No/Low-Code – Application Development Platform (NLC-ADP)

This proposal outlines a multi-layered and multi-tier solution aimed at addressing the challenges of detecting data vulnerabilities in modern applications. Currently, there is a significant gap in the market when it comes to accurately measuring the vulnerability profile of an application across multiple layers. Existing solutions primarily focus on source code analysis or singular aspects of application security, such as queries, composition, configurations, and policies. However, there is a critical need for a more comprehensive or holistic approach that considers all critical layers of an application, including configurations, policies, behavioral analysis, and binary analysis. Additionally, the solution should be compatible with existing frameworks and libraries that are commonly utilized in DevSecOps environments. Therefore, it should be able to calibrate and parse applications with third-party frameworks and libraries in a manner to contribute to comprehensive or holistic findings, analyses, and conclusions. Based on our findings during Phase I period of performance, the proposed solution aims to combine multiple analysis techniques and leverages advanced technologies, such as AI/ML. This solution is based on a modular design that encompasses multiple domains critical to application security. In large part, the essence of this design was inspired by the initial specifications to analyze security policies as well as data-related vulnerabilities in the source code and binary/bytecode of applications. Therefore, the security policy analysis and automation domain exists to ensure that the application adheres to security policies and guidelines. It examines configurations, access controls, and security policies to identify any gaps or weaknesses related to data security, especially as related to popular No/Low-Code (NLC) platforms such as Appian. Each domain within this solution plays an important role in offering a more complete profile of an application's vulnerability surface area, with a particular emphasis on data-related vulnerabilities. These vulnerabilities, including faulty database connections, insecure database queries, and inadequate management of sensitive data, are critical concerns in today's digital landscape. The selected domains are specifically chosen for their ability to effectively detect and address critical and data-related vulnerabilities. AI/ML and reinforcement mechanisms empower the solution to deliver comprehensive and accurate vulnerability detection while continuously improving its performance and staying up-to-date with evolving cybersecurity challenges. The solution supports analysis of code in many representations, including source code, JIT-compiled code, binary code, and intermediate representations, and is able to find potential data-related vulnerabilities introduced during the compilation process.