Salesforce Alerts customers to gainsight Application Security Incident

On November 21, 2024, Salesforce notified customers of unusual activity detected within applications published by Gainsight and directly installed and managed by customers.This incident highlights the importance of robust security practices for applications integrated within the Salesforce ecosystem.

What Happened?

Salesforce detected unauthorized access impacting certain Gainsight applications. These applications are not directly hosted by Salesforce but are installed and managed by customers within their own Salesforce environments. The activity was identified through salesforce’s security monitoring systems.Salesforce’s official statement details the incident and outlines the steps taken to address it.

What is Gainsight?

Gainsight is a customer success platform used by businesses to manage customer relationships and drive retention. It integrates with Salesforce to provide a comprehensive view of the customer journey. Because Gainsight applications are installed directly by customers,security responsibilities are shared between Gainsight and the customer.

What Steps is Salesforce Taking?

Salesforce has taken the following actions in response to the incident:

• inquiry: Salesforce is actively investigating the scope and impact of the unauthorized access.
• Containment: Measures have been taken to contain the activity and prevent further unauthorized access.
• Customer notification: Salesforce is directly notifying affected customers and providing guidance on remediation steps.
• Collaboration with Gainsight: Salesforce is working closely with Gainsight to address the security vulnerability.

What Should Customers Do?

Salesforce recommends that customers who have installed Gainsight applications take the following steps:

• Review Access Logs: Examine access logs for unusual activity related to Gainsight applications.
• Reset Passwords: Reset passwords for any users who may have been affected.
• Enable Multi-Factor authentication (MFA): Implement MFA for all users to add an extra layer of security.
• Follow Gainsight’s Guidance: Refer to Gainsight’s security update for specific recommendations.

Understanding Shared Obligation

This incident underscores the concept of shared responsibility in cloud security. While Salesforce provides a secure platform, customers are responsible for securing the applications they install and the data they store within that environment. This includes managing access controls, implementing strong authentication measures, and regularly monitoring for suspicious activity.

Key Takeaways

• The security incident involves Gainsight applications installed and managed by customers, not Salesforce-hosted services.
• Salesforce is actively investigating and working to contain the unauthorized access.
• Customers should review access logs, reset passwords, and enable MFA as precautionary measures.
• Shared responsibility is crucial in cloud security; customers must secure their own applications and data.

This incident serves as a reminder for all Salesforce customers to prioritize security best practices and stay informed about potential threats. Continued vigilance and proactive security measures are essential for protecting sensitive data within the Salesforce ecosystem.