As a CTO, it can be challenging to keep track of everything that goes on in your organisation, particularly when it comes to low-code development. While you may have a dedicated team of developers working on these projects, it's important to understand that mistakes can happen, and even small errors in code can lead to significant security breaches.
One way to mitigate these risks is to implement a governance framework that provides clear guidelines for the development process. This framework should outline the roles and responsibilities of team members, provide guidance on security best practices, and include regular testing and monitoring of applications.
Another essential element of this framework is communication. As a CTO, it's crucial to ensure that your team members understand the importance of security and the role they play in maintaining it. Regular training and education can go a long way in helping your team members stay up-to-date with the latest threats and best practices.
At the end of the day, it's up to you as the CTO to ensure that your organisation is taking the necessary steps to mitigate the risks associated with low-code development. By implementing a robust governance framework and prioritising communication and education, you can help ensure the security of your applications and protect your organisation from cyber threats.
Low-code development is becoming increasingly popular among non-IT professionals, as it allows them to build applications quickly and easily without the need for specialised technical skills. However, this trend also brings some security risks, as the low-code platforms may not have the same level of security controls as traditional software development environments, and non-IT professionals may not have the same level of security awareness.
To mitigate the risk of security breaches due to low-code development by non-shadow IT people, organisations should take the following steps:
- Implement security controls: Organisations should implement security controls that are specific to low-code development platforms to mitigate the risk of security breaches. This may include measures such as encryption of sensitive data, access controls, and vulnerability scanning.
- Provide training: Non-IT professionals who are building applications using low-code platforms should receive training on the basic principles of cybersecurity and secure software development. This training should include topics such as secure coding practices, vulnerability testing, and risk assessment.
- Monitor for vulnerabilities: Organisations should regularly monitor their low-code development platforms for vulnerabilities and take prompt action to address any issues that are identified.
- Conduct regular security assessments: Regular security assessments can help organisations identify and address vulnerabilities in their low-code development environments. These assessments should be conducted by qualified security professionals and should include a thorough review of the low-code platform, as well as any applications that have been built using the platform.
- Implement a governance framework: To ensure that low-code development is conducted in a controlled and secure manner, organisations should implement a governance framework that includes policies, procedures, and controls specific to low-code development. This framework should include measures such as application testing and approval processes, and the establishment of roles and responsibilities for low-code development activities.
Case Studies
- In 2019, a data breach at the Australian National University (ANU) was attributed to a vulnerability in a custom-built application that had been developed by a non shadow IT team using a low-code platform. The breach exposed sensitive personal information, including names, addresses, dates of birth, and phone numbers, for approximately 200,000 current and former staff and students.
- A data breach at Westpac was attributed to a vulnerability in a low-code platform that had been developed by a non shadow IT team. The breach resulted in the exposure of sensitive personal information, including credit card details, for over 98,000 customers.
- In 2018, where a vulnerability in a low-code platform led to a data breach at Family Planning NSW. The breach exposed the personal information of over 8,000 clients, including names, dates of birth, and contact details.
These cases highlight the importance of ensuring that low-code development activities are conducted securely and in compliance with relevant security standards and regulations, regardless of the location. Organisations should implement comprehensive security frameworks and conduct regular security assessments to minimize the risk of security breaches in all aspects of their IT infrastructure, including low-code development activities.
