News for hackers. Stuff that matters.

A comment on Salesforce enables ‘modify all’ in user profiles. Parent comment

Re:Salesforce enables ‘modify all’ in user profiles by reilly3000 on Friday May 17, 2019 @10:36PM (#19945244)
I’m not aware of access logs exist, perhaps history tracking if enabled on that object(limited to 10 fields per object).

It would absolutely be considered a breach if customer data was accessible by non authorized staff, moreso if by partners.

[ Parent | on HN ]
Re:Salesforce enables ‘modify all’ in user profiles by samanator on Friday May 17, 2019 @11:29PM (#19945410)
Salesforce has a feature called Event Monitoring. Event monitoring does show lots of information, like pages access, reports exported, api endpoints used, etc. but it needs to be purchased. However, Salesforce does track and retain that data for some time so you can decide to purchase it retroactively if you ever want.
[ Parent | on HN ]
Re:Salesforce enables ‘modify all’ in user profiles by reilly3000 on Saturday May 18, 2019 @12:57AM (#19945750)
TIL, thanks. Maybe they ought to give that away to those who have an affected org.
[ Parent | on HN ]