Abstract
Business professionals are tired of waiting for IT to address their needs. Instead, they are increasingly building their own applications with low-code / no-code platforms. Recent surveys show that most enterprise apps are now built outside of IT by business professionals who hold no previous experience in building software. And so, enterprises are placing developer-level power in the hands of 100x new business developers. What could go wrong? In short, everything. In this presentation, we will share extensive research on the security of low-code / no-code applications based on scanning >100K applications across hundreds of enterprise environments. We will demonstrate how most applications get identity, access and data flow wrong, cover a wide range of security issues found in real environments, and share their backstories and implications. We will share the OWASP Low-Code / No-Code Top 10, the first-ever security framework for the categorization and mitigation of common security issues with business-led development. We will illustrate why the involvement of AppSec teams is desperately missing from business-led development, and share stories about organizations that got it right. Finally, we will share resources to help educate others and become a low-code security champion in your organization.
Transcript
AI generated from recording.
Introduction and Context
00:02 Presenter: Hi everyone. What we’re going to do today is going to be a bit different than what you’ve probably seen up until now. So I’ll just promise this, it’s going to be different. Now you get to decide at the end whether it’s different good or different bad, but I’m just going to try. Okay?
00:21 Presenter: Okay, so briefly about me, I’m a security researcher, CTO for a company called Zenity that’s focused on local and local apps.
00:32 Presenter: I lead the OWASP top 10, and we are hiring.
00:34 Presenter: So if you’re looking for a really interesting area where there aren’t many people that are looking into it and there’s major impact on enterprise, reach out to me afterwards.
00:45 Presenter: This is what we’re going to do today.
00:47 Presenter: We’re going to start with figuring out what business users are building, why are they building it, what are the kind of things that they can build, and how important it is for an enterprise today.
00:58 Presenter: Later on, we’ll figure out what goes wrong.
01:03 Presenter: When business users continue to build these things on their own, we’re going to take a step back and try to figure out why this thing is actually happening.
01:11 Presenter: So why are things going wrong that way?
01:13 Presenter: And, of course, the reason for this talk is we’re going to discuss a better way to move forward together with the business.
01:21 Presenter: And so let’s start with understanding what business users are actually building.
Business Users and Low‑Code Empowerment
01:27 Presenter: Low-code, no-code is actually like the latest thing in empowering business users.
01:35 Presenter: Everyone can be a developer, right?
01:38 Presenter: Everyone.
01:38 Presenter: It means somebody in sales, somebody in marketing, somebody from the finance team.
01:43 Presenter: If you can think about the problem that you want to solve, you can solve it yourself.
01:48 Presenter: And so this is kind of the inspiration behind low-code.
01:51 Presenter: And the reason why this is important is because as a business user, you’re always frustrated because you don’t have the resources that you actually need.
02:01 Presenter: And you’re waiting for IT to, like, on a queue to get your thing solved.
02:07 Presenter: business users are no longer waiting.
02:09 Presenter: They’re just moving on without us.
02:11 Presenter: And this puts us in a place where we need to make sure
02:13 Presenter: that we remain relevant as central teams
02:16 Presenter: that look after the organization.
02:17 Presenter: And if this idea of business enablement sounds familiar,
02:20 Presenter: it’s because it’s part of a very large trend
02:23 Presenter: of enabling business users.
02:25 Presenter: So if you think about Excel,
02:27 Presenter: Excel is like something that has,
02:30 Presenter: there are jobs built on top of Excel, right?
02:32 Presenter: There are people that are,
Real‑World Low‑Code Examples
02:33 Presenter: this is the one software I’ve been using throughout my career.
02:37 Presenter: This is the ultimate low-code platform.
02:38 Presenter: And so what low-code is trying to do is build the new Excel here.
02:42 Presenter: And you can see that low-code is another generation on top of that,
02:46 Presenter: and generative AI is another one.
02:48 Presenter: Because again, it’s about empowering business users,
02:51 Presenter: empowering people to do whatever they want to operate on their own.
02:55 Presenter: And so let me show you, this is a video that shows you
02:59 Presenter: what business users are doing right now.
03:00 Presenter: Now, you can see that through a conversation with chat,
03:04 Presenter: I can create an application.
03:06 Presenter: This is the Microsoft Suite, by the way.
03:07 Presenter: I create an application.
03:09 Presenter: This is actually creating a table behind the scenes
03:11 Presenter: in a managed SQL server database.
03:14 Presenter: And all of this thing is happening through chat interfaces
03:18 Presenter: and through drag and drop.
03:20 Presenter: Now, there is identity behind this.
03:22 Presenter: This thing lives in production.
03:23 Presenter: Users can authenticate to this.
03:25 Presenter: This is a significant piece of software.
03:26 Presenter: And so let me share a few examples of things
03:30 Presenter: that have actually been built with this.
03:33 Presenter: So we are all on the same page on why this is important.
03:36 Presenter: The first thing is that if you went to Microsoft offices physically
03:40 Presenter: a couple of years ago, you needed to upload your vaccination proof.
03:45 Presenter: And you would do that through a low-code app that they had on campus.
03:49 Presenter: And again, of course, this is an important application
03:50 Presenter: because it is handling sensitive data, your healthcare data.
03:56 Presenter: Let me show you another example here.
04:00 Presenter: Microsoft, where somebody from their marketing team, they realized that they have different
04:06 Presenter: dispersed processes for product launches, and they wanted to facilitate it all in one place.
04:11 Presenter: So the marketing team created an application to facilitate the product launch process,
04:16 Presenter: and they built it in a couple of weeks, and then it got used by the entire team,
04:22 Presenter: like 150 different employees there. It became the go-to standard for how you do product launches.
04:27 Presenter: Now, ever since they released this example about a year ago, this application has already become, like it started from nothing.
04:35 Presenter: It became viral and used by an entire organization, and now it’s already deprecated.
04:39 Presenter: So this shows you the fast pace in which this space is going.
04:44 Presenter: Another thing we’re seeing on the financial side is risk management.
04:48 Presenter: We’re seeing a lot of processes where people are doing automated approval of credit or escalation in terms of credit is not being issued.
Security Risks in Low‑Code Apps
04:58 Presenter: And, again, these are crucial business processes that are built on top of these low-code, no-code platforms.
05:05 Presenter: Now, one thing that you could be thinking in your head right now is that this might not be relevant to you because you might have chosen not to go with low-code, no-code because in your organization it would never happen.
05:15 Presenter: So I’m sorry to be the one to burst your bubble.
05:18 Presenter: But we all have low-code, no-code in our organization today.
05:21 Presenter: Because show me an enterprise that doesn’t use one of the companies you see here with the logos.
05:25 Presenter: These are no longer SaaS platforms.
05:28 Presenter: These are new types of cloud, business cloud, that allow people to build general-purpose applications on top of these different platforms.
05:37 Presenter: So if you think about a Microsoft or a Salesforce or a ServiceNow, this is not a point solution.
05:42 Presenter: Salesforce is not a CRM anymore.
05:44 Presenter: These are platforms that allow people to build applications.
05:48 Presenter: there in our enterprise and we are kind of in a situation like we were with bring your own device
05:54 Presenter: where security was like way behind the business saying that it will never happen inside of the
05:59 Presenter: organization but of course it ended up happening anyway this is the same thing here we really need
06:04 Presenter: to get on top of this and so one last thing i want to say about this is that is to try to give you a
06:11 Presenter: scale of how important this is for you today what you’re seeing right here is the number of dotnet
06:18 Presenter: according to Microsoft today.
06:19 Presenter: How many low-code, no-code developers
06:22 Presenter: do you think Microsoft has,
06:23 Presenter: like people using the Microsoft suite are today?
06:26 Presenter: Let’s think of a number,
06:27 Presenter: like 5 million .NET developers.
06:29 Presenter: How many low-code developers?
06:31 Presenter: So according to Microsoft’s earning report,
06:34 Presenter: the number today is something like 8 million.
06:37 Presenter: So more, way more people in the business
06:41 Presenter: building low-code, no-code applications
06:42 Presenter: than people using C-sharp building applications.
06:45 Presenter: How much security resources are we spending
06:48 Presenter: on the C-sharp rather than low-code, no-code.
06:51 Presenter: All right.
06:52 Presenter: And this is what it looks like for a single organization.
06:56 Presenter: So a single organization,
06:58 Presenter: and this is anonymous statistics from one Fortune 500 company.
07:02 Presenter: In a single organization,
07:03 Presenter: you’ll find tens of thousands of applications
07:06 Presenter: that are being created very quickly
07:08 Presenter: because, well, this technology allows people to build things fast.
07:12 Presenter: And so a quick recap.
07:13 Presenter: Yeah, like this idea of business people
07:17 Presenter: building their own things,
07:19 Presenter: you can’t escape from it.
07:20 Presenter: It’s already there.
07:21 Presenter: We really need to get on top of this.
07:24 Presenter: And so now I think it’s important,
07:26 Presenter: let’s like move into the next phase.
07:28 Presenter: What we’re going to do right now
07:29 Presenter: is figure out what could go wrong.
07:31 Presenter: And the way that I’m thinking about this
07:34 Presenter: is using a framework that’s called
07:37 Presenter: the OWASP Code No Code Top 10.
07:39 Presenter: That’s an open source project you can find out there
07:41 Presenter: that tries to capture the kind of problems
07:44 Presenter: that happen when business users are building applications,
07:46 Presenter: and it focuses on their side
07:48 Presenter: of the shared responsibility model, right?
07:50 Presenter: The business logic.
07:51 Presenter: Does the business logic make sense?
07:53 Presenter: And so the way that this project got created,
07:57 Presenter: I’m one of the creators.
07:59 Presenter: This is a community-driven project.
08:01 Presenter: We have more than 200 people
08:03 Presenter: across all of the forums that are part of this project,
08:07 Presenter: and thank you here for all of our contributors.
08:11 Presenter: process where you can offer up contributions and they get reviewed. One other thing that we have
08:17 Presenter: is anonymized statistics that some of them were shared by my company. And you can see the numbers
08:23 Presenter: here. So we already have more than a million apps that we’ve seen, like with statistics,
08:28 Presenter: with this project, which is huge. I mean, and this is because of the scale. When you think about those
08:34 Presenter: 8 million developers that we saw before, who do you think they work for? I mean, they work for you,
08:41 Presenter: And so these applications are getting built within the enterprise very quickly, and this gives us a lot of visibility.
08:50 Presenter: So the way that we’re going to do this section is rather than going through the list, which you can do later on on Google, I’m going to share a few examples.
Case Study: Employee Onboarding App
09:03 Presenter: These are real stories that we’ve changed a bit to make sure that they fit this audience.
09:08 Presenter: So let’s try to figure them out one by one.
09:11 Presenter: one. Employee onboarding is like a serious challenge, right? And especially when you think
09:17 Presenter: about having different SaaS services that you need to onboard to each one, or simply the ability for
09:24 Presenter: you to onboard, like each department needs to do their own processes. So there are a bunch of
09:30 Presenter: things that you can do around employee onboarding. The one thing I’m going to show here is HR. So
09:36 Presenter: So with a specific organization, in a single organization, the HR team needed to create a process to collect information from users.
09:47 Presenter: And this is kind of personal information.
09:49 Presenter: So you can see I’m going to show you how this app gets created because it’s important for us to figure out
09:56 Presenter: and put on your application security hat when we are going to discuss exactly how this thing is happening,
10:02 Presenter: because how this thing gets created,
10:04 Presenter: because in a second I’m going to ask you
10:06 Presenter: what are the problems here,
10:07 Presenter: and you’re going to have to answer that.
10:09 Presenter: I mean, in your head, but you’re going to have to answer that.
10:11 Presenter: When you see this little icon,
10:13 Presenter: the icon on the right button side,
10:17 Presenter: this is the icon that tells you that I’m logged in
10:19 Presenter: as a trusted user, like any user within the enterprise.
10:23 Presenter: Because in a moment I’m going to switch hats to the red email,
10:26 Presenter: and we’re going to have a different icon,
10:28 Presenter: so this would allow you to separate the two.
10:31 Presenter: So right now I’m logged into Power Apps.
10:33 Presenter: This is the low-code platform for Microsoft.
10:36 Presenter: And I’m going to create this application,
10:38 Presenter: this application for employee onboarding with HR.
10:41 Presenter: I’m logged into something called the default environment.
10:44 Presenter: This is where we are all,
10:46 Presenter: everybody is able to create applications.
10:49 Presenter: Of course, with low-code, no-code,
10:50 Presenter: we want to enable as many users as we can
10:53 Presenter: to build applications.
10:54 Presenter: And so we would allow everybody to build
10:57 Presenter: and to be productive within that environment.
11:00 Presenter: So this is the app.
11:02 Presenter: It’s like a simple form that you can fill out.
11:05 Presenter: And you can see that there are a bunch of pieces of information that we’re collecting,
11:09 Presenter: the name of the user, some personal information, the social security number,
11:15 Presenter: everything that we require for our HR operations.
11:18 Presenter: In terms of where this data is going to be stored, we’re going to choose.
11:22 Presenter: You can see that this data is stored in something called Dataverse.
11:27 Presenter: Dataverse is a managed SQL server that Microsoft provides
11:30 Presenter: that allows you as a business user to build applications
11:34 Presenter: in a way that abstracts from you everything about the underlying data set.
11:38 Presenter: Dataverse is actually pretty cool because it’s a managed database.
11:41 Presenter: You have role-based access control.
11:43 Presenter: You have an API.
11:44 Presenter: You have logs.
11:45 Presenter: You have a lot of things that are covered by Microsoft.
11:48 Presenter: And even though I’m giving this example about Microsoft,
11:51 Presenter: any local platform or most local platforms
11:53 Presenter: forms, have this version of a managed database today.
11:56 Presenter: And so this is where I’m going to store the data.
11:58 Presenter: All right?
11:59 Presenter: And now one other thing that I’m going to do is to set up an automation where every time
12:06 Presenter: somebody fills out this form, other than just saving this information, I’m going to send
12:12 Presenter: an email to the entire HR team telling them that this person has onboarded.
12:17 Presenter: All right?
12:18 Presenter: So this is the app.
12:20 Presenter: Now think about what went wrong here.
12:23 Presenter: your Red Teamer hat or your AppSec reviewer hat
12:26 Presenter: and think about what could go wrong with this application.
12:30 Presenter: And now if you have any answer in mind, all right.
12:36 Presenter: So I’ve given you a minute,
12:38 Presenter: let’s now take the Red Teamer’s perspective.
12:40 Presenter: And again, you can see the hacker icon
12:43 Presenter: on the right button side.
12:46 Presenter: And right now, again, I’m logged into this application
12:49 Presenter: and the first thing that I’m going to recall
12:53 Presenter: is actually hosted in the default environment,
Data Leakage and Automation Logs
12:56 Presenter: as we’ve just mentioned.
12:57 Presenter: Now, the special thing about the default environment
12:59 Presenter: is that everybody has access to the default environment
13:01 Presenter: because everybody can create in the default environment,
13:04 Presenter: which means that this application
13:05 Presenter: actually stores the table behind this application,
13:09 Presenter: the SQL table,
13:10 Presenter: is actually available to everybody
13:11 Presenter: that has access to build applications
13:13 Presenter: inside of this environment.
13:14 Presenter: In this case, it’s everyone.
13:16 Presenter: So here’s the table.
13:17 Presenter: It’s called sensitive data.
13:18 Presenter: And when I just go to that table and look at it,
13:21 Presenter: then I can just see the data,
13:23 Presenter: You can see the social security numbers that were generated by GPT.
13:29 Presenter: Now, this is like one example, but this idea of having an application store its database in a way that’s obscured from the users of the application.
13:39 Presenter: So they have access only to what they can, through the app, they can see only what they really own.
13:44 Presenter: But underlying this database is shared with everyone.
13:48 Presenter: That’s a recurring theme.
13:49 Presenter: We’ve seen that with SharePoint lists a lot, for example.
13:54 Presenter: So one thing that is clear here in terms of problems is that the data is accessible to everyone.
14:00 Presenter: So there’s an application.
14:01 Presenter: It stores sensitive data.
14:03 Presenter: And it stores it in a way that’s accessible to everyone within the organization.
14:06 Presenter: And this is actually a real example.
14:08 Presenter: We’ve actually seen this in a few different versions in different organizations.
14:12 Presenter: But there’s actually another problem here, which is sensitive data is just stored there in plain text.
14:18 Presenter: So we just saw social security numbers.
14:21 Presenter: We saw PII.
14:23 Presenter: When you think about this from the compliance perspective, or when you think about an auditor asking a question about this application, this would not be a good conversation for us to be in.
14:34 Presenter: But before we stop here, there’s more.
14:38 Presenter: Because think about a trusted user again.
14:42 Presenter: They’re using the application.
14:43 Presenter: They’re submitting all of their information, which is fine.
14:47 Presenter: Recall that there’s an automation here
14:50 Presenter: that is going to tell the HR team
14:54 Presenter: that somebody has filled this form.
14:55 Presenter: The interesting things about these automations
14:59 Presenter: is that they actually store all of the information
15:02 Presenter: that goes through them by default into the log.
15:06 Presenter: And so the log here for that automation
15:08 Presenter: contains the social security numbers and the PII
15:11 Presenter: that was submitted in the form.
15:13 Presenter: And you can configure this not to happen.
15:16 Presenter: configure the logs to remove those parts,
15:20 Presenter: but you need to actively do that, right?
15:22 Presenter: And the default is just storing everything.
15:24 Presenter: So everything you automate gets written down
15:27 Presenter: into those logs in plain text in a way that everybody that,
15:30 Presenter: in this particular case, everybody in the HR team
15:33 Presenter: has access to this automation,
15:35 Presenter: therefore they have access to this data.
15:38 Presenter: All right, and so this is the third thing that we’ve seen.
15:42 Presenter: It’s in here the sensitive data that’s being written to logs.
15:46 Presenter: Recalling what we’ve seen, this was a very simple application, right?
15:51 Presenter: Onboarding employees like a simple form to collect data by HR.
15:55 Presenter: And we’ve seen three separate issues here, data that is accessible to everyone in plain text,
15:59 Presenter: and that the same data also gets written to logs.
16:04 Presenter: Let’s look at another example.
16:07 Presenter: One of the most annoying things at working at an enterprise is enterprise security controls, right?
16:12 Presenter: Right. And one of the things that business users have been trying to do for a long time is to be able to use the things that they are already used, like the apps they’re used to using on their personal side of life.
16:26 Presenter: So one thing that people have been doing since forever is trying to sync their corporate account to their Gmail account.
16:32 Presenter: Right. And we’ve tried to fight that with multiple different ways.
16:36 Presenter: We have DLP. We can put things on the email server.
16:40 Presenter: There are plenty of ways for us to try and stop that.
16:43 Presenter: So here’s the latest innovation in moving data to a Gmail account.
16:48 Presenter: Just copy the content.
16:50 Presenter: And so here’s what they’re doing here with low code.
16:52 Presenter: This is one application.
Identity Misuse and Oversharing
16:54 Presenter: And it goes out.
16:55 Presenter: It has two different hands.
16:56 Presenter: So with one hand, it connects to an Outlook account with your corporate account.
17:02 Presenter: And on the other hand, it queries emails.
17:05 Presenter: And with the other hand, it reaches out to your Gmail address.
17:10 Presenter: It copies the content of every email from your corporate account and just saves this as a draft or sends it to itself on the Gmail site.
17:19 Presenter: Now, the data is being copied on machines that are owned by the cloud provider, in this case, Microsoft.
17:25 Presenter: So there’s no way for you to know that, right?
17:27 Presenter: You won’t find this on the network.
17:29 Presenter: DLP won’t help you here.
17:31 Presenter: This is one application that’s using two different identities and then mixing the data between those different identities.
17:37 Presenter: this. And this is a pattern we’ve seen again and again, really, in almost every enterprise I got
17:44 Presenter: a chance to work with. And so this is obvious, like the problem here is obvious, right? I mean,
17:50 Presenter: you can think about it for a while, but of course, this is just like pure data exploitation, data is
17:55 Presenter: leaving the organization. But unfortunately, this doesn’t stop here, because what we’ve just seen
18:00 Presenter: is my ability to sync every email,
18:04 Presenter: every new email that arrives to my Gmail account.
18:08 Presenter: But what if I want to sync historical emails,
18:10 Presenter: so emails I already have in my account,
18:12 Presenter: so search would work, for example.
18:14 Presenter: And so what we’ve seen is that people create
18:16 Presenter: this kind of application.
18:17 Presenter: Here’s an application that allows me to sync
18:20 Presenter: my historical emails into Gmail.
18:23 Presenter: So here’s how it looks like.
18:26 Presenter: There are two boxes here.
18:27 Presenter: I need to choose the email address
18:30 Presenter: they will be sent through my Gmail account,
18:33 Presenter: but I need to choose where they’ll be sent to,
18:35 Presenter: and also how many emails do I want to sync, okay?
18:39 Presenter: And when I click on sync email,
18:41 Presenter: this automation is gonna run,
18:42 Presenter: and it’s essentially going to query all of these emails
18:46 Presenter: and then iterate through them one by one,
18:48 Presenter: and do the same thing, copy the content
18:49 Presenter: rather than save the email, okay?
18:53 Presenter: And now the other thing I can do,
18:55 Presenter: and recall that I’m thinking,
19:00 Presenter: hat here. Another thing I can do is I can share this app
19:04 Presenter: with people in my organization. And in this particular case, you can see that I’m
19:08 Presenter: sharing with everyone. Now, everyone is interesting. We’ll touch
19:13 Presenter: on that in a moment. But I could share this with people in my team, with people in another
19:16 Presenter: team, everybody within my organization. And you can see that
19:20 Presenter: in order to use this application, users would have to provide these
19:24 Presenter: permissions. You can see two things there. The Office
19:30 Presenter: account and the Gmail account. All right. And now, of course, sharing with everyone,
19:37 Presenter: sharing with everyone means everyone. This particular group in Microsoft, this particular
19:42 Presenter: feature in the Microsoft suite means everyone, including guests inside of your tenant. This
19:48 Presenter: means that when you share this application with the everyone group and you invite a guest later
19:53 Presenter: to your org, they will have access to the underlying data storage. And I’m actually
19:56 Presenter: going to give a talk tomorrow at Black Hat that will discuss how this thing can get abused
20:03 Presenter: from the hacker’s perspective. So if you’re interested, check this out.
20:07 Presenter: All right, so one thing that’s obvious here is that share with everyone is not something
20:12 Presenter: we probably should do. But more than that, let’s kind of, this is, when you go to the
20:20 Presenter: actual application, when you log into the application as a user, as a normal user, this
20:26 Presenter: see that it’s asking me for the credentials I’d like to use. And specifically here, I’m going to
20:31 Presenter: choose my own credentials, which is in this case an admin. And then I’m going to say, okay, I want
20:37 Presenter: the emails to this address, and I want 20 emails. And then I’m going to sync the email. Now, recall
20:43 Presenter: that this is using an automation. And we just learned that automations are storing all of the
20:47 Presenter: data through them. And so as an attacker that has created this application inside of an organization,
20:54 Presenter: I now have access to all of the emails that have been synced for all of the users of that application.
21:00 Presenter: Every user of that application uses my automation behind the scenes,
21:05 Presenter: and I have access to all of the logs for all of the users.
21:09 Presenter: So, of course, this is also leaking personal data to logs, which is another issue that we’re seeing here.
21:16 Presenter: Okay.
21:16 Presenter: Okay, but one more thing that’s important here is that, recall this screen.
21:24 Presenter: When you typically log into an enterprise application, you are used to seeing an O of consent form, right?
21:31 Presenter: This is definitely not an O of consent form.
21:34 Presenter: An O of consent form would tell you, hey, here are the permissions that the application is going to use.
21:39 Presenter: Would you allow it or would you deny it?
Governance, SDLC, and Future Directions — Part 1
21:41 Presenter: This is not what you’re seeing.
21:42 Presenter: You’re seeing an app to use your identity, in this case, your Outlook identity.
21:48 Presenter: And this is actually going to share with the application a refresh token that would allow you to fetch information through the entire Microsoft suite, rather than just a single application or a single resource.
21:59 Presenter: This is full on all of the permissions that you have provided when you created this connection.
22:03 Presenter: And actually at DEF CON last year, I showed how this particular mechanism could be used to create phishing applications within organizations.
22:13 Presenter: So imagine like an attacker gets access to some account within an organization.
22:18 Presenter: Now they can spin up an application that is hosted on a trusted Microsoft domain.
22:22 Presenter: And everybody that logs into it would simply need to go through this allow window in order to be owned.
22:31 Presenter: All right.
22:33 Presenter: For the productivity thing, for the scenarios we just saw, we saw three separate issues.
22:38 Presenter: One is the fact that data is just living the organization.
22:41 Presenter: The other is the fact that we can just share things or overshare things.
22:45 Presenter: Now, the everyone group is one thing, but, of course, you can just share with large groups.
22:50 Presenter: You can share with people however you’d like.
22:53 Presenter: And the crucial thing here is that for productivity, of course, we’re going to share with everyone.
22:58 Presenter: I mean, why not?
22:59 Presenter: And the fact that personal data links to logs is a way for people to create applications which underlying are storing all the data from all of their different users.
23:11 Presenter: The last scenario I want to share with you, before we move on to trying to figure out what’s going on here, is self-service.
23:18 Presenter: So one of the things that happens when you have so many apps that are being created, remember there were, we talked about 8 million users,
23:29 Presenter: in a large organization, one thing that would happen is that a lot of applications would get lost.
23:35 Presenter: Because what happens when somebody builds an app and they build it in their own context
23:39 Presenter: and then they leave the organization?
23:41 Presenter: I mean, people leave an organization all the time, right?
23:43 Presenter: So people could be reliant on that application, but then the person leaves.
23:47 Presenter: And, well, what’s happening with that application now?
23:51 Presenter: This is actually a pretty big issue.
23:53 Presenter: And so this is actually, there’s an OWASP category that’s dedicated to that in and of itself, and I won’t touch on that a lot right now, but one of the things that we are seeing people do in order to fight this is allow people to, allow managers to own the applications that their direct reports are creating.
24:14 Presenter: So this is a self-service application.
24:17 Presenter: As a manager, I can log into this application, and I can choose each one of my employees.
24:22 Presenter: All of my employees would be available here.
24:25 Presenter: And I can click on this button to get access ownership over all of their applications and automations.
24:31 Presenter: And this is important, right?
24:32 Presenter: Somebody leaves the organization, you need to be able to continue their work.
24:36 Presenter: Okay.
24:36 Presenter: Okay, behind the scenes, this is receiving the email address of the user that I would like to own, to own their automations.
24:46 Presenter: And then for each automation and application that this user owns, I’m going to set myself as an owner, to set the user, the manager as an owner.
24:54 Presenter: Now, of course, the manager would not have access to call this API function, right, that sets himself as an owner.
25:01 Presenter: This means that in order for this application to work, I need to plug in an admin credential here inside of the application.
25:07 Presenter: So the application has an admin credential that allows users, if they manage the specific person, to own the applications that were created by that person.
25:18 Presenter: All right.
25:19 Presenter: What could go wrong here?
25:21 Presenter: No.
25:29 Presenter: Okay, so if you have something,
25:32 Presenter: like bear in mind what you already thought of,
25:36 Presenter: here are a few things.
25:37 Presenter: One is that think about this from the SOX perspective.
25:40 Presenter: This is an app that is being used
25:44 Presenter: by people across the organization, right?
25:47 Presenter: They are using the app.
25:49 Presenter: They are taking ownership of people’s, of their direct reports or applications, which is fine.
25:54 Presenter: But from the SOC perspective, this app doesn’t exist.
25:58 Presenter: Because the underlying credential that is the admin credential that allows this application to operate can be the credential that belongs to a single person, to a single admin.
26:10 Presenter: Now, why does this happen?
26:12 Presenter: This happened because if you think about business users trying to build applications, they don’t have access to generate service accounts.
26:21 Presenter: They can’t just ask for permissions to build an app.
26:25 Presenter: Instead, they embed their own identity within those applications.
26:29 Presenter: And then other users of the application end up using the maker’s own identity when they use the app.
26:35 Presenter: And so from the SOC’s perspective, everybody that’s using this application is just another connection that’s using the same credential to reach out and take ownership of automation.
26:46 Presenter: So if you think about it from logs, you just see this admin credential being used from different IPs across the organization for operating on different users.
26:56 Presenter: There’s no app from the SOC’s perspective.
26:59 Presenter: They’re just credentials that seem to have been stolen.
27:02 Presenter: And now think about what happens when the SOC tries to investigate this.
27:06 Presenter: They find the person who’s created this.
27:08 Presenter: Let’s say they are somewhere in the, I don’t know, customer care team.
27:12 Presenter: And they reach out to somebody from the customer care team and say, hi, we’re the SOC.
27:16 Presenter: I mean, something is wrong here.
27:18 Presenter: I mean, think about that conversation.
27:19 Presenter: It’s a tough conversation to have.
27:20 Presenter: So one of the crucial pieces that happens with low code is the thing where these applications are designed
27:29 Presenter: by impersonating their own users, their own makers.
27:32 Presenter: And this is basically putting all of our controls,
27:36 Presenter: our security controls, our monitoring aside, right?
27:39 Presenter: We can’t trust them anymore.
27:40 Presenter: Because when you see that somebody did something
27:42 Presenter: on the logs later, it’s definitely,
27:44 Presenter: it doesn’t mean it’s actually that person.
27:47 Presenter: That they could be using an app to actually do that.
27:50 Presenter: And so thinking about this,
27:52 Presenter: let’s putting our attacker hat here again.
27:56 Presenter: I’m using the app, and I’m going to,
27:59 Presenter: just get access for one of the users that report to me.
28:04 Presenter: And when I look at the request that this application is actually generating,
28:07 Presenter: this request is actually going out to the automation and running that automation.
28:13 Presenter: And in the payload of the request, you’ll see the email address
28:16 Presenter: for the user that I’m going to take charge of their applications right now.
28:21 Presenter: So what can I do as a hacker?
28:24 Presenter: I can just replace this email, right?
28:27 Presenter: Because it’s not signed, it’s trusted that the automation part trusts the application part to put the right email here.
Governance, SDLC, and Future Directions — Part 2
28:35 Presenter: So as a hacker, I can plug in the email of whoever I want in the enterprise, and I get ownership of their account.
28:42 Presenter: So this type of injection attack, specifically IDO, is something that we’re seeing a lot.
28:47 Presenter: And again, business users are building this.
28:51 Presenter: Are they supposed to know that you should be figuring out whether input should be trusted or not?
28:57 Presenter: That’s a difficult ask.
29:00 Presenter: So this is what we’ve seen with the self-service application.
29:02 Presenter: We’ve seen that the application was embedded with the admin zone identity, and we’ve seen the injection vulnerability.
29:08 Presenter: And so these were just three examples.
29:12 Presenter: There were plenty more things that I wanted to show to you today, but unfortunately we don’t have time.
29:17 Presenter: I’ll just mention a couple of them.
29:18 Presenter: One is misconfigurations, which we’re seeing again and again.
29:22 Presenter: Think about the AWS S3 bucket, where you have a predictable misconfiguration.
29:28 Presenter: People can find things that are inadvertently open to everyone.
29:33 Presenter: We’re seeing the same thing with low-code, no-code.
29:35 Presenter: And the other thing is supply chain.
29:37 Presenter: Because guess what?
29:38 Presenter: Low-code, no-code is always the only reason why it works is because there’s a large ecosystem of things
29:44 Presenter: you can just pick up from GitHub
29:47 Presenter: and plug into your own local application,
29:49 Presenter: which of course leads to the usual problems.
29:52 Presenter: And so we are leaving plenty of decisions
29:57 Presenter: that are about the architecture of applications,
30:00 Presenter: the way that the applications get created,
30:01 Presenter: the identities behind those applications.
30:03 Presenter: We are putting those decisions
30:04 Presenter: in the hands of business users.
30:06 Presenter: And they are left with a choice
30:08 Presenter: whether they want to move forward.
30:10 Presenter: I mean, if you share an application with everybody,
30:12 Presenter: then everybody would have access, which is great.
30:14 Presenter: they would always choose productivity over security, right?
30:19 Presenter: And so taking a step back to figure out
30:21 Presenter: what is actually happening here,
30:23 Presenter: like on a more abstract level,
30:28 Presenter: think about the SDLC.
30:29 Presenter: Think about the SDLC we know from professional development.
30:33 Presenter: Now, this is like a representation of the SDLC.
30:36 Presenter: It differs between different organizations,
30:38 Presenter: but it can start with a business user
30:39 Presenter: that has an idea for something
30:42 Presenter: and then goes through engineering and QA and ops,
30:44 Presenter: There are a bunch of people around it
30:45 Presenter: that would make the software successful.
30:49 Presenter: And we’ve also plugged into the SDLC
30:51 Presenter: all of our security controls, right?
30:54 Presenter: So you have security training and threat modeling
30:56 Presenter: and security reviews and security gates
30:59 Presenter: and vulnerability scanning and runtime protection.
31:02 Presenter: These are all reliant on the fact that the SDLC exists.
31:06 Presenter: Now let’s try to figure out
31:08 Presenter: what the SDLC looks like for low-code, no-code.
31:11 Presenter: So in most cases, there’s no SDLC.
31:14 Presenter: most cases what happens is that there’s an application, it’s already in production, you click
31:19 Presenter: on the edit button, you drag a few things around, and the application gets deployed again. And in
31:23 Presenter: some cases, this is done automatically without you even hitting save. And of course, in some cases,
31:29 Presenter: people are doing real SDLC with low-code, but that’s not the standard. That’s not the easy way.
31:34 Presenter: The easy way is just not to do it at all. I think it’s important for us to realize that this is
31:40 Presenter: This is in purpose because this is why low-code is successful.
31:43 Presenter: Because business users can just build whatever they want.
31:46 Presenter: They think about something, they build it.
31:48 Presenter: But who’s monitoring it?
31:49 Presenter: What would happen if somebody hacks that application?
31:51 Presenter: Would you be able to investigate?
31:53 Presenter: I’m not sure.
31:55 Presenter: And so we have given business users a ton of power, really a ton of power.
31:59 Presenter: There are no controls because the controls that you already have do not apply.
32:03 Presenter: Because if you think about, like, can you scan those applications?
32:07 Presenter: Can you monitor those applications?
32:10 Presenter: The answer was probably no.
32:11 Presenter: There are no guardrails.
32:13 Presenter: I mean, of course we’re seeing a lot of problems.
32:17 Presenter: This is the only thing that could really happen here.
32:20 Presenter: And so now I want to discuss what we’re not doing right now
32:31 Presenter: or the part that we are not doing as security professionals
32:34 Presenter: to enable those business users.
32:37 Presenter: shared responsibility model,
32:39 Presenter: particularly in cloud,
32:40 Presenter: but serverless is one example here,
32:43 Presenter: then we know that some parts of the shared responsibility model
32:48 Presenter: fall under the platform’s responsibility,
32:50 Presenter: but some parts are up to us.
32:53 Presenter: When we build something, we own that thing.
32:55 Presenter: We’re the only entity that can actually secure that thing.
32:59 Presenter: It needs to be something that we own.
33:02 Presenter: The same thing applies for local and no-code.
33:04 Presenter: So the fact that you don’t own the code
33:05 Presenter: doesn’t really mean anything.
33:07 Presenter: own the business logic of that application. You own the access layer. You own which data
33:11 Presenter: is being accessed by that application. So we have just kind of neglected our part here.
33:16 Presenter: So of course, if we leave business users to just do whatever they want, and we don’t put
33:21 Presenter: guardrails on them, and we don’t help them to build it in the right way, of course, we’re
33:25 Presenter: going to end up with issues. And so we really need to be better at this. We really need
33:30 Presenter: to own our part. And if you think about the different parts here, so from the platform
33:35 Presenter: platform perspective, we really need to help those platforms
33:38 Presenter: and to push them to be better, right?
33:40 Presenter: To help local and local platforms build better controls
33:43 Presenter: and hold their parts better.
33:45 Presenter: And as a community, we are trying to do that.
33:48 Presenter: One example, as early as kind of just last week,
33:53 Presenter: one tenable has found a major issue with Power Platform,
34:00 Presenter: which is the Microsoft platform,
34:01 Presenter: which basically enabled an attacker to replace the code behind the custom code components within the platform for every one of the different tenants.
34:11 Presenter: So multi-tenant access that you can replace the code underlying.
34:16 Presenter: And so Microsoft has fixed this issue.
34:19 Presenter: And as an industry, we’re trying to get those platforms to a better position.
34:25 Presenter: But think about this.
34:27 Presenter: I mean, Microsoft is struggling with this.
34:29 Presenter: What about the small platforms?
34:31 Presenter: Low code, no code is everywhere, right?
34:33 Presenter: As a customer, we definitely need to hold our part, which we’re not really doing.
34:38 Presenter: So just think about these questions that you’re seeing right now on screen.
34:42 Presenter: Can you answer those questions about your organization?
34:46 Presenter: I mean, those are tough questions.
34:47 Presenter: I mean, how many people, who’s building applications?
34:50 Presenter: What data are they attaching?
34:52 Presenter: How are they being shared?
34:53 Presenter: Those are difficult questions.
34:55 Presenter: But they all fall under the same bucket.
34:57 Presenter: They fall under the AppSec bucket.
34:59 Presenter: We are not owning the applications that business users are creating.
35:02 Presenter: We are just leaving them to be there and do whatever they want.
35:08 Presenter: And so the next section is where I give you some positivity, some optimism.
35:15 Presenter: Because some organizations are actually starting to get on top of this.
35:19 Presenter: And I’m going to share insights from those organizations, large Fortune 500 organizations, that have already started on this journey of low-code, no-code AppSec.
Governance, SDLC, and Future Directions — Part 3
35:29 Presenter: And let’s try to figure out what you can do to take advantage of the insights that they’ve already learned and the pitfalls that they’ve already found.
35:41 Presenter: I think the one thing to understand here is the difference between AppSec for local apps and AppSec for traditional apps.
35:49 Presenter: Because you’re going to find very unique challenges that you didn’t have to solve before.
35:54 Presenter: Let’s go through them.
35:55 Presenter: One is kind of obvious.
35:58 Presenter: Professional developers, I mean, we’ve been trying to raise their security awareness for a long time.
36:04 Presenter: And we’re in a better position than we were 10 years ago.
36:09 Presenter: at all, and it doesn’t really make sense to ask business users to make those security decisions.
36:14 Presenter: But we do need to make them more aware. We need to make a business user aware that they should not be,
36:19 Presenter: I don’t know, sharing their application with everyone within the organization or impersonating
36:24 Presenter: users within the organization. The other thing is the SDLC. I mean, we’ve just seen that no-code
36:30 Presenter: SDLC doesn’t really exist. And so we really need to make, there’s a huge difference here because
36:39 Presenter: it’s very much reliant on the SDLC,
36:41 Presenter: on plugging into the SDLC.
36:43 Presenter: If you try to build the same mechanism
36:45 Presenter: into low code or no code,
36:48 Presenter: you’ll hit a wall because there’s no SDLC.
36:50 Presenter: You can just write a security gate and you’ll be fine.
36:53 Presenter: The other issue is your existing controls.
36:57 Presenter: So your logs, your monitoring,
36:58 Presenter: everything that you’re using on the identity side,
37:01 Presenter: most of them don’t apply
37:03 Presenter: because the applications don’t have code.
37:05 Presenter: So you can’t scan the code of those applications.
37:09 Presenter: Because the logs are poor rather than what you’re used to,
37:13 Presenter: and because of this problem of user impersonation.
37:16 Presenter: So if you see a user performing something through those platforms,
37:20 Presenter: chances are it’s not that user that’s doing that,
37:23 Presenter: it’s actually the user of their application.
37:26 Presenter: And the last thing, which is probably the most challenging, is the scale.
37:31 Presenter: I mean, in a typical Fortune 500 organization,
37:35 Presenter: we have found tens of thousands of applications
37:39 Presenter: like two or three years.
37:41 Presenter: I mean, everything manual goes out the window.
37:44 Presenter: Forget about code review.
37:46 Presenter: Forget about security review.
37:47 Presenter: Forget about manual threat modeling.
37:49 Presenter: This will not work.
37:51 Presenter: You need a way to address this with automated controls.
37:57 Presenter: And so the last thing that I want to do
38:00 Presenter: is leave you with some resources
38:02 Presenter: that you can go at to solve each one of those challenges.
38:07 Presenter: And this is part of, I think the main reason that I want to speak with you today is to, let’s just show you the size of the opportunity that we have right now to take ownership of low-code, no-code security, to own it, and to champion it forward.
38:25 Presenter: So the first thing of raising awareness with business users, I’m very happy to share that we now have in the OWASP top 10,
38:34 Presenter: basically a translation of the top 10 to plain language, language that business users can understand.
38:41 Presenter: And this is huge, right?
38:42 Presenter: You can use this.
38:42 Presenter: This is a free resource.
38:44 Presenter: You can use this resource right now to educate your business users about the kind of things that we’re seeing in large organizations happening when they build applications.
38:51 Presenter: You’ll find descriptions of those problems.
38:54 Presenter: attack scenarios that are explained in a way that they can understand.
38:58 Presenter: So this is pretty cool.
39:00 Presenter: Please use this.
39:01 Presenter: Another thing that is another, like for the next challenge for SDLC,
39:06 Presenter: what we’re seeing people start with in large organizations is just
39:10 Presenter: it’s creating the standards.
39:11 Presenter: You need to start with the basics, right?
39:15 Presenter: People are creating programs for low-code security.
39:17 Presenter: And the first thing that you need to think about is, well,
39:20 Presenter: what are you hoping for?
39:21 Presenter: I mean, what are the use cases that you should use low-code, no-code for?
39:27 Presenter: And where do they need to be developed?
39:30 Presenter: And who has access to build applications?
39:32 Presenter: And who is reviewing them?
39:33 Presenter: And think about the supply chain of those applications.
39:36 Presenter: You need to think about that in order to drive action.
39:40 Presenter: In terms of controls, I’ll just briefly say that you saw how many logs these automations are generating.
39:46 Presenter: low-code, no-code can actually put us
39:50 Presenter: in a much better position than we are right now.
39:52 Presenter: Just like the amount of visibility we could get
39:56 Presenter: as security teams to what business users are building
39:59 Presenter: is vastly more than we have today.
40:00 Presenter: We just need to own this,
40:02 Presenter: we just need to kind of jump on the opportunity.
40:05 Presenter: And the last thing about scale
40:07 Presenter: is that you need to fight fire with fire.
40:09 Presenter: The way to fight this tremendous scale
40:14 Presenter: is to build automations on your own.
40:16 Presenter: security teams that are building those automations in order to identify where things go wrong
40:23 Presenter: and then immediately fix them. So with that, I’m right on time. Thank you very much.
40:36 Presenter: If there are any questions, there are mics, and I’ll also be here afterwards.
40:40 Presenter: Quick question for you. So I know that when you build or publish a Power Automate app,
40:46 Presenter: log that’s generated. You showed a form there that, you know, put social security number or
40:51 Presenter: social insurance number, whatever, into a log. I’m not familiar with where that log goes.
40:58 Presenter: That log, the logs for the automation, specifically for Power Automate, go inside of the Power
41:03 Presenter: Automate object. You won’t find them in activity logs. The only way for you to access those logs
41:09 Presenter: is to have access to that application, to that automation. But if it’s published by everyone,
41:13 Presenter: one in theory I have access to those as well. Okay. Thank you. Good afternoon. I wanted to ask,
41:23 Presenter: you said that there’s no guardrails for the low code, no code option. What’s the best way to try
41:29 Presenter: and introduce that if you’re trying to make the business user more of an ally than somebody that
41:35 Presenter: you have to kind of protect against? And I think on top of that, if you’re not successful
41:43 Presenter: With your guardrails, what do you do?
41:46 Presenter: So let me start by saying there are options to build guardrails.
41:51 Presenter: I mean, platforms are really trying to build the right guardrails for you to secure the business users,
41:59 Presenter: to allow them to build in a way that’s safe.
42:01 Presenter: The problem is that security teams are often just not involved in those initiatives.
42:06 Presenter: And the people that are configuring those platforms are the admins of those platforms
42:10 Presenter: that don’t have the right security mindset.
42:13 Presenter: So if you bring in the AppSec perspective, and if you treat it as part of your security program,
42:18 Presenter: then you’ll be able to use the controls that the platforms provide to put you in a better position.
42:25 Presenter: Having said that, platforms are all about productivity.
42:29 Presenter: They want to have as many applications as possible.
42:32 Presenter: They are about empowering the business users, which is awesome.
42:35 Presenter: We should not expect them to solve the security problem for us.
42:39 Presenter: Because, again, there’s a shared responsibility model.
42:43 Presenter: about. So I think the best case scenario, the top organizations that are fixing this right now
42:49 Presenter: are building their own things. They are trying to, there are some services you could use for that.
42:55 Presenter: But I think the main point is that you need to decide that you are going to own this.
43:00 Presenter: I mean, you need to spend your mind share and your time in educating the business users and
43:07 Presenter: and bringing them under the security umbrella.
43:25 Presenter: All right.
43:27 Presenter: Thank you very much.