devopsy.kinsta.cloud

Tag: low-code applications

  • 5 Ways Low-Code Accelerates Digital Transformation

    5 Ways Low-Code Accelerates Digital Transformation

    Organizations traditionally have struggled with build-versus-buy decisions when digitizing their internal operations and processes. While the build option offered the benefit of using internal teams or outsourcing to external vendors who could satisfy requirements, the downsides are a long wait, higher costs and the constant change and maintenance applications require. On the other hand, buying solutions off-the-shelf meant that the costs were lower but the businesses would have to change or adapt to already-crafted solutions; not all businesses could adhere to a one-size-fits-all solution. 

    This challenge often resulted in only the highest-priority and big-budget applications or tools seeing the light of day while others were put on the back burner—even if those back-burnered tools could have improved productivity and user experience.

    Enter low-code platforms. The adjacent skill phenomenon enables users with similar fundamental experience but in different niches—think web developers and designers—that, when provided with a drag-and-drop tool can supplement their experience to move up the value chain and become full-stack developers.

    In a similar way, low-code platforms enable backend engineers to use drag-and-drop tools to build UI and business logic quickly. This translates into full-stack skills and makes frontend engineers redundant for internal tooling. With low-code and no-code tools, backend engineers can create dashboards, CRUD apps, transactional systems, processes and workflows built on top of existing data sources like databases, connected via APIs, housed in third-party tools etc. These solutions can easily be created and deployed in a matter of hours instead of weeks or months or, worse, back-burnered and doomed to never see the light of day. 

    How Does Low-Code Accelerate Digital Transformation?

    Given that most businesses are struggling to find the right tech talent, they need to explore new approaches to meet the demands associated with digital transformation. Low-code helps by making coding less burdensome and reducing the time and resources spent in building digital solutions. Anyone can develop apps regardless of their technical expertise and, therefore, contribute to the acceleration of digital transformation. 

    Here’s a look at how low-code solutions are accelerating digital transformation.

    Accelerating Visual Development  

    Low-code platforms can reduce turnaround time for building new apps by 90%—from well over six months to under four weeks.

    Developers and non-developers alike can use drag-and-drop functionality to build frontend applications on the fly. A major capability low-code platforms provide is the ability to build functional prototypes of possible solutions and test them quickly. Low-code platforms help unlock innovation by giving low-code platforms to business users who know and understand operational challenges best. Business users can create functional prototypes and iterate toward fully functional applications.

    How? Visual drag-and-drop interfaces, ready connections to data sources and APIs, point-and-click workflow designers and baked-in security. By taking away much of the boilerplate, most low-code app development projects are delivered with little to no coding required in a short time. 

    Along with a catalog of pre-built components and pre-configured modules, component reusability is another advantage of using low-code tools. Using standard UI components such as menu bars, buttons, form sections, etc. allows a user to take advantage of pre-built UI components and merge them into a full-fledged application.

    Democratizing App Development

    Gartner found that the demand for business-related apps is five times higher than the available IT capacity.

    That means the talent gap is one of the biggest hurdles to digital transformation. By turning a large number of semi-technical employees into citizen developers, companies can empower teams to create high-quality digital solutions for everyday operations while still meeting IT security regulations and addressing cybersecurity concerns. Low-code offers an intuitive user interface to design applications, websites, workflows and automation recipes. Some of the more refined low-code platforms also support backend integrations; meaning users can connect their digital solution to multiple data sources and produce unified web portals. 

    So, in addition to increasing the development resources, citizen developers can also help to accelerate business value. While they create business apps, the more complicated digital issues can be managed by the IT department. 

    Easy Data Integration

    Customization is the best way to extract the maximum value from existing systems. 

    Tools built using low-code technology are highly customizable and scalable. Low-code platforms enable the rapid creation of purpose-specific applications, which, via API connectors or building middle layers, can be “stitched” together with legacy applications to create end-to-end products. With easy-to-use API and database integrations, this allows teams to integrate with any pre-existing enterprise software such as ERP, CRM, custom applications and databases and extract the richness from their core legacy investments. 

    Reduced Costs and Scalability

    Many enterprises have project backlogs that cost them billions of dollars in opportunities. Because they can’t find the right talent or software to address business opportunities fast enough or give them priority over other tasks. Low-code can help reduce backlogs by helping your development team get more done in less time.

    Low-code development turns application elements like pre-built UI components, integrations and custom logic into visual building blocks that are easy to copy and repeat. Ready connections to multiple data sources allow users to easily connect to data from different business functions and scale the application. 

    A low-code approach simplifies the work required to scale and maintain apps across the entire enterprise or for millions of customers. The developer can build something once and implement it everywhere in minutes. Easy cloud deployment makes it easy to extend the application from one geographic location to another.

    Eases Application Life Cycle Management 

    The main aim is to produce flexible, cost-effective and rapid applications that are adaptive to enhancements and less complex in terms of maintenance. Low-code development accelerates application delivery by enabling users to deploy applications in just a few clicks, without relying on DevOps or engineering teams. 

    Depending on the platform, all the stages of the application life cycle—development, deployment, monitoring, maintenance, updates—can be performed from a single point in real-time, ensuring security, compliance and version control.

    The maintenance phase of software is vital to be able to quickly change what already has been developed to guarantee that the app continues to serve the purpose the business requires. The essence of low-code is that, as the name suggests, there is less code; therefore, there is little code to maintain.  

    The Future of Low-Code and Digital Transformation 

    All kinds of organizations across all industries are seeking new ways to meet challenges and increase business performance as a result of digital transformation. Introducing low-code/no-code enables businesses to be bolder and more experimental when executing on their ideas. This is digital innovation in action.

    Businesses are already leveraging low-code to get ahead of their competitors by increasing business agility and improving efficiency. This technology is giving IT teams the potential to also get rid of old silos between business departments. 

    Low-code has been helping enterprises overcome the lack of access to relevant resources to meet their business needs. By speeding time-to-market for digital products, low-code helps businesses respond to market dynamics faster while being more efficient. 

    Every organization should take advantage of these opportunities and adopt a low-code platform for accelerating productivity and achieving faster results, apps and tools. In the words of Chris Wanstrath, CEO of GitHub, “The future of coding is no coding at all.”

  • Low-Code is Table Stakes for Enterprises

    Low-Code is Table Stakes for Enterprises

    Enterprises across all industries are facing mounting pressure to deliver business value with speed and agility. In the digital age, companies that can’t keep pace often fall to the wayside, especially in light of increasing customer expectations and dynamic regulatory requirements.

    Speed has become table stakes. And business leaders have risen to the challenge across the board—focusing on efficiency and streamlined operations. However, despite enabling speed, many organizations still struggle to deliver value and continuously improve performance using technology.

    Traditional software development methods can no longer keep up with the demands of modern users. And so, to achieve speed and generate significant value, business leaders must leverage customized software with low-code capabilities, thereby empowering professional IT developers to develop and deploy business applications rapidly and seamlessly.

    Speed is Table Stakes, But So is Low-Code

    Low-code application development is certainly not a new phenomenon—in fact, the term low-code was originally coined in 2014. However, since its advent, an amalgamation of digital disruptions, hyperautomation and new technologies has led to an exponentially rising demand for low-code tools.

    According to Forrester, “Low-code development platforms are emerging as a key strategy to accelerate app delivery to support digital business transformation. And they have the potential to make software development as much as 10 times faster than traditional methods.”

    So, not only is low-code an absolute imperative in today’s business environment, it is the key to unlocking speed and agility in your operations.

    Fabrizio Biscotti, research vice president at Gartner, further states that, “Globally, most large organizations will have adopted multiple low-code tools in some form by year-end 2021. In the longer term, as companies embrace the tenets of a composable enterprise, they will turn to low-code technologies that support application innovation and integration.”

    What Does Low-Code Mean?

    When you Google “low-code” you’ll find a number of different definitions. Low-code means different things to different people, depending on their industry, their business needs and their experience with IT.

    Perhaps the most common interpretation of “low-code” refers to “no-code” development, wherein citizen developers are enabled with declarative, drag-and-drop tools to create applications without having to depend on IT.

    This type of low-code works well in cases where users are attempting to streamline simple workflows and automate standardized use cases. However, when business needs become more complex, the “no-code” approach can fall short.

    A low-code platform, in the truest sense, offers a broader and deeper set of capabilities, enabling professional IT developers to use a modeling-driven environment to rapidly develop and deploy mission-critical applications and address complex, content-driven business needs.

    Generating ROI From a Low-Code Platform

    The right low code platform enables far more than just speedy app development. By investing in one comprehensive low code platform, you can:

    • Simplify your complex, content-driven business needs
    • Enable mobile app development
    • Develop customer-facing and customer support applications
    • Streamline internal workflows
    • Create transaction-oriented standalone applications
    • Develop content-driven workflow applications
    • Modernize legacy systems
    • Reinforce backend systems to handle larger volumes of data and transactions
    • Build portals for internal and external users
    • Deliver an enhanced customer journey across multiple touchpoints
    • Deploy your applications in a cloud-based or hybrid environment
    • Scale your applications with agility

    Low Code is Here to Stay

    Gartner predicts that “Low-code application building would gather more than 65% of all app development functions by the year 2024 and with about 66% of big companies using a minimum of four low-code platforms.”

    So, not only is low code a business imperative today, it is only increasing in utility and ubiquity as we move into the future.
    For enterprises striving to stay on the cutting edge, the right low-code platform is an investment that will keep on generating significant returns. From enabling speedy app development to providing the agility and scalability to keep up with dynamic business needs and customer expectations, low-code is the key to continuous innovation and ongoing success.

  • How Low-Code Makes DevOps Stronger

    How Low-Code Makes DevOps Stronger

    While its roots can be traced back to rapid-application development (RAD), low-code application development started to gain serious momentum about three years ago. Initially, some in the DevOps community dismissed the trend, even as myriad approaches—from no-code to low-code for professional developers—started to enter the market.

    At the time, enterprises of all sizes had embraced agile software development processes, moving to cloud infrastructure for some critical workloads and using test automation tools widely. DevOps emerged as an essential discipline, and it was assumed that its dominance would overshadow low-code.

    Fast forward to 2021, Gartner predicts that the low-code development market will increase by 22.6%, to a total of $13.8 billion in one year, so it’s clear that the obituary for low-code was premature. The growth of the low-code market hasn’t restricted growth of DevOps, either. Thousands of medium to large enterprises either are already adopting or planning to adopt low-code for professional development, and DevOps’s growth continues. Low-code platforms for professional development haven’t replaced the DevOps model; instead it places an emphasis on a robust software development life cycle working with the business and IT to increase the velocity of transformational digital experiences.

    The Need for Speed

    During the early days of the COVID-19 pandemic, many organizations were compelled to accelerate their digital innovation to adapt their business activities to the new normal, or find new ways to compete against more nimble competitors to stay afloat. To enable delivery of their services to suddenly distributed customers and employees, they began to switch to low-code development platforms to deliver solutions faster.

    Low-code software is easy customizable, can fit any organizational needs, doesn’t require in-depth coding skills and speeds up development. Low-code platforms feature a host of pre-made tools to develop an app in a matter of hours instead of weeks or months.

    Some low-code development platforms feature integrated DevOps services and automated testing capabilities. Cutting edge platforms use AI to generate test cases to be executed on the cloud as part of the continuous integration/continuous delivery (CI/CD) pipeline). While these platforms It don’t replace developers, they can help to automate their work so they can focus their time on new features and big ideas, rather than on coding repetitive but essential tests, or on figuring out the back end complexities.

    A Confidence Booster

    With a low-code platform, DevOps teams get automated tools for testing, deployment, security, data management — all of the back end development necessities — plus front end and design capabilities. This is a very different set of skills and expertise, but using low-code platforms to simplify development processes allows almost any developer to work on any app through its full life cycle.

    Even if an aspiring coder from the organization’s marketing team builds an internal app, DevOps team won’t have to worry about build validation or version control, because low-code enables a continuous process.

    One small DevOps team can efficiently and confidently manage building and deploying an app from any developer. It can also deploy these apps across multiple devices — with very little upskilling of different programming languages required. Low-code platforms include pre-wired components, templates and sample apps for smart speakers, wearables, AR, PWA, native mobile and other real-world use cases.

    Strategic Focus

    Once low-code frees the organization’s DevOps teams from repetitive tasks and eases workload burdens, teams can concentrate on more complex problems, like upgrading and maintaining existing enterprise-class apps — enterprise resource planning comes to mind — or work on other high-value digital and operational strategic initiatives.

    Long Live DevOps and Low-Code!

    Low-code for professional developers is best suited for developing consumer-grade mobile and multi-experience apps. Whether an organization is trying to digitize an old process or create new ways to engage with consumers, business partners, customers or employees, low-code development helps organizations be more responsive and agile — just like a good DevOps culture. With the ever-rising demand of a digital economy and the subsequent shortage of development talent, by adopting the velocity of low-code development approaches, we can enhance the power of the developer (and the DevOps) models to meet the next business challenge.

  • Is Low-Code Development a Security Risk?

    Is Low-Code Development a Security Risk?

    According to Gartner, the worldwide low-code development market is projected to be $13.8 billion in 2021, a whopping increase of 22.6% from 2020. Gartner also predicts that the surge in remote development during COVID-19  will continue to boost low-code adoption, despite budget cuts and efforts to optimize cost.

    Low-Code’s Popularity Among Professional and Citizen Developers

    Low-code is no longer the new kid on the block. From simple dashboards to complex applications, low-code applications are becoming more and more diverse, with mainstream adoption in the enterprise world. In essence, low-code is a visual paradigm of application development that involves drag-and-drop of pre-built components and integrations resulting in fast, easy and less-error-prone development.

    The advantage of low-code is that it enables users from a non-traditional development background to participate in the app development process, thus democratizing development and accelerating project timelines. It also narrows the demand-supply gap that arose as organizations catered to ever-rising digitization needs with limited resources and developer scarcity. Many low-code platforms make it easy for citizen developers (business analysts, line-of-business users, junior developers, for instance) to build applications while drastically reducing delivery time compared to traditional coding methods.

    But citizen developer productivity and speed are not the only benefits of low-code development. Today, low-code platforms also come with capabilities purpose-built for professional developers from enterprise IT teams to ISVs. These platforms are hardened for enterprise use, are able to leverage the scalability and security needs of a complex application and have integration capabilities mature enough to seamlessly fit in with existing tools and technologies. During the COVID-19 pandemic, many businesses reinvented themselves through adoption of low-code platforms and applications that helped them adapt to the sudden shift to a remote work scenario and enable the necessary modern application needs that came with it.

    Security Challenges with Low-Code and Remote Work

    Compared to traditional development, low-code involves a variety of personas working together to build applications while dealing with automatically generated code, ready-made components and built-in default configurations. This shift in environment revealed some unique challenges that need to be addressed. There are a few common security challenges with remote teams building on low-code.

    Application Development and Remote Team Collaboration

    • Lack of security awareness: Low-code users come from both business and tech backgrounds. Some practitioners aren’t familiar with application security best practices and lack awareness and understanding of potential vulnerabilities and security holes.
    • Platform access and admin controls: Low-code is deployed centrally and available for users across an enterprise via browser access. This introduces a risk of network intrusion; providing access to unauthorized developers and opening up greater permissions to users that do not need it when accessing the platform remotely.
    • Code repository and team collaboration: Low-code platforms must ensure that the automatically generated code can committed to enterprise-sanctioned repositories. This code access shouldn’t be misused, and ought to have sufficient protocols in place for code control and upgrades.

    Code Generation and DevSecOps Best Practices

    • Securing custom code: Low-code tools allow for writing custom code to extend and enforce platform coding guidelines and design patterns to protect sensitive data from unauthorized access.
    • Adhering to secure release practices: Integration with the existing enterprise CI/CD pipeline is important so that dev teams can extend the same release governance protocol to the auto-generated code before going to production.

    End User Application Access and Data Protection

    • Preventing malicious attacks: Today, both web and mobile apps are becoming constant targets for security breaches. Automatically generated code, and citizen developers working remotely, can make low-code applications more prone to vulnerabilities. Platforms should generate apps that are fully protected against phishing attacks, SQL injections, brute force attacks and DOS attacks.
    • Secure data and application access: Low-code platforms should provide a comprehensive access control mechanism preventing unauthorized access to data and app functionality. With remote teams accessing apps from anywhere, at any time and from any device, data breaches can be prevented with the right controls in place.

    Low-Code and Security – The Future of Development

    As enterprises and ISVs turn to low-code for more serious use cases, the larger question still remains. Can low-code platforms enable modern development teams to deliver applications faster, while still enabling a secure and tightly governed environment?
    The answer is, yes, they can! However, development teams must consider the following security checklist when considering low-code platforms:

    1. The chosen low-code platform must be set up within an enterprise secure DMZ or secure private cloud, and must effortlessly pass cybersecurity clearances.
    2. The platform must enforce best practices in programming (coding conventions, design patterns and data encryption) for automatically generated code as well as custom code written by the developer, facilitating easier integration with existing CI/CD processes and tools.
    3. The platform must offer full protection against the top 10 OWASP vulnerabilities for web and mobile apps, and have third-party certifications to guarantee code quality and security. Also, organizations should ensure that there are no vulnerabilities in their chosen platform’s binaries, as well as all third-party dependencies (including open source libraries) as listed in the CVE library.
    4. The solution must support multiple authentication providers (database, LDAP, AD, SSO, SAML, Open-ID, multifactor, biometric) to build applications with strong user security. For user authorization, ensure support for both coarse-grained as well as fine-grained access control policies to protect various aspects of the application based on RBAC.

    Development teams can embrace low-code technology while ensuring security best practices are in place. Low-code is here to stay, and with the right platform, enterprises and ISVs can make sure security is shifted left and addressed by developers much earlier in the development process. The result is a highly productive, remote workforce churning out applications that are modern, scalable and secure.

  • How Low-CodeOps Can Transform DevOps

    How Low-CodeOps Can Transform DevOps

    Over the past year, enterprise adoption of low-code software development platforms surged across the world economy as COVID-19’s economic consequences drove an unprecedented number of digital initiatives. Enterprises are turning to low-code platforms to rapidly build new apps that empower customers, remote workers and external end users conducting business operations or pivoting to new opportunities.

    Accelerating software development, however, only solves half the puzzle of a digital-first approach. Quickly getting solutions into users’ hands requires careful planning to determine how these new applications will function within the organization’s overall software operations strategy. This is often conducted across multiple cloud deployments.

    But the real prize comes when low-code’s underlying principles of automation and abstraction are extended into the DevOps domain of software maintenance and management. The ability to push out a continuous pipeline of software updates with the click of mouse, with streamlined testing and quality assurance, requires a platform that automates myriad, time-consuming tasks associated with building, testing, releasing and maintaining applications in an enterprise-grade production environment. This inevitably leads to the concept of “low-code operations;” or, to coin a phrase, “Low-CodeOps.”

    Indeed, unless the benefits of abstraction and automation — in this case, primarily speed — extend to operations and deployment, the real benefits of low-code development are elusive. A platform that lets you build an app in six days but requires six months to deploy is no solution at all.

    Harnessing the Cloud for Game-Changing Results

    To witness the vital role seamless cloud operations played in business innovation, look no further than biotech giant Moderna and its success in Operation Warp Speed. Moderna used the public cloud to pull together geographically dispersed collaborators, integrate scientific insights and refine its production cycle, enabling the company to deliver its first batch of mRNA vaccine samples a mere 42 days after the COVID-19 virus genome was sequenced. The time-to-value for this solution was definitely warp speed.

    And, it’s safe to assume, expensive. Cloud engineers and DevOps system administrators are highly skilled specialists who roll up their sleeves at 2 a.m. to fix unexpected glitches buried deep in the connected ecosystem of software operations. They figure out how to make the software actually run. Enterprises, no doubt, wish they could hire more of them.

    But the same shortage of skilled IT professionals that fueled today’s demand for low-code software development also impacts DevOps. In this case, the same low-code platform is the solution, empowering a wider cross-functional, collaborative team to reduce operational burdens — in a word, Low-CodeOps.

    Essential Features of Low-CodeOps

    To achieve a frictionless handoff when moving applications and data to the cloud, a production environment leveraging low-code principles will deliver on these key principles of low-code operations:

    Performance monitoring: Daily monitoring and log checks of platform infrastructure are the backbone of modern DevOps operations, ensuring that complex interdependencies are running smoothly. Automated dashboard monitoring can transform hours spent on these repetitive tasks into opportunities for engineering teams to focus on innovation, while still ensuring the health and performance of enterprise software portfolios. The tooling needs to enable automated end-to-end visibility into application workloads and performance characteristics of upstream and downstream services.

    Compliance: Every economic sector is subject to specific government regulations. Software platforms and DevOp teams must keep track of every requirement when integrating new functionality into software upgrades. Banking customers must deploy digital solutions on infrastructure that’s earned ISO/IEC 27001 certification. Healthcare solutions must conform to federally mandated HIPAA requirements. Defense contractors must be FedRAMP certified. Data—the lynchpin of any digital solution—is subject to privacy laws that differ across nations and borders. Imagine having to manually recheck every iteration of your application deployments for compliance. Luckily, low-code operations mean having an automated, system-wide compliance framework in place. This makes short work of service organization (SOC) audits and reporting.

    Security: Cyberattacks that lead to system outages and disruptions are a growing concern in our digitally connected world. Well-resourced cloud giants are not exempt from damaging cyberattacks, such as last year’s SolarWinds hack. Resilience is key. Ongoing security scanning can halt automatic software deployments when suspicious changes are detected. Prevention is always best. Monitoring tools identify vulnerabilities, enabling systems to quickly come back online and help prevent outages that can last for hours or days.

    Infrastructure independence: Widespread enterprise adoption of multi-cloud and hybrid cloud for operational efficiencies has made flexible infrastructure the new standard. Organizations are bypassing single-vendor lock-in to spread workloads across multiple cloud partners. That means DevOps needs streamlined configuration and management tools that can track relationships between resources and keep track of compliance issues. Geopolitical considerations may enter the equation when cloud providers turn out to have close ties with governments antagonistic to other global trading partners. Monitoring instruments that provide observability across the range of vendors consuming enterprise data and applications is mission-critical.

    Resilience: Snafus happen. Platforms can automate continuous domain-level metrics to correlate performance from different sources (including logs, metrics, application tracing and outside penetration testing), speeding up detection and response time. Fast auditing and debugging tools, combined with real-time dashboard monitoring and system-wide alerts, plus an ounce of detection, equals a pound of cure. For agile DevOps teams, reactive firefighting is transformed into resilient firepower.

    Adopting an All-in-One Low-CodeOps Approach

    Low-code’s power to enable frequent iterations of software ideation, creation and deployment may seem contrary to the DevOps mission to minimize risks. However, the same radical abstraction and automation that has made software development faster, higher quality and more accessible to a larger cohort of developers can also reduce the operational burden of landscape management. Every low-code vendor touts the governance features in its platform. But the nuts and bolts of governance require some assembly, including system-wide actionable monitoring, testing alerts and compliance safeguards. Low-CodeOps combines the most efficient, agile, flexible development platform and powerful, streamlined operations tools, infusing both domains with solid guardrails for operational control and predictability. Adopting this approach will greatly increase time-to-value for enterprises, putting innovative digital solutions directly into the hands of end-users with the click of a mouse.

  • Low-Code and DevOps: Friends or Foes?

    Low-Code and DevOps: Friends or Foes?

    What does low-code mean, and who is it really for?

    Over the last few years, I’ve seen many articles associating “low-code” with “citizen developers” or with people who don’t have deep development skills. Users can arrange visual elements, or fill in forms with key information and publish the result as an application.

    But tools for citizen developers are only one part of the low-code story. There is also a growing number of tools for professional developers, and I want to talk about those, too.

    Both citizen developers and professional developers have a role to play in application development and automation projects, and low-code has something to offer both of them.

    Low-code is Not a Market, it’s an Approach

    Low-code does mean providing visual and graphical tools and simple frameworks that mask more complex coded operations, so the application designer does not have to directly touch the code that performs desired operations. These apps are naturally limited, as the resulting application can’t be highly customized if you can’t touch the code.

    With these kinds of visual tools, anyone can create a simple application within the limits of the tool. But when we pull back and look at what is needed to create larger, more complex applications – ones that need to communicate with other enterprise systems, or need extensive customization, or cross organizational boundaries, or need to pay attention to governance requirements, for example – the visual-only approach is frequently insufficient. In complex cases, developer expertise is often needed, and developers have to get “under the hood” to tinker with code.

    There is no “low-code market.” We are bringing tools to people who need them to develop specific projects. A comprehensive low-code approach to application development and automation means offering both visual programming and coding capability. For usability reasons, these tools are clearly separated and presented to the development team in a way that allows citizen developers to work on certain elements and developers to work on others, all on the same platform.

    We know that it’s possible to serve professional developers with low-code, too. A low-code approach also includes drag-and-drop tools that developers can use – for example, to develop APIs, or to integrate the application with other systems, or to customize front-end interfaces. Of course, when code is required, developers should be able to use their own tools and frameworks and not be limited by low-code tools. Platforms that offer a hybrid approach are likely to be most useful to mixed-skills development teams.

    The Hybrid Approach

    Strictly low-code tools can serve simple automation use cases. More broadly, automation platforms offer a hybrid of low-code and coding capabilities for more complex automation use cases.

    For critical enterprise applications, both business and developer inputs are usually needed. Having tools for both of them means not leaving anyone out.

    Low-code tools will continue to become more mainstream. Low-code is not a fad or a passing trend, but a quiet revolution that will see greater incorporation into more business tools.

    Here Come the Digital Natives!

    More vendors are offering low-code tools for digital process automation, business intelligence, robotic process automation, identity management and data integration, to name just a few.

    As automation platforms and other low-code tools mature, a greater number of people are getting used to working with them. Developers are less hesitant about incorporating non-developers into their teams, as everyone gains a better understanding of the benefits of these platforms.

    The younger generations entering the workplace today are digital natives. They are fearless about diving into technology and working hands-on. So, these low-code tools are ready for them, and they are ready to put them to work.

    Low-code is breaking down technical barriers to work in the automation space, making smooth collaboration between business and development easier.

    Low-Code Can Be a Double-Edged Sword

    Automation and development teams are also becoming more aware of vulnerabilities and compliance issues as citizen developers roll up their sleeves and join the technical team.

    Low-code tools are a double-edged sword. They facilitate teamwork, but issues with security and data governance may not be top-of-mind for non-developers. If you have a big team working on automation and/or application development and delivery, the need to build in governance becomes even more important.

    Using a shared platform will help manage and mitigate these issues with security and governance. This will become even easier as the platform tools evolve and mature, so DevOps teams can use them to help mitigate some of these issues.

    Does Low-Code Have a Place in DevOps?

    We are definitely seeing the impact of low-code on development environments and DevOps. Remember, low-code started with small applications, and while DevOps-style teamwork and workflows may not be needed there, as the use of low-code platforms becomes the norm for critical enterprise projects, DevOps will be a necessary part of the mix. This is where low-code is having a more obvious impact; Agile methodologies using low code platforms for iteration, for continuous improvement and for continuous delivery. These applications aren’t one-and-done. They need to be maintained, improved and delivered, again and again.

    Low code isn’t going away. On the contrary – it’s going everywhere.

  • Manufacturing Workers Eager to Digitally Upskill

    Manufacturing Workers Eager to Digitally Upskill

    Anyone who has worked in machining within the past 70 years knew that the future of machining was automation. In the 1940s, computer pioneer John T. Parsons and engineer Frank L. Stulen invented, via a contract with the U.S. Air Force, numerical control milling machines. The machines were designed to help the Air Force produce geometrically complex parts more economically and accurately.

    Those machines were the precursor to today’s computer numerical control (CNC) machining tools that use programming to automatically process some material, such as metal or wood, to specification. By the late 1980s, such machines were standard within tool and die, machine shops and manufacturing floors. Today, such digitization of manufacturing is accelerating.

    Workers, for the most part, embrace the change and would do more to meet the technical skills demands needed for their jobs – if only their employers supported them. That’s the primary finding from a survey, Digital Illiteracy in the Factory: Providing Workers with Low-Code Tools, commissioned by low-code platform provider Mendix.

    Interestingly, today, low-code development tools are finding a home in manufacturing. According to the survey, nearly 9 out of 10 said they want to learn low-code software development, while only 3% currently use low-code in their jobs. More than two-thirds (67%) say they want to create a software app that would solve work issues. According to this survey and a parallel survey conducted in Europe, U.S. workers are more willing to welcome and contribute to workplace digitalization than their counterparts in Germany (78% versus 61%) — a surprising result, given that German manufacturing workers enjoy a reputation as some of the most skilled in the world.

    “Incorporating digital applications is vital to the ongoing competitiveness of manufacturing in the U.S., and it is heartening to see such a large percentage of the manufacturing workforce ready to contribute to this effort,” Gardner Carrick, vice president of strategic initiatives at The Manufacturing Institute said in a statement. “Low-code applications provide our workforce with the tools to contribute to this digital transformation, and we should prioritize training in these skills.”

    The survey found that 87% of U.S. workers want to learn low-code development, and within those respondents, 88% of women who responded indicated being very interested in learning low-code, while 51% of men responded in kind. Perhaps not surprisingly, younger workers are more interested in learning low-code than those nearing retirement.

    That may be so, but U.S. manufacturing employers aren’t getting the memo. The survey found that U.S. manufacturers are giving their workers little help in developing their digital skills, and only 18% of workers are happy with their digital skills. “That only 18% are happy with their digital skills is just one sign that more training is required. At a time when the country’s manufacturing industry remains mired in a decades-long slump and when managers clamor for more useful software applications, news reports indicate that the nation’s workforce is ill-equipped to deal with writing code,” Mendix said in a statement.

    “The United States needs to move now to get their workers into the digital game,” said Derek Roos, Mendix CEO. “If the country wants ‘Made in the USA’ to mean something again, and if it wants to reduce unemployment and keep its economy vital and thriving, manufacturing and industry should provide low-code and other tools that help bridge the digital divide.”

    The survey was conducted from Jan. 29 through Feb. 11, among 250 full-time manufacturing workers in the U.S. and 250 within Germany. The survey’s objectives included learning workers’ attitudes and motivations, as well as obstacles that prevent them from acquiring low-code and other digital skills.

  • Citizen Development Program: Establishing Guardrails

    Citizen Development Program: Establishing Guardrails

    Citizen development is as easy as one, two, three.

    1. Select the right use cases
    2. Enable the citizen developer(s)
    3. And establish the guardrails, which I will cover here.

    Of course, there is a little more to it than this. Success requires focus, planning and patience. We previously discussed, in parts one and two of the series, the discipline required around use cases and citizen developers (CDs). This third and final post covers how to establish the appropriate technical and process guardrails to ensure the wider enterprise, platform and developers are protected.

    Establishing the Guardrails

    Guardrails exist for two primary purposes: alignment and independence. Clear and concise guardrails ensure alignment across organizational objectives, company policies and disparate teams. Those same guardrails provide CDs with a degree of independence – a safe operating space where they will not be micromanaged or unnecessarily burdened by processes.
    Effective guardrails define and enforce a range of acceptable behaviors, as well as reduce risk and speed application delivery.

    While low-code application platforms (LCAPs) each have their unique capabilities and technical implementations, relevant features can be viewed in three broad categories: platform foundation security, app dev access control and development tools & processes.

    Within the context of your specific LCAP and development methodology, you need to consider and answer the following questions:

    Platform Foundation Security

    • How will you provide your CDs a “safe” environment to build and test their applications? Does your platform support separate and secure development, test and production environments? Will you put your citizen developers in their own discrete development environment?
    • Will your developers be working with data that requires encryption and/or localization? If so, does your platform support data encryption and compliance with relevant data residency laws?
    • Does your LCAP support anti-virus scanning and/or HTML sanitization, and if not, how will you prevent a CD from inadvertently putting your organization at risk?
    • What logging and auditing is required for your CD activities? Who reviews logs? How long is the information kept?
    • Does your platform support enhanced security mechanisms like two-factor authentication (2FA) or virtual private networks (VPNs)? Will citizen developers be working in areas or with applications that require enhanced security?
    • Are there other risk, compliance and security standards that your organization mandates? If so, how will you incorporate them?

    App Dev Access Control

    • How will you provision or deprovision developer and tester accounts? How will you handle developer login and authentication into the development environment?
    • Will CDs have development access to downstream environments across testing, staging and production?
    • Will you use groups to control access to applications in development, and if so, who will manage these groups?
    • Will you use roles to grant access to distinct development capabilities like tables, workflows, UIs, mobile, reporting, analytics, etc.? What determines which role(s) a citizen developer is granted?
    • Will you provide a library of pre-built application components (e.g., workflows, dashboards, virtual agents, etc.)? How will you control access to and usage of the pre-built components?
    • Will you allow citizen developers to access pre-built integrations? How will you control access to and monitor usage of those pre-built integrations?
    • Does the developer identity and access management process need to be driven by an enterprise identity provider, such as Azure Active Directory?
    • Will citizen developed applications be able to access other citizen developed applications? How will app-to-app access be controlled?

    Development Tools and Processes

    • How will you manage your demand intake process? How will you ensure that new applications do not duplicate existing application functionality? What criteria will you use to determine if an application is a good fit for a citizen developer?
    • Will you require your CDs to adhere to all, some or none of your existing development methodology? Can you explain the methodology in terms the citizen developer will understand and accept?
    • Will you require CDs to create requirements or agile stories before building an application?
    • Will you require tests be developed for CDs’ applications, and if so, can these be automated? Who will develop those tests?
    • Will you require code or application reviews of citizen developed applications? What best practices and standards will be used during those reviews? Can those reviews be automated?
    • What level of documentation, if any, will you require developers to produce?
    • How will you promote applications through the development pipeline (i.e., dev to test to prod)? Can the app promotion process be automated?
    • How will you track and manage CDs’ applications through the development pipeline and their life cycle?

    Reflections on Citizen Development Programs

    The exercise of writing this series and your feedback has encouraged me to reflect on parts one (selecting the right use cases) and two (enabling citizen developers). Here are a few final thoughts to consider:

    • Do you care that a CD builds just one app or do you want them to build more?
      Ideally, a CD continues to deliver app after app. But attrition can be high in a CD program. Therefore, if your CD built a single application that delivers business value and then returned to their “day job,” you should still celebrate that success.
    • Is citizen development better suited for creating new apps or maintaining existing apps?
      In my view, the answer is both. LCAPs provide great opportunity for CDs to prototype or even produce an MVP of an application. At the same time, LCAPs allow professional developers to build more complex applications and turn the maintenance of those applications over to CDs.
    • How many LCAPs can you reasonably expect a citizen developer to understand?
      Realistically, perhaps one, or maybe two. Keep in mind that app development is important, but having CDs focus their technology choices on a single LCAP vastly improves their chances of success.
    • Do citizen developers make good professional developers?
      Consider this – some of the best developers I have worked with do not have computer science or software engineering degrees. It’s more important that a developer has a passion for technology and, more importantly, for understanding how technology solves business problems.
    • Finally, explore and embrace citizen development before your competitors do, as the value proposition is real in this new world of work we have found ourselves in. After 30 years in enterprise IT, I can confidently say we’ve reached an inflection point in technology and business, truly democratizing application development.

    This post is the third of a three-part series from Mark Tognetti that provides real-world insights on delivering business value from citizen development initiatives.

  • How to Mitigate Low-Code Security Risks

    How to Mitigate Low-Code Security Risks

    Gartner predicts that by the end of 2025, over 65% of development projects will use low-code builders. The field of low-code continues to expand. But what security implications does low-code introduce?

    Low-code refers to tools that enable application construction using visual programming models. Adopting drag-and-drop components instead of traditional code, no-code and low-code platforms enables non-technical folks to construct their own workflows without as much help from IT. Yet, handing power to citizen developers with less security training can be risky. Plus, low-code platforms may hold compromised propriety libraries or leverage APIs that may unknowingly expose sensitive data to the outside world. There’s also the possibility that low-code could increase shadow IT if not governed well.

    Low-code opens the door to more producers. But, does it open the backdoor, too? I recently met with Chris Wysopal, CTO and cofounder of Veracode, to discuss the growing security risk posed by low-code applications. According to Chris, hardening low-code environments involves a combination of compartmentalization, dynamic and runtime techniques, and adopting the “least privilege as possible” rule across the board. Below, we’ll expand on potential low-code risks and see what other methods Wysopal recommends organizations employ to secure the emerging low-code paradigm.

    Low-Code Security Concerns

    Verizon’s 2020 Data Breach Investigations Report (DBIR) found 43% of all breaches are connected to a vulnerability at the application layer. Thus, securing these applications, or in the case of low-code, the layer that generates them, is essential for business to function smoothly.

    When it comes to low-code, Wysopal notices a few key risk areas:

    Proprietary libraries with hidden vulnerabilities. By their nature, low-code platforms typically use a good deal of proprietary software, making securing them a bit opaque. These systems could involve a proprietary language, proprietary libraries and proprietary frameworks. If you trust a low-code platform, you place a lot of faith in the low-code vendor to have a strong security process in place.

    Some platforms do generate traditional code, which organizations can export to run on a Node.JS or Java server. Yet, this often involves a mix of code and proprietary libraries, says Wysopal. While you could run traditional static analysis on the generated code, you may miss some context.

    Lack of citizen developer security training. Citizen developers have little technical knowledge, let alone DevSecOps training. If runtime applications present vulnerabilities, expecting no-code users to mitigate them is unrealistic.

    API integrations. If low-code platforms expose an API or generate a web application via an API, the platform could be exposing sensitive data.

    Ways to Harden Low-Code Environments

    To respond to these areas, Wysopal offers some advice for securing low-code environments:

    • Perform static code analysis: Perform your own static analysis on any generated code and test for common errors. “Look at the code, and understand where it interacts with the outside,” Wysopal recommended.
    • Audit proprietary libraries: Whenever possible, Wysopal said he recommends pushing back on the vendor to question them on their application security standards and examine proprietary libraries for potential risks.
    • Verify partners: Similarly, take precautions when working with third-party partners around low-code tools. Partner tools should be carefully vetted and hold some sort of application security certification from the low-code platform.
    • Secure the API layer: Understand what APIs the application interacts with. These connections should be tested dynamically and automatically with an API scanner. Along your journey, consider these API security testing best practices.
    • Compartmentalize: Wysopal also recommends traditional isolation techniques. Consider more than just the application layer; Wysopal recommended isolating the app and running it in a virtual machine or a container.
    • Security training for citizen developers: Since citizen developers are typically not trained on appsec practices, hold security exercises to train them on fundamentals. A helpful demonstration could involve directly attacking an app to find flaws.
    • Apply the least-privilege-as-possible rule: When assigning user capabilities, whenever possible, use secure-by-default settings and allow access only to those that need it.

    By applying dynamic and runtime techniques, you may catch vulnerabilities, such as a cross-site scripting error. However, if you’re working with proprietary low-code systems, you may not be able to fix it immediately! You may have to send a request to the vendor and wait for the bug to be patched. Thankfully, most technology providers take more immediate action in response to bugs than to feature requests, Wysopal noted.

    Change the Attitude Toward Security

    On the low-code spectrum, there is the attitude that “people aren’t really doing mission-critical applications — they’re mainly doing prototyping, or back office automations,” Wysopal said. Or, since low-code applications often do not publicly expose an application, they are deemed low-risk and fall to the bottom of the security team’s inbox and list of to-dos. “We’re still in a world where people don’t secure all applications,” he said.

    However, these attitudes are a bit short-sighted, since “applications aren’t islands,” Wysopal said. Even if applications are intended for internal use only, phishing attempts could expose credentials and gain access to the network. Here, attackers could leverage sensitive resources or steal infrastructure for compute power.

    Thus, all low-code users should be aware of potential threats and change habits to address these risks accordingly. However, the onus is also on low-code vendors to sufficiently arm their systems. Having a vulnerability disclosure, bounty program and an easy means to accept bug reports from white hat security researchers will be necessary to continually patch issues.

    No-Code ≠ No-Bug

    Low-code continues to permeate more and more digital operations, opening up novel potential for citizen developers. While the low-code movement promises impressive returns, it also brings potential risk.

    To mitigate these concerns, we must level up our security understanding and evolve our approaches, Wysopal said. “Any application can have flaws and security bugs in them.” Just because you’re not writing a function in C and are relying on a visual programming model doesn’t mean you’re not introducing flaws.

    Disseminating the real risk of resources and dependencies, along with helpful consumer-facing documentation, will set the superior low-code platforms apart from the rest. Otherwise, putting faith in proprietary libraries will be a tough pill to swallow.

  • No-Code Tech and the Rise of Citizen Developers

    No-Code Tech and the Rise of Citizen Developers

    In today’s increasingly remote-first work environment, technical frustration affects all levels of an organization. Because of this, IT leadership teams are looking for new ways to empower and streamline their organizations through the use of innovative technologies. And with remote workforces on the rise, it’s an ideal time to implement new solutions that improve how employees interact and collaborate with each other.

    As a result, more organizations are looking to adopt no-code automation in an effort to streamline their workflow processes. By doing so, businesses empower the average employee to become a citizen developer – and with so much room for no-code solutions to grow, it’s safe to say the era of the citizen developer is just beginning.

    No-Code Solutions Empower Employees

    Behind-the-scenes operations are a major contributor to the success of any business. Time wasted on mundane tasks can limit productivity, which, in turn, can minimize output. For example, in the finance world, traders use code to automate financial data scans so they can find the correct information quickly and maximize their gains – transforming an hour-long task into a simple button click.

    The average employee, however, likely lacks the technical ability to create a function like this; and this is where no-code solutions come into play. With the proper no-code solution, any employee can implement solutions to refine and automate their own workflow processes – as well as processes across the entire organization.

    There are a few key benefits to doing this. First, an improved workflow means employees will have more time in their day to focus on the strategic, less-tedious tasks. Assignments that require critical thinking will receive the attention they deserve without being backlogged by other work. Another factor is the current state of the global remote workforce. Although this way of working has become the new normal, connecting to a video conference room to brainstorm or to facilitate meetings can still feel fruitless, at times. An improved workflow can enhance how these remote collaborations take place, and will unlock more potential for those involved.

    Improved operations can also help to achieve a better work-life balance for employees; freeing time to take more breaks and reducing the potential for burnout that so many have faced over the past year. Not to mention the positive impact more streamlined operations can have on creativity across the workforce, which is a crucial part of driving business success. An employee in the role of citizen developer can unlock a spark of creativity when they realize the power they have and the magnitude of what they can accomplish with no-code solutions.

    Let IT Teams Focus on What’s Most Important

    Aside from benefits to themselves and the business, citizen developers can have a positive impact on the IT teams within their organizations. In addition to keeping staff technology in working order through longer-form remote interactions, IT professionals must maintain and monitor a remote infrastructure that limits disturbance to company operations and maintain vigilance for security vulnerabilities that have surfaced due to remote work. With all of these factors in mind, the last thing IT teams should be worrying about is an employee’s effectiveness in their role.

    No-code solutions empower employees to take the reins on their own workflow processes and gives IT teams more time to focus on critical issues related to infrastructure, security and ultimately, business continuity. When employees use these solutions to their fullest potential, it’s a win-win situation. As a result of the pandemic, we’ve had a glimpse into the future of what the digital business world will look like, and we’re only in the early days of this transformation. The earlier employees are able to gain access to no-code solutions and step into their role as citizen developers, the better organizations will be in the long run.