Category: Features

  • DevSecOps May Be Key to Prevent Data Leaks

    DevSecOps May Be Key to Prevent Data Leaks

    Data leakage has become something of a norm in the digital realm, despite the fact that cybersecurity budgets are growing and more engineers are assigned to these very issues. Nowhere does this seem more true than in the realm of health care, where breaches that expose sensitive patient data are, sadly, a fairly common occurrence. 

    A recent report by Approov illustrates how severe the problem has become. According to Approov’s  All That We Let In research report, many of the mobile healthcare applications in use today are leaking sensitive patient data through APIs, potentially compromising millions of patients. 

    The study tested 30 popular mobile health (mHealth) apps, and the research estimates that some 23 million mHealth users are exposed, at a minimum. The average number of downloads for each app tested was 772,619. Analysts expect that the total number of users exposed by the 318,000 mHealth apps now available on major app stores is likely far greater. Among vulnerabilities detailed in the report:

    • 50% of the records accessed contained names, Social Security numbers, addresses, birthdates, allergies, medications and other sensitive data for patients.
    • 50% of the APIs tested allowed users (medical professionals) to access the pathology, x-rays and clinical results of other patients.
    • 50% of the APIs tested did not authenticate requests with tokens.
    • Of the 30 popular apps tested, 77% contained hardcoded API keys, some of which don’t expire, and 7% contained hardcoded usernames and passwords. Seven percent of the API keys belonged to third-party payment processors that warn against hard-coding their secret keys in plain text.

    “Look, let’s point out the pink elephant out in the room,” said Alissa Knight, researcher and author of the report. “There will always be vulnerabilities in code, so long as humans are writing it. Humans are fallible. But, I didn’t expect to find every app I tested would have hard-coded keys and tokens, and all of the APIs to be vulnerable to broken object-level authorization (BOLA) vulnerabilities allowing me to access patient reports, X-rays, pathology reports and full PHI records in their database. The problem is clearly systemic.”

    The report helps to illustrate a critical point: Sloppy code can lead to data leakage. “These findings are disappointing, but not at all surprising. The fact is, leading developers and their corporate and organizational customers consistently fail to recognize that APIs servicing remote clients, such as mobile apps, need a new and dedicated security paradigm,” said Approov founder and CEO David Stewart. “Because so few organizations deploy protections for APIs – that ensure only genuine mobile app instances can connect to backend servers – these APIs are an open door for threat actors, and present a real nightmare for vulnerable organizations and their patients.” 

    For organizations deploying apps using a DevOps methodology, it becomes very clear that much more must be done on the cybersecurity side to prevent data leakage. However, the general consensus is that data protection falls under the purview of CISOs and cybersecurity teams in the enterprise. Perhaps there is no better argument for adopting DevSecOps than the data leakage problems caused by insecure code and sloppy APIs. The report echoes that sentiment and offers several recommendations for developers creating and organizations using mobile applications. In other words, organizations should take several key steps to protect their customer data and sensitive resources, including:

    •  Address both app security and API security: Recognize that synthetic traffic to the API is an issue, and arises from bots and automated tools, not from genuine apps and legitimate data requests.
    • Shift left and shield right: Secure the development process and harden apps, but ensure that runtime protection is also in place.
    • Protect against X-in the middle attacks: Certificate pinning is critical, but often left undone because expired certificates can block apps and impact customer experience. However, when done correctly, certificate pinning does not impact either performance or availability.
    • Improve visibility into controls: Organizations and developers need to monitor the effectiveness of the controls they implement and adjust them easily – both for compliance with legislative mandates and to sustain data security and privacy.
    • Continuous testing: Penetration testing and static and dynamic code analysis should be performed regularly.

    Interestingly, those recommendations fit squarely into the role that DevSecOps should take in the DevOps process. 

  • Grafana Labs Adds On-Premises Observability Platform

    Grafana Labs Adds On-Premises Observability Platform

    Grafana Labs announced today the availability of a unified Grafana Enterprise Stack that enables IT teams to deploy a curated observability platform, based on open source tools such as Prometheus, in their own on-premises IT environment.

    Tom Wilkie, vice president of product for Grafana Labs, said Grafana Enterprise Stack, in addition to providing a version of Prometheus optimized for distributed computing environments, includes curated instances of open source Grafana dashboards, Loki log aggregation tools and the Cortex query engine.

    Grafana Enterprise Stack also includes plugins for visualizing data from other commercial tools in Grafana, such as Splunk, New Relic, MongoDB, ServiceNow, Oracle and Snowflake. In addition, it includes reporting tools and enhanced authentication and security controls.

    Grafana Labs

    Developed under the auspices of the Cloud Native Computing Foundation (CNCF), Prometheus has gained traction as a monitoring platform used primarily in Kubernetes environments. However, Wilkie said it’s only a matter of time before IT organizations expand their use of Prometheus to include a wider range of platforms. The Grafana Enterprise Stack facilitates that transition by making it easier for organizations to deploy a complete observability platform based on open source software, said Wilkie.

    While open source software has a key role to play in enabling observability, most IT organizations today rely on a range of proprietary tools to monitor IT environments. Many of those tools will be replaced, in the months ahead, by observability platforms that provide more context than individual monitoring tools currently do. However, it’s not clear yet if IT teams will prefer open source or proprietary platforms that, in most cases, incorporate open source components.

    As IT environments become more complex, the tools most organizations rely on today don’t surface enough actionable insights. Most IT teams today still waste a fair amount of time navigating amongst multiple tools in an effort to discover the root cause of a problem. It’s not uncommon for IT teams to take days to discover the source of a problem that is then fixed in a few minutes. The expectation is that observability platforms will sharply reduce the amount of time and effort required to investigate, for example, a performance issue.

    Of course, to achieve that goal, applications themselves will need to become more instrumented. A mix of open source and proprietary agent software will make it easier to collect traces, logs and other metrics at a reduced cost. In many cases, IT teams have been reluctant to fully instrument an IT environment, because of both the cost of proprietary agent software and the inherent challenges associated with deploying and managing it across an extended enterprise. However, as the deployment process for agent software becomes more automated, organizations are finding it easier to instrument their applications.

    It may be awhile before IT environments are fully instrumented. However, as it becomes easier to collect traces, logs and metrics, the level of observability that can be achieved across an enterprise will undoubtedly increase. The challenge and the opportunity then becomes employing the greater visibility provided by these platforms to manage the sprawl of applications and platforms across IT more proactively.

  • DevSecOps Implementation: Patch Management

    DevSecOps Implementation: Patch Management

    Patch management has been a thorn in IT’s side for decades. While it is undeniably necessary for security and stability purposes, the staggering array of patches that are available make managing them effectively nearly a full-time job – or a job better left to users. Few IT professionals want to be the “patch person,” and yet, nearly all IT professionals want their systems protected by the latest patches. No one wants to find out an intrusion was easily preventable via patching. It goes without saying that the SolarWinds attack has left quite a few IT departments scrambling for an alternate solution.

    The world of patch management has gone through several evolutions that we won’t cover in much detail here. Instead, we’ll focus on what’s available, what you should look for and where the market is headed. Suffice it to say that patch management as a practice has grown from an individual applying patches to servers and server apps while employees were encouraged to patch their equipment, to complex systems that manage the patching themselves, with IT oversight. Currently, patch management is often bundled with endpoint management, simply because many of the patches are going to end points (user machines and devices).

    Out of this growth have come several market differentiators that you should be aware of when looking into a way to manage the avalanche of updates the average organization is seeing.

    • Centralized or de-centralized? Increasingly, patch management is run on servers/cloud and pushes changes out to those machines/devices that need them, or agents on each machine manage updating themselves. Which is best for a given organization really varies. If a lot of machines are running at the edge of their capability, an agent running updates in the background might be too much to ask. In that scenario, a server-managed install environment is probably better. Conversely, if a centralized location to run updates from is considered an architectural weakness (because it requires access to the update pushing engine), agents might be the better plan.
    • OS support. We’re way past the days when single-OS solutions were considered useful. List the operating systems used in your environment, and choose a product accordingly. Most products on the market support Windows/Mac/Linux, but there are variances. First off, make certain your chosen product supports all three. Then ask, “Which flavors of Linux?” Make certain the flavors running in-house are supported by the software.
    • App support. There are a lot of applications out there. Which are supported by the tool? How much leeway does the customer have for adding applications by pointing the tool at update locations? Does it support FOSS updates? There are a lot of those too, and which ones matter. Make certain the tools the organization uses are supported or can be added.
    • Many tools will scan machines for update issues. Understand what your chosen tools scan for, and how the scans impact performance on the target machines.
    • Updates are not 100% perfect. There will inevitably be problems. Make certain the tool can roll back changes. Updating 50 core infrastructure machines, only to find, hours or days later, that the update breaks something demands roll-back capability.
    • Inter-relationships. Updating a piece of software can require that another piece of software or a driver be updated, which can demand that UEFI/BIOS be updated. Or the CMOS on a RAID controller. Understand how cascading updates are handled by the tool, and if the cascading updates can be packaged, so that a failure automatically rolls back the updates applied thus far.
    • Approvals. Speaking of driver and BIOS updates, what tools are available to allow a human to approve changes? No one wants willy-nilly updates to the drivers on core systems – or even to drivers on user systems.
    • Security of the tool itself. We’re in perilous times where IT security is concerned, and frankly, an update command-and-control server is an attacker’s dream machine – take it over, put your back-door update into the mix, and tell it to update every machine it manages. It cannot be understated: an update management tool must be as protected as possible – both by the customer locking down the installation and by the developer making sure the code is solid.

    Once the system is chosen and worked into your DevSecOps environment, updates will be more responsive, which leaves one more thing to consider – does it feed into your agile tools? If the update management tool notifies a project management tool like JIRA when it updates a server, then if code on the server breaks, the developers aren’t in the dark about changes, and will have breadcrumbs to help them track down the source of the problem.

    Imagine if manual updates became a rarity instead of the norm. There is a cost associated with this process, but most of the products on the market can be had for a reasonable price – if you waste a couple hours a month (or for some products, a year) on updating, they’re paying for themselves. Of course, your time is a sunk cost, and the cost of these is an operational cost, so there is an evaluation your organization will have to undertake. Given how busy everyone in DevOps and DevSecOps is, it is likely worth the investment for all but over-staffed organizations. What? There are a few!

    Find what suits your organization, and put it to use. Faster updates, less time investment. The idea is sound, you just need to figure out what suits your needs. And keep rocking it. You are managing updates already, this is just a way to make your life easier. And we could all use a bit of easier in a busy, complex IT environment.

  • Survey: Fixing Bugs Stealing Time from Development

    Survey: Fixing Bugs Stealing Time from Development

    A global survey of 950 developers published today finds more than a third (38%) of developers spend up to a quarter of their time fixing software bugs, with slightly more than a quarter (26%) spending up to half their time fixing bugs.

    Conducted by the market research firm Propeller Insights on behalf of Rollbar, a provider of artificial intelligence (AI) tools to detect software errors, the report also notes that 88% of developers find traditional error monitoring tools are not meeting expectations.

    Daniel Day, vice president of marketing at Rollbar, said the survey makes it apparent that continuing to rely on manual processes to surface errors in code is having a major downstream impact on both DevOps teams, in particular, and the business as a whole.

    For example, nearly nine in 10 developers (89%) also noted that undetected errors take a big toll on the business. More than one-fourth (26%) of developers also said that their employers have lost a significant number of users due to errors in software. The same share (26%) said software errors damage their company’s reputation and its ability to attract investments, and nearly a fifth (18%) said that undetected software problems anger their company’s investors.

    Nearly a third (32%) of developers said they spend up to 10 hours a week fixing bugs instead of writing code, while 16% said they spend up to 15 hours a week. Another 6% said they have to dedicate up to 20 hours a week fixing bugs instead of writing code.

    More than half of developers (55%) said that if they didn’t have to spend so much time fixing bugs, they would have the time to build new features and functionality. Many of these errors are not addressed because current tools require them to manually respond to errors (39%); it takes too long to find all of the details they need to fix bugs and errors (36%); focus on system stability and not enough on code health (31%); make it difficult to detect errors (29%); and have an approach to error aggregation that is either too broad or too narrow (23%).

    Nearly two-thirds of developers (62%) said they have found out about errors from users reporting through the application, while a quarter (25%) said that they have heard about errors from users sharing these issues on social media. Another 17% said media coverage clued them in about errors in their software, while more than a fifth (21%) said they heard about them from their CEO.

    Nearly a third of the survey group (31%) said that manually responding to errors makes them feel frustrated, while more than a fifth (22%) said they feel overwhelmed when using manual processes to address errors in software. Nearly as many (17%) said it leads to burnout. More than a tenth (12%) said it elicits feelings of resentment, and 7% said it makes them want to quit their jobs.

    Nearly two-thirds of all developers said they would rather do an unpleasant activity than fix errors, including pay bills (26%), go to the dentist (21%) and spend time with in-laws (20%).

    Rollbar clearly has a vested interest in convincing developers to increase reliance on AI to surface errors in code. The productivity paradox holds that, the more application code developers write, the more time they spend fixing existing code than writing new code. Most developers have a lot better things to do with their time than manually combing through lines of code looking for those errors. In fact, the problem is, many of them simply don’t have the time required to catch all the issues before an application makes it into a production environment.

  • LinearB Aligns with Clubhouse to Advance Project Management

    LinearB Aligns with Clubhouse to Advance Project Management

    LinearB, a provider of an analytics application for software delivery projects, announced today it has allied with Clubhouse, a provider of a project management application that includes built in collaboration tools.

    LinearB’s analytics application uses code, Git logs and releases to automatically construct and visualize detailed timelines without requiring any manual input. That data can now also be automatically fed into the Clubhouse project management application.

    Dan Lines, COO, LinearB, said the goal is to make it possible for any project participant to keep track of updates without spending hours manually compiling and entering data into a project management application.

    In addition, DevOps teams can use both applications to gain visibility into every feature, bug and chore via a live feed of activity generated by branches, pull requests and releases for Clubhouse stories. Along with tools for tracking individual activity and collecting metrics, blockers, delays, high-risk code and branches merged without review for Clubhouse stories are also highlighted. There is also a shadow work detector that detects activity in a Git repository that is not attached to a Clubhouse story.

    Lines said one of the project management challenges organizations face today is the tools they employ only allow them to see segments of a DevOps pipeline. The LinearB analytics application unifies the data and metrics required to make an informed decision, without having to first collect and then normalize data residing in different tools. Instead, all the metrics required to make an informed decision about how best to allocate limited software development resources is automatically collected from the tools the DevOps team employs, Lines said.

    There is no need, then, for project managers to pester members of a DevOps team to enter data in a separate analytics or project management application, Lines added. Given the rate at which application development projects are now updated, much of the data manually entered into a project management application is usually outdated, anyway.

    LinearB employs the application programming interfaces (APIs) exposed by DevOps tools to gather the existing metadata about the status of any given project. LinearB then employs machine learning algorithms to construct and correlate that data to give DevOps leaders more accurate insights into the status of a project, instead of requiring that data to be entered manually.

    In fact, Lines said meetings should be shorter, too, because rather than the need to provide a status update, it will become apparent to everyone what the real status of a project is before a meeting even starts. That means more time can be allocated to determining how best to optimize limited application development resources, Lines said.

    In the wake of the COVID-19 pandemic, organizations have more application development initiatives underway than ever. Many of these projects are core to digital business transformation initiatives which a core group of developers are working on simultaneously. Being able to dynamically reallocate resources to a faster-moving project from one that is stalled is increasingly critical. The challenge has been that the more projects there are, the harder it becomes to collect data that accurately reflects their true status at any given time. The goal should be to eliminate the need to reenter data that, in one form or another, already exists in another tool.

  • ZeroNorth Adds Analytics App to Advance DevSecOps

    ZeroNorth Adds Analytics App to Advance DevSecOps

    ZeroNorth today added an Advanced AppSec Risk Analytics module to its platform for orchestrating DevSecOps processes.

    John Worrall, ZeroNorth CEO, said the analytics tool pulls vulnerability data generated by a variety of security tools to provide both DevOps and cybersecurity professionals with a single source of truth for assessing security within an application environment.

    The ZeroNorth platform is designed to enable IT organizations to orchestrate multiple vulnerability scanning tools within the context of a larger DevSecOps workflow, and can apply analytics to a large pool of security data. That data can be viewed in the context of specific groups, such as a business unit or specific application development and deployment team, or within the context of whichever application generates the most revenue for the business, Worral said.

    Additionally, the Advanced AppSec Risk Analytics module will surface types of vulnerabilities detected and the vulnerabilities most encountered, ranked by criticality, along with other trends in types and number of vulnerabilities detected/remediated, such as the number and criticality of vulnerability findings per specific scanner. It also tracks the applications and entities scanned, number of vulnerabilities detected per application/entity and the applications/entities that have the highest risk.

    ZeroNorth

    Armed with that analytics data, Worral said it becomes easier for IT teams to prioritize and focus their efforts, in addition to identifying areas of the business that may need additional cybersecurity resources and training. IT leaders can also get a snapshot view of the top application security risks to better assess the organization’s overall security posture, Worral noted.

    The Advanced AppSec Risk Analytics module will also surface vulnerability remediation bottlenecks spanning multiple applications within the context of a software development life cycle (SDLC), Worral added. Longer term, Worral said the data collected by the ZeroNorth analytics application will also create an opportunity for the company to apply machine learning algorithms to DevSecOps.

    In general, Worral said the only viable path toward achieving DevSecOps is to foster more collaboration between developers and cybersecurity teams. Getting those teams on the same page in terms of the security data that needs to be analyzed is a crucial first step, Worral said.

    It’s still early on in the adoption of DevSecOps best practices within organizations, however, it’s apparent a lack of cohesion between software developers and cybersecurity teams about which vulnerabilities to prioritize is a major source of dysfunction. Cybersecurity teams tend to create long lists of vulnerabilities discovered within applications without providing much context. Developers are then left to weigh, on their own, when to address a vulnerability versus focusing on writing additional code needed to make an application delivery deadline. Developers take potential vulnerabilities seriously, but there are only so many hours in a day to write code.

    Unfairly or not, developers are being held more accountable for application security. The challenge – and the opportunity – is to find a way to make the entire DevSecOps workflow a whole lot less contentious by helping DevOps and DevSecOps teams more aware of which tasks should be prioritized when.

  • Open Source Advocates Want Share of Wealth

    Open Source Advocates Want Share of Wealth

    The egalitarian spirit of the open source community might be starting to fray as individual developers begin to question who is really benefiting most from their efforts.

    A survey of 4,440 developers who actively participated in open source projects in 2020 finds more than half (54%) of respondents said they feel that individuals should be paid for their contributions to open source projects. The report, conducted by DigitalOcean, a cloud service provider, finds only 14% of respondents are currently paid for their contributions.

    Developer opinions vary, depending on age group, about whether individuals should be paid for their contributions to open source, with those between the ages of 18-25 being more likely to be in favor (60%), while only 34% of those aged 55 or above agreed.

    “A lot more people want to be compensated,” said Raman Sharma, vice president of product marketing for DigitalOcean. “That may mean there will be a need for more sponsorships by vendors.”

    The DigitalOcean report arrives just after Elastic announced it is changing the licensing terms under which it makes Elasticsearch available. Elastic is shifting away from an Apache license to a dual license strategy that includes a server-side public license, or SSPL, along with a proprietary Elastic license. That shift was made to help ensure more of the revenue generated by Elasticsearch winds up in the hands of Elastic rather than cloud service providers, such as Amazon Web Services (AWS), that routinely launch paid services based on open source code. AWS responded to the Elastic move by announcing plans to fork Elasticsearch code that it will now curate.

    Nearly half of respondents (47%) to the DigitalOcean survey said they think technology companies should fund the payment of open source contributions, while a quarter (25%) believe project owners or individuals should pay.

    Discontent among startup vendors has been building for months. Startups typically are backed by venture capitalists, and make their software available as open source code in an effort to build a customer base on the strength of their support services. Cloud service providers have discovered they can take the code these vendors create to launch their own service. Those cloud service providers may contribute code to the project, but the startup vendor doesn’t typically enjoy any of the economic benefits.

    In most cases, the open source code used by the cloud service provider comes from a small cadre of developers that work for the startup company. Most of those startup companies are hoping to build a community around their code that includes individual contributors, external to the company, to help defray those costs. In fact, that business model has contributed to open source projects’ role as one of the primary drivers of IT innovation in recent years. If more independent developers demand to be paid for those efforts, the innovation rate of open source projects is likely to slow. The labor required to support those projects simply won’t be as freely available.

    In contrast, massive open source projects, such as Linux, have already reached a level of sustainability that other projects can only dream of. The Linux community is still ruled by Linus Torvalds, who some say is something of a benevolent dictator. Many of the contributors to Linux, however, are full-time employees working for vendors like IBM and SAP, which have a vested interest in the underlying open source platform.

    In contrast to the Linux community’s approach, the Eclipse Foundation, The Open Infrastructure Foundation (formerly the OpenStack Foundation), the Apache Software Foundation and the various arms of the Linux Foundation have stepped in to provide some level of independent governance for a wide range of open source initiatives, with mixed success. The Cloud Native Computing Foundation (CNCF), for example, as an arm of the Linux Foundation, has played a major role in spurring Kubernetes adoption. However, Google recently spurned the CNCF when it decided to create its own steering committee to oversee development of the Istio service mesh.

    Despite all the internecine rivalries and the potential for more forking of open source projects, overall, these projects are still viewed favorably. A survey of 3,400 developers, conducted by O’Reilly Media on behalf of IBM, finds 94% of respondents said they rate open source software (OSS) as equal to or better than proprietary software. Nearly two-thirds of respondents (65%) also agreed that contributions to open source projects impress potential employers and result in better professional opportunities.

    Of course, one of the primary reasons so many developers prefer open source is that there is no purchasing process for them to navigate.

    “Developers can move faster,” said Todd Moore, vice president for open source at IBM. “Programmers can move at the speed of light.”

    Regardless of motivation, it’s clear open source software isn’t going away. However, how it is built and exactly what is permissible under an open source license may soon vary much more widely from one project to the next.

  • Dual-Track and Low-Code’s Excellent Adventure

    Dual-Track and Low-Code’s Excellent Adventure

    Digital transformation can be a bogus journey. Here’s how low-code and dual-track transformation efforts can help.

    Large-scale enterprise digital transformation can take a while. Transformation initiatives like cloud migration, mainframe upgrades or refactoring monolithic systems could easily take five to seven years. Yet, this slow pace is at direct odds with today’s digital innovation standards and the pressure to release software rapidly.

    COVID–19 has amplified this drive to innovate, especially complicating matters for non-cloud-native companies, which struggle to attract and retain talent amid a developer shortage. Not to mention, developers are experiencing surmounting pressure to perform, which could result in burnout if not supplemented by new strategies.

    To maintain agility while diligently advancing multi-year digital transformation projects, some proponents argue for a dual-track approach. This approach uses low-code platforms to increase operational agility (the fast track) while digital transformation initiatives (the slow track) progress methodically on the side.

    I recently sat down with Jay Jamison, chief product and technology officer at Quickbase, to discuss today’s digital transformation concerns. According to Jamison, implementing a dual-track approach affords great rewards, but it requires an organizational cultural shift. He recommends establishing centers of excellence (COE) to evangelize low-code practices and encourage citizen development, enabling subject matter experts of lower technical acuity to automate operational workflows and operations.

    Dual-Track Transformation

    “Digital transformation is an important element for businesses of all sizes,” said Jamison. However, mainstream digital transformation projects, like rationalizing an ERP, moving to the cloud, or upgrading a network, can take an exorbitant amount of time and money. It’s hard for IT to meet business requirements. “We really need a second track of digital transformation — one that is more agile.”

    Jamison likens dual-track transformation to chipping out “small rock” projects from the larger digital transformation cliff. This strategy focuses on streamlining realizable goals in shorter timespans, empowering teams of people — with subject matter expertise — with tools to transform and digitize their workflows.

    Low-Code’s Role in Dual-Track

    A recent study conducted by Harvard Business Review found that 80% of executives “strongly agree” that a dual-track approach is essential for digital transformation. Yet, only 31% of companies have adopted said approach.

    To realize a dual-track process, Jamison recommends low-code for its “low-risk, high-throughput capability.” According to Jamison, low-code enables the edge of business to quickly adapt new solutions and run them in parallel with big rock digital transformation. For example, non-engineer government employees in a Texas county recently used a low-code platform to help distribute coronavirus vaccines.

    For a citizen developer culture to flourish, “you really need to have all hands in the pile,” Jamison said. IT stakeholders and business members must collaborate and work together to bring low-code to fruition. This process combines setting goals, outlining guardrails, and forming learning groups with progressive leadership at the helm.

    Introducing Centers of Excellence

    Naturally, many factors can affect IT innovation (leadership commitment, collaboration, organizational expectations, etc.). But arguably, the most common roadblock to digital innovation is culture. In fact, 45% of executives report that organizational structure is a major transformation challenge.

    That’s where centers of excellence (COE) come in. No, centers of excellence is not an archive of Bill & Ted’s adventures. COEs aim to fix the cultural barrier by encouraging progressive leadership, collaboration, and innovation. The Playbook for Centers of Excellence defines COE as “a concentration of expertise and resources in a specific capacity, designed to maximize the focus on a specific project.”

    A COE aims to foster shared understanding between IT leadership and business leadership. In Jamison’s words, “a center of excellence provides the ability to utilize low-code to sustainably build and empower applications in a safe, sustainable way.”

    Building a Most Triumphant Center of Excellence

    The COE goal is to empower business users to innovate. Yet, COE is a governance framework, which seems a bit contradictory. So, how does an organization go about implementing it? Well, there is a range of how companies adopt COE, but Jamison shared some common steps:

    Step one is establishing your goals. This could be increasing productivity, enhancing customer satisfaction or improving service reliability. Step two involves inviting the right people and perspectives — the key personnel to own the COE program.

    Next, develop transparent policies around security. This helps preempt concerns around data security and compliance. Finally, now that goals and rules are established, communicate the initiative across an organization.

    Throughout this process, investing in training is paramount. There are many project management philosophies for encouraging low-code adoption, but Quickbase recommends a training and education team to “roll out information and goals in a structured, targeted way”. They also encourage a community focus — user groups, internal events and knowledge-sharing initiatives can build excitement within the employee base.

    Benefits of Low-Code Enabled COE

    A COE aims to bring disparate parties to the same table. For example, companies could hold what Jamison described as an “appathon,” in which business executives present their goals, like rolling out new installations or driving 5G deployments. Then, priorities are assigned to individual groups, who apply domain knowledge to construct applications.

    Setting up a COE by accelerating ground swell innovation “catalyzes the dual-track innovation that we think is really key,” said Jamison, reducing the mean cycle-time to introducing new features. Low-code could also lower the integration barrier, enabling connectivity with CRM systems, or connecting with big, heavy systems like SAP or Oracle.

    Jamison also described low-code platforms as encompassing “the spirit of microservices,” as they introduce a relatively lightweight application process and easy deployment model. Furthermore, if teams are tapped into the same PaaS, they receive data reusability benefits, he said. “Everyone can utilize the same data in a way that’s relevant for what they need.”

    Citizen Developers: Bogus or Non-Bogus?

    Personally, I think it would be great if the future of application development ushered in a democratizing effect, allowing more people to participate in software creation. Yet, the skepticism around a fully working citizen developer model is hard to shake.

    The “citizen developer” seems to have a negative connotation among coder elites, too. As one reader commented:

    “So top talents are overpaid extravagance and bored secretaries working from home will be driving innovation by writing no-code workflows, am I right with understanding what is written here?”

    I pressed Jamison on the reality of the citizen developer concept in practice and how he responds to naysayers. He jokingly equates it to a witch hunt.

    “Saying that only people that get to participate in software development is professional software developers is ridiculous,” he said, noting the importance of subject matter expertise.

    According to Jamison, companies often fail when they attempt to transmit subject matter expertise to developers. Organizations would rather teach subject matter experts low-code than teach the subject matter to programmers, he noted. It’s not hard to imagine why allowing subject matter experts to build their own workflows for specialized fields, such as accounting, natural science, or mathematics, makes sense.

    Regardless, Jamison adds there’s nothing really to worry about — “The full stack developer isn’t going anywhere.”

    Dual-Track Digital Transformation? Excellent!

    A dual-track approach combines large-scale transformation and rapid-cycle development. By separating “small rock digital transformation” out from the larger puzzle, organizations can increase operational agility to meet business needs a bit quicker.

    Establishing a center of excellence seems to boil down to bringing people together to share ideas, collaborate, and drive better productivity. If anything, this way of thinking will help operationally-intensive industries consider how they can automate parts of their business.

    Ultimately, the goal here is to enable organizations to collaborate better and drive better productivity. By empowering more creators, you can start seeing creativity at the edge of business emerge too, said Jamison. If that involves citizen developers creating event-driven workflow automation, so be it. “We invite people to take on the challenge,” said Jamison.

    Hopefully, then, business and IT can be excellent to each other.

  • Why Your Next CIO Will Be a CPO

    Why Your Next CIO Will Be a CPO

    Here’s what the transition to CPO means for everyone in IT

    Over the last 20 or so years, the evolving role of the CIO, or chief information officer, has been a hot topic of conversation in most large enterprises. It’s a topic that doesn’t just affect those breathing the rarefied air of the C-suite but has concrete implications for everyone in the IT organizations these CIOs lead.

    For these last two decades, most larger companies in traditional industries have vacillated between periods of enthusiasm for technology and so-called “digital transformation”—in which CIOs are viewed as wizards bringing new wonders, changing their entire business models and growth trajectories for the better—and periods of disillusionment, with late projects, missed requirements, user and customer dissatisfaction and cost overruns—in which the CIOs become scapegoats. In these latter times, they often are replaced by CIOs of a different stripe, often moved laterally from finance or general management roles and charged with cost-cutting and predictability as top priorities. Even if the existing CIO keeps their job, they’re often pushed to change the way they operate and lead. When this happens, the entire IT organization finds it needs to change its pitch and priorities to sustain funding for every project and every function, resulting in whiplash. That itself contributes to the perception, and often reality, of late and unfinished projects and unpredictable IT outcomes. It is usually at that point someone realizes the newly efficiency-focused organization is losing market share, brand perception or customers to competitors that are more technically innovative (often digital-first upstarts challenging incumbents in a given industry), and the organization pivots back to “techthusiasm” and a different kind of CIO again. And more whiplash. And so it goes.

    During the periods of techthusiasm, some organizations replace or supplement the CIO title with newly coined titles such as CDO (chief digital officer), CAO (chief analytics officer, an uncomfortable namespace collision with the established corporate title of chief accounting officer), or chief experience officer (no one dares make that into a redundant CEO three-letter acronym).

    In the disillusioned periods, the CIOs stay CIOs as long as they can hang onto their jobs. Title creativity is as suspect as any other kind of creativity.

    Meanwhile the vicious cycle continues: techthusiam -> disillusionment -> retrenchment -> falling behind -> renewed techthusiam.

    As a longtime CPO (chief product officer) for enterprise software companies whose customers predominantly have been these seesawing IT organizations, I’ve been seeing of late the start of a powerful conceptual shift that is the escape route from this vicious cycle.

    So what’s the magic shift in thinking?

    If you’re in a traditional business in which the technology your IT organization delivers merely facilitates people doing their jobs and interfacing with each other and customers, your primary threat in the 2020s—especially with a pandemic interrupting face-to-face interactions—is digital-first, new entrants that conceive of their product as the software and the people as the behind-the-scenes back office and failover when the software doesn’t work. Every business is now a software business, and the software is now the product; some companies in a given industry just happen to be better software companies than others. Such digital-first entrants range from Amazon to Netflix to Workday to Sofi to Wealthfront.

    However, you don’t leap from being ADP to Workday simply through what so far has passed for “digital transformation” led by a CIO, CDO, CAO or whatever another newfangled c-level tech title, as a peer to product leaders whose organizations came from the pre-digital business and look to the CIO, CDO, CAO, etc., to simply execute the technology support.

    What do true software companies in traditional industries have in common? They have CPOs! (Chief product officers, not chief procurement officers or even chief pandemic officers.) Analytics and digital are not in their titles because these are assumed means at their disposal. (I’m thinking of taking on the excesses of our fetish for data in IT and software today in a future column. Send me thoughts if you have them.)

    The role of the CIO was to deploy technology efficiently to support the company’s strategies and plans. The role of the CPO, as inherited from pure technology companies, is to develop and maintain a deep understanding of the customer and market and guide the delivery of products to best meet and monetize their needs, and do so ahead of any and all competition. The traditional CIO derives the why and what from other parts of the organization and supplies the how. Transitional versions of the CIO and the CDO and other neologisms may start to encroach on the what. But the true CPO drives the why and what—and the how if they also have engineering, or collaborates on the how with a CTO or head of development if not. (My friend Kaj van de Loo has an excellent discussion of CPO vs CTO and the trend toward combining the roles here, implicitly focused on digital-first companies, here.)

    Does this sound broad, even encroaching on CEO territory? Well, yes. It’s no accident that former product chiefs are the new CEOs of Google and Microsoft.

    So what does that mean for you if you are in an IT organization?

    Well, first, while your organization may or may not change the actual title to CPO from CIO, it’s important for your career to recognize when the definition of their job becomes that of what a CPO would do in a “pure” software company. If you see the signs that the CPO is guiding the IT organization to become the experts on the market and customers and invent new digital-first products, that shift is underway. It’s good news for those in IT because it means you no longer are simply a cost center to be minimized and even offshored but a driver of the business and value.

    Once you realize you are now in a product organization and not an IT organization, you need to start thinking about what a (software) product actually is and how that differs from what IT delivered before.

    IT traditionally operates on a project and service maintenance basis. Projects have a defined scope and concrete, finite objectives to be considered complete. They have beginnings and ends. Projects either result in the existence of a service that is operated and maintained on an ongoing basis or deliver a discrete set of changes to a service that already existed. Project teams form, deliver the project, and then break up and are reassigned to the next project. Much smaller maintenance teams (usually as low-cost and low-skill as the organization can get away with) make sure that the resulting services stay alive and maintain agreed service levels and consistent, fixed functionality (until the next project to evolve the service is funded).

    True products are quite different. Products have many yearslong life cycles, from inception through launch, constant active enhancements and growth and then eventual end of life. During these life cycles, customers reasonably expect new capabilities to increase and existing capabilities to evolve for better usability and effectiveness.

    Products are not defined by a particular architecture or features but their mission on behalf of the market, users and customers. During a product’s life cycle, the product team may discover new feature ideas or develop new architectural implementations to replace or enhance old ones, all within the umbrella of the same product and mission.

    Product teams maintain staffing levels throughout a product’s life cycle to continue delivering new capabilities and technical enhancements, not just keep the lights on. Every member of a high-performing product team takes the team’s mission as its own and strives to build holistic knowledge of the mission and the product, and contribute new ideas and challenge existing ones—not just a defined role of a product manager or product owner or architect.

    Product teams are acutely aware of competitive and substitute products and strive to become and stay their target customer’s first choice in the face of competitive product teams doing the same. Product teams regard selling, evangelizing and making their products available to their market as being as much a part of delivery as software development and integration. Product teams see opportunities to interact with target users and customers as invaluable two-way dialogue during which they get to show and get reactions to the shiny features they’ve built, as well as discover latent needs that drive ideas for new features and maybe even entirely different conceptions of the overall product.

    In an IT organization that is transforming itself into a product organization, these ideas and this approach apply not just to teams working on “external” products for paying customers outside the organization but also in equal measure to internal products that either serve internal end users, such as a finance or payroll system, or become services that developers on other teams incorporate into their products or platforms on which other developers build, such as a common identity service, customer data pipeline or private cloud. In today’s world, every such official internal service resides in an environment with competitive third-party services and possibly competing internal approaches, and in which what was state of the art yesterday is not viable today.

    Conversely, a well-conceived, designed and managed internal product may turn out to be the basis of a massive external business. Witness AWS and countless DevOps startups that began with the old story, “We built this thing to support our social media/dating/gaming/whatever B2C startup and it turned out to be something other companies wanted to buy more than people wanted what our startup was doing.” Managing internal services and platforms as products is the way to both ensure that the original mission is fulfilled and new opportunities are discovered, too.

    I’ll come back to some of these themes in future columns, but for now, I’ll leave you with this link to a podcast featuring a small Brazilian fintech startup that I believe is one of the best recent examples of a true product team’s approach: Their level of customer intimacy enabled them to identify a new product that solved problems within the scope of their mission and on behalf of their target users that a lesser product team would not have done. How would this kind of product thinking apply to the products in your IT organization?

    Until next time,

    Christina

  • Rewind Acquires BackHub to Protect GitHub Repositories

    Rewind Acquires BackHub to Protect GitHub Repositories

    Rewind, a provider of a software-as-a-service (SaaS) platform for backing up cloud services, today announced it has acquired BackHub to gain control of a platform for backing up GitHub repositories.

    Based in Germany, BackHub adds a data protection platform to a Rewind portfolio that includes offerings for backing up everything from QuickBooks to Shopify. Fresh from raising an additional $15 million in funding, Rewind CEO Mike Potter said BackHub addresses a critical issue involving the protection of some of the most valuable intellectual property any organization has in a cloud service. GitHub, a subsidiary of Microsoft, is the largest host of source code in the world, with over 40 million users and 190 million repositories. BackHub claims it protects data in those repositories for more than 1,000 organizations.

    Rewind GitHub backup

    While GitHub itself is a reliable cloud service, the code residing in GitHub is subject to the same potential threats as it would be in any other cloud service. It’s not uncommon for a malicious actor to gain access to credentials that they exploit, for one reason or another, to delete or alter data – or, in the case of GitHub, code. BackHub makes it possible to back up code stored in GitHub to another cloud service where it can be easily recovered.

    Potter said the ultimate goal for Rewind is to make it possible to back up the entire cloud. Achieving that goal will require both additional acquisitions and internal product development, said Potter.

    In the meantime, the company is focused on providing data protection for specialized cloud services usually overlooked by other backup and recovery tool providers. For now, it leaves the backup and recovery of data stored on widely used cloud services, such as Microsoft 365, to other vendors. Rewind claims more than 80,000 organizations are using its platform to protect data, stored in a wide range of cloud services, that address a specific niche use case.

    Given the prominent role GitHub plays in software supply chains, it is not surprising that the code stored in Git repositories becomes a target for cybercriminals. Much of the intellectual property stored in those repositories is a high-value target for organizations looking to reduce the amount of time required to re-engineer a rival company’s functionality.

    Nation-states around the world have cyber-espionage programs aimed at gathering any type of digital asset that might benefit their military or economy. Naturally, copying code isn’t always enough when, in one fell swoop, add code that might derail that project long enough for them to catch up.

    Unfortunately, there have been some high-profile breaches involving software supply chains. The best way to determine if a project has been compromised is to compare code bases. Repositories, by definition, provide application development teams with version control capabilities. However, backing up a GitHub repository provides one extra layer of security that can make it easier to recover from a breach.