Penetration Testing

[mickhanneyIRL]

Hi,

We have a project ongoing using Power Automate Desktop (PAD).  As part of our due diligence we are to do a pen-test of the solution.  I can find no resources on pen testing specifically for PAD?  There is a pen test for Power Automate on the Service Trust Portal (Dated: 10.14.2022) but it is silent as regards PAD.  Has anyone faced a similar need and where you able to find any resources to help?

Thanks

Mick

[MichaelAnnis]

I don't, but I'm commenting so I get notifications when a solution is marked.  Good luck!

[momlo]

Interesting topic.

I assume you have your threat and risk models and know what are the key themes you want to address/ensure are safe.

When it comes to actual pentesting in a sense acting as a bad actor/red team - I am unable to help hot to break things 🙂

From the governance side of things, what pops into my mind right away are the main items below.
I can elaborate based on my experience/or/and point to the MS docs later (I was gathering the information when implementing PA/PAD in my client with 0 knowledge about the product). Many are identical/same as PA as are shared between the two.

Access management

DLP

Data management

Data transfer from within on-prem infra to the 3rd party infra (MS cloud / other)

Data encryption at rest, in motion, in use

Secrets management

Best practices to limit the secrets/sensitive information leak into logs/cloud.

ALM/Best practices 

Machines registrations

Hosted bots (VMs)

Software updates

When I think of the products/infra, these items come to my mind:

Power Automate

Power Automate Desktop

Azure Relay

Data Gateway

Java env for automating Java applications

Different libraries such as .Net, JS, VB used by PAD behind the scene

Browsers add-ins