PA and security

[DetourNoir]

Hi all - apologies, I know very little about web security. My company would like me to build a small PA site with a handful of questions (4-5, plus the ability to attach pdf files). The attached pdf files are a particular security concern - as they contain sensitive client information. Does anyone here host a PA site that saves client data(say, as an attached PDF or a CSV) to a SP list? (Or somewhere else, I assumed a SP list might be easiest). Do you find the built-in SP/Powerapps security sufficient or would you just suggest letting a web developer build a standard site to handle such a task? Appreciate any info, thanks in advance.

[RandyHayes]

@DetourNoir 

Your question is not so much related to the Security of a PowerApp (which, by the way, is NOT a site...it's an App), but is more related to the security of the datasource in which you store your information.

In this case - SharePoint.  The general point about SharePoint lists is this...in order for users to be able to submit a record to SharePoint, they need read and write access.  SharePoint lists don't have item level security (as a default), there are workarounds for this utilizing PowerAutomate to alter the item permissions.  This is a potential solution for you, but would require that to be in place.

In general, this is true for almost every datasource.  You would need to allow users access to get to information and submit it.  So again, your question really relates to this aspect and not so much about PowerApps.  You can "force" security and hide things and make your app do pretty much whatever you want to obscure the other records and sensitive information, but the reality is...(as with any database), a clever user can go around your app and directly to the data source to get information.

There are many other ways to obscure information and to make it only accessible by those with permission, but the above gives you some ideas.

I hope this is helpful for you.

[DetourNoir]

Thanks Randy. So if I'm not mistaken, you're saying that a major concern would be that other members of the SP list would be able to find a way to see the entire contents of the list? And that there may be a way to prevent this via PowerAutomate? 

What about a third party getting into the list?(someone who is not a list member) Is that extremely unlikely if they do not have list permissions? Would savvy list members being able to view list information of other users be a larger concern? Really appreciate the help, thanks again.

[RandyHayes · Accepted solution]

@DetourNoir 

Yeah, if the person has not access to the list, they will not be able to get in, and also will not be able to use the app.

The larger concern usually is that, as an app user, the user needs access (such is the case with any datasource).  So, if they know how to get to the list, they can see it all.

This again is where setting item level permission via PowerAutomate can help.

There is an ability in SharePoint to enable such permissions where users can only see the items they create, but then this cuts off people that really need to see all the items.  So, the PowerAutomate option is sufficient.

That all is the age long issue over access to data.  Even if you were to write an application that, say, connects to a SQL database and allows users to read and write...a savvy user can figure out the database and connect to it via alternate utilities and view whatever they have permission to see.

[DetourNoir]

Thanks for being so helpful Randy. I used PowerAutomate when it was still Flow, I'll investigate setting item level permission there. 

[RandyHayes]

@DetourNoir 

Sounds good.  Take a look at this article.  There are a few out there, but the concept is the same.