Disrupting the Kill Chain with WithSecure Cloud Protection for Salesforce: Attacks Via The Community Portal

Cybercriminals are after two main things: money and data. Exploiting the Salesforce Community Portal allows criminals to gain access to both of these things at once. And it's not easy, but if they gain access, they can potentially access a treasure trove of data by moving laterally through your network — causing damage as they go. This means that if cybercriminals are able to compromise the Salesforce Community Portal, they may be able to leverage that access to gain control over your other systems and applications.

This information can be used for a range of nefarious activities, such as identity theft, financial fraud and more. Every type of cybercriminal has different motivations and techniques , but the end result is the same. Loss of money, brand reputation and data.

While Salesforce offers critical infrastructure-level security measures like replication, backup, disaster recovery, encrypted network services and advanced threat detection, it's important to note that each individual company is ultimately responsible for securing data and access controls.

One of the most common methods attackers use to gain access to Salesforce is through the Community Portal. In this scenario, the attacker registers and creates a new user account, disguised as a member of your community who would have legitimate access to your Community Portal.

To go into further detail, let's dissect this external threat using the Cyber Kill Chain. But first, a quick recap:

• The Cyber Kill Chain is a widely accepted model that describes the different stages of a cyberattack. The stages include reconnaissance, weaponization, delivery, exploitation, C2/persistence and objective.

Although we've outlined a typical attack scenario, there are many other ways in which these attacks could occur. Cyberattacks don't follow a linear process; attackers can jump between stages, go back and forth and adjust their tactics based on their objectives.

Now that we’re refreshed on the Cyber Kill Chain, let's take a look at how it applies to this attack.

Although we've outlined a typical attack scenario, there are many other ways in which these attacks could occur. Cyberattacks don't follow a linear process; attackers can jump between stages, go back and forth and adjust their tactics based on their objectives.