Low and no Code Security: 4 Tipps & How to configure.

The recent rise of No-code/low-code platforms has made it relatively easy for non-technical business users to deploy and configure applications. However, this also means that they may not be aware of security best practices or even what is possible.

No-code/low-code platforms provide a wide range of features, some of which control the balance between security and support of specific use cases. Misconfigurations can often result in anonymous user access to sensitive data or operations, unprotected public endpoints, secrets, and oversharing. Furthermore, many configurations can be changed by business users rather than administrators because they are specified at the application level rather than the tenant level.

Is Security an Issue at Low and No code Automations?

Examples of Attack Scenarios

Case one:

An API endpoint is exposed by a maker's application, but the endpoint is not set up to forbid anonymous access. Attackers discover the app and steal its underlying data by scanning the low-code/no-code platform's subdomains.

Case two:

A maker creates automation that is triggered by a webhook without encrypting the webhook. Attackers can now launch the automation at will after discovering the webhook. Data deletion or modification may be automated.

Let us give you an example:

Marc one of our senior automation developers in the past - accidentally added his account via OAuth to a customer's account. How can this even happen? Well, it is called a session. Marc was logged in with his O365 account and did not use the customer's session. Simple mistake happens to the best ones.

It says Sebastian but actually uses Marc’s Mail. Misconfigurations can often result in anonymous access to sensitive data or operations, unprotected public endpoints, secrets, and oversharing. Now in this example Sebastian can access via Marc's M365 access his emails and his files.

How to prevent security and access issues at No Code?

• Read vendor documentation and follow best practices guides and educate business users!
• Ensure configurations align with industry best practices, and use multi as well as separated sessions within Edge, Chrome or other browsers.
• Monitor configuration for changes and freeze them. You can do this with ASERVMENT and secure technically these security issues.
• Implement a change management system for tenant-level configuration. Does your iPaaS or Low and No Code not have change management, we can help you - just drop a message and we will set it up!

‍