Latest / CYBR.Signal / Low Code No Code Dev Tools

Transcript

Low Code No Code Dev Tools · CYBR.Signal

• 0:00
  SPEAKER_00: Hey everybody, happy Cyber Sunday.
• 0:02
  SPEAKER_00: Michael Farnum here.
• 0:03
  SPEAKER_00: Hope you're doing well.
• 0:05
  SPEAKER_00: I am just starting to do a little bit of research into the low-code and no code tools that are out there that are creating these so-called citizen developers, kind of an odd term, but essentially essentially they are platforms that allow anyone who can't code to create an application based on whatever that they're trying to get out of it, whatever function it's going to perform, by just using a platform that lets you drag and drop different functions into uh into your code or into your uh program, your application, and then you don't really have to know how to code.
• 0:44
  SPEAKER_00: You just pull these things together, it creates all that, uses the code that's already built in, pieces it together, and out spits an application.
• 0:51
  SPEAKER_00: That's an oversimplification, but essentially that's it.
• 0:55
  SPEAKER_00: Um, I've used one of these before.
• 0:57
  SPEAKER_00: I used uh and I've seen it actually as a movement in the um from a security perspective in the uh security orchestration and automation uh platform, the the SOAR type tools.
• 1:10
  SPEAKER_00: Um, I've seen that in there as well where you don't have to know how to code as much, you're just piecing the stuff together.
• 1:16
  SPEAKER_00: Um, the concern in the security community is that these low code and no-code platforms, it's it's not a misnomer uh that it's low code or no code.
• 1:29
  SPEAKER_00: That actually that you know goes towards that, or that means that you don't have to know how to code or you don't have to do much coding.
• 1:37
  SPEAKER_00: Um, but some people take it as there is no code, but there's absolutely code in this.
• 1:44
  SPEAKER_00: That's how applications perform.
• 1:46
  SPEAKER_00: They have to have code.
• 1:47
  SPEAKER_00: You just don't see it, it's abstracted, it's an abstraction layer, so you don't have to see that, and then you get the application that you want.
• 1:55
  SPEAKER_00: Problem is that some of these tools are not exactly having gone through a lot of rigor to see whether or not they are secure.
• 2:04
  SPEAKER_00: The coding that they're doing is secure.
• 2:07
  SPEAKER_00: Um, so you really people don't think about that.
• 2:09
  SPEAKER_00: That somebody is building this, and it's it's not that they're not going through secure coding processes or practices, it's that the platform that they're using is inherently has some security flaws in it, and the code that it's putting together has some flaws.
• 2:29
  SPEAKER_00: So when I start coupling this in my mind, and this is why I'm kind of researching it.
• 2:35
  SPEAKER_00: When I start coupling this in my mind with what we've already got a problem with in the industry, which is shadow IT, which is organizations have different business units who are able to go out and slap a credit card down and get a cloud uh environment set up and maybe get somebody to develop an application.
• 2:57
  SPEAKER_00: Now you could actually have somebody within that same business unit slap that credit card down and get one of these platforms and build their own application without having even the expertise of somebody who knows how to code at least.
• 3:12
  SPEAKER_00: Um it's a little bit of an interesting uh scenario and something I'm a little concerned with.
• 3:19
  SPEAKER_00: And I've I've seen a lot of articles and I'll link to a couple of things that I've read on like CSO online and dark reading and stuff.
• 3:28
  SPEAKER_00: Um, and there I've noticed that there was an OWASP project for low code, no code, so an OWASP top 10, which um is interesting because it's sponsored by a company that's specifically trying to work on this area is security in the low code and no code.
• 3:45
  SPEAKER_00: But anyway, just maybe an extra thing you need to um add to your questionnaire or whatever verification you're doing, if you're if you're doing um any kind of work in uh buying companies, if your company is doing some mergers and acquisitions activity, stuff like that.
• 4:08
  SPEAKER_00: Something they might want to think about is that organization doing any low-code, no code in the applications that they have and checking those tools.
• 4:16
  SPEAKER_00: And if you're looking at introducing those into your organization or somebody's telling you they are, make sure they're doing the right thing and that tool, whatever they're using, is uh is being checked out.
• 4:28
  SPEAKER_00: So, anyway, one more thing to worry about low code no code tools, check them out, make sure they're secure in your organization if they're being used, and if you're acquiring anybody that they're using them, please check them out, make them part of your list to check out.
• 4:43
  SPEAKER_00: All right, see you next time on Cyber Sunday.
• 4:45
  SPEAKER_00: Have a good one.