TechTarget.com/searchcloudcomputing

https://www.techtarget.com/searchcloudcomputing/tip/Mitigate-low-code-no-code-platform-security-risks

Mitigate low-code/no-code platform security risks

By Chris Tozzi

Low-code/no-code platforms are an increasingly popular option for the continuous delivery of business software, but they also raise new security challenges.

Low-code/no-code apps refer to software programs that developers build primarily via GUIs and prebuilt modules, rather than code them by hand. Beneath the surface, these applications still contain a great deal of code. But, from the perspective of the programmers who create them, the amount of coding and configuration they require is minimal.

Top security challenges

While low-code/no-code platforms can simplify development and speed software delivery, they create security challenges, including the following:

Outsourced code development. When you use low-code/no-code programming, a lot of the code your program relies on is outsourced; it's written by someone external to your organization, who then delivers it to you via preconfigured modules. This can make it difficult to enforce your organization's security policies or adhere to best practices.

Third-party updates. When you outsource your code, you also outsource your update workflows.

With a no-code/low-code platform, you must rely on the vendor to stay on top of security vulnerabilities within the modules it provides and to push out updates to address any risks. This reliance can add complexity to your organization's internal policies and workflows for applying updates. You might need to adjust your update schedule to accommodate that of your vendor. In addition, you might not be able to correct known security vulnerabilities in your low-code apps until the vendor provides a fix.

Lack of security checks. Low-code/no-code platforms enable rapid software development and delivery. That fast delivery alone is not necessarily a security risk; in fact, it can improve security by enabling faster updates -- and, therefore, faster bug fixes -- for applications. But when you deliver applications at rapid speeds, they might fail to undergo proper security checks.

Lack of data validation. One of the most common uses for low-code/no-code platforms is to create applications that interact with business data. However, when you don't properly validate that data, or store it insecurely, it could be at risk. Many low-code programming platforms make it much easier to ingest and manipulate data than to secure it.

Inexperienced developers. A big selling point for low-code/no-code platforms is their ability to empower people to create software without extensive programming experience. However, the empowerment of these "citizen developers" presents a risk, as they might not be aware of security vulnerabilities that would be obvious to more seasoned programmers.

Mitigate the risks

Because the security challenges above are inherent to low-code/no-code platforms, it's impossible to avoid them completely. However, you can manage and mitigate these risks with these best practices:

• Prioritize security over delivery speed. Don't let your need for more rapid software delivery get in the way of the security reviews you would do for other application types. Security should still come first.
• Still hire skilled developers. Low-code/no-code platforms are not a substitute for skilled developers. You might want to avoid paying pricy professional developers, but you should still have them on your team to supervise the overall development process.
• Use a vendor you trust. When choosing a platform, evaluate the security features it provides, as well as the reliability of the vendor. If the vendor has a history of security issues, or is likely to be acquired by another company, that could create complexity.
• Customize and extend. The best low-code/no-code platforms make it easy for you to customize and extend your applications. Take advantage of this extensibility to add your own security features. Customization can also make your program unique and, therefore, less vulnerable to known security vulnerabilities that exist in off-the-shelf, low-code apps.
• Don't use low-code platforms for high-security apps. While low-code/no-code programming is convenient and cost-efficient, apps with critical security or compliance requirements are not good candidates for low-code platforms.