Data security : hiding an application, a sheet or a community sheet ? 

Data security and confidentiality are key elements in in managing a Qlik Sense environment. Perhaps, some data should only be visible by specific users. Similarly, applications or analysis sheets with sensitive topics might only be accessible by key users.

Giving access to data to certain users only

For the first case, the solution is easy and directly integrated in the loading script. Indeed, the implementation of an “Access Section” allows, for a given user, to make visible only the data related to him.

For example, a team leader in a sales department will only have access to data specific to his team.

Giving access to applications from analysis sheets about sensitive topics to certain users only

In the second case, on the other hand, the resolution will have to go through the Qlik Sense management console and more specifically through the security rules.

By default, a user having an access right to a Stream, will have the right to view all its content: applications, sheets, graphics, bookmarks, …

In order to meet the confidentiality requirement, it is necessary that within the same Stream, some applications and/or sheets are invisible by default.

Only a defined group of users will be able to consult them, if and only if their category corresponds to the category of the application and/or sheet.

Thus, a person with the ability to see hidden elements, will not necessarily see all the hidden elements.

To illustrate the problem, consider the following case :

Case of the HR application – Hiding sheets

Description :

In a construction company, an HR application analyzes workers’ benefits, illnesses, and wages. This application is accessible to the entire HR team (manager, administrative staff, Payroll manager). This application also includes a few sheets that are only intended to feed a NPrinting report. The rest of the sheets are still under development (Bradford Analysis).

Need :

Benefit and sickness sheets must be visible to all users with access rights to the application.  The sheets developed for NPrinting must only be visible by the developers. The sheets analyzing salaries must only be visible by the HR manager and the Payroll managers. Finally, the Bradford (DEV) sheets must not be visible to anyone.

(Developers can view these sheets when they duplicate the application on their MyWork).

Table 1: Visibility Matrix

Solution :

The solution presented below deliberately ignores the more technical aspects in order to emphasize the general logic (it is not possible to apply “custom propreties” directly on the sheets). For this, we use sheet name and description).

As a first step, you will need to assign two flags to the sheets :

• HiddenSheet (YES/NO): Is it a hidden sheet?
• HiddenSheetType(CONF, NP, DEV): If it is a hidden sheet, what is its content type?

The CONF flag will be used for all sheets whose content can be qualified as sensitive. The NP flag will be used for the so-called “technical” sheets used only to feed a NPrinting report without any real value for a QS user. Finally, the DEV flag will be used to designate sheets still under development.

Table 2: Flags on sheet

Once the user/sheet flags have been assigned, the security rule will be to allow a user to see a hidden sheet (HiddenSheet=’YES’) only if that person has the right to see hidden sheets (SeeHiddenSheet=’YES’) and the type of content he can see corresponds to the content of the sheet in question (User@HiddenSheetType = Sheet@HiddenSheetType).

For example, the manager will have access to the salary slips, because, although these slips are hidden by default, the manager has the right to see the hidden slips and the type of slip he is allowed to see corresponds to the type of the slip. (User@HiddenSheetType = Sheet@HiddenSheetType=’CONF’).

On the other hand, the manager will not have access to the NP sheet, because although he can see the hidden sheets, the manager does not have the ‘NP‘ flag (here, only the developers have this flag).

We can also point out that nobody will have access to the ‘Bradford (DEV)’ sheets, because no ‘DEV‘ flag has been assigned.

This flag can later be assigned to a reference user in charge of validating the data while leaving the sheet invisible for the rest of the users. Once the data has been validated, the sheet can be made visible to everyone via HiddenSheet=’NO’ and the removal of the ‘DEV‘ flag. It is therefore no longer mandatory to work with a Development Stream.

To conclude:

The method presented above applies equally to Stream, apps, sheets or community sheets. The only difference is the type of flag used (“Clean”, “Customer Propreties” or “Sheet Elements”). It thus enables companies to manage the confidentiality of their data with maximum flexibility and also allows them to simplify certain processes (data validation in particular).