Skip to main content

Notifications

Announcements

Welcome to the Power Platform Communities
News and Announcements icon
Power Platform Community / Blogs / Power Pages Community Blog / Securing Your Power Pages: ...

Securing Your Power Pages: Top Encryption Methods to Protect Your Website

ArchitectMadhan Profile Picture ArchitectMadhan 1,531
In an era where cyber threats are ever-evolving, securing your website is more critical than ever. Power Pages, part of Microsoft’s Power Platform, offer a suite of encryption methods to protect your data and ensure a secure user experience. This blog post will guide you through the key encryption techniques used by Power Pages, including HTTPS (SSL/TLS) for secure data transmission, SSL/TLS certificates for custom domains, and comprehensive encryption of data both in transit and at rest. Additionally, we’ll explore how Power Pages integrate with authentication providers like Azure AD B2C and the importance of regular security scans. Whether you’re a developer or a site administrator, understanding these security features is essential for maintaining the integrity and confidentiality of your website.


Encryption over the network:

  • HTTPS-SSL/Transport Layer Security (TLS): Power Pages use HTTPS to encrypt data transmitted between the user’s browser and the server. This involves SSL (Secure Sockets Layer) or its more modern replacement, TLS (Transport Layer Security), which use both asymmetric and symmetric encryption algorithms. Data in transit is protected using TLS, which encrypts the data being sent over the network to prevent interception and tampering.
  • SSL/TLS Certificates: When setting up custom domains, Power Pages require SSL certificates that meet specific criteria, such as being signed by a trusted certificate authority and encrypted with TripleDES2.

Encryption at rest:

  • Database Encryption: Databases used by Power Pages are encrypted to ensure that data remains secure even if the database is accessed directly.
  • Advanced Encryption Standard (AES): Data at rest (stored in database) is encrypted using AES, a widely recognized and secure encryption standard. Typically, AES-256 is used, which provides a high level of security.
  • BitLocker: For data stored on physical drives, BitLocker encryption is used to protect against unauthorized access in case of physical theft or loss.
  • Azure Key Vault: Encryption keys are managed and stored securely using Azure Key Vault, which provides additional layers of security and access control.
Authentication and Authorization: Power Pages integrate with authentication providers like Azure AD B2C, Microsoft, and LinkedIn to ensure secure user access. Authenticated users are assigned web roles that control their access to data and resources.

Security Scans:
Power Pages offer security scans to detect common threats like cross-site scripting (XSS) and insecure libraries, providing solutions to enhance site security. To ensure the encryption settings in Power Pages, you can use the Security workspace in the Design Studio.
  1. Access the Design Studio: Go to the Power Pages Design Studio by navigating to the Power Pages portal.
  2. Open the Security Workspace: In the Design Studio, find and open the Security workspace. This section allows you to monitor, protect, and manage your site’s security settings.
  3. Run Security Checks: Use the built-in security checker to run a series of security checks on your website. This tool will provide a security strength score and highlight areas that need attention.

  6. Review Encryption Settings: Within the Security workspace, you can review the encryption settings for data at rest and in transit. This includes checking the use of TLS for data in transit and AES for data at rest.
  7. Audit Logs: Check the audit logs to see detailed records of security-related activities, which can help you verify that encryption protocols are being followed.
  8. Consult Documentation: For more detailed information, refer to the Power Pages security documentation which provides comprehensive guidance on security settings and best practices.
In summary, securing your Power Pages website is crucial. By using robust encryption methods and integrating with authentication providers, you can protect your data and ensure a secure user experience. Regular security scans help maintain the integrity and confidentiality of your website.

Comments

*This post is locked for comments