devopsy.kinsta.cloud

Tag: appdev

  • Low-Code and DevOps: Friends or Foes?

    Low-Code and DevOps: Friends or Foes?

    What does low-code mean, and who is it really for?

    Over the last few years, I’ve seen many articles associating “low-code” with “citizen developers” or with people who don’t have deep development skills. Users can arrange visual elements, or fill in forms with key information and publish the result as an application.

    But tools for citizen developers are only one part of the low-code story. There is also a growing number of tools for professional developers, and I want to talk about those, too.

    Both citizen developers and professional developers have a role to play in application development and automation projects, and low-code has something to offer both of them.

    Low-code is Not a Market, it’s an Approach

    Low-code does mean providing visual and graphical tools and simple frameworks that mask more complex coded operations, so the application designer does not have to directly touch the code that performs desired operations. These apps are naturally limited, as the resulting application can’t be highly customized if you can’t touch the code.

    With these kinds of visual tools, anyone can create a simple application within the limits of the tool. But when we pull back and look at what is needed to create larger, more complex applications – ones that need to communicate with other enterprise systems, or need extensive customization, or cross organizational boundaries, or need to pay attention to governance requirements, for example – the visual-only approach is frequently insufficient. In complex cases, developer expertise is often needed, and developers have to get “under the hood” to tinker with code.

    There is no “low-code market.” We are bringing tools to people who need them to develop specific projects. A comprehensive low-code approach to application development and automation means offering both visual programming and coding capability. For usability reasons, these tools are clearly separated and presented to the development team in a way that allows citizen developers to work on certain elements and developers to work on others, all on the same platform.

    We know that it’s possible to serve professional developers with low-code, too. A low-code approach also includes drag-and-drop tools that developers can use – for example, to develop APIs, or to integrate the application with other systems, or to customize front-end interfaces. Of course, when code is required, developers should be able to use their own tools and frameworks and not be limited by low-code tools. Platforms that offer a hybrid approach are likely to be most useful to mixed-skills development teams.

    The Hybrid Approach

    Strictly low-code tools can serve simple automation use cases. More broadly, automation platforms offer a hybrid of low-code and coding capabilities for more complex automation use cases.

    For critical enterprise applications, both business and developer inputs are usually needed. Having tools for both of them means not leaving anyone out.

    Low-code tools will continue to become more mainstream. Low-code is not a fad or a passing trend, but a quiet revolution that will see greater incorporation into more business tools.

    Here Come the Digital Natives!

    More vendors are offering low-code tools for digital process automation, business intelligence, robotic process automation, identity management and data integration, to name just a few.

    As automation platforms and other low-code tools mature, a greater number of people are getting used to working with them. Developers are less hesitant about incorporating non-developers into their teams, as everyone gains a better understanding of the benefits of these platforms.

    The younger generations entering the workplace today are digital natives. They are fearless about diving into technology and working hands-on. So, these low-code tools are ready for them, and they are ready to put them to work.

    Low-code is breaking down technical barriers to work in the automation space, making smooth collaboration between business and development easier.

    Low-Code Can Be a Double-Edged Sword

    Automation and development teams are also becoming more aware of vulnerabilities and compliance issues as citizen developers roll up their sleeves and join the technical team.

    Low-code tools are a double-edged sword. They facilitate teamwork, but issues with security and data governance may not be top-of-mind for non-developers. If you have a big team working on automation and/or application development and delivery, the need to build in governance becomes even more important.

    Using a shared platform will help manage and mitigate these issues with security and governance. This will become even easier as the platform tools evolve and mature, so DevOps teams can use them to help mitigate some of these issues.

    Does Low-Code Have a Place in DevOps?

    We are definitely seeing the impact of low-code on development environments and DevOps. Remember, low-code started with small applications, and while DevOps-style teamwork and workflows may not be needed there, as the use of low-code platforms becomes the norm for critical enterprise projects, DevOps will be a necessary part of the mix. This is where low-code is having a more obvious impact; Agile methodologies using low code platforms for iteration, for continuous improvement and for continuous delivery. These applications aren’t one-and-done. They need to be maintained, improved and delivered, again and again.

    Low code isn’t going away. On the contrary – it’s going everywhere.

  • Culture, Behavior and Unconventional Strategy Plays a Major Role in Secure App Development

    Culture, Behavior and Unconventional Strategy Plays a Major Role in Secure App Development

    In today’s fast-paced environment, security often plays second fiddle to deadlines. That means software development doesn’t typically get considered when building secure applications, rather it’s the innovations that can be quickly implemented which take center stage. Unfortunately, ranking short term tactical gain over long term vision is undeniably flawed. Doing so ignores the fact that attacks are more sophisticated than ever before, and applications that have security holes have become a key focal point for those attackers because once a vulnerable application is discovered it becomes easier to compromise a wide set of users at once. But change requires more than drastic measures. It requires an unconventional strategy to adjust culture and behaviors throughout the organization.

    Although the tools and practices to build secure, defect-tested software are maturing, most organizations find internal hurdles to be more daunting. Organizational impediments including process, differing software development approaches, and short-term business drivers – like the need to update apps to reflect the latest must-have features and platform support – make it more difficult to effect meaningful change. Those interested in leading secure development initiatives within their organizations face myriad challenges.

    Step out of your comfort zone to influence culture, process and strategy change

    Often, folks who find themselves in the position to step up to the plate and change culture did not initially plan to do so. The developer who is chosen to lead the charge and establish a process that ensures applications are securely built is extraordinarily smart and devoutly technical. In order to begin changing the world, he or she will need to utilize approaches outside of their comfort zone. Success will rely on the acknowledgement that a full frontal assault on the status quo will not do. Instead, hearts and minds must be won. The skill sets that propel developers’ careers forward must take a back seat to the forces of leadership and persuasion, not coercion, which will ultimately affect the cultural shift in an organization’s application development mindset.

    To effectively change the way organizations build software, an enterprise-wide initiative is required – one that accounts for organizational culture at each step. By taking a step-by-step approach, implementing a successful software security initiative does not have to be so daunting. Five proven best practices include taking a disciplined approach by characterizing the landscape, securing champions, defining standards and strategy, executing, and then sustaining the effort. These steps, as outlined below, will help ensure that your corporate-wide efforts to secure applications are as productive as possible.

    Characterize the Landscape – Understand the task ahead and craft a realistic strategy for adoption within your organization. Whether that be identifying your organization’s compliance framework and cultural norms, to artifacts of the software security and what software development lifecycles you have in place. Being able to characterize your existing landscape allows you to fill the gap between policy and practice.

    Secure Champions – Focus explicitly on the fact that you will need clear support of executive sponsors and other key influencers in the organization in order to be successful. While senior leaders may not understand or care about the minutia of software vulnerabilities, they will appreciate the business impact of a data breach with far-reaching cost, reputation or legal repercussions.

    Define Standards and Strategy – You will only have one opportunity to successfully roll out a secure development initiative, meaning you cannot overlook this step. Conduct a risk assessment of applications owned by your organization to identify the most vulnerable applications to provide some qualitative ranking for decision-making. Having a baseline set of practices and procedures that are well thought out, realistically implemented, and reflect what is realistic in your organization is absolutely critical.

    Execution – So you’ve done your homework, secured supporters throughout the chain of command and in the field, and laid out your strategy and goals. Now comes the hard part – bringing the issue of software security to the forefront through innovative awareness campaigns. Remember, it will be important to show quick wins, highlight positive behaviors, and do it over and over again; ratcheting up expectations and software security with each iteration.

    Sustainment – This follows the successful execution of your software security initiative campaign, which can take between one and two years. To ensure your campaign stays fresh and does not lose momentum, a regular, disciplined update of the regulatory framework must occur. In addition, staying knowledgeable about what is occurring within your organization to determine whether there are new technology risk areas emerging in critical.

    Creating a software security initiative is difficult by any measure. From organizational culture or politics to the status quo bias towards meeting deadlines for new features and functionality, there is no limit to the amount of hurdles that need to be overcome. But by demonstrating the importance of looking long term from a security standpoint and winning the hearts and minds of everyone that plays a role, success can be achieved. Organizations that focus only on the tasks ahead of them do not change the world. Long term vision is critical for organizations that endeavor to strategically move, grow and change the status quo.