Sure, Let Business Users Build Their Own. What Could Go Wrong?

on YouTube ↗51m

" summary

Scans of over 100,000 local low‑code apps reveal enterprises with 65,000 applications created in a few years and Microsoft reporting about 7–8 million low‑code developers versus ~5 million .NET devs. Common builds include Slack/Zapier automations, Power Platform portals and SharePoint scripts; failures include stolen refresh‑token impersonation, credential‑sharing connections, default APIs exposing tables, plaintext credit‑card storage, automation‑backed data exfiltration and even ransomware‑style file encryption. Many apps deploy to production with no SDLC, limited logs and minimal vetting.

AI-written summary · about

" chapters (22)

1. 0:00Intro
2. 0:34About me
3. 1:31Outline
4. 6:25Business users become business developers
5. 9:15The vast majority of enterprise apps
6. 12:47Development
7. 18:42The Shared Responsibility Model
8. 21:14Account Impersonation
9. 22:56Better Customer Care - The Problem
10. 24:42Better Customer Care - Summary
11. 25:18Authorization Misuse
12. 25:37Credential Sharing as a Service
13. 27:04App Reader API Admin
14. 28:09LCNC-SEC-03: Data Leakage and Unexpected Consequences
15. 30:39Authentication and Secure Communication Failures
16. 34:21Injection Handling Failures
17. 35:02Vulnerable, Unmanaged and Untrusted Components
18. 36:24Data and Secret Handling Failures Low-code/no-code applications often store data or secrets as part of their "code" or on managed databases offered by the platform, which needs to be properly stored in compliance with regulation and security requirements.
19. 36:57Give-Aware Campaign
20. 38:07Asset Management Failures
21. 39:02Security Logging and Monitoring Failures
22. 41:45Opportunities - Champion Low Code / No Code AppSec in your org •Create a Low Code / No Code Security Framework No Code SDLC

" related talks

• 44mSure, Let Business Users Build Their Own. What Could Go Wrong?Michael Bargury · Black Hat USA 2023
• 39mWhy You Should Look Into Low CodeChristoph Windheuser · GOTO Amsterdam 2022
• 31mLow-Code/No-Code Top 10 (LCNC)Michael Bargury · Global AppSec Lisbon 2024
• 29mLow-Code: It’s Also for DevelopersBear Douglas · Postman Galaxy 2021
• 54mCredential Sharing As A Service: The Dark Side Of No CodeMichael Bargury · Global AppSec Dublin 2023
• 34mSecurity in Low-code/No-code developmentMirza Dautbegovic · IT Security Virtual Conference 2021
• 51mAre Low-Code and No-Code Tools a Security Risk?Mark Nunnikhoven · RSAC 2022
• 30mSo you've been told to low code, now what?April Dunnam, Scott Durow · Powerful Devs Conference 2023