Salesforce’s ‘Ghost Sites’ Putting Sensitive Information at Risk, Warn Organizations

Varonis Warns of “Salesforce Ghost Sites” Exposing Sensitive Information

Salesforce has been a revolutionary software in the sales industry for many years, merging customer relationship management with cloud computing to provide services that improve customer experience and sales force automation. While Salesforce has worked to improve customer and data security, data breaches still happen, and they can be disastrous. In June 2023, data security and analytics company Varonis reported the discovery of Salesforce “ghost sites” that can expose sensitive personal and business information because they have not been properly deactivated after abandonment by organizations.

What are Salesforce Ghost Sites?

Ghost sites are Salesforce Community websites that have been abandoned, but they are still accessible to outsiders. Companies can set up Salesforce Community websites to share information and enable users to connect and collaborate. They are hosted on domains such as ‘partners.acme.org.00d400.live.siteforce.com’ but can be accessed through a shorter URL such as ‘partners.acme.org’ by configuring DNS records. When a company replaces a Salesforce site with a new, for instance, a website running in their AWS environment, the “partners.acme.org” domain is pointed to the new site, but they do not remove the custom domain in Salesforce, nor do they deactivate the site. As a result, the site continues to exist, pulling data and becoming a ghost site.

Risks Associated with Salesforce Ghost Sites

Sensitive information such as personally identifiable and business data can be found on ghost sites. Data previously shared on the Salesforce Community website is also exposed, making new records available to the guest user, due to the sharing configuration in their Salesforce environment. This makes ghost sites dangerous to businesses and individuals using them unknowingly exposing their data. Since they are abandoned sites, they lack adequate monitoring or protection and are more vulnerable to attacks as they could have unpatched security holes. Ghost sites are a dangerous security threat that needs to be mitigated, considering the upward trend of data breaches.

Advice to Companies and Users

Organizations are advised to take the necessary action and properly deactivate Salesforce Community websites no longer in use. This is an effective way to mitigate ghost site threats. It is important to keep track of all Salesforce sites and their respective users’ permissions, both community, and guest users. Tools such as SecurityTrails can be employed to find ghost sites identified through indexed and archived DNS records.

Editorial

Data breaches are expensive, causing reputational damage, loss of clients, and lawsuit cases. Data security is of utmost importance, and organizations must prioritize it in their operations and software use. When Salesforce was launched, it made it possible for sales teams to manage accounts and sales effectively, removing the need for manual data collection and management. However, with the increasing use of Salesforce Community websites, there is a need to create the necessary security solutions to ensure their proper use and deactivation. It is a daunting task to balance the push for productivity and the need for security. Nonetheless, innovative solutions must be created to balance the two and safeguard precious data.

Conclusion

Salesforce Ghost sites pose a significant risk to both individuals and organizations, especially considering the sensitive data often shared on these sites. Data breaches can have costly consequences, and organizations must prioritize data security to prevent them. Properly deactivating Salesforce sites no longer in use is a necessary step to avoid ghost site threats. Furthermore, companies and individuals must be vigilant and keep track of all Salesforce sites and their respective permissions. This combination of caution and the use of innovative solutions will safeguard sensitive personal and business data.