Preventing Data Leakage in Low-Node/No-Code Environments

Low-code/no-code (LCNC) platforms enable application development by citizen developers, often generating “shadow engineering” projects that evade security oversight. While LCNC solutions like Power BI reports and automated workflows foster agility and innovation, they also introduce significant risks, including data leakage.

Data leakage risks in LCNC

One of the biggest security concerns in LCNC environments is the inadvertent exposure of sensitive assets.

Examples include:

• Misconfigured applications: LCNC-created assets like reports, data portals and AI agents may unintentionally be made public, exposing critical data. Citizen developers without formal training might not recognize the extent of this exposure.
• Insecure data flows: Automations often mishandle sensitive data, storing it in unapproved locations like an employee’s OneDrive or a widely accessible SharePoint site, leading to security and compliance violations. Some workflows use unencrypted channels or unsafe protocols to transmit data, compounding the risk.
• Data misuse: Inexperienced LCNC developers may unintentionally share sensitive data externally, such as using personal email to send internal information, creating anonymous access links to files or SharePoint lists, or exposing credentials embedded in outbound URLs.

Why traditional security controls aren’t enough

LCNC platforms operate outside the reach of conventional security tools, making it difficult for IT teams to monitor data flows and enforce policies. Key challenges include:

• Lack of choke points: Traditional DLP solutions monitor endpoints and gateways, but LCNC data flows bypass these controls entirely.
• Uncontrolled sharing: It’s common for users to create sharing links for files stored on platforms like Google Drive or SharePoint. These links can be shared internally and externally without oversight, bypassing DLP protections and other security measures.
• Speed of deployment: Citizen developers can spin up new applications and automations quickly, often without following standard security protocols. In larger organizations, this can lead to hundreds or even thousands of untracked applications, each with the potential to leak data.

These challenges highlight why organizations need to adopt LCNC-specific security measures to close the gaps that traditional controls can’t address.

Mitigating data leakage in LCNC

Given the unique risks LCNC environments pose, here are some best practices for minimizing data leakage:

• Monitor data flows: Implement monitoring systems that track data as it moves through LCNC applications. By creating a map of data flows from source to destination, security teams can spot any unusual movement that might indicate a leak. This visibility is essential for identifying potential leaks before they happen.
• Enforce data flow policies: Mandate that LCNC data flows use approved, monitored channels like enterprise storage or secure APIs. This ensures compliance with security controls, such as DLP and access logging, providing visibility and reducing risks of exposure or unauthorized access.
• Identify public-facing resources: Establish mechanisms to detect public-facing resources generated by LCNC platforms, such as portals, bots, and reports. Review these assets to ensure they do not expose sensitive enterprise data.
• Monitor public accessibility over time: Implement systems to continuously inspect LCNC applications for resources that might become public, such as shared links, APIs, or files. Periodic scans can reveal new vulnerabilities, enabling organizations to quickly identify and address changes in resource accessibility.
• Implement permissions and controls on automations: Limit the scope of automations within LCNC tools to reduce risk. For example, restrict access to sensitive data repositories or only allow certain user groups to create workflows. By enforcing strict permissions, organizations can minimize the chance of unauthorized data exposure.

Scaling up LCNC security

The adoption of LCNC is accelerating, with some organizations developing thousands of applications and automations every year. This growth introduces additional challenges for security professionals, who must secure LCNC environments at scale without stifling innovation.

Here are some strategies to help:

• Centralize oversight: Consider a centralized system or team responsible for reviewing and approving LCNC applications and automations. This team can act as a checkpoint to ensure that new applications are created securely and in compliance with data protection standards.
• Automate security reviews: As LCNC usage scales, manual oversight can become a bottleneck. Automate security checks for new workflows and sharing links to catch potential risks as they arise. Automated review processes allow your team to stay on top of new automations without becoming overwhelmed.
• Conduct regular audits: Routine audits can uncover untracked applications and ensure workflows follow security protocols.
• Establish a software development life cycle (SDLC) process for LCNC: Create a secure SDLC tailored for LCNC platforms, engaging security teams and developers. Focus on early detection and remediation using tools that flag vulnerabilities during development.

Data leakage doesn’t have to be a side effect of LCNC adoption. Organizations can balance innovation with security by implementing controls that are as adaptable as LCNC platforms.

Source: https://www.helpnetsecurity.com/2024/12/10/lcnc-platforms