Feature Service Security...or lack thereof!?!

[GunnarOlson]

Hi,

I just created a parcel feature service, created a web map containing the feature service, and then created a Web Mapping Application from the Web Map (Parcel Viewer). The security settings on the feature service are set so no one can export to a shapefile, geodatabase feature class, .csv, etc. This prevents people from exporting the data from the feature service description window. I have to share the feature service with EVERYONE in order for county residents to view the Parcel Map Viewer without an ArcGIS Online account & membership in a group. That being the case, ANYONE can open the feature service in ArcGIS for Desktop and then export the data to a shapefile or geodatabase feature class!!! The option to disallow export is apparently POINTLESS, as anyone can work around it as described. This basically makes sharing of Web Maps and Web Applications completely USELESS if you don't want others to be able to obtain a copy of your data.

That's a SERIOUS data security issue!!! NOT COOL. Hard to believe this has been overlooked. Maybe I'm missing something???

[MikeMinami]

Am I correct in assuming that in ArcMap, you are Creating a local copy for editing?

Feature services, by definition, return the geometry of features to the client application for drawing. Disabling the export option will not prevent this. A savvy person can still get all the geometry of your data. The Disable Export option only removes the download links from the user interface.

If data security is an issue, you probably shouldn't be using a feature service. In ArcGIS Online, your only other option is to create a tiled map service. You can create this directly from your features. However, tiled services have their pros and cons as well. If you have ArcGIS Server, you can publish a dynamic map service.

The current workflow for editing hosted feature services in ArcMap is to create a local copy. Thus, it's not possible to prevent export and still allow editing. We opted on the side of allowing editing, rather than preventing export for the reason above. Specifically that the disable export option doesn't secure your data. We will look at this again. Maybe there is some other solution here.

Hope this helps,

Mike

[GunnarOlson]

Hi Mike,

Thanks for your response. I am not creating a local copy for editing. I'm brand new to ArcGIS Online subscription functionality, so I'm just exploring stuff as I dive in head first. I was exploring functionality when I discovered that you can open a feature service in ArcMap and then export the features to a shapefile or featureclass. The lack of ability to share an App with everyone while still maintaining security of the feature service (i.e. not having it available for folks to open and export as described above) is very disappointing. I work with a lot of counties in Mississippi, and they don't necessarily have the $$$ (or technical expertise and resources) for server, so I thought this would be an excellent scalable solution for them to provide dynamic mapping services to county residents. Considering they have invested THOUSANDS of dollars to have their GIS parcel data created, there's no way they would want that data to be available for others to obtain. Query...yes. Download (i.e. export)...absolutely not. Even with data disclaimers for term of use, it's still not a good idea. I thought I was really on to something with ArcGIS Online, and was ready to pull the trigger and suggest to counties I am working with that it would be worth the investment. BUT...with things the way they are right now, I won't recommend it. Not enough control over security of their data. Ultimately, that's less sales for ESRI, because the counties will outsource it to companies who use software other than ESRI...for around the price they would have paid for ArcGIS Online.

As I said...I am new to ArcGIS Online subscriber services, so maybe I'm missing something, but right now I'm very disappointed and confounded by the lack of security options for sharing/not sharing data. There should be some kind of option that allows for download to edit for specific individuals/entities, while still allowing sharing to everyone else just for viewing in a dynamic map service. That would seam to make sense to me...

What if I didn't want anyone to edit it? I'd still have to share it with everyone in order for all county residents to be able to access the Parcel Viewer App, correct?

Please let's continue this dialogue, as I think I may need a little more enlightenment. I already have further questions, but will wait on a response to this so as not to get ahead of myself!

Thanks!

[Anonymous User]

Hi Gunnar,

I'd be happy to setup a call with you to talk in detail about your issues and concerns. I will send you an e-mail soon with my contact information so we can set up a time.

Cheers,
Andrew

[GunnarOlson]

Thanks Andrew! Sounds good...

[DanielleKulas]

I just made this discovery today... has there been any progress in terms of feature service security in ArcMap since this thread started? Any sort of administrative work around?

[DavidForbuss1]

I believe there is a max record count that doesn't allow you to download the whole set at once.  I have mine set to 1000, and I haven't found a way around that limit.