Security Risks of Low-Code Platforms

Low-code platforms provide a fast and easy way to build custom applications by enabling developers to assemble pre-built components through a visual interface instead of traditional hand-coding. However, while low-code can accelerate application delivery, it can also introduce security vulnerabilities if not managed properly. Here is an in-depth look at the key security risks of low-code platforms and how organizations can mitigate them.

Lack of Control Over Generated Code

One of the main appeals of low-code platforms is that they generate much of the application code automatically based on visual models and configuration settings. However, this auto-generated code is essentially a “black box” – developers have limited visibility into or control over it. This lack of transparency creates several security issues:

• Vulnerabilities may be inadvertently introduced in the generated code that developers cannot identify or fix. For example, the platform may fail to properly sanitize inputs or implement authentication controls.

• It is difficult to customize auto-generated code to implement strong security practices like encryption, key management, and access controls.

• Generated code often includes a lot of unnecessary features and dependencies, expanding the application’s attack surface. Removing unneeded code and dependencies is challenging.

To mitigate these risks, organizations should carefully vet potential low-code platforms on their ability to generate secure code and allow customization of security features. Developers should also inspect auto-generated code through static and dynamic analysis tools to identify any vulnerabilities.

Over-Privileged Applications

Low-code platforms frequently generate applications with excessive permissions by default for expediency. For example, applications may have full access to databases and files that they don’t actually need, or wide-open network connectivity. This over-privileging introduces risks like:

• Data exfiltration, where the application can access and leak sensitive data.

• Lateral movement, allowing attackers who compromise the application to pivot to other systems.

• Vulnerabilities like SQL injection, enabled by unnecessary database permissions.

Organizations can reduce these risks by carefully configuring permission settings during application development to implement least privilege access. Automated scanning tools can also identify and reduce unnecessary permissions.

Difficulty Applying Security Updates

The auto-generated nature of low-code applications makes it challenging to update them to address newly discovered vulnerabilities and security patches:

• Framework security fixes may not automatically flow through to low-code applications. Developers have to manually identify, test, and integrate relevant patches.

• Updating application business logic often requires rebuilding visual models. Simply applying patches to generated code will not change the underlying logical vulnerability.

• Testing the impacts of updates is difficult given limited visibility into auto-generated code.

Rigorous tracking and testing of updates for components used in low-code platforms can help address these challenges. Organizations should also budget additional time and resources for applying security fixes.

Limited Options for Security Testing

Traditional software security testing approaches like static analysis, dynamic analysis, and penetration testing are more difficult with auto-generated low-code applications:

• Static analysis tools cannot analyze visual models – they rely on source code.

• Dynamic testing requires runtime instrumenting of compiled code, which may not be possible.

• Penetration testing is restricted by lack of source code visibility. Testers cannot see the application’s full logic and attack surface.

Low-code platforms vendors should provide testing utilities and visibility specifically for security teams. Organizations can also explore intelligent application security testing tools that simulate attacks against running applications without underlying code visibility.

Difficulty Detecting Runtime Attacks

The abstraction provided by low-code platforms obscures application runtime behavior, complicating detection of attacks and anomalies:

• Logs and metrics lack granularity about internal application state and execution.

• Monitoring code execution for exploitation is limited without code visibility.

• Detecting issues like insecure data flows relies on language-level semantics.

Improving runtime monitoring and detection requires instrumenting low-code platforms themselves, rather than just applications. Organizations should evaluate platforms’ capabilities to generate execution logs, trace data flows, monitor memory, and integrate with other detection tools.

While low-code brings significant productivity benefits, it also disrupt traditional application security models. Organizations adopting low-code must re-architect their strategies, technologies, and processes to manage these new risks. With proper mitigation, low-code can accelerate development without compromising security.