devopsy.kinsta.cloud

Category: Low-Code/No-Code

Bringing Development Environments Into the Modern Age
It’s time to rethink how we deliver distributed access to software development environments.

We know how to write code. And there are plenty of well-established tools, techniques and processes for doing so.

We know what kind of code to write: Functional, scalable and efficient code that’s inherently secure and that we can readily modify whenever and however we need to modify it.

We know why we write code. We write it to enhance the value we offer customers, to expand our market reach, outperform the competition, cut costs, minimize risks and otherwise engage in what we call “digital transformation.”

We know who writes code—or, more accurately, the various “whos” who write it. We need developers with a diverse range of skills. And as our needs keep changing, we keep adjusting the mix of in-house and contract developers accordingly.

We also know when to write code—which is now and for the foreseeable future.

The one thing we still struggle with is where to write code. Not ‘where’ in the physical sense; we’re way past that. We know that for development teams to be optimally productive, we have to enable everyone to work from any physical location at any time. COVID-19 has dramatically reinforced this principle.

The ‘where’ we struggle with is the virtual ‘where’ of the developer workspace. Yes, we already provide developers with remote access to development resources. Sort of. But there are a lot—a lot—of problems with the way we do that. These problems adversely impact development every day by, among other things,

Bogging developers down in annoying technical problems that hamper their ability to set up their environments.

Forcing developers to wrestle with the maddening complexity of configuring and managing the multiple dependencies associated with each project.

Trapping developers in an endless cycle of building, terminating and recreating environments as projects begin, end and are resurrected for updates and enhancements.

Unfortunately, we’ve become so accustomed to these problems that we tend to accept them as normal. But we cannot afford to accept them any longer. Here’s why.
Development Environments: Insecurity, Lost Productivity and Technical Debt

One big problem for both developers and the enterprise is that developer workspaces aren’t fully portable. The methods we use to give developers remote access to their environments invariably come with unacceptable insecurity. There’s also the issue of onboarding. When a developer joins a team—whether as a new hire, temporary contractor or current employee switching to another project—it can take days for them to get them fully up to speed with access to all the project-specific resources they need. That ramp-up time invariably frustrates developers.

On the other hand, offboarding developers can be a security and compliance issue. Piecemeal provisioning of the multiple resources developers need inherently results in the piecemeal deactivation of those same resources. So when a developer quits or is fired—or when a contractor’s contract is up—we can’t be 100% certain that all their permissions have been revoked.

Moreover, what happens when a developer needs to go back into a project that no one has touched in months or even years? How does a developer recreate the full workspace associated with that project and have high confidence that they’re doing it right?

The answer is that we can’t. Instead, some unfortunate developer inevitably has to spin their wheels trying to piece together a long-dormant project. All your aging code is thus guaranteed to become “legacy” (which is just another name for ‘code no one is quite sure how to work on’), thereby guaranteeing that your organization will forever be burdened with an ever-growing mountain of resource-draining technical debt.

The Shoemaker’s Children

So how can we re-engineer the delivery of remote workspaces so we make life easier for developers while also fulfilling the security and compliance requirements of the enterprise?

Here are a few ideas to consider:

Host developer workspaces in the cloud. Developers provide everybody else with a wealth of cloud resources, yet rarely take full advantage of the cloud themselves. Some resources they need may reside in the cloud, but the complete workspaces they require to be fully productive do not.

But why not? Everything a developer needs for every project should exist as a complete, unified, project-specific workspace that’s available to them anywhere—just like all the other SaaS solutions developers build for end-users every day.

And given the sophistication of today’s browsers, cloud-based workspaces can be made available to developers without requiring them to install a desktop client. The cloud also enables workspaces to be hosted anywhere to avoid latency delays.

Nothing should leave your secure workspace repository. Ever. To ensure the security of all developer work-product, no actual code or data should ever leave the hosting environment.

Only screen pixels and keystrokes should move across the network. This remote-access model makes developers’ workspaces fully secure and fully portable. It also provides the best protection against data exfiltration.

Simplify the definition and administration of project-specific workspaces. You don’t want developers looking around for tasks in progress, relevant datasets or process workflows. Instead, administrators should be able to configure workspaces that give developers access to all the resources they need for each project via a single sign-on (SSO).

Leverage containerization into your workspace hosting. Better, safer enterprise development isn’t just about re-engineering remote workspace access. It’s also about making those workspaces easier to manage on the back end. The best way to do this is containerization, which allows you to flexibly mix-and-match workspace elements. That way, you don’t have to build every workspace from scratch.
And those workspaces don’t exist as monolithic, “all or nothing” environments that you pray you’ve gotten right. Instead, with containerization, you can build project-specific workspaces more quickly, at less cost and with less risk.

Effective hosting of fully portable developer workspaces requires other important functionality as well: Inactivity time-outs, cloud cost/utilization controls, etc. Before addressing these details, however, development leaders must first come to terms with the fact that developers need a much better way to work remotely—and that every remote workspace must be a secure one.
March 29, 2022
Apple Outage Outrage | Linux Random Redo | Okta Hacked (or Not)

Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

This week: Why Apple services were down, Linux gets a huge RNG overhaul, and we wonder if Okta was hacked again. (more…)

March 22, 2022
7 Steps to Unleashing Your Citizen Developers
As digital transformation accelerates, organizations are searching for ways to enable all their employees—not just IT, development or DevOps teams—to design, build, iterate and launch new processes and applications as per their requirements. This democratizing approach is called citizen development—where business users are empowered to create their own processes and apps with only minimal supervision from IT, ultimately relieving them from IT backlogs.

How to Get Started with Citizen Development

Running a citizen development program doesn’t mean relegating IT to the sidelines. Citizen developers can often be prone to mistakes due to their lack of programming background. Limited skills may also result in creating a faulty app or unknowingly developing one that resembles existing software that serves the same purpose.

Thus, citizen development calls for a new relational approach that’s founded on transparency, trust and dialogue between IT specialists and non-IT employees.

As a business leader, you’re in the best position to initiate such a program. Here are the steps you can take to get you started:

1. Identify citizen development potential

You can issue surveys across departments or meet with division heads to understand who is using forms of shadow IT or already using citizen development tools, what they’re using these for and the number of users of these apps. Your findings can help you assess which departments have the most citizen developer candidates.

Also, determine your company’s backlog of IT requests and current IT pain points. Knowing the pent-up demand will give you an idea of what issues citizen developers can seek to resolve.

2. Set clear goals

Communicate what citizen development aims to accomplish for your organization. Identify the apps you intend to create, the mode of deployment, the role of citizen developers and which departments will benefit.

3. Get support from IT and fellow business leaders

Find partners in the IT team and among other managers who can help champion your vision for citizen development.

First, approach the potential managers who will be collaborating with you in this cause. Getting their support early can aid you in establishing a more well-rounded vision and avoiding any conflicts down the road. By helping them understand how it will actually boost their department’s workflows instead of delaying internal tasks, you’d be able to muster credibility for your proposal.

Meanwhile, assure your IT team that there’ll be a clear delineation of responsibilities between citizen developers and IT personnel. Employees will undergo self-directed and group training before being allowed to access a development environment. The software development life cycle will also be documented to make citizen developers aware of the process and necessary requirements for submitting their ideas. Moreover, IT developers will still be in charge of providing documentation, evaluating ideas and offering technical guidance with regular check-ins.

4. Shortlist low-code/no-code platforms according to your business needs

It would be best to look for low-code platform providers, schedule demos and invite IT and business unit leaders during dedicated sessions. They can compare feature sets and appraise learning curves with you.

5. Lay down a governance plan

A governance plan ensures that data security best practices are in place and that IT assistance is well-defined in your citizen development program. Such a plan should cover:
- The evaluation process for admitting projects into the citizen developer backlog or IT backlog
- Standard compliance and security requirements for any project accepted for citizen development
- Standard workflow protocols including testing, validation, audit and integration
- What instances will require IT involvement
6. Get senior management buy-in

You’ll need to communicate your intentions with your senior executives and prepare to formally present your citizen development plan.
- Establish the rationale behind the plan. Compare internal metrics with industry stats showing the current need for citizen developers. Cite success stories or case studies.
- Share internal figures pointing to the current IT backlog as well as results of surveys and discussions with employees and fellow managers.
- Calculate and show your company’s projected one- to five-year ROI for using low-code/no-code platforms for citizen development.
- Introduce your proposed governance plan and pilot program.
7. Start training

The citizen developers should be given time to learn the selected low-code/no-code platform. You can later pick a use case to pilot the tool. Identify your expectations and criteria to measure the success of the project.
March 8, 2022
Data-Driven Insights & No-Code Automation – Techstrong TV

Nishant discusses the importance of data-led engineering leadership. Nishant shares several examples of enterprises that have significantly improved development productivity, speed, quality, and security by bringing together data-driven insights and no-code automation. The video and a transcript of the conversation are below.

Recorded Voice: This is Digital Anarchist.

Alan Shimel: Hey everyone. Welcome to another Techstrong TV segment. My guest for this segment is Nishant Doshi. Nishant is with a company called “Propelo.” Nishant welcome to Techstrong TV.

Nishant Doshi: Thank Alan, thank you for having us.

Alan Shimel: Oh it’s a pleasure to have you on. Nishant, you know let’s assume our audience doesn’t know Propelo, not familiar with you, so I think that’s the place to start. Why don’t you give us a little background of both your own personal history, as well as as the company.

Nishant Doshi: Absolutely Alan. So first of all thank you everyone for joining, really appreciate it. My name is Nishant Doshi. I am the CEO and founder of Propelo.

                                 Propelo is a Series A startup based in the valley. What we are doing is we’re building an engineering excellence platform. My own sort of background is I sort of straddle between entrepreneurship and, and engineering leadership. Prior to this I was a VP of Engineering at Palo Alto Networks where I essentially helped them with, with all of their cloud security product lines and, and saw a tremendous growth within four years, from like zero to all the way like three-digit run rates.

                                 So I’ve had a lot of experience sort of like actually scaling themes, scaling processes, integrating acquisitions and realized that as an engineering leader I was making a lot of decisions and those decisions were not really based or backed by data. They were more gut-driven and you know there was a lot of different bottlenecks, a lot of different challenges where we really needed that data. We needed some automation and there just wasn’t a great tool or a great product to do that.

                                 So that, that sort of led me to start Propelo and sort of like bring you know data-driven insights and, and actionable sort of automation to the engineering to the world and that’s, that’s our mission.

                                 A little bit about Propelo. We help a lot of different engineering teams of all sizes, shapes, and varieties across a lot of different verticals. We have Fortune 100 customers, Fortune 500 customers, we have startups, unicons. We have customers all over, you know all over the world.

                                 You know I see very consistent theme across all of these different companies and, and what we see is that you know all these themes need to sort of run faster. They need to sort of like shift faster, they need to you know deliver you know quality sort of products in order to compete in order to sort of like capture their own individual markets.



                                 You know when you have, when you have this challenge of shipping you know faster with great velocity one of the challenges that you sort of grow and, and is that you know you have multiple personas, you have multiple tools, you have different processes within the company, within an organization that sort of need to come together to be able to ship this software, to be able to build and release the software.

                                 And often this results in a lot of different bottlenecks and friction points and those bottlenecks sort of keep shifting and it becomes a really big challenge to identify where the bottlenecks are. Sort of like you know you’ve got to understand how do you automate some of those bottlenecks or solve for those bottlenecks? How do you bring automation? And that’s really sort of like you know the common theme that we’ve seen is the lack of intelligence, the lack of sort of actionable intelligence across these different teams.

                                 So that’s, that’s the mission we are on. We are helping a lot of different companies with that sort of like mission to sort of improve productivity of their engineering teams by optimizing you know everything from processes to their tools across the entire software lifecycle.

Alan Shimel: You know Nishant someone sitting here listening to this it sounds simple. It sounds you know very clear, very well enunciated. This is really a case of the devil is in the details though, right? I mean when we’re, when we’re talking about you know I mean it’s classic kind of Phoenix Project, the gold, the book, the goal before that, right? Because what happens is as you find them or clear a bottleneck or a constraint you, you very often expose the one that was behind it and then you know and it’s become it’s like a treasure map where you, you know you’re going around from one bottleneck and one resource constraint or one you know trouble spot to the next. And you know it, it’s, it’s also usually a kind of never-ending story, right, because there’s always something else to improve, something else to do better, something else that popped up, something that’s changed that now needs improvement, right? It’s almost like by the time you get done you know to the end you got to come back to the beginning, because things have changed perhaps. It’s a tough problem to tackle, you know it’s a tough challenge. Let’s talk about how Propelo does that though if you don’t mind.

Nishant Doshi: Yeah absolutely. So it is a tough challenge but something that we believe definitely you know it’s, it’s worth start taking a step in that journey and that’s why we call it an excellence solution. It’s never done, right, it’s never you know, it’s a continuous improvement process.

                                 Now the way sort of you know I sort of guiding principles, right, coming into this is we, we really build a solution around flexibility and adaptability. The reason is you know almost every organization and even within the organization we’ve seen that they operate in sort of slightly different ways. And as a solution if you have to sort of succeed and sort of moving the needle any solution it needs to be flexible and adaptable. Someone might be actually releasing code manually, someone might be actually using GitHub, someone might be using a CI and CD system like Jenkins. So deployment sort of like might be you know following in a different process, right? As a product you need to be able to sort of like have the ability to be flexible and adaptable and that, that’s sort of like you know one of the guiding principles we have.

                                 The other guiding principle we have it’s sort of like really talks to some of the, you know some of the challenges you spoke about is really being wholistic. You know I’ve seen companies some of the products take the stance like, “We’re just going to look at this one problem.” But as you accurately pointed out it’s a treasure map. So you need to look at different facets not only within the engineering organization, but also how other stakeholder teams sort of like in track with engineering, right? What is the handoffs? What is that sort of process look like? Are there any deficiencies there between security and engineering, between product and engineering?

                                 In fact we’ve seen like product teams that actually have great sort of like hygiene around requirements, acceptance criteria. We see that have a huge impact on engineering delivery and software delivery. So I think like there’s a lot of different facets.

                                 And our product the way we’ve sort of architected our product is being able to sort of like use our libraries and our flexible dashboards to actually you know look at different facets, all the way from you know DORA metrics, which is, which is pretty standard nowadays in terms of like measuring overall productivity, but also looking at how teams are collaborating. We’re looking at like how customer success and customer support is sort of flowing into engineering. We look at security, we look at quality. So we’re looking at all these different aspects, because that’s how you stitch a story together, that’s how you understand what’s going on. So it’s really combining that KPIs with those insights and sort of like making it very wholistic.

                                 The third thing that we’ve sort of like really architected into our product is actionability first. We really believe like you know insights are great, but you need to sort of take action. Ours sort of like you know learning very early on was that it’s very interesting that everyone sort of has talks a lot… When, when we talk about sort of automation in the you know the Ops world there’s a lot of great tools, there’s a lot of like automation around the CI/CD, but there’s a huge sort of scope of automation outside of the CI/CD, especially as it relates to handoffs between different teams, nudging, sort of like certain actions, certain workloads, with sort of like all the way from release checklist, to sort of nudging the ______, to kind of checking their PRs, to security, engineering, product security, intakes. There’s a lot of different sort of like workloads that need to be automated or, or you know or semi-automated if there’s a human intervention that’s needed.

                                 So I think like our view is that there are sort of three sort of fundamental things that are needed to solve this huge challenge, flexibility, sort of being wholistic, and actionability. By sort of putting these three elements together we’ve been able to sort of like work with our customers to, to move the needle and get them into that continuous data-driven sort of improvement process and being able to sort of see examples, a lot of different examples of, of success there.

Alan Shimel: I love it, excellent stuff. So it’s a new company Nishant. Give us kind of you know what’s, what’s going on new, what you know, what’s, what’s happening?

Nishant Doshi: Yeah, it’s a new company. We’ve, we’ve grown. Last year was a great year for us, we grew 350 percent year-over-year. So posted some record numbers. In terms of like you know what we’re seeing in the market is as I said you know what was surprising to us was the every company, you know it sounds cliché, but every company is becoming a software company and what we’re seeing is you know a huge demand across the board.

                                 Like so we have you know we recently helped a company you know get sort of like their sprints in order, like you know measuring sprint hygiene. We help companies sort of like you know with a customer success, customer support, through engineering journeys. We’ve helped companies with sort of like triaging their Jenkins failure so that they can shift faster.

                                 So what we’re seeing is common themes, but across different verticals, across different shapes and sizes of the company. And that’s something that, that sort of like we didn’t expect going in, into this, into this, like how, how widespread the demand is.

                                 Engineering leaders more than ever like looking at using data, leveraging data to make decisions. And actually what’s, what’s interesting is with COVID, with remote work what we’re seeing is you know engineers they want to like work in companies that are better organized. They want to work in companies where the processes are flowing smoothly, they’re more productive. They aren’t working on like _____ a lot. And they’re getting sort of like appreciation for the work they’re doing. And that’s something hard to sort of like if you don’t have you know an ______ or it’s hard to recognize that, it’s hard to sort of put that into action.

                                 One of the most popular features that we, we saw last year was a feature of ours called “Kudos” where you can sort of actually give kudos to, to a job well done backed by data. And that was sort of amazing and we’ve had customers telling us that it’s really helped them sort of retain talent to be able to sort of like actually increase employee happiness.

                                 So, so I think like we’re seeing, we’re seeing a sort of inflection point in how engineering is sort of actually, how engineering leadership – the art of and science of engineering leadership evolve and I think data is a way big part of that story.

Alan Shimel: Absolutely. Nishant we’re about out of time, but for people who want to get more information is it propelo.com or?

Nishant Doshi: It’s propelo.ai.

Alan Shimel: Dot AI.

Nishant Doshi: Yeah.

Alan Shimel: And that’s: P-R-O-P-E-L-O?

Nishant Doshi: That’s correct: P-R-O-P-E-L-O.A-I.

Alan Shimel: Okay. Then on the website what’s the best way to engage with you via the site?

Nishant Doshi: Yeah, so we have multiple ways you can engage with us. We have free trials, so there’s you know there’s action, an action button for that. You can also contact us at info@propelo.ai or e-mail, you know e-mail us at or e-mail me at nishant.propelo.ai. So there’s multiple ways to engage. And we do, you know we do work with companies of all shapes and sizes and, and being able to help them sort of actually increase employee happiness and, and be more productive.

Alan Shimel: You know in the age of great resignations that’s an important thing. Hey Nishant thank you for coming for coming on and telling us about Propelo. Best of luck with it and we’ll have you back on again and we’ll check in on you guys.

Nishant Doshi: Thanks a lot Alan and thank you.

Alan Shimel: All right. Nishant Doshi here from Propelo, that’s propelo.ai.

                                 We’re going to take a break on Techstrong TV. We’ll be right back.

[End of Audio]

February 3, 2022
Low-Code SaaS Solutions Need Security at Their Core
Faster integrations. Accelerated software delivery. Elevated user experiences. These are only three of the benefits organizations gain by incorporating low-code platforms, apps and solutions into software development and business process management.

Low-code platforms aren’t new, but demand for the technology soared in the last two years as companies were challenged to meet stakeholder demand for more digital transformation. With low-code tools, companies find they can expand digital transformation efforts through faster business application delivery. In addition, the time it takes to innovate is dramatically reduced with low-code tools.

Low-code solutions are no passing trend. In their recent report on global cloud revenue, Gartner predicted that by 2025, the use of low-code and no-code will “nearly triple,” adding that “70% of new applications developed by organizations will use low-code or no-code technologies, up from less than 25% in 2020.”

Low-code solutions give organizations the ability to produce working solutions and integrations with more speed and agility than more traditional on-premises development. Integration used to be a labor-intensive IT process requiring custom development on both sides of the integration. As more organizations adopt a “buy versus build” approach to software development, they are turning to self-service and other solutions with “out of the box” functionality to increase speed and efficiency. In addition, the vendor-developed components of low-code tools also offer a better user experience.

Rising Demand for Low-Code, Platform-based Solutions

As organizations expand their product and service offerings, the demand for low-code, platform-based solutions will increase. SaaS and PaaS solutions with a low-code focus can be effective for organizations looking for accelerated functionality. Often these tools include pre-built models and templates that businesses can quickly implement and easily duplicate for flexibility and versatility.

The ability to create seamless integrations with other applications is a must. Best-of-breed low-code platforms enable intelligent integration between multiple applications using graphical user interfaces (GUI) as well as industry-standard interfaces such as JSON and APIs within vendor-supplied environments. Intuitive visual user interfaces and drag-and-drop features allow businesses to customize the solution to meet their needs and preferences.

But along with ease of use and rapid functionality, organizations must look for low-code tools with security built-in.
Security: A Priority for Low-Code Tools

Security must be a top priority for organizations using low-code tools in any capacity, from using a low-code platform for application development or using a no-code SaaS solution for business process automation.

Anytime an organization introduces outside applications or any third-party API integration to an environment, the organization is entirely dependent on the vendor’s security implementation. This is especially true when combining various solutions to create a unified product or service. If the vendor doesn’t take security seriously, other parts of a solution could be exposed to risk because of a weakness in another area.

Problems can get in either intentionally or unintentionally, as demonstrated with the recent Apache Log4j vulnerability. The bug in this commonly used routine was found to have massive potential for cybersecurity attacks. As CNET cautioned, “The vulnerability in the widely used software could be used by cyberattackers to take over computer servers, potentially putting everything from consumer electronics to government and corporate systems at risk of a cyberattack.”

Ways to Remedy Security Risks of Low-code Tools

Organizations can’t make assumptions about the security of every tool, solution or platform they bring into their environment. They must complete their own due diligence for security in the software development pipeline or any time a 3rd party app or tool is introduced.

One critical step to addressing security is incorporating DevSecOps and shifting security left in the software development pipeline. The Log4j vulnerability put the need for DevSecOps in the spotlight. Taking a shift left approach and implementing security earlier and more often in the DevOps process can help to catch more potential vulnerabilities. It’s critical to introduce DevSecOps early in the development cycle, or organizations risk missing a bug or vulnerability. In the development cycle, security isn’t an antivirus scenario; all code must be scanned for vulnerabilities.

Organizations also need to employ due diligence when exploring options and solutions to bring into their environments. Look for solutions with security at their core. Before integrating any low-code solution, examine the vendor’s approach to security.

Some security measures to look for when considering vendors or solutions include:

Ensure they’re using the latest OAuth/2 models for both client to server security as well as server-to-server security or an equivalent standard.
All communications should utilize at least TLS 1.2 (transport layer security) and comply with industry standards for certificates and encryption keys.

All hashing should be using current accepted standards with HMAC, they should be enforcing security rules on passwords such as only storing password hashes and requiring 2FA if they interact directly with customer accounts.

Low-code platforms and tools have the ability to accelerate digital transformation efforts without having to rely on hand-coded, on-premises solutions. The potential for time savings and cost savings is significant, but it’s important for organizations to ensure they’re not compromising security when choosing solutions.
January 14, 2022
Low-Code/No-Code and Simple APIs

In recent years, implementing AI and IoT technologies has been top priority for many organizations as their leading-edge capabilities have become a requisite for digital transformation – but the speed of their adoption is greatly influenced by the flexibility of supporting software. Enter low-code, no-code programming and truly open APIs.

Low-code/no-code platforms are a promising alternative to traditional software platforms for non-technical business users; a more democratic approach to software development, built on either no or minimal code. The approach begins by minimizing external expenses and time required by outside developers or programmers as business analysts and line managers can now structure new process flows and functionalities.

This is coming into sharp focus, as the increasing need to get new applications to market quickly is coupled with a growing demand for digital transformation from the C-suite. But to access the benefits, organizations must ensure that their underlying software can integrate well with external systems—introducing application programming interfaces (APIs).

Low-Code/No-Code – The New Focus

Analyst predictions have revealed an industrywide trend geared towards these platforms, as 60% of CIOs are set to employ low-code/no-code tools by 2025, with plans to bolster their output capacity. Other analysts expect to see 65% of all application development taking place in low-code/no-code environments by 2024. But, it is the openness of APIs that will determine the success of this software.

APIs have reached new heights since the early days of component-based architecture, but today’s APIs are still inspired by Roy Fielding’s Representational State Transfer (RESTful) API.

APIs – Providing Essential Internal and External Openness

Some vendors will talk about how they have open APIs, but these are often limited and designed for specific, pre-determined integration scenarios. The application, in the meantime, internally communicates in a proprietary fashion that cannot be leveraged by external systems. To maximize the agility delivered by low-code/no-code tools, the entire application should be built on open APIs.

Enterprise applications can go a step further by relying on the ISO/ICE–approved OASIS Open Data Protocol (OData), making things even more interoperable with more choice, flexibility and capabilities for customers. When the application is built on the same set of RESTful APIs it exposes to other systems, it is even easier to access the precise spot in a value flow with which organizations need to integrate.

With the support of open APIs, there is an opportunity for companies to leverage low-code/ no-code tools and achieve crucial business returns in three ways:

1. Undisrupted Connectivity

A robust architecture built on RESTful Data APIs, documented according to the Open API Initiative specifications, gives organizations the ability to extend enterprise software on the outside to create task specific apps or connect to other systems.
This may simply be used for automating steps around onboarding a new employee; for instance, filling in a desk number in an office floor plan, initiating payroll activities and creating an Outlook account. It could also populate a serialized part structure from a machinery manufacturing process into the software that will be used to annually service that piece of equipment. Any data, action or event should be accessible in a clear and thorough API library.

With enough of these RESTful APIs, any number of low-code/no-code tools can be used to create targeted apps that interact with enterprise software and other systems running in a business. Commercial software offerings can be used to build an experience and drive processes in enterprise software.

2. Digital Transformation Accelerated and Uninterrupted

The main benefit of using RESTful APIs is that an organization’s external and internal systems can automate processes, expand access to data, and create extensions to their enterprise software on the outside. Regardless of whether an internal process automation (IPA) tool or external low-code/no-code process orchestration software is used, their ERP system should offer transparent access to the part of the system supporting any given integration or process automation.

Here’s where a low-code/no-code approach helps to develop new solutions and industry specific functionalities that can be built faster, cheaper and with higher quality. Integrating a low-code domain-specific language (DSL) into solutions not only helps create value faster, but also insulates organizations from future technology changes. The DSL describes the intent of what a component in the application (for example, an API) should do, rather than how it is technically done.

3. Increased Software Governance

Low-code/no-code tools are also more commonly used to tailor how enterprise software works internally, giving organizations more control over their software. Software providers might currently offer the ability to extend the data model or to tailor the user interface and user navigation flow through a process to an organization’s specific needs, using no-code tooling. But this is not enough.

Low-Code/No-Code: Go the Extra Mile

Enterprise software platforms should offer intuitive low-code/no-code tools that will not only automate process steps or actions, but add machine learning capabilities for intelligent process automation. This democratizes the creation of intelligent systems by putting it within reach of business analysts and line managers—a simple what-you-see-is-what-you-get.

Logical, Automated Processes

With the IPA capability embedded into software, any additional input needed from users can be captured automatically. These capabilities can then be further enhanced with intelligent parts, such as AI and machine learning models, to make choices inside the automation about what to do next (branching decisions), or predicting values to be filled in.

As the need to digitally transform continues to surge, enterprise solutions based on open APIs, strengthened by low-code/no-code programming, will become fundamental business tools—speeding up deployment times and delivering business value when it matters most.

May 4, 2021
Is Low-Code Development a Security Risk?
According to Gartner, the worldwide low-code development market is projected to be $13.8 billion in 2021, a whopping increase of 22.6% from 2020. Gartner also predicts that the surge in remote development during COVID-19 will continue to boost low-code adoption, despite budget cuts and efforts to optimize cost.

Low-Code’s Popularity Among Professional and Citizen Developers

Low-code is no longer the new kid on the block. From simple dashboards to complex applications, low-code applications are becoming more and more diverse, with mainstream adoption in the enterprise world. In essence, low-code is a visual paradigm of application development that involves drag-and-drop of pre-built components and integrations resulting in fast, easy and less-error-prone development.

The advantage of low-code is that it enables users from a non-traditional development background to participate in the app development process, thus democratizing development and accelerating project timelines. It also narrows the demand-supply gap that arose as organizations catered to ever-rising digitization needs with limited resources and developer scarcity. Many low-code platforms make it easy for citizen developers (business analysts, line-of-business users, junior developers, for instance) to build applications while drastically reducing delivery time compared to traditional coding methods.

But citizen developer productivity and speed are not the only benefits of low-code development. Today, low-code platforms also come with capabilities purpose-built for professional developers from enterprise IT teams to ISVs. These platforms are hardened for enterprise use, are able to leverage the scalability and security needs of a complex application and have integration capabilities mature enough to seamlessly fit in with existing tools and technologies. During the COVID-19 pandemic, many businesses reinvented themselves through adoption of low-code platforms and applications that helped them adapt to the sudden shift to a remote work scenario and enable the necessary modern application needs that came with it.

Security Challenges with Low-Code and Remote Work

Compared to traditional development, low-code involves a variety of personas working together to build applications while dealing with automatically generated code, ready-made components and built-in default configurations. This shift in environment revealed some unique challenges that need to be addressed. There are a few common security challenges with remote teams building on low-code.

Application Development and Remote Team Collaboration
- Lack of security awareness: Low-code users come from both business and tech backgrounds. Some practitioners aren’t familiar with application security best practices and lack awareness and understanding of potential vulnerabilities and security holes.
- Platform access and admin controls: Low-code is deployed centrally and available for users across an enterprise via browser access. This introduces a risk of network intrusion; providing access to unauthorized developers and opening up greater permissions to users that do not need it when accessing the platform remotely.
- Code repository and team collaboration: Low-code platforms must ensure that the automatically generated code can committed to enterprise-sanctioned repositories. This code access shouldn’t be misused, and ought to have sufficient protocols in place for code control and upgrades.
Code Generation and DevSecOps Best Practices
- Securing custom code: Low-code tools allow for writing custom code to extend and enforce platform coding guidelines and design patterns to protect sensitive data from unauthorized access.
- Adhering to secure release practices: Integration with the existing enterprise CI/CD pipeline is important so that dev teams can extend the same release governance protocol to the auto-generated code before going to production.
End User Application Access and Data Protection
- Preventing malicious attacks: Today, both web and mobile apps are becoming constant targets for security breaches. Automatically generated code, and citizen developers working remotely, can make low-code applications more prone to vulnerabilities. Platforms should generate apps that are fully protected against phishing attacks, SQL injections, brute force attacks and DOS attacks.
- Secure data and application access: Low-code platforms should provide a comprehensive access control mechanism preventing unauthorized access to data and app functionality. With remote teams accessing apps from anywhere, at any time and from any device, data breaches can be prevented with the right controls in place.
Low-Code and Security – The Future of Development

As enterprises and ISVs turn to low-code for more serious use cases, the larger question still remains. Can low-code platforms enable modern development teams to deliver applications faster, while still enabling a secure and tightly governed environment?
The answer is, yes, they can! However, development teams must consider the following security checklist when considering low-code platforms:
1. The chosen low-code platform must be set up within an enterprise secure DMZ or secure private cloud, and must effortlessly pass cybersecurity clearances.
2. The platform must enforce best practices in programming (coding conventions, design patterns and data encryption) for automatically generated code as well as custom code written by the developer, facilitating easier integration with existing CI/CD processes and tools.
3. The platform must offer full protection against the top 10 OWASP vulnerabilities for web and mobile apps, and have third-party certifications to guarantee code quality and security. Also, organizations should ensure that there are no vulnerabilities in their chosen platform’s binaries, as well as all third-party dependencies (including open source libraries) as listed in the CVE library.
4. The solution must support multiple authentication providers (database, LDAP, AD, SSO, SAML, Open-ID, multifactor, biometric) to build applications with strong user security. For user authorization, ensure support for both coarse-grained as well as fine-grained access control policies to protect various aspects of the application based on RBAC.
Development teams can embrace low-code technology while ensuring security best practices are in place. Low-code is here to stay, and with the right platform, enterprises and ISVs can make sure security is shifted left and addressed by developers much earlier in the development process. The result is a highly productive, remote workforce churning out applications that are modern, scalable and secure.
April 26, 2021
Low-Code Automated Software Testing Drives DevOps

The DevOps world has quietly turned its focus to solving an essential challenge: enabling software teams to innovate quickly while meeting high customer expectations for quality. In other words, to build useful things faster with fewer mistakes. This tension has been growing for years, but 2020 added the challenges of remote work and accelerated digital transformation to the continued disruption brought about by cloud, SaaS and DevOps. In 2021, we need a road map for taking test automation to the next level with quality engineering, a discipline that incorporates best practices and data-driven testing into the end-to-end customer experience and drives organizational growth.

Rethinking the Quality Process for the DevOps Era

Quality engineering (QE) has traditionally lacked the tools needed to keep pace with digital transformation. Many QE teams struggle with complex, brittle automation frameworks and slow manual testing which create serious bottlenecks to DevOps adoption. While development accelerates, QE is left with disparate or outdated workflows and toolsets.

Rising to the challenges and opportunities presented by DevOps and digital transformation will require innovation in our approach to quality. More than ever, we need to shift our focus away from quality assurance as a task that you perform late in the software development life cycle (SDLC) in favor of quality engineering practices throughout the entire life cycle. It starts with broad, effective test coverage – beginning when your developer is working on a local branch and continuing until a high-quality customer experience is confirmed in production across the entire surface area of the application – web, API, mobile, email, PDF or otherwise. It also goes deep; you evaluate all aspects of quality, ensuring that you satisfy requirements related to functional correctness, accessibility, performance, user experience and more.

Low-Code Test Automation Unlocks a Culture of Quality

With low-code, genuinely effective testing is at the fingertips of every role, from manual testers to developers, automation engineers, product owners and customer support. Requiring all of these roles to develop specialized programming skills is impractical, so low-code tools serve to democratize quality engineering by enabling everyone to participate in authoring tests, updating tests, and gaining insight from test results.

Low-code testing brings several advantages to quality engineering, particularly in the transition from manual testing to automated testing. While traditionally this process would create major disruptions, low-code platforms are smoothing the way. In their IT Automation predictions for 2021, Gartner expects that by 2024, improvements in automation capabilities will refocus 30% of IT operations efforts from support to continuous engineering. For manual testing teams, that shift would likely trigger talent changes and a long process of pilot projects, retraining, and gradual rollouts. Low-code is key to managing this shift, upskilling workers and ensuring quality throughout.

Modern Automation Solutions Embrace Rapid Change

A key challenge with traditional test automation tools is that they were designed for applications that didn’t change frequently and were intended only to validate code. They relied on static selectors to identify page elements. If the selector (say, an ID) changed or objects (the XPath) moved on your webpage, then your tests failed. As more enterprises accelerated development via DevOps, Agile and CI/CD, the burden of test maintenance resulted in the same bottlenecks as manual testing.

2020 was a breakout year for low-code test automation. New, easy-to-use solutions surpassed the capabilities of legacy frameworks that have dominated the sector. These solutions incorporate machine learning, data analytics and other advanced technologies to greatly reduce the burden of test maintenance and overcome the test rigidity challenges of legacy frameworks.

With AI and machine learning, test automation solutions are trained by a tester simply navigating their product. As the tester moves through common customer journeys, the solution builds an understanding of each element and its context so that if an element moves or a property changes, tests containing that element are updated without human intervention. This drastically reduces the amount of maintenance required to ensure your tests are current. When tests do need to be updated, low-code models make it easy for anyone to jump in and make the updates. Looking ahead, auto-healing and low-code editing are crucial to supporting quality engineering in high-velocity teams.

Testing the Entire Customer Experience

Traditional pass/fail validation stops short of offering real insight into the user journey, a critical step effective quality engineering. The next generation of test automation platforms expands focus from validating code to validating the entire user experience. This starts with broadening testing to cover non-functional requirements, such as application performance, accessibility, and user experience. For example, identifying trends in load time for key pages and monitoring visual changes are done autonomously and essential to managing the customer experience. From there, you can prioritize quality efforts toward the components of your application that are most heavily used or highest risk. This enables you to make data-driven decisions about test coverage — focusing your testing efforts on high-priority pages like the checkout page for an e-commerce site, or high-risk pages such as those with multiple interactive elements that are linked from other pages, such as signup forms.

But even a fully data-driven testing strategy that only focuses on the app or website UI is unlikely to cover the full end-to-end user journey, resulting in test coverage gaps and potential pain points for customers. For example, a common user journey may include opening an email, clicking on a link, checking a web site, and downloading a PDF. Whereas the limitations of legacy tools relegates testing to the web portion of that journey, modern solutions allow you to validate the entire user or customer experience (CX): receiving and opening an email, clicking on the link, logging into the web site, downloading the PDF and verifying its content. It’s even possible to confirm values in the backend via API – all without writing a line of code. Developing the tools to seamlessly monitor, repair, and manage the expanded CX is central to our innovation and to our customers’ success.

Quality Engineering as User-Centric as You

Quality is no longer an afterthought or just a box to check before deployment; it’s an essential part of the user experience, and therefore an essential part of maintaining a competitive advantage in every industry that uses software to serve customers. Test automation is critical for high-velocity teams racing to innovate faster, shift to DevOps, and build quality products while working remotely. Thankfully, a growing number of quality assurance teams are getting a seat at the table as DevOps is implemented, elevating the profile of quality as a strategy and growing demand for test automation solutions that can keep pace with the demands of DevOps.

In response to this demand, a new generation of intelligent test automation solutions is enabling teams to rise to the challenge by embracing low-code and machine learning to maintain quality. To build a culture of quality engineering in this environment, your team needs test automation solutions that are as user-centric as you are: solutions that provide coverage across the entire user journey. Solutions that not only verify functional correctness, but provide rich insight into all aspects of quality and enable continuous improvement. Perhaps most importantly, you need solutions that enable everyone on the team to participate in quality. This ensures that the entire SDLC actively participates in building user-friendly products that continue to set the standard for quality at the speed of DevOps.

April 19, 2021
How Low-CodeOps Can Transform DevOps

Over the past year, enterprise adoption of low-code software development platforms surged across the world economy as COVID-19’s economic consequences drove an unprecedented number of digital initiatives. Enterprises are turning to low-code platforms to rapidly build new apps that empower customers, remote workers and external end users conducting business operations or pivoting to new opportunities.

Accelerating software development, however, only solves half the puzzle of a digital-first approach. Quickly getting solutions into users’ hands requires careful planning to determine how these new applications will function within the organization’s overall software operations strategy. This is often conducted across multiple cloud deployments.

But the real prize comes when low-code’s underlying principles of automation and abstraction are extended into the DevOps domain of software maintenance and management. The ability to push out a continuous pipeline of software updates with the click of mouse, with streamlined testing and quality assurance, requires a platform that automates myriad, time-consuming tasks associated with building, testing, releasing and maintaining applications in an enterprise-grade production environment. This inevitably leads to the concept of “low-code operations;” or, to coin a phrase, “Low-CodeOps.”

Indeed, unless the benefits of abstraction and automation — in this case, primarily speed — extend to operations and deployment, the real benefits of low-code development are elusive. A platform that lets you build an app in six days but requires six months to deploy is no solution at all.

Harnessing the Cloud for Game-Changing Results

To witness the vital role seamless cloud operations played in business innovation, look no further than biotech giant Moderna and its success in Operation Warp Speed. Moderna used the public cloud to pull together geographically dispersed collaborators, integrate scientific insights and refine its production cycle, enabling the company to deliver its first batch of mRNA vaccine samples a mere 42 days after the COVID-19 virus genome was sequenced. The time-to-value for this solution was definitely warp speed.

And, it’s safe to assume, expensive. Cloud engineers and DevOps system administrators are highly skilled specialists who roll up their sleeves at 2 a.m. to fix unexpected glitches buried deep in the connected ecosystem of software operations. They figure out how to make the software actually run. Enterprises, no doubt, wish they could hire more of them.

But the same shortage of skilled IT professionals that fueled today’s demand for low-code software development also impacts DevOps. In this case, the same low-code platform is the solution, empowering a wider cross-functional, collaborative team to reduce operational burdens — in a word, Low-CodeOps.

Essential Features of Low-CodeOps

To achieve a frictionless handoff when moving applications and data to the cloud, a production environment leveraging low-code principles will deliver on these key principles of low-code operations:

Performance monitoring: Daily monitoring and log checks of platform infrastructure are the backbone of modern DevOps operations, ensuring that complex interdependencies are running smoothly. Automated dashboard monitoring can transform hours spent on these repetitive tasks into opportunities for engineering teams to focus on innovation, while still ensuring the health and performance of enterprise software portfolios. The tooling needs to enable automated end-to-end visibility into application workloads and performance characteristics of upstream and downstream services.

Compliance: Every economic sector is subject to specific government regulations. Software platforms and DevOp teams must keep track of every requirement when integrating new functionality into software upgrades. Banking customers must deploy digital solutions on infrastructure that’s earned ISO/IEC 27001 certification. Healthcare solutions must conform to federally mandated HIPAA requirements. Defense contractors must be FedRAMP certified. Data—the lynchpin of any digital solution—is subject to privacy laws that differ across nations and borders. Imagine having to manually recheck every iteration of your application deployments for compliance. Luckily, low-code operations mean having an automated, system-wide compliance framework in place. This makes short work of service organization (SOC) audits and reporting.

Security: Cyberattacks that lead to system outages and disruptions are a growing concern in our digitally connected world. Well-resourced cloud giants are not exempt from damaging cyberattacks, such as last year’s SolarWinds hack. Resilience is key. Ongoing security scanning can halt automatic software deployments when suspicious changes are detected. Prevention is always best. Monitoring tools identify vulnerabilities, enabling systems to quickly come back online and help prevent outages that can last for hours or days.

Infrastructure independence: Widespread enterprise adoption of multi-cloud and hybrid cloud for operational efficiencies has made flexible infrastructure the new standard. Organizations are bypassing single-vendor lock-in to spread workloads across multiple cloud partners. That means DevOps needs streamlined configuration and management tools that can track relationships between resources and keep track of compliance issues. Geopolitical considerations may enter the equation when cloud providers turn out to have close ties with governments antagonistic to other global trading partners. Monitoring instruments that provide observability across the range of vendors consuming enterprise data and applications is mission-critical.

Resilience: Snafus happen. Platforms can automate continuous domain-level metrics to correlate performance from different sources (including logs, metrics, application tracing and outside penetration testing), speeding up detection and response time. Fast auditing and debugging tools, combined with real-time dashboard monitoring and system-wide alerts, plus an ounce of detection, equals a pound of cure. For agile DevOps teams, reactive firefighting is transformed into resilient firepower.

Adopting an All-in-One Low-CodeOps Approach

Low-code’s power to enable frequent iterations of software ideation, creation and deployment may seem contrary to the DevOps mission to minimize risks. However, the same radical abstraction and automation that has made software development faster, higher quality and more accessible to a larger cohort of developers can also reduce the operational burden of landscape management. Every low-code vendor touts the governance features in its platform. But the nuts and bolts of governance require some assembly, including system-wide actionable monitoring, testing alerts and compliance safeguards. Low-CodeOps combines the most efficient, agile, flexible development platform and powerful, streamlined operations tools, infusing both domains with solid guardrails for operational control and predictability. Adopting this approach will greatly increase time-to-value for enterprises, putting innovative digital solutions directly into the hands of end-users with the click of a mouse.

April 9, 2021
Low-Code and DevOps: Friends or Foes?

What does low-code mean, and who is it really for?

Over the last few years, I’ve seen many articles associating “low-code” with “citizen developers” or with people who don’t have deep development skills. Users can arrange visual elements, or fill in forms with key information and publish the result as an application.

But tools for citizen developers are only one part of the low-code story. There is also a growing number of tools for professional developers, and I want to talk about those, too.

Both citizen developers and professional developers have a role to play in application development and automation projects, and low-code has something to offer both of them.

Low-code is Not a Market, it’s an Approach

Low-code does mean providing visual and graphical tools and simple frameworks that mask more complex coded operations, so the application designer does not have to directly touch the code that performs desired operations. These apps are naturally limited, as the resulting application can’t be highly customized if you can’t touch the code.

With these kinds of visual tools, anyone can create a simple application within the limits of the tool. But when we pull back and look at what is needed to create larger, more complex applications – ones that need to communicate with other enterprise systems, or need extensive customization, or cross organizational boundaries, or need to pay attention to governance requirements, for example – the visual-only approach is frequently insufficient. In complex cases, developer expertise is often needed, and developers have to get “under the hood” to tinker with code.

There is no “low-code market.” We are bringing tools to people who need them to develop specific projects. A comprehensive low-code approach to application development and automation means offering both visual programming and coding capability. For usability reasons, these tools are clearly separated and presented to the development team in a way that allows citizen developers to work on certain elements and developers to work on others, all on the same platform.

We know that it’s possible to serve professional developers with low-code, too. A low-code approach also includes drag-and-drop tools that developers can use – for example, to develop APIs, or to integrate the application with other systems, or to customize front-end interfaces. Of course, when code is required, developers should be able to use their own tools and frameworks and not be limited by low-code tools. Platforms that offer a hybrid approach are likely to be most useful to mixed-skills development teams.

The Hybrid Approach

Strictly low-code tools can serve simple automation use cases. More broadly, automation platforms offer a hybrid of low-code and coding capabilities for more complex automation use cases.

For critical enterprise applications, both business and developer inputs are usually needed. Having tools for both of them means not leaving anyone out.

Low-code tools will continue to become more mainstream. Low-code is not a fad or a passing trend, but a quiet revolution that will see greater incorporation into more business tools.

Here Come the Digital Natives!

More vendors are offering low-code tools for digital process automation, business intelligence, robotic process automation, identity management and data integration, to name just a few.

As automation platforms and other low-code tools mature, a greater number of people are getting used to working with them. Developers are less hesitant about incorporating non-developers into their teams, as everyone gains a better understanding of the benefits of these platforms.

The younger generations entering the workplace today are digital natives. They are fearless about diving into technology and working hands-on. So, these low-code tools are ready for them, and they are ready to put them to work.

Low-code is breaking down technical barriers to work in the automation space, making smooth collaboration between business and development easier.

Low-Code Can Be a Double-Edged Sword

Automation and development teams are also becoming more aware of vulnerabilities and compliance issues as citizen developers roll up their sleeves and join the technical team.

Low-code tools are a double-edged sword. They facilitate teamwork, but issues with security and data governance may not be top-of-mind for non-developers. If you have a big team working on automation and/or application development and delivery, the need to build in governance becomes even more important.

Using a shared platform will help manage and mitigate these issues with security and governance. This will become even easier as the platform tools evolve and mature, so DevOps teams can use them to help mitigate some of these issues.

Does Low-Code Have a Place in DevOps?

We are definitely seeing the impact of low-code on development environments and DevOps. Remember, low-code started with small applications, and while DevOps-style teamwork and workflows may not be needed there, as the use of low-code platforms becomes the norm for critical enterprise projects, DevOps will be a necessary part of the mix. This is where low-code is having a more obvious impact; Agile methodologies using low code platforms for iteration, for continuous improvement and for continuous delivery. These applications aren’t one-and-done. They need to be maintained, improved and delivered, again and again.

Low code isn’t going away. On the contrary – it’s going everywhere.

April 8, 2021