Skip to content

  • Platform
    • Platform overview
    • Why Genus?
    • Use Cases
    • Evaluation guide
    • Pricing
  • Industries
    • Industry overview
    • Banking and finance
    • Insurance
    • Energy and utilities
    • Public safety
    • Business services
    • Consumer goods
    • Transportation and logistics
    • Manufacturing
    • Property management
  • Resources
    • Case studies
    • Professional Services
    • Support
    • Academy
  • Partners
    • Hire a partner
    • Become a partner
  • Company
    • About
    • Blog
    • News
    • Careers
    • Contact
  • Book a Demo

Security concerns and priorities when choosing your low-code platform.

By See all articles from the author: Johnny Troset Andersen
28. January 2021
  • Share on LinkedIn Share on LinkedIn
  • Share on Facebook Share on Facebook
  • Share on Twitter Share on Twitter

If you are concerned about the security of your custom business application, you should consider using a low-code platform. A well-designed low-code platform will handle many aspects of security for you.

A well-designed low-code platform will allow you to focus solely on the business aspects of security. The technical aspects of security will be handled by the platform. This post will discuss some of the most important aspects of security.

Data access

Some low-code platforms allow access to your data by other means than through the platform. Means such as custom code extensions, custom database queries, or third party components. Other platforms generate program code, opening for developers to modify the code afterward, and thereby circumventing the platform altogether.

User identity

You should make sure your low-code platform supports secure authentication services, offering trust in that your users are who they claim to be. Your application should facilitate the process of keeping accounts updated and leave the rest to the platform.

Secure actions

Your next priority should be to check if the low-code platform supports the business process aspects of security, i.e., what actions are allowed by whom. The platform should offer easy to understand controls to build a secure actions scheme. This will enable business people and engineers to understand, discuss, and agree upon the design.

Strict global policy

Genus protects your data by enforcing a strict global policy. All access to your data is governed by the platform, and no custom code or third-party components are allowed. Further, there is no code generation. Genus is a metadata execution-platform only. Therefore, there is no code to be tampered with. Lastly, all database queries (SQL) are generated by the platform, without any possibilities for modification (SQL injection) by the user.

The latter is confirmed by Forrester Research in their report (requires an account at Forrester) “Don’t Ignore Security In Low-Code Development”:

Some low-code platforms such as Salesforce, Microsoft PowerApps, and Genus go even further and allow no direct database access through custom SQL at all. In such cases, the burden to avoid SQL injection rests entirely with the low-code platform rather than any individual low-code developer.
Sandy Carielli and John Bratincevic, December 23nd., 2020. Don't Ignore Security In Low-Code Development, Forrester.

Our security measures may sound too strict. However, we claim that they will not prevent you from achieving the desired functionality. Instead, the strict measures will make you confident that your data is secure.

Please read our post on the paths to low-code to get a better understanding of metadata execution and code generating platforms.

Securely identified users

Genus supports a range of identity providers through industry standards like OpenID Connect or OAuth2. These services enable multi-factor authentication for your application. A Genus user must be properly authenticated through our secure gateway based on one of these standards.

Combining secure controls and securely identified users

The Genus platform offers a set of easily understandable controls to build a secure action scheme. The controls are Find and List, Read and Execute, Create, Modify, Delete, and more. By combining controls and connecting these to securely identified users, you can build both role-based and level-based setups, and many variants in-between. Finally, you will get a 360-degree secure application if you also utilize the rich auditing features of the platform.

You can also rest assured that most of the risks listed in OWASP Top Ten are taken care of by our platform. Be aware that some of them (like sensitive data exposure and broken access control) require a business effort, so make sure to do your part as well.

Genus, a highly secure low-code platform

The Genus platform is hardened over decades based on feedback from customers using the platform. These customers are in highly security-aware industries like public safety, insurance, banking, and finance. The hardening of the platform should make you confident that also your applications will benefit from using Genus as a low-code platform.

If you want a deeper dive into the security aspects of Genus you should read our evaluation guide: Developing in Genus and Identity and access management. The guide provides more details on how the security regime is implemented in the platform.

We also recommend reading Forrester Research’s report “Don’t Ignore Security In Low-Code Development”, as mentioned above. The report gives valuable insight into how security professionals could work with low-code developers and how to further manage the security benefits and risks of low-code development in an organization.

Reach out to Genus or one of our partners for help in designing your specific data access and secure actions setup. You should be ready for answering security questions about your business processes, but you may safely leave technical concerns to our platform.

Related blog posts and pages
The two paths to low-code
03.07.20

At the heart of low-code is “model-driven development” – visual modelling of applications rather than traditional hand-coding. However, there are two fundamentally different architectural approaches towards how the visual model should be made into a running application.

→ Read more
Evaluating low-code platforms
05.11.20

Many businesses will invest in low-code as a strategic platform in the coming years. But how do you evaluate this new, and perhaps unfamiliar, technology?

→ Read more
Johnny Troset Andersen avatar image
Johnny Troset Andersen

Johnny Troset Andersen is Chief Technology Officer (CTO) in Genus, looking over all current and future technology aspects of the platform.

Genus AS

Strandveien 55

N-1366 Lysaker

Norway

contact@genus.no

  • Subscribe to newsletter
  • LinkedIn
  • Facebook
  • Twitter
  • Privacy policy

Copyright © 2019-2020 Genus AS, All Rights Reserved.