Tag: low-code development

  • OutSystems Acquires Ionic to Further Automate App Development

    OutSystems Acquires Ionic to Further Automate App Development

    OutSystems this week revealed it has acquired Ionic, a provider of an open source framework that provides developers with a higher level of abstraction for building and deploying mobile and desktop applications.

    OutSystems CTO Patrick Jean said Ionic will accelerate the company’s ongoing efforts to extend the reach of its platform for building low-code applications without developers having to worry about, for example, the screen size of the device an application is deployed on it because the framework automatically right-sizes it. Ionic, in effect, will provide an extension to the platform that OutSystems already uses to automate the building and deployment of low-code applications, he added.

    In addition to its namesake user interface (UI) framework for building mobile applications that can run on multiple platforms, the Ionic portfolio also includes a tool for natively deploying web applications, dubbed Capacitor, and a toolchain for building web component-based design systems, dubbed Stencil. Collectively, these tools are used today by more than five million developers.
    OutSystems plans to extend the capabilities of these tools to make it simpler to deploy applications on both mobile devices and desktop systems, said Jean. The overall goal is to reduce the cognitive load that developers currently carry when they need to build and deploy applications that run on multiple platforms, he added.

    That capability will prove critical as more individuals beyond professional developers become involved in building, deploying and updating applications, noted Jean. In fact, many of those developers are likely to be business people that only develop applications on a part-time basis, he added.

    The percentage of applications being built using low-code tools has increased dramatically. Professional developers have embraced these tools and platforms alongside so-called citizen developers that are using them to build applications, as well. As the backlog of applications that needs to be built steadily increases, low-code platforms have played a crucial role in enabling developers to keep pace with the demand for new applications.

    Less clear is the impact these low-code applications are having on DevOps workflows. On one hand, there are clearly more applications that need to be deployed than ever. At the same time, many of the DevOps and data modeling processes that once required, for example, a dedicated continuous integration/continuous delivery (CI/CD) platform are being embedded in the platforms provided by the vendors that create low-code tools.

    Regardless of how low-code applications are deployed, the one thing that is certain is the pace of digital business transformation is being greatly accelerated by these tools and platforms. DevOps teams will soon need to put guardrails in place that enable developers with a wide range of experience and skillsets to securely deploy and update applications.

    On the plus side, DevOps teams should also expect it to become easier to automate the delivery of low-code applications at levels of unprecedented scale. In fact, the issue going forward may not be whether IT can keep up with the needs of the business but whether the business can keep pace with the rate of innovation now being enabled.

  • EP 20: DevOps for Low-Code – Friend or Foe?

    EP 20: DevOps for Low-Code – Friend or Foe?

    Low-code development has become increasingly popular since the onset of the COVID-19 pandemic in 2020. Low-code technologies allow organizations to build and customize fully responsive, easy-to-deploy applications with little to no coding. It accelerates digital transformation and empowers citizens developers. In this episode of DevOps Unbound, hosts Alan Shimel and Mitch Ashley are joined by Derya Sousa (Kianda), Andrew Manby (HCL) and Brian van den Brink (Valori) to discuss the benefits of low code and how it is transforming software development. The video is below and a transcript of the conversation follows.

    Alan Shimel: Hey, everyone, welcome to another episode of DevOps Unbound. DevOps Unbound is a biweekly panel session on all things DevOps, of all things—hence the name, DevOps Unbound. It is sponsored by our good friends at Tricentis, and many thanks to Tricentis for sponsoring DevOps Unbound.

    For those of you who are catching DevOps Unbound for the first time, in addition to our biweekly panel sessions like this, which are pre-recorded, we also do a monthly live roundtable open to the audience, and you are one of the guests at the roundtable where you get to ask questions and steer the panel discussion yourself. So, if you go to DevOpsUnbound.com or check it out on Digital Anarchist, TechStrongGroup.com, or devopsy.kinsta.cloud, you’ll be able to see the schedule and maybe join in one of our live roundtables.

    Today, though, is one of our pre-recorded panels—and what a panel we have. Our topic today is low code/no code and many of its aspects and flavors, if you will.

    But before we jump into that, I want to introduce you to our panel today—and I thought we lost one there for a second, but we’re okay. Let me first introduce you to Brian van den Brink. Brian, welcome to DevOps Unbound.

    Brian van den Brink: Thank you, Alan. Yeah, I’m Brian, I work for Valori, it’s a company in the Netherlands. We completely focus on testing, so we don’t have any developers, it’s really all about testing for us, and I worked there for about eight years now. I started, really, as a tester of test automation, et cetera, but then I also noticed in the assignments I did that it was also important to learn something about requirements, how do you get them ready to be tested.

    So, I focused also a few years on business analysis to get going and know what I need for testing, up until, I think, approximately five years ago when I came into contact with OutSystems, and really focusing now on testing solutions specifically for the OutSystems platform and seeing how can you use a low code platform in your benefit as a tester. And yeah, it really opened a lot of opportunities for me, I think, but also for testers, like, how can you work with low code and use it for your testing strategy, so.

    Alan Shimel: Excellent, and thank you very much, Brian. Next, let me introduce you to Derya Sousa, and I’ve been trying all through our prelim to get it right, I hope I did, but if not, say it correctly, but please introduce yourself. Okay, three time’s the charm. I’m sorry—go ahead.

    Derya Sousa: It’s great to be here on this panel today. Thank you so much for having me, first of all. So, I’m Derya Sousa, I’m the Co-founder and COO of a company called Kianda Technologies, based in Ireland, helping companies across the globe. Kianda is a no code/low code application development platform, and we are the enablers of digital transformation and accelerators of digital transformation for companies.

    My background is in IT. I worked as a developer IT consultant across different companies, industries during my career, and I came across the fact of how difficult it is to deliver digital solutions for companies. That’s how the idea of Kianda was born in mid-2016, with the vision of helping people regardless of their technical skills to create the technology they need.

    Alan Shimel: Okay, thank you. Thank you for what you’re doing and thank you for joining us today. Our next panel member is Andrew—excuse me, it’s Andrew Manby, correct? Andrew, if you wouldn’t mind introducing yourself?

    Andrew Manby: Sure. My name’s Andrew Manby. I head up Product Management for our Digital Solutions Portfolio here at HCL Software. You know, in our portfolio, we have both professional developer low code platforms and also citizen developer low code platforms.

    A little bit about me, I’ve been involved in multiple successful software products. Some of them you may know about, a product called DataStage, which we created back in a former company that really, along with Informatica, lit the imagination of the data integration market and have also been involved in other market spaces as well, including bringing thought leadership to IBM around big data analytics.

    Alan Shimel: Excellent. And then, last but not least, not necessary a panel member, but a panel member, but he’s also my Co-host for DevOps Unbound, it’s TechStrong Group CTO and TechStrong Research Principal and Co-founder, Mitchell Ashley. Hey, Mitch, how are you?

    Mitch Ashley: Hey, Alan, always good to be doing a panel together and for the folks on the panel I know, good to see you again. Folks that I’ve met for the first time, like our audience—good to have you all here. I know we’ll have a great discussion.

    Alan Shimel: Absolutely. Thanks. So, guys and gal, let me kick this off. As I was talking about before we went live, I almost view the low code/no code discussion with a BC, Before COVID, time frame, right? Much like ADBC, we have DC and then pre-COVID. I think—and Derya, you’re living proof of this. Low code/no code was alive and well prior to COVID, right? You started in 2016. Low code/no code’s been around, obviously, much longer than that.

    But certainly, with the onset of COVID and the pandemic, never have we seen a need to do more, faster, to get apps out better, to expand the base of people who can develop like we have this past going on almost two years now, right, year and a half—well, more than a year and a half, two years. And so, we’ve seen sort of a rapid development in the state of low code/no code.

    And Derya, I don’t mean to pick on you, but I’m gonna ask you to kinda kick us off, here. I gotta assume that this is what you’ve seen at your company in particular over the last year and a half to two years.

    Derya Sousa: I think to start with, I could tell you, when we founded Kianda, when we would say low code/no code platform, our audience would say, “What do you mean?” Now, we came to a stage that anyone we talk to understands now, most of the people we are talking to, they understand what we do because of this trend and the movement that’s happening with the help of the unfortunate event of the pandemic. But low code/no code was always here, solutions that we had. It started long, long—years ago. You know, we were using Excel sheets, we were using Access, we were using WordPress back then to create our website. So, they are, I think, the initial solutions that we started to use.

    But it came to a stage that the surge of the remote working, the surge of the digitalization needs that are growing really dramatically now in the last two years, it’s going into more enterprises, it’s going into more organization level. And what we are seeing, this is a problem that’s not a new problem. Currently, only 0.5 percent of the work population is capable of coding.

    So, what was happening before was, you know, business users, anyone working in organizations, they were in need for technical solutions, and they were always waiting for IT teams to go in and create these systems for them. But it’s changing now, there is more inclusivity in creating technologies, empowering people, regardless of them knowing how to code or not. It’s giving an amazing world of opportunities for people who were not able to be part of it, be actively part of digital transformation are now becoming what we call citizen developers to create these technology companies, organizations are in need. And of course, we live in a digital first world now with everything that’s going on around us. Any company who doesn’t try to benefit leverage from these technologies that are rapid application development are gonna stay, unfortunately, behind when it comes to competitive advantages and improving or creating that economical value for the organizations.

    Alan Shimel: Agreed. Folks on my panel—thoughts, follow on to that?

    Andrew Manby: Yeah, I have a few thoughts. So, you know, as Mitch and I have discussed a couple of times, right—for me, low code or sort of no code has been around for a long period of time. In fact, my father-in-law was programming in dBase, you know, many years ago, right? [Laughter]

    Alan Shimel: That’s another name I haven’t heard in a while.

    Andrew Manby: Yeah, okay, let’s get Delphi, FoxPro, all of those things out on the table. Let’s do it.

    Mitch Ashley: I think I met your father-in-law, so. [Laughter] [Cross talk] dBase.

    Andrew Manby: [Laughter] Yeah. So, all of these things have been around for a long period of time, right? And if technology has taught us anything is, they evolve to serve a particular need and that’s because the business was trying to accomplish a particular outcome, right? So, they built something, they’ve effectively had it deployed.

    Now, what’s happened now is, you know, we have a lot more tech savvy people in the workforce and, you know, IT is taking a little bit more of a proactive approach. They want a bit more governance, they want a bit more standardization, they also want to be assured of the security and governance of what the business buys, and I think this generation of low code and also no code tools, which I think are two separate things, by the way—

    Alan Shimel: Absolutely.

    Andrew Manby: – help us to do that. And so, you know, I don’t think it’s new. You know, what’s actually interesting—and I hope we’re gonna get to this, Alan—is the type of things that we’re seeing that people are building with these individual products.

    So, I think it was always there beforehand. I think a lot of organizations like, for instance, we have one major airline and there’s a couple of hundred people who are business users building applications on it, right? But typically, you know, to be clear, a lot of them are employee-facing, and they fill the gap between some of those traditional enterprise applications or maybe to some of those SaaS franchises that we often hear about now to get the job done, right? So, I think it was alive and well before, and I think it’s continuing.

    Alan Shimel: Absolutely, it’s continuing, but I think it’s changing. And Brian, I think you might serve as a poster child.

    Brian van den Brink: I think, actually, if you look a few years ago, like maybe four or five years ago, a lot of companies were maybe starting to work with, for example, health systems with low code platforms, using them as smaller apps, basically, in their organization.

    For example, you know, logging hours of your work, whatever, and then starting to grow, like—hey, we can really get to a product really fast, and then other departments of the organization see, hey, they realized an app in a few months, and it’s interesting to maybe expand on it. And then you see, like, a center of excellence within a company start to build apps, and then it grows bigger, and now, I think, currently more and more organizations actually use low code for their core applications as well. So, actually, the most important processes are also done with low code nowadays, and it’s growing like that, because they see the benefits, I guess. And when I see—

    Alan Shimel: Well, why shouldn’t they?

    Brian van den Brink: – yeah. And what I see in my work as well is that, if you work in a high code environment, it might be difficult for a tester or for a business analyst to say, “Hey, this is how it works” and dive into the product, you know, dive into the code, then you need these technical skills. But I think with low code, it’s easier, for example, for a tester to say, “Is this really what we meant with this piece of software?” and you can really get the dialogue going with your developer, even with your product owner, for example, to see, is it really doing what we want it to do, and how can we improve it, for example? And that’s so much easier in a low code environment, I think, than in a high code environment.

    Mitch Ashley: You know, Alan, there’s some—Accelerated Strategies, now TechStrong Research did some research earlier this year on low code/no code and there were some interesting trends in that. And I think part of it was driven by, Derya was talking about the effect of the pandemic; you were, as well. That rose software to prominence in terms of business strategy must-have capabilities. And along with that, sort of low code/no code was sort of viewed by IT as something that happened outside of IT, we don’t really care about it, the business units are doing something, whatever, to it is a mainstream platform.

    And I’m not saying it wasn’t before, but I think the embracing of low code/no code as a strategy, I think that improved over the last 18 months, and you can also see it by the need to access data, what information people need to get to, because no application is truly an island. They eventually have to get security, they eventually have to get to data and other systems and the fact that, Andrew, you talk about citizen developers and professional developers both as IT viewing those as legitimate creators of applications.

    Are you seeing that trend as well? That certainly bore out in our research.

    Andrew Manby: Yeah, so, we have some of our own survey that’s coming out very shortly that we did with Forrester. You know, we actually found that, from a business decision making perspective for the people surveyed, 80 percent of them said that low code was one of the top three IT priorities for the organization, right?

    Mitch Ashley: Mm-hmm.

    Andrew Manby: You know, 77 percent of the respondents actually said that, you know, agility and velocity were the two most important things to their business in achieving that.

    So yeah, I think companies are realizing that. I do think that there’s a couple of other different phenomena, and I think, Mitch, you and I have talked about this when we’ve had a separate conversation. I do think there are the organically grown stuff that Brian was talking about, which is, you know, you provide a citizen development tool, you establish a center of excellence, right, and then you sort of start draining the desire of the organization to fill the gap with building these applications.

    But I think there’s also—and maybe you touched on it, Brian—you know, organizations are taking also a top down type approach, right? And they’re saying, what are the important digital touch points I have in my organization and, given the advent of COVID, what do I need to be able to fill the gap or continue my business, right? So, if I’m a retailer, through the early part of COVID, one of the biggest challenges I had was, how do I handle, you know, touchless commerce? How do I pick up the deliveries and still allow my retail department to function, right?

    Or say, for instance, I’m a tax office, right, and all of a sudden, you know, the tax function, there’s no people in the office, and what we want people to do is start filing an abeyance request to delay the delivery of the taxes—how are you gonna do that? Or, you know, families are looking for special support, family services support, right? So, those types of things have suddenly become very, very important and low code, whether it was built by the IT organization or it was built by the business has really helped to fill the void. Sometimes, there have been brand new things, and sometimes they’re just really about adapting the business to the new reality.

    Alan Shimel: Absolutely. Let me weigh in, here. You know, I think prior to the pandemic, there is a long history of low code as I think, Andrew, you pointed out, right, though it may not have been called low code then. But prior to the pandemic, low code/no code was around, but a lot of people viewed it as, “Look, if I’ve gotta get something done simply, it’s Minecraft, you know, for adults.” It’s easy, you know, for simple—as I think, Brian, you mentioned, it’s good if I wanna track my hours or something like that. It’s a glorified spreadsheet.

    And then I think what we’ve seen with the pandemic is, in my mind, we’ve seen three branches of low code/no code, and I think, Andrew and Mitchell, you both mentioned it. One is no code, and I gotta be really honest with you—I got a problem with that. I have the same problem with no code that I have with no ops. I think that’s pure marketing, and I don’t know what you can truly, truly do with just no code. And we can talk about that, feel free when I’m done if you guys wanna jump.

    Andrew Manby: I’m just thinking about your Excel spreadsheet, right?

    Alan Shimel: Uh huh.

    Andrew Manby: You know, Excel is no code until you type in that formula.

    Alan Shimel: Right, and then all of a sudden, you better—take it from me, I’m illiterate on Excel formulas, so I know there’s code there.

    Mitch Ashley: Because you put in an expression, you’re now coding, right?

    Andrew Manby: Yeah, exactly. [Laughter]

    Alan Shimel: But when we look at quote-unquote low code, here is the big takeaway with COVID for me is, we have low code for developer teams—and Brian, I’m gonna include testers in there, because testers were already scripting and doing some coding in order to write their test.

    So, we have low code for development teams—DevOps teams, whatever you wanna call them, developers—and then we have low code for the quote-unquote citizen developer. These are people who traditionally didn’t do any development other than maybe spreadsheets. And, you know, lo and behold, the business analyst, the person over in Sales or Marketing or in HR, they now have the capability of not having to wait or go through that whole IT process driven formula, but they could use some paint by numbers and relatively easily build a very functional application. Don’t equate citizen developer with simple app. There’s some sophisticated stuff we can do now.

    Brian van den Brink: Alan, I wanted to react to that is that, indeed, the citizen developers, but also the IT development teams working with low code.

    Alan Shimel: Yep.

    Brian van den Brink: But what I do see is that more and more companies choose low code to basically restructure their, how do you say, legacy applications, you know, rebuild it or rethink their software. And I think it’s really crucial to still have—maybe you can work with citizen developers as part of, okay, what are the business requirements we need and how are we gonna implement it, et cetera. But it’s super important, I think, to still have your development skills on par with what you need. Because even with low code, maybe it’s easier to make something, but you still need the same kind of skill set that the developer would have to know how do I structure things, you know, how do I set up my architecture around it. Those kinds of things are still development skills, maybe without coding, but it’s still development skills, I think.

    And that’s why I think you always need maybe a senior developer, whatever, in your team to be able to handle those kinds of questions and then supported, I think, of course, by juniors or citizen developers even, but the development skills that you need to build an application are still very much necessary, I think.

    Alan Shimel: Agreed. Derya, it looks like you wanted to—

    Derya Sousa: I would like to add something, a point to what you said, Alan, to your definitions. So, there are solutions in the market that low code solutions, they generate code for a developer to go in and speed up this process of delivery and make the changes as they receive them.

    Alan Shimel: Yeah.

    Derya Sousa: There are solutions like what we provide. We don’t generate code, so we call ourselves as our customers call a true no code platform. However, we allow developers to go in and create widgets, create rules and actions that can help them bring that end to end business application to life. And I think that’s important, because there is a good bit of differentiation between them, and from our experience, we work with IT teams as well as Business Departments.

    Alan Shimel: Yeah.

    Derya Sousa: But we start with IT Departments, because they’ve seen the benefits they can get—

    Alan Shimel: The strength, the power.

    Derya Sousa: – by using a platform like this—exactly, filling the gaps that they might have. And now, even since the pandemic, we are talking to more public entities for—public hospitals, for example, for government agencies. Even them, they tend to be slower to catch up with innovation and technologies. Even them are looking at low code/no code systems, how they can use their legacy systems, which they’ve been using maybe two decades, but they had no idea how, actually, they could bring a user-friendly interface on top of these systems.

    So, that’s where, I think, solutions like rapid application development solutions that come into place and bring a lot of benefits to organizations.

    Andrew Manby: Yeah, I would agree that certainly, you know, some of those you think are traditional sort of holdouts, right, typically on the laggards in the adoption curve are certainly doing that. You know, we’ve seen that in state government, we’ve seen that in large tax authorities. We’ve also seen that in the District of Columbia Motor Vehicle Registry. But I think also one of the things that I want to make sure that we add to the conversation, I sort of touched on it is, you know, I think organizations, I’m just thinking about actually the first private distribution only utility in North America is the Vermont Electric Company. And they, a lot of companies want to go through additional transformation, right? I know we’ve all heard that term, right? But they really set out a plan for a number of years to sort of think about how they could not only replace some of the legacy, but really sort of think about, you know, shifting the cheese on what does it mean to digitize the processes that they actually do.

    So, I think, for some of the organizations, you know, they’re not only thinking about—okay, how do I put a new front end on an existing system where, you know, it’s been particularly inflexible. But I think also, a lot of them are a lot more, you know, thinking about how do I, you know, move the cheese? So, in the case of the D.C. DMV, how do I, for instance, say, “I don’t want to have people go into a motor vehicle registry to register their vehicle, right? I don’t need them to go into a public office to pay a parking fine or a speeding ticket—what if we just actually changed our processes and put it on one of these things, right?

    So, I think a lot of organizations out there are actually thinking about low code in that way, and I think that’s where the conversation shifts from being an IT way and an enabler to also being—alright, you know, the CMO, the COO has a seat at the table and she is saying, “Look, how can we improve the engagement with our customers where our traditional ways of engagement with them have change significantly?” And I see probably equal amounts of companies coming to us and saying, “I’d like to do this,” right? You know, “I want to change the way people buy tires for their cars,” right?

    Mitch Ashley: You know, in thinking about this, it seems that sometimes the terms we create don’t always serve us well, right?

    Andrew Manby: Right, right.

    Mitch Ashley: And, you know, visual programming is what we would’ve called low code maybe 5 or 10 years ago and you know, is a macro low code or no code? And actually, I don’t really care, it’s a macro, it’s just like—you know, is Python a scripting language or a programming language? I really don’t care. It sort of doesn’t matter. I think the end result is, you know, you talked about, Derya, the rapid application development, and I don’t mean the RAD term, but creating applications quickly and expanding the universe of people who can do that across the business is all good. I mean, it’s to the benefit, to the end of the business. And we can create a mess for ourselves, or we can do it well, in a way that it works together.

    But I think, hopefully, we get to a point in a year or two where we don’t think about low code/no code, right, it’s just—it’s another way of, it’s an application platform for creating apps. And anybody can do it, because it’s—I mean, whether it’s no code, I don’t care if Trello’s a no code or a low code. I don’t care if Zapier is a low code or a no code, you know, just to pick a few commonly used things. I think we’re about the result we wanna get.

    Andrew Manby: Yeah, I agree, Mitch. I mean, I think at the end of the day, you know, we obviously know that technology goes in cycles. You know, certainly, in our portfolio, we have low code that we would sell to a customer for doing that specific task, right, and those are broad sort of use cases.

    But, you know, low code or that sort of no code citizen developer construct exists in our digital experience platform and it also exists in some technology we have specifically for the DevOps process, which is a low code version way of them to help orchestrate what they do in the DevOps process. And you think to yourself—well, are they a commercial low code tool? Well, no, but they’re bringing the, enshrining the value of a no code/low code tool to a specific challenge.

    You know, maybe that will be the way that this market will evolve over time, but definitely, I would say that where we are right now is, it’s permeating into lots of different places, right? You know, does that mean that, say, is Monday a no code tool? But probably what makes it stickier is the fact that it has some no code type capabilities to it, right? And maybe that’s okay, right, for customizing certain types of applications.

    Mitch Ashley: Well, it ventures into the whole workflow space, right? I mean, you know, Atlassian now is positioning themselves as a competitor to Monday and others as a workflow tool, and you could say that’s low code or no code, too. So, it’s really, when we talk about that as a segment of the market, it really is much bigger than just what we might narrowly define as low code.

    Alan Shimel: Yeah. So, to me, the definition goes back to something Brian was talking about earlier, and that is—what’s the involvement of IT, right? Even with this citizen developer thing, I see it bifurcating. There are some cases where traditional IT teams are calling in a non-traditional IT person to help with the building, architecting, sizing of an app. And that non-traditional IT person benefits from the team being, using low code/no code tools, right? So, that’s one scenario with the IT Department’s involvement.

    Then there’s sort of a shadow low code/no code development kinda operation without IT, right? Where—hey, man, it takes too long, I don’t wanna go through the whole change management process and the architecting, I just need this quickly. And I got the tool to do it and it’s cheap and it’s SaaS an it’s boom, boom, boom and I’m done. “Hey, where’d that come from?” “Eh, I built it.” “You built it?” “Yeah, I built it.” Right? And that’s powerful. I’m not gonna—let’s not kid ourselves. That’s a powerful enabler in an organization when the IT person says, “Hey, wait a second, where’d you get that?” “I built that.” Right?

    How do those two jibe? And I think that’s really where the friction, where the rubber meets the road, and what is low code, what is no code, who does it? I think the delineation is, is IT involved or not? And, you know, Derya, you were saying most of your engagements are going through the IT Department. Brian, you seem to be on the IT Department is involved side of the house as well. Andrew, I’ve heard you go both ways here a little bit. But, to me, that’s the key sort of indicator.

    Andrew Manby: Well, and Alan, can I ask you a question, then, right?

    Alan Shimel: Sure.

    Andrew Manby: You know, I tend to think about low code for citizen developers to be a bit like a sandbox, right? You know, I live—where I live, there’s a zoo a mile away, right, and there’s an area there and a kids’ playground, there’s a tent and there’s a sandbox underneath it, right? And it makes it very easy for the family to sit down and observe their kids, right?

    So, you know, I think the way that no code is developing from an IT perspective, it’s trust but verify. Can I see what they’re doing? If they get into trouble, I can help them out, or as Derya said, you know, if there’s something that they need, right, maybe they need a specific widget to do a payment or they need something to deliver a package or they need some very specific type of math problem and they build an algorithm in the math lab and they want to bring it in, that’s when IT does that, but also, again, it’s that oversight and governance, right? Trust but verify, but you know, who’s using the application? What data do they have access to? Are they doing Select Star from HR executive salaries, right? Is someone curating those data sources for them so they can do no harm in their developments?

    So, I think that’s the place where citizen development is going. I think that’s where organizations want to invest, that’s where they’ll put the COEs. I think the days of, say, my father-in-law building something in dBase will go away from an IT perspective.

    Alan Shimel: So, let me use your sandbox analogy. I’ll put forth the proposition to you that most parents, a lot of mommies, take their kids to the sandbox and leave them there because it’s a relatively safe environment and they can concentrate on other things, maybe doing some of their own work or speaking to the other moms or what have you, and they consider it a safe environment to leave their kids, and they only keep half an eye on them versus, you know, being on swings or something. Same thing, here.

    Andrew Manby: Exactly, Alan. So, I think, for me, you hit the nail on the head, right? If it’s about IT backlog, you’ve effectively given one strategy to halve or reduce your IT backlog because, with your supervision, right, the moms can go off and do something else which they focus on which really requires their skills.

    Alan Shimel: Mm-hmm.

    Andrew Manby: But then, you know, as citizen developers in the sandbox, I can get what I need done for the business faster. Isn’t it like a division of—

    Alan Shimel: Well, let’s go try it.

    Andrew Manby: – a division of labor?

    Alan Shimel: It is sort of a division of labor because we’re not talking about kids in sandboxes. But when you have testers doing low code/no code, you know, building quick, being able to testing faster, better—that, to me, is a very different low code/no code use, right? That’s a—

    Brian van den Brink: What we often see, for example, with Tricentis, Tricentis is a low code testing tool, and I think it’s important as a company if, for example, I choose low code development for my core applications. Then also, you have to probably think about what does that mean for the other roles within the IT Department like, do we have to think about then, also, a low code testing tool that fits our development platform, for example? Often, I think what I still see happening is that we choose low code for several reasons and the decisions that help that. Also, you can rely on—okay, that’s the same decisions we need for our test tooling, for example. And I think what’s important is that I think what the low code opens is that you can work with a low code platform and use those capabilities for a testing perspective as well.

    So, for example, if I test a process, it takes a lot of time to go through all the screens and to test a workflow, for example. And I’m testing a workflow and there’s all kinds of data I need to test specific outcomes of that workflow, try to find solutions in your platform to basically mock that data or to set that data up through a faster way than to going through all those screens, maybe you can use an API or you can leverage something out of the platform to make that faster. And I think that’s where low code testing comes in place is that it’s easier to shift left towards a developer and discuss those kinds of things. Like—okay, we have a requirement we want from this business perspective, what do we need to build that as a developer and what do we need as a tester to test that more efficiently? And I think that’s where the thing comes together is that if we discuss that within a team and then it’s really an IT thing, what do we need from a technology perspective to make everybody’s life easier, basically?

    And I think low code, companies use low code, for example, because they have a challenge in finding the technical people to be able to build their apps. And we have similar challenges in testing that it’s difficult to find the technical people to build the technical scripts. So, there, I think we need to make sure, as a company, that you match these challenges in the same way that—okay, low code platforms probably also need low code testers, because you have, you know, you make those decisions for a reason, I guess. And that’s what I see in my work.

    Yeah, it opens a lot of opportunities as a tester to be more efficient in your work and to make sure that you keep up the pace with your developers. Because low code development is a lot faster than traditional development, and if you don’t change as a tester as well, you will always be, like, a bottleneck in the process, because you’re not as fast anymore. And then that’s why you need to think of smarter solutions as well.

    Alan Shimel: Derya, low code apps need low code testers?

    Derya Sousa: Sorry?

    Alan Shimel: Brian said something that if you have low code apps, it makes sense to have low code testers.

    Derya Sousa: Low code testers—yeah, yeah, absolutely. Just to add to the original conversation about governance and security, I would like to maybe add a couple of points there. I think, again, the solution to what you mentioned, Alan, there is—yes, we deal with IT Departments and, you know, business users are being exposed to these solutions, low code/no code solutions—where is the security, who has access to what, and how we can implement governance. And it sounds like a broad concept, but you know, any organization would need to implement governance, you know, how they operate, what is moss, what is a shoot, what is a can for them to do and now to do things.

    And the same approach should be implemented when it comes to employing this type of low code/no code solutions. So, just because the platform is like a LEGO building block or sandbox, as you mentioned, it doesn’t mean that we should forget about everything, it’s too exciting, let’s build whatever we need and, you know, roll it out quickly. I think the same approach as the company would have had in their change management, change control, governance, they all should be now considered the same way for low code/no code approaches, whether it’s IT building it or whether it’s business users building it.

    And what we usually see that’s working is when IT and Business Departments work together. So, IT creates some kind of a controlled environment for these non-IT users to go in and create solutions while IT is shadowing them or supervising them, giving them tools they need. But at the end, it’s all a controlled environment where, I’m really the biggest fan of giving people free, innovative solutions that they can freely innovate and create solutions they need, but this should not come without a plan. So, a low code/no code system should not be implemented without a plan.

    So, that’s why we are seeing sometimes a struggle that companies go through, because they see the opportunities, they start with one solution and they want to implement so many more in a couple of months’ period, and it can be challenging if there is no plan. It can be challenging if there is no strategy, overarching strategy that looks to different kind of aspects of how to implement such a rapid application development system, yeah.

    Brian van den Brink: Yeah, when we have—

    Andrew Manby: I probably disagree, because I think there’s different modalities. I would say a lot of citizen developer low code is an either they develop it to prototype it and then hand it to IT once they’ve actually proven it, sometimes they’re there for a period of time so it’s literally like a pop-up booth or a food truck. You know, it arrives, it serves it purpose, and then it’s torn down, right? So, I don’t think you can necessarily have IT be involved in all of them.

    I mean, certainly, you have some sort of, you know, diamond team to do that, but I don’t think it all happens like that. I think there’s different ways that, yeah, some of it is definitely planned out through IT and Business to deliver something. Sometimes it’s a cross functional team and it’s driven by the business. But I think part of the attraction of low code, and we mustn’t forget about it is, it’s that organic nature and the empowerment of the people in the business to get their job done.

    And sometimes, you know, back to Alan’s point, it’s—you know, you don’t wanna get slowed down by what IT’s doing and as vendors, if we do our job correctly, we give them that safe space to be able to do that, right? Trust but verify.

    Brian van den Brink: I think it’s important to—I think, indeed, what it opens, and I agree there is, it allows you to prototype things from a business perspective, but I think what’s important then in the next space is that that prototype is not to go in our production environment, basically. So, you know, you have to make sure that sometimes what we say is that, if you look at old spaghetti code, with low code, it’s easy to make, like, fast-cooking spaghetti, basically. Because, you know, you can make your mistakes faster because it allows you to create things faster, as well.

    So, I think, indeed, you start with a prototype, you verify the basic concept, and then at some point, if you really wanna structurally have a core application out of it, it has to go through architecture principles and things like that. But I think that’s what Derya also means, maybe, with the plan is that, once it goes to that, after that first phase, it really goes into that planning phase and how are we gonna structurally broaden this application, for example?

    Derya Sousa: Absolutely. Just to add there, so, the applications we build, we deliver, or our customers are delivering are core applications, core business applications, and I don’t see them working well in terms of security and governance if they are just let and there’s no plan or there’s no cooperation with IT teams.

    So, from my experience, I’ve seen this and there are, really critical solutions are being built with low code/no code systems, and they are connecting to critical data as well, and especially with security in mind, that we all have to have nowadays. I don’t see this getting to the highest potential without IT being involved.

    Andrew Manby: Yeah, I will agree about that, but I would argue, continue to argue that there are a lot of things that need to be put in production in a safe space that have been curated by IT that we just allow the business to run with, right? That’s just the nature of the beast, right?

    Alan Shimel: Absolutely

    Andrew Manby: And to be honest, I don’t know why you would want to change that.

    Alan Shimel: Well, this is a great conversation, but we’re out of time, we’re over time. But, you know, obviously, if you couldn’t tell at home listening to this, there’s a lot more we could—we could’ve spent all day talking and still not cover it all. Maybe we’ll have to re-run it and bring it back for another low code/no code episode, soon.

    But we’re gonna need to wrap up this episode of DevOps Unbound. Brian, Andrew, Derya—thank you so much for joining in and contributing to this panel, it was great. Mitchell, as always—good job, man, you know? You’re doing this—

    Mitch Ashley: Enjoyed listening to the panel as well as participating. It’s a great group.

    Alan Shimel: Absolutely. Many thanks to Tricentis for sponsoring DevOps Unbound. We’ll be back in two weeks with a fresh topic related to DevOps. Hope to see you there and have you join us, but for now, this is Alan Shimel for DevOps Unbound. Have a great day, everyone.

    [End of Audio]

  • Get the Benefits of Low-Code Without the Risks

    Get the Benefits of Low-Code Without the Risks

    Today, more than 300 vendors and various platforms offer different flavors of low-code solutions. However, the majority of these low-code tools are really no-code tools that benefit individuals or groups trying to solve a specific program. The list of benefits of low-code tools in your environment is long and compelling; however, there are security risks that businesses should be aware of when working with these powerful tools.

    When evaluating or using a low-code tool, it’s important to remember that while low-code tools abstract the process of writing code, code is still being written. Applications created with low-code tools are susceptible to the same attacks as any other web application. However, companies don’t have control over the code generated by a low-code tool, so the burden of developing secure applications is largely shifted to the low-code tool vendor. Therefore, the best way to minimize risk when using a low-code vendor is to properly evaluate that vendor’s security practices and test applications created using these tools as vigorously as you would any application developed using a traditional/pro-code approach.

    Risks to consider include access control and authentication (permissions, multifactor authentication), data security (encryption in transit and at rest) and application security from vulnerabilities and attacks (network security and intrusion detection). Other risks to consider are risk mitigation covering areas such as DDOS (distributed denial of service) attacks, backup and disaster recovery, and security incident handling. Responsibility for management of these risks belongs to the low-code vendor, the hosting provider and the company using the low-code tool.

    The following tips should be considered when bringing new low-code tools into your environment to minimize security risk. Remember, it’s critical to perform due diligence of the vendor. Items to consider include:

    Hosting Platform: Be sure the vendor is using a reputable hosting provider, ideally Amazon Web Services (AWS), Google Cloud Platform, Salesforce or Microsoft Azure. Leading players will offer secure, highly available platforms that address the aforementioned risks and will have completed third-party audits and certifications demonstrating their commitment to security.

    Vendor Infrastructure Management: Low-code vendors typically have some level of responsibility for management of the upper tiers of the overall stack; this is generally referred to as the shared security model. Review the vendor to ensure they have solid controls and processes in place to properly manage and secure the infrastructure. Ideally, the vendor regularly submits to some form of recognized audit, such as a SOC 2 Type 2 or ISO-27001. This helps ensure controls and processes are in place in areas such as security, availability, confidentiality, privacy and processing integrity to address the aforementioned risks in the area of the hosting platform the vendor is responsible for.

    Formal SDLC: The vendor should follow a documented software development life cycle (SDLC) and change management process used for the development of their low-code tool. A good SDLC process includes using a source code management system, dependency checking process, static code analysis, automated unit and regression tests, peer code review, secure coding practices training, application vulnerability scanning, quality assurance testing process and third-party penetration testing.

    Policies and Processes: Documented policies and processes covering information security, business continuity, disaster recovery, security incident handling, infrastructure hardening and more should be in place at the vendor. This helps demonstrate that the vendor is committed to providing a secure, highly available and high-quality offering.

    The company adopting the low-code tool itself should also consider internal processes and how it’s using the low-code tools. Items to consider include:

    Formal SDLC: Even though the company uses a low-code tool, there’s still the need to follow a formalized SDLC. It’s important for the company to emphasize and embrace secure programming practices, even for low-code developers. Low-code tools have the ability to implement customer-developed code snippets or components and it is recommended companies follow programming standards and secure programming practices as outlined by the Open Web Application Security Project (OWASP) foundation. Another area of emphasis that can sometimes be overlooked is the need for testing, including functional and security-oriented testing.

    Security Testing: Consider performing a penetration test of the completed low-code application. While ideally, the vendor has performed these tests on the tools itself, it’s a good idea to also perform one on the completed low-code application.

    Access Control and Authentication: Configure access and permissions according to the least privilege model. Leverage advanced authentication mechanisms like multifactor authentication and single sign-on where possible. Ensure an access removal process is in place to remove access for terminated employees.

    Data Security: Verify the application is configured to use HTTPS and that all databases are encrypted. Low-code vendors may or may not provide a database, and either way, the company likely has some level of responsibility for securing the data, regardless of who is hosting it.

    Policies and Processes: Documented policies, processes and related training for team members helps mitigate risk. Some level of formality is recommended for documentation and training for the SDLC, business continuity planning, disaster recovery and security incident handling. For example, the team responsible for the low-code application needs to know how to handle a security incident if one occurs, whether it’s due to an issue in the low-code application, the low-code tool or the hosting infrastructure.

    The benefits of low-code tools far outweigh the risks of introducing these tools into your environment, but with a little effort up front, you can save a lot of headaches down the road.

  • How Low-Code/No-Code Can Transform Your Organization

    How Low-Code/No-Code Can Transform Your Organization

    For many companies, IT transformation is no small feat. Between the technology, process and organizational changes needed, it can take time to see a return on your IT transformation efforts and investments. So it’s no surprise that low-code/no-code is starting to be seen as a compelling solution for some.

    With low-code/no-code, you can empower teams of ‘citizen developers’ and enable experienced developers to accelerate deployment and reduce IT backlogs. To gain insights on the ways that low-code/no-code can transform your organization, I asked several DevOps Institute Ambassadors for their thoughts. Here’s what they said:

    Brendan O’Reilly, DevOps Specialist, Daysha DevOps

    Low-code/no-code introduces urgency into an organization. By removing the bottleneck that is scarce development resources, you can reduce the lead time to value.

    Mark Peters, Technical Lead, Novetta

    Low-code situations are likely best for highly tailored situations, with clearly defined purposes and minimal changes. Low-code can work when your business depends on scaling rather than creating new code. If the business is good enough, and one is adding microservices or more instances of the same expanded for a larger market, low-code can be perfect. Implementing low-code then allows the next opportunity to move from some code to no-code, providing a graphical interface to change architecture, implement policy or change recurring controls through mouse clicks rather than code. This also provides an excellent chance for improved ops control; if one is scaling the number of users, controls can be implemented to ensure the graphical delivery does not hard-code a password into the system, instead of relying on approval checks within an alternative interface.

    Vishnu Vasudevan, Head of Product Engineering and Development, Opsera

    When an organization practices DevOps, they continuously expand by team, product, platform and application because of different solutions coming into the market. Incorporating a low-code/no-code approach gives enterprises the ability to speed time-to-market and expand engineering capabilities beyond IT.

    If you have a low-code platform that can help manage and provide visibility into technology and security compliance, that’s a gold mine for any developers or any organization. For example, anytime a new application comes in, teams can use a template from the previous application and put it over the new application. The same security quality of the audit governance is quickly established as a baseline, and all the developers have to do is focus on coding.

    Shriniwas Sathe, DevOps Chief Architect and CoE Leader at Capgemini

    Low-code/no-code tools can help change the way that regular employees interact with technology. With no-code tools, every employee, regardless of their background, can create custom applications, websites, forms, etc. With low-code tools, this can be taken a step further by building upon the offerings of a no-code tool by coding in the unique features needed by the organization. This is much less time-consuming compared to traditional development processes, even though it requires a general know-how of coding.

    With every employee able to contribute to new applications and tools, there’s a better chance of obtaining unique insights and unforeseen capabilities. You can also simplify processes to an extent where regular employees can benefit from the freedom from tedious and repetitive tasks. There are low-code/no-code tools for most industries, which gives you a choice of either a ready-made solution or one that can be customized to your particular requirements.

    Peter Maddison, Founder, Xodiac, Inc.

    Low-code development platforms are great at automating important procedures using drag-and-drop editors that allow citizen developers to create virtual models of an app’s business logic and user interface.

    A major advantage of having an enterprise no-code platform is the presence of built-in governance capabilities. No matter what an IT team’s size, a central console offers visibility for all applications and environments so that they can keep track of any issues or vulnerabilities.

    Business developers can use the solution to create applications that fit their unique business needs. And more than one developer, or a team of developers, can work on the same module at the same time.

    Of course, we need to ensure we are providing appropriate guard rails so our citizen developers are not able to accidentally expose data or create additional risks through the solutions they create.

    If you’d like to learn more about the latest in low-code/no-code and similar topics, check out the upcoming SKILup Day schedule. Or, learn more about the benefits of becoming a DevOps Institute Member.

  • Will App Dev Become a Normal Competency?

    Will App Dev Become a Normal Competency?

    With a shortage of available developers, companies are considering low-code methods to meet massive application development needs. As a result, by 2024, citizen developers will be responsible for 65% of applications, Gartner predicted. So, if technical ability rises across the board, will application development become an expected skill set for tomorrow’s digital workers? And if so, when?

    “Application development will become a normal competency,” said John Bratincevic, senior analyst, Forrester. Bratincevic recently gave a talk at the Rethinking “How” into “Who” with Low-Code event, presented by TrackVia.

    I asked Bratincevic to dive deeper into how application development is becoming democratized. In short, the low-code movement has permanently altered expectations around who can be involved in application development. To him and others within the industry, leveling up with citizen development knowledge could be vital to retaining a competitive advantage in the future digital-native workplace.

    The Undigital Condition

    As more and more companies digitally transform, they are evolving into software companies. In this new paradigm, “software is an expression of the business,” says Bratincevic. Yet, most organizations have not entirely digitally transformed. According to Forrester’s Q1 2020 Global Digital Process Automation Survey, 76% of companies still rely on paper-based processes, and 94% use Excel or email-based processes.

    Unfortunately, developer talent is too few and far between to rectify this “undigital condition,” and existing IT teams are struggling to keep pace with demands for more software-based processes. Too often, teams are told to get in line and wait for experts to develop software when they can, said Bratincevic. This gap results in a less adaptive structure that limits new ideas.

    “All organizations are probably, to some degree, adaptive, but their improvement and adaptation are typically only periodic and conducted by specialists,” wrote Mike Rother, Toyota Kata. “In other words, such organizations are not, by their nature, adaptive.”

    A New Generation of Citizen Developers

    The old model is not realistic anymore, said Bratincevic. Instead, a new generation of citizen developers could use no-code and low-code platforms to program operational tasks themselves. These tools use visual, declarative techniques instead of programming and are “empowering employees outside of IT to deliver apps,” Bratincevic said.

    So what is the demographic behind citizen development? Reports show that younger, digital-native employees are more likely to use low-code platforms. According to the TrackVia report The Next Generation Worker: The Citizen Developer, 50% of citizen developers are 18 to 29 years old. The study also found that citizen developers are 13% more likely to expect promotions, correlating citizen development experience to career advancement.

    In this projected economy, “digital elites” seem well-positioned to progress, whereas others are in dire straits. “Knowledge workers with simpler, more focused roles (e.g., a “coordinator”) and without digital skills are at risk,” said Bratincevic. Thankfully, low-code could offer a practical way to enter the tech field and increase job security.

    Leveling Up From Productivity Tools

    Today’s average worker is quite familiar with personal productivity apps such as email, social communications, calculations and other consumer technologies. Just as productivity tools have become commonplace, Bratincevic predicts that application development will become a standard skill set in the future.

    Other IT leaders agree that coding literacy will soon become ubiquitous. Apple CEO Tim Cook, for example, recently emphasized to the U.S. president that “we believe strongly that it should be a requirement in the United States for every kid to have coding [education] before they graduate from K–12 and become somewhat proficient at it.”

    Application development may become a typical proficiency; however, the exact nature of software development is up for debate — especially as development environments add more abstraction layers to the lower stack that only involve programming languages indirectly. For example, Bratincevic describes how those learning to code often use a service like code.org, which involves low-code tooling and games to help educate students. “I see the same pattern for the adult professionals in the workforce,” he said.

    Future application development may not even resemble programming in the traditional sense. “Once ‘development’ on these kinds of tools becomes ubiquitous, we may not even call it application development anymore,” Bratincevic said. “It will just be — work.”

    Goals for Citizen Developer Programs

    According to an Outsystems report, 20% of companies adopted low-code to enable citizen developers to construct applications. “One of the main reasons firms are buying low-code is to enable non-IT folks to develop,” noted Bratincevic. “I routinely get inquiries from enterprises who are looking to accomplish this very thing, at scale in their organizations.” In particular, he notes apps of substance being created within health care, vehicle manufacturing, oil and gas and insurance industries.

    It appears more and more organizations are sanctioning a new wave of citizen developers. So what goals should these new citizen development programs aim to achieve? Bratincevic shared the following benchmarks:

    • Digitize. Everything. Always: Foster a digital problem-solving culture and develop a digital workforce.
    • Balance autonomy and control: Citizen developers shouldn’t have to ask permission to make a spreadsheet. Yet, guardrails are necessary for more far-reaching programs.
    • Take charge as privateers: He recommends organizations start by adopting an autonomous, business-led team, which he calls a Privateer model.

    Low-code could also help bring shadowy, rogue IT to light and rehabilitate it in a sanctioned way.

    The Era of Low-Code

    In 2021, the low-code market is estimated at $13.8 billion, said Gartner. SD Times even coined 2021 the “year of low-code.” But, since the citizen developer movement has permanently raised the bar, I would edit this statement to say we have entered the era of low-code.

    For more information and case studies on citizen development, I recommend watching the panel webinar Citizen Developer Movement with Forrester: Rethinking “How” into “Who” with Low-Code. In addition to John Bratincevic, it features Dave Garret, chief strategy and growth officer, PMI, (who I’ve spoken with in the past on How To Foster a Culture of Citizen Developers) and Joshua Yaklin, SVP of operational risk, Stearns Lending.

  • Empowering Developers Through Lean Code

    Empowering Developers Through Lean Code

    Digital transformation is widely understood as a critical component for increasing user adoption, fueling workplace productivity and innovation, and driving business growth. Software has become increasingly important across countless industries, teams, and functionalities, and as a result, companies are beginning to understand that being an industry leader and gaining competitive advantages starts with software development.

    Easier said than done. Modern software apps are a complex orchestration of infrastructure, deployment pipelines, notifications, user experience, data filtering and processing, and error handling. A good engineering team will be able to account for each of these items and integrate them into a larger, comprehensive infrastructure.

    So what happens when you don’t have a solid, in-house team guiding your software maintenance and development? Consider a lean code development platform; a developer service that pares down the explicit requirements of standard functions, interactions, errors and software infrastructure into implicit scripts, templates, configurations and API requests. Using a lean code solution will give your team the power to build higher-quality features more quickly than they otherwise would on their own.

    There are several ways that lean code platforms can simplify processes for developers. Primarily, these platforms turn explicit requirements into implicit interactions, eliminating the need for developers to pull elaborate infrastructure to solve complex problems. Lean code also gives developers the freedom to customize everything to fit where it is needed, while limiting the amount of code necessary to do so. Lastly, lean code platforms provide tools that assist developers at all levels of the software stack, significantly increasing productivity while cutting down on time and workload.

    How Does it Differ from Low-Code?

    While many people might be unfamiliar with the term “low-code,” they’d probably be surprised to learn that they use it all the time. Low-code describes platforms that require minimal code in order to build applications and processes.

    Essentially, these programs enable users with little to no coding or software development experience to create and use applications. The idea of low-code is to introduce audiences to intermediate level software development concepts such as object-oriented programming, interface design, conditional logic and code syntax.

    However, no matter how helpful these low-code approaches might be, many users still run into the problem of wanting more customization than the low-code system is designed to give. In fact, many users become frustrated with the term “customization” because it’s viewed as the enemy, indicating a need for more advanced software development services than the consumer is able to provide.

    Lean code platforms, on the other hand, are designed to specifically meet developers’ needs at all stages of the software development life cycle. In essence, lean-code prioritizes simplicity, efficiency, flexibility and accessibility with the goal of making software development accessible on a larger scale.

    Instead of encouraging you to reduce your development team, lean code platforms allow users to expand development through exploring new avenues and abstracting away the explicit requirements of traditional software development.

    What Does Lean Code Have to do With Productivity Infrastructure?

    Many forward-thinking companies have gone beyond simply building technical solutions to specific development problems. Instead, they’ve taken the advancement of lean code platforms to a new level by providing fixes that meet developers at the central stages of the integration process.

    Because lean code offers such integrated solutions to developer challenges, the approach is increasingly becoming the norm across the bulk of the productivity infrastructure category — an emerging market category that combines elements of cloud communications services, API platforms, low-code development tools, business process automation and AI software development kits.

    If you’re looking to implement a lean-code platform, consider the following features:

    • Intelligence: By making it easy to pull information from unstructured data sources and flip it into more meaningful material, machine learning (ML) replaces the manual effort to build, implement and maintain models.
    • Automation: Workflows, triggers, templates and notifications can be abstracted away for common use cases.
    • Security: When handling user data, security is a top priority. From protecting health records to pet names, data security is crucial.
    • Connectivity: The ability to connect to a relevant data source can make or break an infrastructure.
    • User experience: User interfaces should follow expected conventions for whichever task the user is trying to accomplish. Maintaining a successful user experience requires constant evaluation.

    How will Lean Code Become Market-Leading Software?

    Lean code development platforms have emerged as market-leading software development solutions in three major areas:

    • Productivity Infrastructure: More companies have pivoted to providing full-stack development services that assist developers in building out native communications, search and indexing, scheduling and financial experiences.
    • Software development and deployment workflows: Continuous integration/ continuous deployment (CI/CD) pair down complex build and deployment pipelines to basic configuration files.
    • Infrastructure deployment: Infrastructure as a service (IaaS) products assist in deploying scalable web services via API requests and simple configurations.

    Where are lean code development platforms headed?

    It’s safe to assume that, given their ability to provide efficient and effective infrastructure to development teams, lean code has a bright future ahead. The number of developers in the space is only growing. A Slash Data survey from 2019 estimated there to be just under 19 million active developers across the globe and expected the number to grow to 45 million by 2030.

    As the market for software development rapidly expands, it would make sense to assume that the need for a platform that solves problems across the entire software ecosystem would, too. Lean code development platforms are emerging as a top choice for companies that want to build out a leading software platform into the future.

  • Low-Code/No-Code and Simple APIs

    Low-Code/No-Code and Simple APIs

    In recent years, implementing AI and IoT technologies has been top priority for many organizations as their leading-edge capabilities have become a requisite for digital transformation – but the speed of their adoption is greatly influenced by the flexibility of supporting software. Enter low-code, no-code programming and truly open APIs.

    Low-code/no-code platforms are a promising alternative to traditional software platforms for non-technical business users; a more democratic approach to software development, built on either no or minimal code. The approach begins by minimizing external expenses and time required by outside developers or programmers as business analysts and line managers can now structure new process flows and functionalities.

    This is coming into sharp focus, as the increasing need to get new applications to market quickly is coupled with a growing demand for digital transformation from the C-suite. But to access the benefits, organizations must ensure that their underlying software can integrate well with external systems—introducing application programming interfaces (APIs).

    Low-Code/No-Code – The New Focus

    Analyst predictions have revealed an industrywide trend geared towards these platforms, as 60% of CIOs are set to employ low-code/no-code tools by 2025, with plans to bolster their output capacity. Other analysts expect to see 65% of all application development taking place in low-code/no-code environments by 2024. But, it is the openness of APIs that will determine the success of this software.

    APIs have reached new heights since the early days of component-based architecture, but today’s APIs are still inspired by Roy Fielding’s Representational State Transfer (RESTful) API.

    APIs – Providing Essential Internal and External Openness

    Some vendors will talk about how they have open APIs, but these are often limited and designed for specific, pre-determined integration scenarios. The application, in the meantime, internally communicates in a proprietary fashion that cannot be leveraged by external systems. To maximize the agility delivered by low-code/no-code tools, the entire application should be built on open APIs.

    Enterprise applications can go a step further by relying on the ISO/ICE–approved OASIS Open Data Protocol (OData), making things even more interoperable with more choice, flexibility and capabilities for customers. When the application is built on the same set of RESTful APIs it exposes to other systems, it is even easier to access the precise spot in a value flow with which organizations need to integrate.

    With the support of open APIs, there is an opportunity for companies to leverage low-code/ no-code tools and achieve crucial business returns in three ways:

    1. Undisrupted Connectivity

    A robust architecture built on RESTful Data APIs, documented according to the Open API Initiative specifications, gives organizations the ability to extend enterprise software on the outside to create task specific apps or connect to other systems.
    This may simply be used for automating steps around onboarding a new employee; for instance, filling in a desk number in an office floor plan, initiating payroll activities and creating an Outlook account. It could also populate a serialized part structure from a machinery manufacturing process into the software that will be used to annually service that piece of equipment. Any data, action or event should be accessible in a clear and thorough API library.

    With enough of these RESTful APIs, any number of low-code/no-code tools can be used to create targeted apps that interact with enterprise software and other systems running in a business. Commercial software offerings can be used to build an experience and drive processes in enterprise software.

    2. Digital Transformation Accelerated and Uninterrupted

    The main benefit of using RESTful APIs is that an organization’s external and internal systems can automate processes, expand access to data, and create extensions to their enterprise software on the outside. Regardless of whether an internal process automation (IPA) tool or external low-code/no-code process orchestration software is used, their ERP system should offer transparent access to the part of the system supporting any given integration or process automation.

    Here’s where a low-code/no-code approach helps to develop new solutions and industry specific functionalities that can be built faster, cheaper and with higher quality. Integrating a low-code domain-specific language (DSL) into solutions not only helps create value faster, but also insulates organizations from future technology changes. The DSL describes the intent of what a component in the application (for example, an API) should do, rather than how it is technically done.

    3. Increased Software Governance

    Low-code/no-code tools are also more commonly used to tailor how enterprise software works internally, giving organizations more control over their software. Software providers might currently offer the ability to extend the data model or to tailor the user interface and user navigation flow through a process to an organization’s specific needs, using no-code tooling. But this is not enough.

    Low-Code/No-Code: Go the Extra Mile

    Enterprise software platforms should offer intuitive low-code/no-code tools that will not only automate process steps or actions, but add machine learning capabilities for intelligent process automation. This democratizes the creation of intelligent systems by putting it within reach of business analysts and line managers—a simple what-you-see-is-what-you-get.

    Logical, Automated Processes

    With the IPA capability embedded into software, any additional input needed from users can be captured automatically. These capabilities can then be further enhanced with intelligent parts, such as AI and machine learning models, to make choices inside the automation about what to do next (branching decisions), or predicting values to be filled in.

    As the need to digitally transform continues to surge, enterprise solutions based on open APIs, strengthened by low-code/no-code programming, will become fundamental business tools—speeding up deployment times and delivering business value when it matters most.

  • Is Low-Code Development a Security Risk?

    Is Low-Code Development a Security Risk?

    According to Gartner, the worldwide low-code development market is projected to be $13.8 billion in 2021, a whopping increase of 22.6% from 2020. Gartner also predicts that the surge in remote development during COVID-19  will continue to boost low-code adoption, despite budget cuts and efforts to optimize cost.

    Low-Code’s Popularity Among Professional and Citizen Developers

    Low-code is no longer the new kid on the block. From simple dashboards to complex applications, low-code applications are becoming more and more diverse, with mainstream adoption in the enterprise world. In essence, low-code is a visual paradigm of application development that involves drag-and-drop of pre-built components and integrations resulting in fast, easy and less-error-prone development.

    The advantage of low-code is that it enables users from a non-traditional development background to participate in the app development process, thus democratizing development and accelerating project timelines. It also narrows the demand-supply gap that arose as organizations catered to ever-rising digitization needs with limited resources and developer scarcity. Many low-code platforms make it easy for citizen developers (business analysts, line-of-business users, junior developers, for instance) to build applications while drastically reducing delivery time compared to traditional coding methods.

    But citizen developer productivity and speed are not the only benefits of low-code development. Today, low-code platforms also come with capabilities purpose-built for professional developers from enterprise IT teams to ISVs. These platforms are hardened for enterprise use, are able to leverage the scalability and security needs of a complex application and have integration capabilities mature enough to seamlessly fit in with existing tools and technologies. During the COVID-19 pandemic, many businesses reinvented themselves through adoption of low-code platforms and applications that helped them adapt to the sudden shift to a remote work scenario and enable the necessary modern application needs that came with it.

    Security Challenges with Low-Code and Remote Work

    Compared to traditional development, low-code involves a variety of personas working together to build applications while dealing with automatically generated code, ready-made components and built-in default configurations. This shift in environment revealed some unique challenges that need to be addressed. There are a few common security challenges with remote teams building on low-code.

    Application Development and Remote Team Collaboration

    • Lack of security awareness: Low-code users come from both business and tech backgrounds. Some practitioners aren’t familiar with application security best practices and lack awareness and understanding of potential vulnerabilities and security holes.
    • Platform access and admin controls: Low-code is deployed centrally and available for users across an enterprise via browser access. This introduces a risk of network intrusion; providing access to unauthorized developers and opening up greater permissions to users that do not need it when accessing the platform remotely.
    • Code repository and team collaboration: Low-code platforms must ensure that the automatically generated code can committed to enterprise-sanctioned repositories. This code access shouldn’t be misused, and ought to have sufficient protocols in place for code control and upgrades.

    Code Generation and DevSecOps Best Practices

    • Securing custom code: Low-code tools allow for writing custom code to extend and enforce platform coding guidelines and design patterns to protect sensitive data from unauthorized access.
    • Adhering to secure release practices: Integration with the existing enterprise CI/CD pipeline is important so that dev teams can extend the same release governance protocol to the auto-generated code before going to production.

    End User Application Access and Data Protection

    • Preventing malicious attacks: Today, both web and mobile apps are becoming constant targets for security breaches. Automatically generated code, and citizen developers working remotely, can make low-code applications more prone to vulnerabilities. Platforms should generate apps that are fully protected against phishing attacks, SQL injections, brute force attacks and DOS attacks.
    • Secure data and application access: Low-code platforms should provide a comprehensive access control mechanism preventing unauthorized access to data and app functionality. With remote teams accessing apps from anywhere, at any time and from any device, data breaches can be prevented with the right controls in place.

    Low-Code and Security – The Future of Development

    As enterprises and ISVs turn to low-code for more serious use cases, the larger question still remains. Can low-code platforms enable modern development teams to deliver applications faster, while still enabling a secure and tightly governed environment?
    The answer is, yes, they can! However, development teams must consider the following security checklist when considering low-code platforms:

    1. The chosen low-code platform must be set up within an enterprise secure DMZ or secure private cloud, and must effortlessly pass cybersecurity clearances.
    2. The platform must enforce best practices in programming (coding conventions, design patterns and data encryption) for automatically generated code as well as custom code written by the developer, facilitating easier integration with existing CI/CD processes and tools.
    3. The platform must offer full protection against the top 10 OWASP vulnerabilities for web and mobile apps, and have third-party certifications to guarantee code quality and security. Also, organizations should ensure that there are no vulnerabilities in their chosen platform’s binaries, as well as all third-party dependencies (including open source libraries) as listed in the CVE library.
    4. The solution must support multiple authentication providers (database, LDAP, AD, SSO, SAML, Open-ID, multifactor, biometric) to build applications with strong user security. For user authorization, ensure support for both coarse-grained as well as fine-grained access control policies to protect various aspects of the application based on RBAC.

    Development teams can embrace low-code technology while ensuring security best practices are in place. Low-code is here to stay, and with the right platform, enterprises and ISVs can make sure security is shifted left and addressed by developers much earlier in the development process. The result is a highly productive, remote workforce churning out applications that are modern, scalable and secure.