低代碼開發會帶來安全問題和數據泄露隱患嗎？

{"type":"doc","content":[{"type":"blockquote","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"低代碼開發的缺陷在於缺乏經驗的開發者並不掌握安全性的相關知識。要重視軟件安全性問題，不要等它變成災難後再亡羊補牢。"}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"低代碼開發方法有可能比傳統開發方法更快、更便宜地創建軟件。但很少人會提到，用低代碼方法開發出來的軟件所包含的安全風險是和傳統上基於代碼開發的軟件一樣多的。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"安全性被構建進了低代碼開發工具中，但這種安全性必須由開發人員理解和配置才能發揮作用。非專業開發人員可能很難意識到安全隱患的存在，或者不具備配置軟件安全性的經驗。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"能擊倒你的往往是你看不到的風險。非專業開發人員的注意力都集中在了軟件創建上，並不會小心謹慎地應用那些最佳安全實踐。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"如果低代碼開發流程沒有同IT部門緊密結合，沒有充分應用最佳實踐，那麼前者的開發指引就不會是由經驗豐富的開發人員來定義。這就會引入安全漏洞和數據泄露的風險。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"這不是非專業開發人員獨有的問題，而是普遍存在的開發問題。區別在於有經驗的開發人員（並非總是）會檢查安全性是否到位，而沒有經驗的初級\/非專業開發人員甚至不會意識到安全性是他們的責任和應該做的事情。"}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"微軟Power App Portal暴露了3800萬條記錄"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"微軟的低代碼開發工具Power Apps之前登上了頭條新聞，因爲一款配置錯誤的Power App將3800萬條記錄暴露在了互聯網上。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"重點摘要:"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"blockquote","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"“包括微軟在內的47家政府實體和隱私公司錯誤配置了微軟的Power Apps，將3800萬條敏感數據記錄暴露在了互聯網上。Power Apps是一種低代碼服務，承諾以一種簡單的方式構建專業應用程序。”"}]}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"是什麼導致了這個問題？"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"UpGuard公司的一名分析師發現Power Apps portal的OData API可以允許匿名訪問數據庫記錄。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Power Apps portal是面向互聯網的門戶。該門戶由微軟託管，並與微軟Dataverse集成。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"簡單來說，通過某種特定配置，面向互聯網的Power Apps Portal可以允許存儲在多個數據源（SharePoint、Microsoft 365、Dynamics 365、SQLServer等）中的數據通過匿名（也就是非用戶）的OData查詢來訪問。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"如果你不希望數據可見，你需要檢查一個布爾字段——啓用表權限（Enable Table Permissions）布爾值爲真纔行。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"對於這種煩人的配置值，大多數人都會採用默認值，也就是與世界分享數據。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"分析師看到許多公司都在使用Power Apps portal，但許多公司沒有設置過這一字段。結果是，他們可能會在面向公共\/互聯網的門戶上提供大量個人和其他數據，任由別人查詢。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"真是糟糕啊。"}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"設計如此"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"這不是什麼錯誤或安全漏洞，而是一項按設計意圖運作的配置。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"UpGuard的報告清楚地表明瞭這一點——"},{"type":"link","attrs":{"href":"https:\/\/www.upguard.com\/breaches\/power-apps","title":"","type":null},"content":[{"type":"text","text":"設計理念：微軟Power Apps的默認權限如何暴露數百萬人的數據。"}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"如果你想知道如何解決這個問題（我敢肯定有很多開發人員和非專業開發人員都會冒冷汗），請閱讀這一說明："},{"type":"link","attrs":{"href":"https:\/\/thehosk.medium.com\/Tip%20#1407:%20How%20to%20secure%20Power%20Apps%20portal%20from%20making%20the%20news","title":"","type":null},"content":[{"type":"text","text":"提示#1407：如何保護Power Apps portal"}]}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"低代碼警告"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"低代碼開發方法允許非專業開發人員或任何開發人員使用一系列組件來創建軟件，並使用更容易理解的查詢對軟件進行配置。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"像微軟的Power Platform這樣的低代碼開發工具，其重點都放在了應用程序創建上——但開發人員所要做的工作並不只有創建軟件而已。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"低代碼開發人員（非專業開發人員）同樣是開發人員，他們也需要完成開發流程中的其他一些任務。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"收集需求（提煉、理解）"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"維護軟件"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"爲軟件編寫文檔"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"部署"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"安全性（數據安全、個人數據、安全角色等）"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"數據源（數據庫、文件、保留、備份等）"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"與其他系統集成"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"更廣泛的環境和其他軟件"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"營銷活動不僅僅是發送電子郵件，開發工作也不僅僅是創建代碼或構建應用程序。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"非專業開發人員和開發人員並非安全專家，所以IT部門需要參與進來，並對軟件運行滲透測試。IT部門需要確保開發人員應用了最佳實踐，並找出軟件中存在的設計缺陷或軟件錯誤來保證安全性。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"非專業開發人員欠缺很多專業知識，這就是爲什麼他們應該在專業人員指導下創建應用程序並將其部署到生產環境中。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"如果公司組建自己的低代碼開發團隊時沒有讓經驗豐富的開發人員或IT部門參與，由後者來創建相關標準和最佳實踐，就會出現問題。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"傳統開發方法同樣會出現很多安全性缺陷，但它着重強調了安全性這個領域，而非專業開發人員需要學習很多知識才能理解其中的要害。低代碼開發工具也都很複雜，所以人們只能精通一兩種低代碼工具。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公司將需要單獨的團隊來監督和維護低代碼工具，因爲沒有人能一接觸到它們就理解其中的細節。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"這不是低代碼問題，而是開發問題。低代碼開發工具不會取代開發人員，它們會創造新的開發人員羣體，催生一支創建和維護生產級應用程序的缺乏經驗的開發團隊。"}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"低代碼革命需要資深開發人員領導"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"由缺乏經驗的開發人員創建大量應用程序有可能導致很多安全漏洞，這就是爲什麼不可逆轉的低代碼革命必須由經驗豐富的開發人員和IT部門全力領導。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"低代碼開發是一種強大的工具。與其他工具一樣，它們需要被當作長期戰略的一部分，人們還要爲軟件創建後發生的各種事情制定計劃。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"低代碼開發不會取代開發人員，它會造就更多缺乏經驗的開發人員。非專業開發人員需要高級開發人員的指導和領導，因爲與所有初級開發人員一樣，他們也會犯錯誤。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"軟件是如何創建的並不重要；重要的是它需要安全、維護和支持。低代碼軟件需要的是與傳統軟件相同的清單、團隊和流程。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"原文鏈接："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"https:\/\/thehosk.medium.com\/will-low-code-development-lead-to-security-problems-and-data-breaches-83a9375d4087","title":"","type":null},"content":[{"type":"text","text":"https:\/\/thehosk.medium.com\/will-low-code-development-lead-to-security-problems-and-data-breaches-83a9375d4087"}]}]}]}