As Salesforce is a Customer Relationship Management tool, the data stored in here can often be commercially sensitive data. This could be information on sales leads or opportunities, contract data, customers contact information, pricing documentation or even confidential internal information. As well as attackers being aware that such a great volume of sensitive data will be stored in Salesforce, they have cottoned on to the fact that it is not at all uncommon for Security and IT teams to have very little visibility over Salesforce. In fact, sometimes they could even be completely unaware of what type of information is living within Salesforce and who is actually accessing it or potentially downloading this data. 

Salesforce created their platform to have many capabilities and user roles, unfortunately with this flexibility comes an incredibly complex and complicated permission model. Permissions can be managed across 4 different levels and specific record-access can be managed through various settings such as role type, sharing rules or manual settings. To add to the complexity, it’s possible to share data with users in your Salesforce Community, which are customers, external users or members of the public who require an account. As a result, it is easy to misconfigure access and accidentally leave data exposed making Salesforce an appealing target for cyber criminals.