Tag: application development

  • The Rise of Low-Code/No-Code in DevOps

    The Rise of Low-Code/No-Code in DevOps

    The ever-evolving landscape of technology has ushered in a paradigm shift in software development and deployment. One of the prominent trends gaining momentum is the integration of low-code/no-code platforms within the DevOps ecosystem. This article explores how these platforms are revolutionizing the way applications are developed, deployed and managed, fostering collaboration between developers and operations teams.

    1. Democratizing Development:

    Low-code/no-code platforms empower individuals with limited coding experience to actively participate in the application development process. This democratization of development accelerates the delivery of software by allowing business analysts, designers and other non-developers—sometimes referred to as citizen developers—to contribute directly to the creation of applications.

    2. Accelerating Time-to-Market:

    The traditional software development life cycle often involves lengthy coding processes, leading to delayed releases. Low-code/no-code platforms enable rapid prototyping and development through visual interfaces, significantly reducing the time required to bring applications from concept to production. This acceleration aligns with the principles of DevOps, promoting continuous delivery and faster time-to-market.

    3. Enhancing Collaboration:

    DevOps is all about breaking down silos and fostering collaboration between development and operations teams. Low-code/no-code platforms bridge the gap between these traditionally distinct roles by providing a common ground where both technical and non-technical stakeholders can collaborate seamlessly. This collaborative environment promotes better communication, understanding, and alignment of objectives.

    4. Flexibility in Deployment:

    Low-code/no-code solutions are designed to be platform-agnostic, allowing for the deployment of applications across various environments, including on-premises and cloud. This flexibility aligns with the DevOps principle of infrastructure-as-code (IaC), enabling teams to deploy and manage applications consistently across diverse infrastructures.

    5. Reducing Dependency on Specialized Skills:

    In a DevOps environment, reducing bottlenecks and dependencies on specific individuals or roles is crucial. Low-code/no-code platforms enable teams to be more self-sufficient, reducing the reliance on specialized coding skills or DevOps Training. This, in turn, contributes to a more resilient and adaptable DevOps culture.

    6. Challenges and Considerations:

    While the adoption of low-code/no-code in DevOps brings numerous benefits, it also introduces challenges. This section discusses considerations such as security, scalability and the potential need for customization beyond the platform’s capabilities.

    7. Real-World Use Cases:

    Explore real-world examples of organizations successfully incorporating low-code/no-code in their DevOps workflows. Highlight the positive outcomes, lessons learned, and the impact on their overall software development life cycle.

    Conclusion:

    The rise of low-code/no-code platforms in DevOps is reshaping the way software is developed and deployed. By fostering collaboration, accelerating development cycles, and reducing dependencies on specialized skills, these platforms align seamlessly with the principles of DevOps. As organizations continue to embrace this trend, the synergy between low-code/no-code and DevOps is set to redefine the future of application delivery.

  • DevSecOps: 5 Tips for Developing Better, Safer Apps

    DevSecOps: 5 Tips for Developing Better, Safer Apps

    The cloud is rapidly becoming a major battleground for cyberattacks — and the cost of a breach has never been higher. According to IBM, the average cost of a breach was $4.5 million, and according to the CrowdStrike 2023 Global Threat Report, there was a 95% increase in cloud exploits in 2022, with a three-fold increase in cases involving cloud-conscious threat actors. The acceleration of cloud-focused threat activity and its effects has made security a key priority across organizations – especially DevOps teams.

    Security in the Cloud is a Shared Responsibility

    Security teams are accountable for protecting against risks but cannot be the only ones. Each team must try to communicate why their part of the development lifecycle is important to the other teams in the pipeline. With the growth of cloud-native applications and the demand for faster application delivery or continuous integration/continuous delivery (CI/CD), the use of containers is increasing widely. Complex security issues arise as businesses adopt containerized and serverless technologies and cloud-based services.

    Application developers have a tricky balance to maintain between speed and security. In DevOps, security used to be an issue addressed after development — but that’s changing. Now, developers who previously had to code right up to the last minute — leaving almost no time to find and fix vulnerabilities — are using shift-left capabilities to ensure that code with security vulnerabilities is not moved into production.

    When security is considered at every step in the pipeline, it ensures developers find and address issues early on and reduces the cost of downstream fixes. DevSecOps helps developers find and remediate vulnerabilities earlier in the app development process. Vulnerabilities discovered and addressed during development are less expensive and faster to fix. Automation of testing, remediation and delivery ensures stronger software security without slowing development cycles. The goal is to make security a part of the software development workflow, instead of having to address more issues during runtime.

    Below are five key tips for developing apps with security and efficiency.

    1. Automate Security Reviews and Testing.

    Every DevSecOps pipeline should utilize a combination or variation of tools and features like those listed below. A good automated and unified solution will provide broad visibility and address those issues as they arise, while alerting, enforcing compliance and providing customized reports with relevant insights for the DevOps and security teams.

    SAST: Static application security testing to detect insecure code before it’s used

    SCA: Software composition analysis to detect library vulnerabilities before building

    CSA: Container scanning analysis to detect operating system library vulnerabilities and mitigate risk

    IaC scanning: Infrastructure-as-code scanning to detect vulnerabilities in infrastructure

    ASPM: Application security posture management to detect application vulnerabilities and risks once deployed

    2. Integrate With Developer Toolchains.

    Streamline and consolidate your toolchain so developers and security teams can focus attention on a single interface and source of truth. The tighter the integration between security and app development, the earlier threats can be identified, and the faster delivery can be accelerated. Seamlessly integrate with Jenkins, Jira, Bamboo, GitLab and other cloud security solutions to allow DevOps teams to respond to and remediate incidents faster within the toolsets they already use.

    3. Share Security Knowledge Among Teams.

    DevSecOps is a journey enabled by technology but a process that starts with people. Your DevSecOps team should share lessons learned and mitigation steps after resolving the compromise. Some organizations even assign a security champion who helps introduce this sense of responsibility for security within the team. Be prepared to get your teams on board before changing the process, and ensure everyone understands the benefits of DevSecOps. Make security testing part of your project kickoffs and charters, and empower your teams with training, education and tools to make their jobs easier.

    4. Measure Your Security Posture.

    Identify the software development pain points and security risks, create a plan that works well for your organization and your team, and drive execution. Ensure you track and measure results such as the time lost in dealing with vulnerabilities after code is merged. Then, look for patterns in the type or cause of those vulnerabilities, and make adjustments to detect and address them earlier. This introduces a shared plan with integration into the build and production phases.

    5. “Shift Right” as well as “Shift Left.”

    Detection doesn’t always guarantee security. Shifting right and knowing how secure your applications and APIs are in production is just as important. By leveraging ASPM to uncover potential vulnerabilities in the application code once they are up and deployed, teams can find potential exposure in their application code that could allow backdoor access to other critical data and systems.

    The bottom line is that while security and development used to be separate, the lines are now blurring to a point where security is becoming more integrated with the day-to-day job of developers. The benefit is that the modern practice brings together teams across the company to a common understanding, which drives business growth. DevSecOps requires teams to collaborate and enable the organization to deliver safer applications to customers without compromising security.

    Security is not meant to be a red light on the road to your business goals or slow down your software development. It is to enable you to reach those goals safely with minimal risk.

  • CircleCI Adds Release Orchestration Capability to CI/CD Platform

    CircleCI Adds Release Orchestration Capability to CI/CD Platform

    CircleCI today added a release orchestration capability to its namesake continuous integration/ continuous delivery (CI/CD) platform to give developers more control over application deployments.

    CircleCI CTO Rob Zuber said a CircleCI releases capability provides development teams with the ability to release a controlled subset of their code in a live production environment in a way that provides immediate feedback on how that code is performing. That level of visibility can then be used to determine whether that code might need to be rolled back using automation tools embedded in the CircleCI CI/CD platform, he added.

    In the absence of that capability, noted Zuber, it takes DevOps teams, on average, 45 minutes to an hour to manually roll back an application.

    Initial platforms supported by CircleCI releases are Kubernetes and Amazon SageMaker. CircleCI releases is also compatible with the open source Argo CD platform that CircleCI integrated its platform with last year.

    CircleCI also plans to add support for blue-green deployments later this year, enabling DevOps teams to deploy one application version more gradually to replace another.

    The way CD is managed often varies widely from one organization to another. In highly regulated industries, CD is typically managed by a central team to ensure compliance requirements are met. In other instances, developers are directly responsible for building and deploying their code. Regardless of approach, CircleCI enables organizations to define a set of guardrails to ensure best practices are observed, noted Zuber. In effect, each organization can implement a set of checks and balances that are aligned to their specific needs, he added.

    As DevOps continues to evolve, more organizations want the ability to control deployments at a more granular level by, for example, only making a new application or an update available to a select number of users. Once deployed, developers need a more holistic view into not just how that application is performing but also how it impacted the business, said Zuber. If, for example, the number of logins declines after an update, a developer needs the information to determine whether that update should be rolled back as quickly as possible, he added.

    It’s not clear how many organizations are managing the entire CI/CD workflow on an end-to-end basis. While most DevOps teams make extensive use of CI to build an application, the deployment of applications is still often managed manually. However, as CD capabilities become simpler to employ across platforms with standard interfaces, the number of organizations automating CD should steadily increase. In fact, that capability will soon prove essential as, thanks to the rise of generative artificial intelligence (AI), the pace at which applications are being built only continues to accelerate.

    In the meantime, each organization will need to determine how closely it wishes to integrate CI and CD workflows. However, the more tightly integrated these processes become, the simpler it becomes for developers to assume full responsibility for building and maintaining the software they create.

  • 7 API Observability Anti-Patterns to Avoid

    7 API Observability Anti-Patterns to Avoid

    Observability has become a buzzword, and the API world is slowly catching up. But be careful when looking for content about API observability- there are many outdated best practices and irrelevant pieces of content.

    I was recently invited as a guest to Stephen Townshend’s SlightReliability podcast, and his brilliant blog post on “Bad Observability” inspired me to start ranting about the topic.

    Here is a follow-up to our discussion: The observability anti-pattern to avoid when working with APIs. Thanks, Stephen, for the inspiration!

    Anti-Pattern: You Forgot Your Users

    It’s easy to lose sight of the fact that APIs are built for people to use. APIs are not just a technical interface; they are a bridge that connects digital experiences and enables people to accomplish tasks efficiently.

    There are two different kinds of users for your API:

    • The developers who are integrating your API into their system.
    • Your customers’ users, who will ultimately interact with the applications or services that rely on your API.

    If you can’t understand how they interact with your APIs, you’re missing half the picture.

    When developers integrate with your APIs, how long does it take them to make their first successful API call? What are typical errors slowing them down? Observability plays an essential role in surfacing insights to improve developer experience.

    Once your customers’ applications or services relying on your APIs are in production, can you track how your releases impacted their requests? Which version of your APIs are they using? What are the most popular endpoints? Are all customers getting the same performance? Same error rates?

    Anti-Pattern: Relying Only on API Monitoring

    API monitoring typically involves sending automated test requests to API endpoints and verifying the responses. It helps you keep track of the health of your APIs even when there is no customer activity at all, and can be used to report uptime.

    But API monitoring is nothing more than black box testing; you don’t see what is happening inside. You just know that your requests reach the API and receive responses, but you can only create and maintain tests for some possible use cases. You will miss something.

    Anti-Pattern: Using API Access Logs for Troubleshooting

    API access logs are records of requests and responses made to an API, capturing details such as the requestor’s IP address, HTTP method, requested endpoint, status codes and other relevant information for monitoring, debugging and security purposes.

    Using access logs to troubleshoot API issues is like searching for a needle in your microservices haystack. One of our users had a performance issue with their APIs; they spent days searching for the root cause using access logs. Is it the gateway? Does it need more CPU? Is it a configuration issue? They enabled distributed tracing and, within seconds, they could see what was happening: All the time was spent in the authentication server issuing JWT tokens.

    To really understand what is happening in your system, you need to be able to track a single user request from the API gateway to the upstream services and their dependencies for effective troubleshooting.

    As Martin Thwaites puts it: “Logs are a poor man’s observability tool.” You need distributed tracing.

    Anti-Pattern: Different Teams, Different Tools, Different Data

    Different teams have different needs. The tool that works for your DevOps team might not fit your product team best. By forcing everyone to use the same tool, you’re not promoting unity but inefficiency.

    However, while promoting tool diversity might be the right move for your organization, there should be some coordination and integration between different tools and data sources. Open standards like OpenTelemetry help ensure that information can be shared and leveraged across teams and tools.

    The DevOps and the product teams should rely on the same error rate when assessing the performance and reliability of the newest API product launched.

    Anti-Pattern: One Size Fits All

    Different API architecture styles have different needs when it comes to observability.

    REST APIs might be today’s default, but newer styles like GraphQL and gRPC are gaining popularity. Each of these styles has distinct characteristics and requirements regarding observability. Just think about GraphQL’s way of handling errors, which differs significantly from REST APIs. Web Socket and event-driven APIs have their own unique observability challenges, as well.

    Different API architectures have different needs, and your observability strategy needs to reflect that to improve the overall reliability of your application.

    Anti-Pattern: Observability for Production Only

    Why aren’t you using observability in pre-production?

    By using distributed tracing during the API development life cycles, developers can trace the flow of requests and responses across different services, providing a comprehensive view of how the API behaves under various scenarios.

    With observability, they can identify performance bottlenecks and even detect architectural problems like N+1 problems in GraphQL queries.

    For teams leveraging APIOps practices, observability data can be used as an additional validation before promoting an API to the production stage.

    Anti-Pattern: Starting the Trace at the API Gateway is Overrated

    Tutorials about observability usually start the instrumentation process at a microservice level. It is great to have detailed insights into your microservices. But a lot will happen at the API gateway level when dealing with APIs.

    You want to capture all your user transactions, including those that never reach your microservices because of rate-limiting rules, an authentication problem or a caching mechanism.

    Starting the trace at the API gateway gives you a clear entrance point and a complete picture of the journey of all your users. That’s why it’s important to use a modern API gateway with built-in support for OpenTelemetry.

    So there you have it: Seven API observability pitfalls to avoid. Keep your APIs observable and your users happy!


    To hear more about cloud-native topics, join the Cloud Native Computing Foundation, Techstrong Group and the entire cloud-native community in Paris, France at KubeCon+CloudNativeCon EU 2024 – March 19-22, 2024.

  • Low Code: The Key to Accelerating Custom App Dev for Moderate Developers

    Low Code: The Key to Accelerating Custom App Dev for Moderate Developers

    Custom app development has become a crucial skill in an increasingly digitized world. Many moderate developers face challenges while creating unique and functional applications. This is where low-code platforms come into play, offering a solution to accelerate app development and compensate for those shortcomings.

    Who are Moderate Developers?

    While every developer is constantly evolving and growing in experience, like any professional, they can be put in three baskets. The first is entry-level developers learning on the job who may assist with debugging, essential documentation, code repository maintenance and some simple feature requests. At the other end are very experienced developers who lead projects, architect solutions, oversee the development of applications and take full ownership of delivering killer features in a new application.

    Moderate developers are those in the middle, representing a large swath of professionals with the foundational expertise to implement most app designs and feature requests. With more experience than beginners but yet to be qualified to serve as seniors on a team, they have a shared set of challenges.

    Understanding the Challenges of Moderate Developers

    Moderate developers often need help with complex application development demands and skill limitations. They are faced with creating high-quality, functional and unique applications, which can be daunting in light of the rapid pace of technological change and user expectations.

    These moderately skilled developers often face common challenges such as:
    ● Limited Expertise: Cultivating an in-depth knowledge of programming languages and development environments is an ongoing process.
    ● Time Constraints: Developing an application from scratch requires significant time. Dedicating effort to a single project can constrain developers and their organizations.
    ● Scalability Issues: Growing and expanding applications increase the need for scaling and can create complexity. Making changes and adding new features can drag down an organization’s ability to focus on new projects.
    ● Security Concerns: Moderate developers may not be aware of an application’s security risks, jeopardizing the protection of a company.

    Low-Code Platforms Offer Hope

    Low-code platforms have been created to meet the needs of moderately skilled developers and competitively focused organizations. The use of tested drag-and-drop elements offers a secure and powerful way to overcome these challenges.

    Creating practical and powerful applications is available through low-code platforms by connecting ready-made templates. This process rapidly creates applications for use as mobile and web-based applications.

    Non-IT professionals can overcome their lack of time and knowledge through low-code platforms. Short-staffed organizations in their IT department can still provide a powerful connection for their services. The team can quickly get to work meeting its primary mission.

    Visual Modeling is the Secret Power of Low-Code Platforms

    Traditional application development involves writing lines of code, testing and managing by an experienced IT staff. Low-code platforms use pre-tested and connected visual components to build and implement successful and secure applications rapidly.

    Low-code developers can see the application they are building from the beginning of the process to its launch. The drag-and-drop aspect of these platforms is more intuitive and user-friendly. Using proven templates offered by these platforms can also help reduce errors.

    Duplicating Success

    Assembling tested and ready-made components boosts the chance of an application’s success. Pre-configured applications are a way to rapidly launch applications with the confidence of a proven track record.

    Low-code platforms offer users the confidence to trust the components while looking straight at their ongoing results from a clear visual perspective. More time and attention can be paid to an application’s unique functionalities rather than the complexity and drudgery of coding.

    Team Building and Collaboration Opportunities

    The visual nature of low-code platforms allows the entire team to play an active role in an application’s development and keeps everyone speaking the same development language.

    Built-in collaboration tools facilitate feedback loops, revision tracking, user stories and messaging, making it easier for teams to work together in the same office or distributed worldwide. Everyone can own the solution while having a positive impact upon its release.

    Ensuring Scalability

    Low-code platforms offer more than a “one and done” opportunity for growth and success. Robust and friendly customer-facing connections await users of low-code platforms who take advantage of their power. They can continue to generate further service opportunities and sales after the initial launch.

    Proven internal processing networks can be extended with the same low-code platforms that started this robust development. Low-code connections can be efficiently expanded using earlier low-code work.

    Ever-changing business needs can be readily addressed with existing low-code platforms. They can continue to offer ready-made templates for internal and external successes that fit an enterprise’s needs.

    The cloud-based nature of low-code platforms ensures a flexible and continuous service of the applications. This helps ensure reliability and responsiveness to a customer’s ongoing needs.

    Choosing the Right Low-Code Platform

    Identifying the best low-code software development platform is based on several key factors that developers must consider:
    ● Ease of use
    ● Scalability
    ● Integration capabilities
    ● Ability to customize applications

    Decision-makers must also consider their team’s expertise when choosing a low-code platform. Trial versions or free tiers can be beneficial for understanding the team’s expertise and a platform’s capabilities to meet an organization’s needs.

    The Future of Low-Code Platforms

    As businesses continue to navigate the complexities of digital transformation, analysts predict a bright future for low-code platforms. The trend will be continued enterprise adoption to ensure faster development and specific business needs. It’s also clear that low-code platforms will only partially replace traditional software development. But by democratizing app development and fostering a more robust culture of innovation, low-code platforms are positioned to significantly shape the future of business in the digital era.

  • ReversingLabs Applies AI to Better Secure Application Binaries

    ReversingLabs Applies AI to Better Secure Application Binaries

    ReversingLabs this week launched a binary analysis tool that uses machine learning algorithms to identify risks before and after applications are deployed.

    Erik Thoen, vice president of product management for ReversingLabs, said Spectra Assure makes use of the same core artificial intelligence (AI) technologies the company uses to discover malware within binaries to analyze the entire software package, including first-, second- and third-party components, to identify potential threats.

    Thanks to the use of AI, Spectra Assure is able to scan applications that are gigabytes in size in minutes or hours, depending on their complexity, noted Thoen.

    That approach is critical because attacks launched against applications are more often aimed at binaries that are deployed in production applications rather than the source code used to create them, he added.

    In addition, Spectra Assure can be applied to both open source and proprietary software, said Thoen. In contrast, many legacy scanning tools are designed to only surface potential issues in open source software, he noted.

    Spectra Assure is designed to be used by both producers of software and the organizations that deploy software, said Thoen. Organizations that develop software need to be able to identify any security potential issues that may have arisen during the build process, while organizations that consume software need to be assured that there are no issues that will later compromise their IT environments, said Thoen.

    ReversingLabs is attempting to fill a gap that exists in many software supply chains between when a software build is completed and deployed, said Thoen. While developers may scan source code for vulnerabilities, it’s not uncommon for changes to be made during the build process that inadvertently create vulnerabilities, said Thoen.

    It’s still not clear which teams within organizations are assuming responsibility for the software supply chain. In many cases, DevSecOps teams are securing the software supply chain, but in other instances, cybersecurity teams have been tasked to lock them down. Among organizations that consume software, responsibility for application security might be assumed by either the cybersecurity teams or a procurement office responsible for purchasing software.

    Regardless of how software supply chain security is managed, the number of attacks against them has risen sharply. A recent ReversingLabs report found there has been a 1,300% Increase in malicious packages found in open source software platforms since 2020.

    Ultimately, it’s only a matter of time before more stringent regulations force the software supply chain security issue. A recent executive order issued by the Biden administration requiring federal agencies to secure software supply chains is a harbinger of stricter controls that enterprise IT organizations must implement. DevSecOps teams, in the meantime, have an opportunity to revisit the workflows that were created in an era where developers tended to overly trust the integrity of software components downloaded from open repositories.

    Of course, it may require a catastrophic event to truly galvanize organizations into action, but one way or another, application security is going to improve. The only issue remaining to determine is how expensive a proposition that will be given the potential fines that are likely to be one day levied.