{"id":4161,"date":"2024-06-24T13:57:13","date_gmt":"2024-06-24T18:57:13","guid":{"rendered":"https:\/\/www.darkreading.com\/application-security\/building-application-security-into-shadow-it"},"modified":"2024-06-24T13:57:13","modified_gmt":"2024-06-24T18:57:13","slug":"what-building-application-security-into-shadow-it-looks-like","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/06\/24\/what-building-application-security-into-shadow-it-looks-like\/","title":{"rendered":"What Building Application Security Into Shadow IT Looks Like"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

Application security (AppSec) programs are difficult to use and filled with vulnerabilities. Overloaded staff face an inadequate budget. Communication with developers is challenging. These sayings are so true, so ubiquitous, that they’ve become tropes. This is why meeting a team of two who managed to resolve 70,000 security vulnerabilities in three months made me gasp.<\/span><\/p>\n

70,000 Vulnerabilities? Really?<\/h2>\n

Actually, they found 80,000, 70,000 of which they were able to fix within 90 days. These numbers do not indicate particularly vulnerable applications. They indicate taking a real look in the mirror, beyond the usual lines drawn in the sand between professional development and citizen development, which we sometimes call shadow IT.<\/span><\/p>\n

Citizen developers are now embedded in every part of large enterprises. <\/span>Yes, that includes yours.<\/a><\/span> Last year, Microsoft <\/span>announced<\/a><\/span> that Power Platform, its popular low-code\/no-code platform built into M365, had surpassed 33 million users, growing 50% year over year. These users work for the enterprise \u2014 your enterprise. They build critical applications, from finance to risk and customer care. It’s a real boost to digital transformation, for the business and by the business (user).<\/span><\/p>\n

Citizen Development Security Challenges<\/h2>\n

A few aspects of citizen development make building an AppSec program around it particularly challenging:<\/span><\/p>\n

\n