Assessing/Threat Modeling No/Low Code Applications

I'll always remember looking at a 4GL (fourth generation language) telecom app in late 2012 at an insurance company.  It was used to route, via prompts, the caller to the right service desk.

So, I embarked on an informal security assessment/threat model by handwriting on my notepad "sources | sinks" then enumerating my perceived/observed of each.  After that we walked through the business logic, error/exception handling & misuse cases.  It was not the most thorough affair, but it was a value-add to the Cyber folks.

As the industry embraces more no/low code solutions (Power Apps, Honeycode, AppSheet) it behooves Cyber professionals to use a methodology to assess these solutions.  Here's a take on such a methodology that I'll pronounce DASL:

D for Data: classification/sensitivity/compliance requirements/retention

A for Application: underlying platform (Cloud Service Provider: CSP) & security/risk/SRE/DR posture

S for Sources/Sinks: ecosystem/supply chain

L for Logic: ruleset, QA testing, misuse cases      

Cloud-Native Threat Modeling & Alignment with Design Patterns

 https://techbeacon.com/enterprise-it/7-container-design-patterns-you-need-know

When performing a threat model for cloud-native environments I advocate for a comparison to the design patterns articulated above, especially how security-centric services are deployed.  To execute on segregation of duties one must abide by said best practices.

CASE STUDY: Security in Theory versus Security in Practice

Yesterday evening, as I approached my vehicle after a long (Mon)day with dry cleaning in one hand and my laptop bag in the other, I realized that my rear, driver-side tire was as flat as a pancake / crêpe. Fun times, especially since I parked on an incline!

After jacking up that side of the vehicle, and wrestling with the lug nuts, I was introduced to what I now know (thank you Google) is a security lock nut. Yes, I am mechanically challenged! 

After being unable to find anything in my vehicle that resembled a tool capable of removing said physical security safeguard, I called the dealership. Well, said nut (and the ability to remove it) is like a laser key, which is customized to each particular vehicle! Thankfully, a repair shop was across the street.

Research and interviews (e.g., my Lyft driver that evening, blogs) have shown that many drivers have lost or never received the tool(s) to remove a security lock nut, and therefore multiple individuals (such as myself) now ask: why? The answer is that this nut is a physical safeguard to negate stolen tires / rims / wheels. However, flat tires happen and people lose stuff.

So, learn from my experience. Before introducing the next great physical / logical / digital safeguard, think practically and verify whether or not that control is useful in practice / the field. Be pragmatic and kick the proverbial tires!