How to ensure logs don't expose PII (Personally Identifiable Information)or sensitive data?

Help Studio
1

Hi all,

I’m preparing for interviews.
Please help me with these questions.

  1. How do you ensure logs don’t expose PII (Personally Identifiable Information)or sensitive data?
  2. How to ensure bot is secured and adhered to compliance rules?

Any help is appreciated :slight_smile:

2

@Vaishnav_Tej

  1. In activity properties you have a private option which will help in not logging the info..
  2. Bot in itself will jot adhere but you might need to consider those while designing it

Cheers

3

Hello @Vaishnav_Tej

Here are answers for

  1. How do you ensure logs don’t expose PII (Personally Identifiable Information)or sensitive data?

Preventing PII/Sensitive Data Exposure in Logs:

I agree with the Private property setting suggested by @Anil_G

In addition to it, you can consider below measures

a. Implement logic within your workflows to mask or redact sensitive data before it is logged. This involves replacing sensitive information with placeholder characters like **** or removing it entirely.

b. Configure the project.json file to exclude specific data or patterns from being logged. This can be done by defining reserved words or regular expressions in the excludedData parameter.

c. Store sensitive credentials and PII in secure assets within UiPath Orchestrator, such as Credential Assets or Orchestrator Assets, rather than hardcoding them directly into workflows. This ensures that sensitive data is encrypted and access is controlled.

For

  1. How to ensure bot is secured and adhered to compliance rules?

These are few guidelines:

  • Secure Credential Storage:

Store all sensitive credentials and API keys in UiPath Orchestrator Assets or Credential Stores (like CyberArk) to leverage their built-in encryption and access control mechanisms.

  • Role-Based Access Control (RBAC):

Implement strict RBAC within Orchestrator to ensure that only authorized users and processes have access to specific bots, assets, and queues.

  • Least Privilege Principle:

Design bot permissions and access rights based on the principle of least privilege, granting only the necessary permissions for the bot to perform its intended functions.

  • Regular Audits:

Conduct regular audits of bot activity, logs, and access permissions to identify and address any potential security vulnerabilities or compliance deviations.

  • Secure Development Practices:

Follow secure coding practices during bot development, including input validation, error handling, and avoiding hardcoded sensitive information.

Please let me know if it helps