Tag: app dev

  • The Three “S’s” To A Successful App, Pt. 1

    The Three “S’s” To A Successful App, Pt. 1

    Developing your first app can be a daunting task. Many first-time developers may overlook, or over think, certain aspects of building their first app. Through scores of conversations and interactions with developers, I established common pain points and gathered advice that they themselves wish they had known before building their first app. With all of the collective feedback, I was able to identify the three “S’s” to building a successful app:

    • Scalability – knowing how to grow the app as user engagement increases
    • Simplicity – understanding which features are most critical to users
    • Streetsmart – analyzing the marketplace and differentiating the app

    This series of articles will discuss each “S” in detail, share developer stories and offer practical advice for first-time app developers.

    In conversations with developers about building their first app, several of them mentioned how the app turned out to be much more successful than they had originally anticipated, which in turn, lead to support issues due to the influx of traffic. These stories are what lead to the first “S”: scalability.

    What does it mean to scale an app?

    Scaling an app means architecting the app to accommodate the size of the audience that your organization predicts. While the future success of an app and brand it’s associated with is ultimately unknown, projected audience size is a key factor used to help guide developers to make the best decisions with regards to scalability. When projecting audience size, it’s important to make a bold prediction that’s an order of magnitude greater than the best case scenario. Why? Because it’s better to be over prepared than under. However, resources should not be exhausted and the app should not be over engineered.

    Finding the sweet spot

    Finding the sweet spot between scaling for a current audience size and a magnitude greater than the best case scenario can be tricky. The greatest factor in deciding this is the size and stage of the company. In the case of Uber for example, the app will need to be extremely robust right off the bat because the app is central to the operation of the organization. But with an organization such as Yo, the app does one thing and has a clearly defined scope, so the focus should be placed on getting the product out in the market and and scaling from there. Once an organization has found its market fit, scale should be at the forefront of the agenda. Because if scale is not top of mind, that’s when challenges will occur.

    Overcoming Challenges

    Developers are often faced with hurdles when their distributed systems do not allow for components to communicate together. Applications can’t achieve scalability if the different system components do not work seamlessly as the load increases.

    For example, if there is one server with one database that handles all of the read/write connections, it is rather easy to maintain; there is only one pipe to be concerned with. But when that database crashes due to traffic increase and lack of scalability, the app will stop functioning. So to add scalability to support the increased user-base, the database server needs to be replicated with load balancers that understand when the database server is overloaded and can transfer traffic over to a new one and so forth.

    To achieve this, it takes a combination of network expertise, smart app architecture and building smart connection points between the different services.

    Final Thoughts

    Scalability is just one factor that contributes to the success of an app. When developing your first app, whether it be for robust use or for a clearly defined scope, it is paramount to keep your database servers and the connections between them in mind because those smart connections are the key to building a successful platform for future users.

  • Clearing through the app backlog clutter

    Clearing through the app backlog clutter

    Development and operations teams today are under more pressure than ever to develop apps the business needs to make its workforce productive, its partners connected to the resources they need, and to deliver the apps to the marketplace that will make it competitive.

    The number of production hours for development is at a precious premium as demand for apps soar and resources remain tight. According to Gartner, the demand for enterprise mobile apps alone will be a $40 billion market by 2016.

    Of course, the inevitable happens and the list of designed applications gets backlogged. They get caught-up in budget requests that drag on, and then they get caught in the long list of requested apps in the development queue. A recent survey commissioned by PaaS provider OutSystems found that 85% of enterprises surveyed had an app backlog, with about half having backlogs of 10 to 20 apps.

    App Backlog, agile and DevOps

    Sure, development and operations teams move as quickly as they can to meet the enterprise demand for new applications, but when there is any deep app backlog, there is the potential for business costs when it comes to lost opportunity, untimely product development, and future missed sales. In a time when agile IT means competitive advantage, any amount of latency that can be cleared from the application backlog is crucial.

    Agile development approaches and agile IT departments tried to remedy some of these issues, but didn’t go far enough. Fortunately, DevOps picks up where agile left off in the evolution of enterprise development. And in the face of agile IT, continuous integration, continuous deployment, and the rise of DevOps – operations, development, and infrastructure bottlenecks become minimized – and infrastructure and applications move more quickly, and existing applications are iterated more swiftly.

    Of course, DevOps itself, can help to accelerate app deployment, in addition to continuous integration and continuous deployment efforts. And all of the associated deployment automation tools and deployment processes are essential to eliminating manual waste so teams can focus on pressing business demands. This waste can include time burnt on manual process, manual testing, and the configuration of the software development environment.

    DevOps-driven organizations have shorter app backlogs. A recent CA Technologies study in fact found that organizations embracing DevOps report a 17 to 23 percent improvement in certain business outcomes, such as increased revenue, and faster time-to-market.

    Cloud architectures and easier to master development languages also help, not just infrastructure services, but also platforms that help to free up operations teams and developers to focus on the applications that need to get out yesterday.

    Even with DevOps practices in place and automation running full throttle, the business development teams still find themselves having to make difficult choices about which apps to build and deploy. Not all of these apps will survive, in fact, many apps will go unused and dormant. This means that a lot of time can be lost developing apps people don’t want to use, or are too cumbersome to bother to use.

    Turning to the Minimum Viable Product

    In addition to DevOps, development teams are also turning to approaches such as the Minimum Viable Product (MVP) as a way to help identify apps that have real user demand and those that do not. Essentially, the MVP app is an app that consists of only the essential. The MVP provides the essence of the app and what users need to get done and no more. The MVP is a potent way to provide the essential attributes of an app to see if users embrace it before building the app out further. If the app is used, new features can be added over time.

    Not everyone is convinced that the gains made against app backlog aren’t necessarily illusion. David Mortman, distinguished engineer, says “DevOps and MVP both have the ability to create the impression that you are solving backlog issues. This is because in both cases you are enabling the development organization to get that first release as early as possible and then to keep iterating it and adding features as the dev group goes,” he says. “This however may not get you to a particular defined endpoint any faster since regardless of the organization there are always resource limitations.”

    Still, “One advantage of DevOps and Agile is that they let you interweave development cycles so multiple apps can be worked on faster and each can be incremented more quickly. They also make it easier to adjust priorities between apps more quickly and more quickly identify apps that aren’t meeting the business needs and either deprioritize or eliminate the app before overinvesting in its development,” Mortman adds.

    There’s no doubt, based on my discussions with enterprises, app backlog repeatedly comes up as a serious challenge to competitiveness. But by embracing continuous integration, deployment, and MVP development, organizations can go a long way to help clear through, at least the initial stages of their app backlog. What is your organization doing to help clear app backlog? We’d like to hear your experiences and lessons learned.

  • Build security into your app development

    Build security into your app development

    Integrate security testing into your dev process now or else face cyber-attacks later

    The way we develop software has been radically transformed in the last few years. Agility and speed are vital components for any company that wants to compete in the market. In order to achieve that it has proven necessary to break down barriers. The idea of separate silos with developers, operations, testers, and management working in isolation, sometimes even in opposition, is dated and flawed.

    We’ve accepted the logic of bringing development and operations together with the DevOps movement. The recognition that testing is required earlier in the process has come. Now it’s time to apply the same logic to security. It’s time to bring InfoSec into the fold.

    The security threat

    Trends like cloud computing, big data, SaaS, and the BYOD end of the mobile revolution have created new opportunities for increased efficiency and productivity, but they also represent unique challenges for security. Sensitive data, financial information, and intellectual property are all exposed to risk when security is a secondary concern.

    The issues that splashed back from the waterfall model for testing apply to security as well. Only passing applications through the QA process at the end of production, when time pressures to release were the greatest and it was too late to make significant changes, resulted in fixes being more expensive and software quality suffered.

    If we don’t integrate security testing into the development process and make it part of the software development lifecycle now, then we run the risk of encountering exactly the same problem. We waste time retro-fitting functionality that should have been there in the first place, and we all know the pain of securing a hybrid system with legacy software that wasn’t designed with modern security threats in mind.

    How to address security in software development

    Automation for testing has enabled developers to move towards a continuous delivery system where new features can be rolled into live software as they are created. How do we ensure that security is maintained?

    • Secure programming education is required to make sure developers are limiting and testing inputs, storing minimum data and encrypting, compartmentalizing the system, questioning requirements that may introduce security risks for little gain, limiting privileges, and analyzing and auditing the code.
    • IAST (Interactive Application Security Testing) allows you to combine elements of static and dynamic techniques to run automated tests continuously on the software under development and see how it copes with malicious traffic. Since IAST monitors data inside the application it can pinpoint issues that might arise from real-world attacks, enable a useful assessment of the impact, and make it easier to remediate.
    • Security analysts are needed to properly configure your tools and interpret the results. You can buy the best security tools in the world, but you have to know how to leverage them and act on the data. An external analysis can provide real insights that will boost application security.
    • OWASP (The Open Web Application Security Project) is a great community where you can find innovative solutions to modern software security challenges. It can help you understand secure development standards and it’s packed with invaluable resources and advice from experts around the globe.

    Bringing InfoSec on-board from the outset will help you build security considerations like this into your development pipeline. It will save time and money in the long term.

    Ongoing research and modelling

    It’s important to model potential threats and test for them, but you must be aware that new threats evolve and emerge all the time. Dedicated InfoSec employees will continually research and explore the new trends and risks in the security industry. Opening a direct line between DevOps and InfoSec enables them to pass along that wisdom and fold it into the mix when it’s relatively cheap and easy to do.

    The security testing in your development pipeline is no more static than any other element. It has to be continually reviewed and modernized to ensure it continues to deliver results. Continuous real-time monitoring will deliver the oversight you need.

    Building for the future

    There’s no question that cyber-attacks will come, but if you prepare properly you can detect and nullify them with minimal effort. When considering the investment now, you must factor in the cost of lost confidence, post-mortem forensic investigation, and significant redevelopment to close any gaps in your defenses in the event of a future breach.

    Once you have built solid foundations for security in your application development they will benefit every project going forward. Taking a long term view makes financial sense and results in better quality software.


     

    About the Author

    MichelleDrolet_BlackcropMichelle Drolet is founder of Towerwall, a data security services provider in Framingham, MA with clients such as Smith & Wesson, Middlesex Savings Bank, Brown University and SMBs.  You may reach her at michelled@towerwall.com.