Know Salesforce Vulnerabilities Are Your Responsibility?

1. Identify Salesforce Security Vulnerabilities

2. Understand Your Salesforce Data Security Responsibilities

3. Learn What You Can Do to Protect Yourself

4. Realize the Benefits of Working Off-Platform

5. Find Out How to Prepare for the Future

Next Step…

FAQs

Develop high quality, secure code!

Quick Links

Products

Contact Us