Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: Everyone has Twitter advice for Elon, passwordless vision is vacuous, and Apple prevented from forcing Safari. (more…)
What is managed detection and response (MDR)? Managed detection and response (MDR) is an outsourced service that helps organizations detect threats on endpoints, respond to them and carry out proactive threat hunting.
MDR services typically include an endpoint detection and response (EDR) platform, which is deployed on company endpoints, and human security experts. MDR providers give their customers access to security analysts and engineers who can help with endpoint security, network security management, triage of alerts and responding to real security incidents (here’s some further reading and more background on managed detection and response platforms).
Traditional managed security services (MSS) offer basic monitoring and alerting that do not provide the context and guidance needed to identify, respond to and remediate real security incidents. It leaves organizations exposed to many threats that pass through these basic services.
MDR provides a proactive, outcome-driven approach that goes beyond the scope of what MSS vendors can offer. Common MDR services include:
DevSecOps is a software development methodology that unifies previously disparate development (Dev), security (Sec), and operations (Ops) teams. It aims to integrate security across all development life cycle phases, including design, development, testing, deployment and delivery. It involves using automation to integrate security across all phases.
In the past, security tasks were performed at the end of the development pipeline by a separate security team. Next, the product was tested by a quality assurance (QA) team. This approach worked when developers released software updates only once or twice per year. However, once software development teams adopted Agile and DevOps pipelines to reduce the development time, security became a bottleneck.
DevSecOps integrates security into Agile and DevOps pipelines. It ensures teams can address security issues during the early phases of the development cycle. As a result, teams can apply fixes when it is easier and faster to remediate before products are released to production.
DevSecOps makes security a responsibility shared by all teams, including Dev, Sec and Ops. It is no longer the sole responsibility of one team that creates a security silo. Instead, it enables teams to automate secure software delivery, prioritizing security without slowing down the software development cycle.
DevOps has revolutionized application development. However, due to the high velocity of modern development methods, they can introduce security gaps and flaws.
In addition to regular security breaches occurring across the DevOps pipeline, new and sophisticated attacks, most significantly supply chain attacks infect the development systems themselves or third-party software components. This results in mega-attacks that can compromise millions of devices before being detected.
MDR is a relatively new cybersecurity offering but is beginning to have a major impact on companies seeking better protection with lower operational overhead. There are many overalls between MDR and DevOps. To integrate cybersecurity into production and deployment pipelines, some organizations are turning to a DevSecOps approach and MDR can help.
DevSecOps makes cybersecurity an integral part of the entire DevOps life cycle. As more organizations implement DevSecOps, they can supplement the knowledge and security best practices of in-house teams with the security expertise provided by MDR services.
MDR keeps DevOps teams ahead of the latest threats by keeping developers up-to-date on emerging threats and vulnerabilities and providing advanced tools for continuous security monitoring and response in their development and deployment pipelines. A key benefit of MDR is that it provides access to experts who can take action to prevent attacks, not just provide recommendations.
MDR becomes a supporting element that allows developers to write more secure code as well as better secure their DevOps environment. With the help of MDR technology and experts, it becomes easier to identify advanced threats that can bypass security controls before they impact the DevOps environment or the resulting software product.
All of this is useful as you find the right way to shift your organization to a true DevSecOps process.
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: More than 100,000 tech workers leave Russia, Perforce buys Puppet, and Intel moves faster than planned. (more…)
ACCELQ today unveiled the cloud-based ACCELQ Live test automation platform that is continuously integrated with a wide range of low-code and no-code application development and deployment platforms.
ACCELQ CEO Mahendra Alladi said the goal is to make it simpler to run complex tests across a multi-cloud computing environment.
Usage of low-code and no-code tools has greatly expanded since the start of the COVID-19 pandemic. Many organizations are now relying on these tools to accelerate a wide range of digital business transformation initiatives. The challenge they encounter is that many of these processes depend on multiple applications that have lots of interdependencies across which it is difficult to conduct tests, noted Alladi.
The ACCELQ Live platform reduces testing complexity by automatically updating itself as, for example, Salesforce or ServiceNow platforms are updated. It also provides access to pre-built codeless automation assets modeled on business processes via a live link. The company is also moving toward creating a marketplace where software vendors and service providers can build and deploy pre-built testing assets, as well.
Gartner predicts the adoption of low-code and no-code technologies will nearly triple by 2025. Testing those applications creates a major challenge as the pace of application development increases. The only way organizations will be able to keep pace is by embracing test automation platforms infused with artificial intelligence (AI) capabilities, said Alladi. In effect, ACCELQ’s ACCELQ Live represents an effort to democratize the testing of cloud and enterprise apps, he added.
As organizations increasingly appreciate their dependence on software, the way tests are being conducted is rapidly evolving. In addition to dedicated testing teams, developers and application owners are becoming more involved as responsibility for testing applications continues to shift further left. The challenge organizations face is the volume of applications that are simultaneously being constructed has significantly increased. Platforms that automate many lower-level testing functions are gaining traction as a means to enable humans to focus more of their time and energy on testing more complex functionality. The goal now should be to first rely on test automation platforms as much as possible and then employ humans to fill in the gaps as necessary, said Alladi.
It may be a while before most organizations achieve that level of test automation. However, with each passing day, it’s apparent that AI will play a larger role in application testing. The issue that many DevOps teams are now working through is how to incorporate test automation platforms within the context of a larger workflow.
In the meantime, the rate at which application testers become burned out should decline as more routine errors are uncovered by machines. It’s not likely AI will eliminate the need for dedicated testing teams any time soon, but as more rote tasks become automated there is going to be more time to focus on enhancing overall quality at a time when application environments have not only become much more distributed but also a lot more complex.
Software development is complex. It can take years of practice to become an experienced developer. But the good news is that you can build many applications without ever learning to code.
Low-code/no-code development is the practice of using a visual interface and drag-and-drop elements to build applications for business processes without coding.
These types of tools can be used by non-technical users to build many types of applications; these can then be integrated with other software systems. By learning low-code/no-code development, you will be able to create software for yourself or your business much faster than if you were to learn how to code the traditional way.
In this post, we’ll cover why you should learn no-code development, along with some great learning resources and communities you can join to get started with low-code and no-code development.
The internet is a very different place today than it was even a short 10 years ago. In the past, websites simply aggregated information to an audience on the web. Today, websites are designed to engage and encourage visitors to take action, from filling out sales forms to education and training to shopping and scheduling appointments.
Fortunately, the tools available on the market today have made it possible for individuals without coding experience to build beautiful websites, useful business applications and productivity and automation enhancements to workflows using no-code tools. In fact, 26% of executives say that no-code, low-code development platforms are their most vital automation investment.
Forrester Research believed that by 2022, the market for no-code and low-code development platforms will increase to $21.2 billion. Another report from Gartner estimated that by 2024, 65% of application development activity will be credited to no-code development.
While there is still a place for code and professional developers, no-code development gives individuals a way to build applications and boost their productivity and their effectiveness faster, cheaper and better than ever before. In addition, it relieves the burden on IT, software development and DevOps teams who can offload the work of creating applications to the actual users of those applications.
No-code also allows for collaboration of citizen developers with other cross-functional teams in the business, while developing apps that can solve for their unique challenges.
No-code can also accelerate digital transformation. The most important advantage of no-code development is speed. On average, it takes a few minutes to build a simple app or a website using no-code tools. When you’re developing more complex projects such as an entire business management system, this speed can be a major competitive advantage. It lets you quickly test your ideas and iterate until you get the results you want.
Since most development is done with a drag-and-drop interface that is built visually using pre-built modules, you can create apps faster. Usually, even testing is automated, which further speeds up development time. In fact, no-code platforms can reduce development time by 90%.
Forrester reported that when one company passed up hiring two IT developers and implemented low-code tools instead, they saw an increase of about $4.4 million in business value from the resulting apps over three years. Naturally, since low-code/no-code technology removes the need for and additional cost of developers, it helps you cut those costs as well.
People who make the switch from traditional coding to no-code development often say that it feels like a new world. It’s fast, easy and efficient—and you can create beautiful results with relatively little effort.
It is estimated that 71% of organizations that leverage citizen development could speed up app development by at least 50%. And 29% of companies noticed delivery speed doubled. These numbers suggest that citizen development and no-code development can increase productivity tremendously.
If a company wants to add a new feature or change existing ones, many no-code apps are flexible enough to adapt. The majority of no-code app development platforms allow you to add new features and customize your app. Low-code apps, on the other hand, are slightly less flexible and often have predefined components that make it difficult to customize the app.
Plus, because of the drag-and-drop elements, no-code app development platforms allow you to build an app quickly. You don’t need coding skills to create an app. Instead, you will rely on prebuilt modules and templates.
There are lots of great resources out there to help you learn how to build your apps and workflows without code. Here are some of our favorite places to start!
No Code HQ is a great resource for learning how to build your website or app without the need to code.
It is a community of no-code builders, where they showcase their newest projects, share news and experiences and engage with and learn from each other. You will get tutorials about no-code development, templates and tools to start your no-code project.
This community has more than 5,000 no-code builders and experts. They learn and share experiences and showcase the progress of creating no-code products.
This forum is for no-code experts to learn, interact, share and collaborate with other no-code community members and creators. They regularly update the community with news about no-code tools and experiences.
This is another space for no-coders that arms you with valuable information. You will find many tutorials, learning materials and over 200 free resources on various tools. Soon, the site said there will be a formal traning academy with mentors and tutors.
This is a directory of over 200 tools and strategies implemented by developers and no-code makers. Even a novice can learn how to build no-code software and receive community support.
The idea of learning to code can be overwhelming, even for experienced designers. This is why no-code is so appealing to so many people—it is essentially instantaneous, which allows you to create projects without worrying about the coding process. Have fun!
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: Okta and Sitel under fire over Lapsus$ hack, Greenpeace and others call for bitcoin change, and Europe still hates encryption. (more…)
It’s time to rethink how we deliver distributed access to software development environments.
We know how to write code. And there are plenty of well-established tools, techniques and processes for doing so.
We know what kind of code to write: Functional, scalable and efficient code that’s inherently secure and that we can readily modify whenever and however we need to modify it.
We know why we write code. We write it to enhance the value we offer customers, to expand our market reach, outperform the competition, cut costs, minimize risks and otherwise engage in what we call “digital transformation.”
We know who writes code—or, more accurately, the various “whos” who write it. We need developers with a diverse range of skills. And as our needs keep changing, we keep adjusting the mix of in-house and contract developers accordingly.
We also know when to write code—which is now and for the foreseeable future.
The one thing we still struggle with is where to write code. Not ‘where’ in the physical sense; we’re way past that. We know that for development teams to be optimally productive, we have to enable everyone to work from any physical location at any time. COVID-19 has dramatically reinforced this principle.
The ‘where’ we struggle with is the virtual ‘where’ of the developer workspace. Yes, we already provide developers with remote access to development resources. Sort of. But there are a lot—a lot—of problems with the way we do that. These problems adversely impact development every day by, among other things,
Unfortunately, we’ve become so accustomed to these problems that we tend to accept them as normal. But we cannot afford to accept them any longer. Here’s why.
One big problem for both developers and the enterprise is that developer workspaces aren’t fully portable. The methods we use to give developers remote access to their environments invariably come with unacceptable insecurity. There’s also the issue of onboarding. When a developer joins a team—whether as a new hire, temporary contractor or current employee switching to another project—it can take days for them to get them fully up to speed with access to all the project-specific resources they need. That ramp-up time invariably frustrates developers.
On the other hand, offboarding developers can be a security and compliance issue. Piecemeal provisioning of the multiple resources developers need inherently results in the piecemeal deactivation of those same resources. So when a developer quits or is fired—or when a contractor’s contract is up—we can’t be 100% certain that all their permissions have been revoked.
Moreover, what happens when a developer needs to go back into a project that no one has touched in months or even years? How does a developer recreate the full workspace associated with that project and have high confidence that they’re doing it right?
The answer is that we can’t. Instead, some unfortunate developer inevitably has to spin their wheels trying to piece together a long-dormant project. All your aging code is thus guaranteed to become “legacy” (which is just another name for ‘code no one is quite sure how to work on’), thereby guaranteeing that your organization will forever be burdened with an ever-growing mountain of resource-draining technical debt.
So how can we re-engineer the delivery of remote workspaces so we make life easier for developers while also fulfilling the security and compliance requirements of the enterprise?
Here are a few ideas to consider:
And those workspaces don’t exist as monolithic, “all or nothing” environments that you pray you’ve gotten right. Instead, with containerization, you can build project-specific workspaces more quickly, at less cost and with less risk.
Effective hosting of fully portable developer workspaces requires other important functionality as well: Inactivity time-outs, cloud cost/utilization controls, etc. Before addressing these details, however, development leaders must first come to terms with the fact that developers need a much better way to work remotely—and that every remote workspace must be a secure one.
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: Why Apple services were down, Linux gets a huge RNG overhaul, and we wonder if Okta was hacked again. (more…)
As digital transformation accelerates, organizations are searching for ways to enable all their employees—not just IT, development or DevOps teams—to design, build, iterate and launch new processes and applications as per their requirements. This democratizing approach is called citizen development—where business users are empowered to create their own processes and apps with only minimal supervision from IT, ultimately relieving them from IT backlogs.
Running a citizen development program doesn’t mean relegating IT to the sidelines. Citizen developers can often be prone to mistakes due to their lack of programming background. Limited skills may also result in creating a faulty app or unknowingly developing one that resembles existing software that serves the same purpose.
Thus, citizen development calls for a new relational approach that’s founded on transparency, trust and dialogue between IT specialists and non-IT employees.
As a business leader, you’re in the best position to initiate such a program. Here are the steps you can take to get you started:
1. Identify citizen development potential
You can issue surveys across departments or meet with division heads to understand who is using forms of shadow IT or already using citizen development tools, what they’re using these for and the number of users of these apps. Your findings can help you assess which departments have the most citizen developer candidates.
Also, determine your company’s backlog of IT requests and current IT pain points. Knowing the pent-up demand will give you an idea of what issues citizen developers can seek to resolve.
2. Set clear goals
Communicate what citizen development aims to accomplish for your organization. Identify the apps you intend to create, the mode of deployment, the role of citizen developers and which departments will benefit.
3. Get support from IT and fellow business leaders
Find partners in the IT team and among other managers who can help champion your vision for citizen development.
First, approach the potential managers who will be collaborating with you in this cause. Getting their support early can aid you in establishing a more well-rounded vision and avoiding any conflicts down the road. By helping them understand how it will actually boost their department’s workflows instead of delaying internal tasks, you’d be able to muster credibility for your proposal.
Meanwhile, assure your IT team that there’ll be a clear delineation of responsibilities between citizen developers and IT personnel. Employees will undergo self-directed and group training before being allowed to access a development environment. The software development life cycle will also be documented to make citizen developers aware of the process and necessary requirements for submitting their ideas. Moreover, IT developers will still be in charge of providing documentation, evaluating ideas and offering technical guidance with regular check-ins.
4. Shortlist low-code/no-code platforms according to your business needs
It would be best to look for low-code platform providers, schedule demos and invite IT and business unit leaders during dedicated sessions. They can compare feature sets and appraise learning curves with you.
5. Lay down a governance plan
A governance plan ensures that data security best practices are in place and that IT assistance is well-defined in your citizen development program. Such a plan should cover:
6. Get senior management buy-in
You’ll need to communicate your intentions with your senior executives and prepare to formally present your citizen development plan.
7. Start training
The citizen developers should be given time to learn the selected low-code/no-code platform. You can later pick a use case to pilot the tool. Identify your expectations and criteria to measure the success of the project.
You can’t control the pace of change; instead, consider that we are in a process of reinvention—both with regard to the way organizations use technology and how vendors position their offerings. At the same time, it’s never been more important for IT organizations to have complete visibility into the way technology is used from both a security and operations perspective.
This need to embrace reinvention while continuing to have broad and deep insight across all technology platforms led me to create a 2022 DevOps Radar Report. In this article, I highlight three near-term priorities that must be on every technology team’s radar. In addition, I’ll point out some long-range radar trends that should be on your agenda.
APIs are the lifeblood of the cloud-native and app-based economies. Increasingly, poor API security across a variety of applications and systems puts your organization at risk. A compromised API or the use of unsupported or outdated APIs can prove to be an easy attack vector for cybercriminals. In addition, API vulnerabilities are calling into question how organizations approach application security and the usefulness of web application firewalls (WAF) and encryption protocols. Therefore, API security is rapidly becoming a top security priority for enterprise security teams and software professionals.
Failing to adequately manage the security of APIs creates a host of new challenges and questions that you must consider. For example, who is using which APIs? Are your APIs updated? Did your DevOps team evaluate the security of your APIs during their selection process? Have you formalized the way your organization is evaluating API security?
It is increasingly clear that an API breach can lead to the downfall of your entire digital software strategy—but it doesn’t have to be this way.
At Techstrong Research, we segment the market into “pure-play” API security vendors and larger security vendors with specific API security offerings. Our team will be publishing a Market Vista report on the API security landscape soon, so if you want to share your opinion or thoughts, please reach out.
Below is a brief list of some of the vendors we are tracking in the API security market. Of course, expect consolidation—some of these pure-play vendors will likely be acquired in 2022.
Pure-play API security vendors we’re tracking include:
General security vendors with API security offerings that we’re tracking:
Modern applications are composed of containers and APIs that your organization can’t control, and into which visibility is difficult. Monitoring and application performance management (APM) solutions aren’t new; for many years log vendors built their businesses on collecting log files and sending alerts … so what’s changed?
First, logs without context are meaningless. You need to understand upstream and downstream dependencies. Additionally, speaking for myself, I’m a mere mortal—if your teams are also made up of mere mortals, there is no way they can ingest, correlate and understand the tsunami of incoming DevOps log data quickly enough to take proactive measures.
Besides the need to understand context, we are dealing with multiple cloud and on-premises platforms that each have their own logging protocols. Ultimately, the goal of observability and AIOps is to understand what’s happening across and among all these environments and technologies so you can detect and resolve issues as quickly as possible to keep your systems efficient and reliable and your customers happy.
As an industry analyst, I see our clients pouring resources into cybersecurity efforts to prevent zero-day attacks and sophisticated advanced persistent threats (APTs). These threats, while real enough, are mostly external and may not pose as great a threat as many organizations believe. In fact, the vast majority of security vulnerabilities are caused by:
The first step in combating this problem is improving security awareness and building a cybersecurity culture. That starts with everyone in your organization understanding that security is a team sport and that it is a 24/7/365 responsibility. Even if you work from home; even when you’re cooking dinner while checking email on your phone, you need to have your “corporate security/Is it safe?” hat on.
At the same time, machine learning, AI and automation have a role to play. There are emerging offerings that help enforce DevSecOps best practices and help security teams reduce the constant noise so they can focus on the most vital threats.
To support emerging business models, what do DevOps leadership teams need to be thinking about from a long-term perspective?
Attempting to control change and the speed of reinvention is futile. You need to get comfortable riding the waves of industry change, or you’ll be swept away! Every IT leader needs to learn how to roll with and manage the ebb and flow of business, IT and personnel change.
The best place to start is by building a successful culture within your organization. Although we often talk about technology-focused solutions to business problems, the first step on this journey doesn’t involve tech at all; it involves helping IT and business teams understand each other’s pain points and learn how they can each support a continual reinvention process.
I will be tracking these incoming radar targets and other associated trends throughout the year and I look forward to your input. Do you think I missed something? Have a question or want to share what your organization is doing to support the need for continual reinvention?
Feel free to engage with me – @DDKirsch, LinkedIn or, of course, email.