Salesforce Service Cloud Security Assessment: Vulnerabilities, Mitigation Tools and Security Ratings (Montana Out Door Scenario)
9 min read Scenario: Montana Out Door Inc. (MOD) application security assessment
Montana Out Door Inc. (MOD) is a provider of outdoor equipment and hunting adventures in Montana. The CEO has decided to pursue a digital transformation designed to support a more robust Internet presence including integrated social media outreach and an online store that integrates with its newly adopted software solutions including HubSpot Suite for CRM, SAP SCM for supply chain management, and Salesforce Service Cloud to support the expansion.
Security is an obvious consideration for this endeavor and you have been asked to assess the security risks of the integration of one of these systems with the Internet and other internal systems. In assignments 2 and 3 you will address integration policies and testing respectively.
Preparation: Choose one of the applications identified in the scenario and research its vulnerabilities and ways to safeguard them.
Instructions:
- Describe 3 significant security vulnerabilities inherent in the software that includes historical security performance data. Cite your sources.
- Describe 2 security tools designed to mitigate one of the vulnerabilities. One should be internal to the software and the other a 3rd party solution. Explain how each works.
- Evaluate the application’s effectiveness in addressing 5 of the following security elements. Rank each as Excellent, Good, or Weak. Support the rationale for your ranking: data encryption; access control and management; data retention; management and processing; system login requirements; process monitoring and traceability; analysis and reconstruction of transactions and events due to adversarial actions (forensic reconstruction); integration with the existing Oracle DB.
Course learning outcome: Evaluate application technologies and the security issues associated with them.
Why Salesforce Service Cloud?
This model assesses Salesforce Service Cloud, the platform MOD will use for customer service cases, live chat and a customer self-service portal. It is a strong choice because it will hold sensitive customer data (names, addresses, purchase and booking history, support cases), will be exposed to the internet through customer portals and chat, and will integrate with MOD’s online store, HubSpot and its existing Oracle database. It also has a well-documented recent security history.
Public portals exposing records
Stolen tokens reach CRM data
Vishing and malicious connected apps
Model assessment
Original example for study purposes.
Introduction
Montana Out Door Inc. plans to use Salesforce Service Cloud to support customer service for its online store and adventure bookings. Because Service Cloud is a cloud-based software-as-a-service (SaaS) platform, Salesforce secures the underlying infrastructure, while MOD is responsible for configuring users, permissions, integrations and data access, a shared responsibility model. Most recent Salesforce-related data breaches have resulted not from flaws in Salesforce’s core platform but from customer misconfigurations, compromised integrations and social engineering. This assessment describes three significant vulnerabilities, two tools to mitigate one of them and an evaluation of Service Cloud’s effectiveness across five security elements.
Three significant security vulnerabilities
1. Misconfigured guest user access on public portals. Service Cloud customer portals are built with Salesforce Experience Cloud, which allows unauthenticated “guest” users to view certain content. When guest profiles are given excessive permissions, anonymous internet users can query objects containing sensitive data through the site’s Aura API, including customer lists, support cases and employee information (Varonis, 2025). This weakness has a long history. Researchers described it publicly in 2021, government agencies and a bank exposed sensitive records through misconfigured sites in 2023, and beginning in September 2025 the ShinyHunters group ran an automated campaign scanning Experience Cloud sites, claiming data from 300 to 400 organizations (Apex Hours, 2026; Salesforce Ben, 2026). Salesforce stated that the activity resulted from overly permissive customer configurations, not a platform vulnerability (Salesforce Ben, 2026). For MOD, a public customer help center or booking portal could expose customer and trip data if configured incorrectly.
2. Compromised third-party integrations and OAuth tokens. Service Cloud connects to other applications through “connected apps” that use OAuth tokens. If an integration partner is breached, attackers can use its tokens to access every connected Salesforce environment without needing user passwords. In August 2025, attackers stole OAuth tokens from the Salesloft Drift chatbot integration and used them to access Salesforce data at more than 700 organizations, including major security companies; in November 2025, tokens tied to Gainsight integrations were abused to reach more than 200 companies (Apex Hours, 2026). MOD’s plan to connect Service Cloud with HubSpot, its online store, social media tools and chat creates similar exposure.
3. Social engineering and malicious connected apps. In 2025, attackers tracked as UNC6040 phoned employees while posing as IT support and persuaded them to install a modified version of Salesforce’s Data Loader tool, which then exported CRM data. One confirmed incident at Google involved about 2.55 million business contact records (Apex Hours, 2026). Because MOD is a small company with limited security staff, customer service agents and administrators could be targeted in the same way.
Two tools to mitigate guest user misconfiguration
Internal tool: Salesforce Health Check, the Guest User Access Report and Shield Event Monitoring. Salesforce provides built-in tools to find and fix risky settings. Health Check compares an organization’s security settings against a Salesforce baseline and scores them, while the Guest User Access Report package identifies objects and fields that guest users can access. Administrators can then apply Salesforce’s recommended controls: setting org-wide defaults to Private, enabling secure guest record access, removing unnecessary object permissions and unchecking “API Enabled” on the guest profile, which Salesforce identified as the highest-impact change (Salesforce Ben, 2026). Salesforce Shield’s Event Monitoring adds detailed logs of API calls and data exports, and Transaction Security Policies can alert on or block suspicious activity, such as large data downloads, in real time.
Third-party tool: a SaaS security posture management (SSPM) platform such as AppOmni or Varonis. SSPM tools connect to Salesforce through read-only APIs and continuously scan configurations, permissions, guest access, connected apps and OAuth scopes against security best practices. They alert administrators when a change creates risk, for example when a guest profile gains access to the Contact or Case object, and they map who can access sensitive data across users and integrations. Many also monitor activity logs for anomalies, such as an integration suddenly exporting large volumes of records from unfamiliar IP addresses. Because they operate independently of Salesforce administrators, they provide an external check against configuration drift.
Evaluation of five security elements
| Security element | Ranking | Rationale |
|---|---|---|
| System login requirements | Excellent | Since February 1, 2022, Salesforce has required multi-factor authentication for all users of Service Cloud and its other core products, and it does not allow weaker email, SMS or phone codes (The Record, 2022). Administrators can also enforce single sign-on, login IP ranges, login hours and session timeouts. Remaining risk comes from integration users and social engineering rather than weak login controls. |
| Data encryption | Good | Data is encrypted in transit with TLS and at rest by default. Shield Platform Encryption adds customer-controlled keys and field-level encryption of sensitive data, which would rate Excellent, but it is a paid add-on. Encryption also does not protect data from users or integrations that are authorized to view it, which was the issue in recent breaches. |
| Access control and management | Good | Salesforce offers highly granular controls: profiles, permission sets, role hierarchies, sharing rules and field-level security. However, this complexity makes misconfiguration easy, as the guest user incidents show (Varonis, 2025). Strong capability combined with high configuration risk justifies Good rather than Excellent. |
| Process monitoring and traceability | Good | Standard features include login history, the Setup Audit Trail of administrative changes and field history tracking on selected fields. Detailed tracking of API calls, report exports and record views requires Shield Event Monitoring. Without it, MOD would have limited visibility into how data is accessed. |
| Forensic reconstruction | Weak (without add-ons) | By default, logs are retained for limited periods, and not every data access event is captured, making it difficult to reconstruct exactly what an attacker viewed or exported. Organizations affected by 2025 integration breaches had to rely on available event logs to determine the scope of exposure. Adding Shield Event Monitoring, Field Audit Trail and exporting logs to a security information and event management (SIEM) system would raise this to Good or Excellent. |
Recommendations for MOD
MOD should apply a least-privilege configuration before launching any customer portal, disable API access for guest users, require MFA and single sign-on for all users including integration accounts, and limit connected app OAuth scopes to only the data each integration needs. It should inventory and regularly review connected apps, train staff to verify any request to install software, and budget for Shield Event Monitoring or an SSPM tool to improve monitoring and forensic capability. For integration with MOD’s existing Oracle database, MOD should use a controlled middleware layer, such as MuleSoft or Salesforce Connect with secure, authenticated connections, rather than direct database exposure; integration policies and testing will be addressed in the next assignments.
Conclusion
Salesforce Service Cloud provides strong built-in security, particularly for login authentication and encryption, but its real-world security depends on how customers configure and integrate it. The most significant risks for MOD are misconfigured guest access, compromised third-party integrations and social engineering. By combining Salesforce’s internal tools with a third-party posture management solution and investing in monitoring, MOD can support its digital transformation while protecting customer data.
References
Apex Hours. (2026). Salesforce data breaches: What really went wrong and how to protect your org. https://www.apexhours.com/salesforce-data-breaches-what-really-went-wrong-and-how-to-protect-your-org/
Salesforce Ben. (2026, March 10). ShinyHunters breach 400 companies via Salesforce Experience Cloud. https://www.salesforceben.com/shinyhunters-breach-400-companies-via-salesforce-experience-cloud/
The Record. (2022, January 7). Salesforce to require MFA for all users starting next month. https://therecord.media/salesforce-to-require-mfa-for-all-users-starting-next-month/
Varonis. (2025). Abusing misconfigured Salesforce Experiences for recon and data theft. https://www.varonis.com/blog/misconfigured-salesforce-experiences
Tips for completing the assignment
- Choose one application and stay focused on it; HubSpot or SAP SCM are also valid choices if you prefer.
- Include historical data for each vulnerability, such as dates, number of affected organizations and records.
- Make sure the two tools address the same vulnerability, with one built into the software and one third-party.
- Rank exactly five elements as Excellent, Good or Weak, and justify each ranking with evidence.
- Distinguish platform flaws from customer misconfiguration, which reflects the shared responsibility model.
Frequently asked questions
What is the shared responsibility model?
In SaaS, the provider secures the infrastructure and application, while the customer is responsible for its users, configurations, data access and integrations.
What is an OAuth token?
A credential that allows one application to access another on a user’s behalf without sharing a password. If stolen, it can provide the same access as the connected application.
Related reading: ERP systems for small and midsize businesses and supply chain outsourcing checklist.
More model assignments posted today
- GEN 101 Final Project Example
- NU 671 Group Therapy and Family Therapy Paper
- GCU Individual Success Plan (ISP) for RN-to-BSN Students
- Salesforce Service Cloud Security Assessment
