devopsy.kinsta.cloud

Tag: low-code development

  • Low-Code Makes API Testing More Accessible

    Low-Code Makes API Testing More Accessible

    APIs are rising both in quantity and business value. But with that growth comes an increasing number of vulnerabilities, which could affect cloud service dependencies and internal APIs. Functionality and uptime could also suffer as cloud services evolve their APIs with new versions. Thus, API endpoint testing is critical to ensure a reliable back end. With growing interest across the organization to stabilize these integrations, how do we test APIs in a reproducible way that non-developers can grasp?

    Low-code platforms — tools that enable workflows with visual programming models — are opening doors for citizen developers to construct applications in a visual mode. Similarly, the low-code concept could aid API testing by providing an easier method to create API tests to verify functionality and uptime. This could arm quality assurance, DevOps and site reliability professionals with an easier means to test high-value integrations and their UI representations.

    Amid a growing headless movement, APIs are now powering many end-user experiences. However, during a developer drought, it may be challenging to find talent with integration know-how.

    I recently met with Dan Belcher from Mabl to discuss combining low-code and API testing. Here, we’ll uncover why it’s difficult for non-engineers to conduct API testing and consider what API testing must address to ensure today’s software meets tomorrow’s digital innovation demands.

    A Low-Code Approach to API Testing

    The software landscape has evolved rapidly in recent years. “Many forces have combined to create an incredible amount of change,” said Belcher, citing DevOps, CI/CD, the API economy and agile enterprises as examples. In this era, applications are becoming more dynamic, disrupting the way teams conduct end-to-end quality testing.

    API-based cloud services are part of this new frontier, becoming popular building blocks within modern applications. Yet, integrations require upkeep as cloud services evolve and version. Without continuous testing of API-based cloud services, organizations could easily suffer from breaking change and poor usability.

    Unfortunately, as it stands, typical QA teams aren’t well-equipped to handle ongoing regression testing for APIs. Instead, “developers, historically, have been the only ones that understood API testing,” explained Belcher. For years, API testing has been relegated to the realm of developers, who use tools like Postman to perform unit-level testing. But why is API testing so difficult for others?

    What Makes API Testing Difficult?

    Well, to start, non-engineers are typically more accustomed to UI-based testing. These environments use a structure designed for anyone to consume, making it easy to locate fields and confirm values, Belcher explained. When it comes to API testing, you often must handle massive chunks of JSON responses to match fields and surface issues. Testing API responses typically requires writing code, parsing JSON and writing it to variables, Belcher explained, which may be difficult for non-developers to implement.

    Or, difficulties could arise when testing asynchronous endpoints, Belcher added. Asynchronous APIs often involve background server processes that take a while to respond. This comes at a moment when event-driven architecture (EDA) is a growing trend. Take AsyncAPI, a standard API specification for EDA APIs, which recently joined the Linux Foundation. A recent report found AsyncAPI production usage tripled from 5% in 2019 to 19% in 2020. According to Belcher, testing such asynchronous services requires an infrastructure for continuous testing to anticipate these emerging scenarios.

    Four Crucial Areas For API Testing

    So what should API tests be focusing on? Belcher highlighted four areas that warrant close examination throughout the API testing process:

    • Functionality: This is the core functionality. Does the API do what it promises? Does it return the correct data?
    • Uptime: What is the API’s availability? Are all endpoints available in production?
    • Speed: This ensures cloud dependencies meet SLAs. What is the latency? Is there drift in API performance over time? Though API monitors like Api.expert help aggregate industry performances, they might not always reflect your specific customer-level realities. Belcher recommends not placing faith in supposed performance and instead, clocking your own.
    • End-to-End: Belcher stresses the role APIs now play across customer-facing presences. An end-to-end workflow should involve API endpoints, how they interact with one another, and the resulting visual representations. “Just like we have end-to-end testing for UIs, we should have end-to-end testing for APIs,” he said.

    API testing isn’t always combined with other parts of the user experience, but Belcher believes, going forward, end-to-end testing will be critical to ensure all workflows function in concert. For example, if a user profile is created within a browser, teams should verify the user profile has been created at an API level, as well.

    Low-Code API Testing and Shift Left

    APIs are beneficial to avoid reinventing the wheel. However, 100% operational uptime is impossible. Applications will inevitably encounter API problems, including outages, technical failures and functional misrepresentation. Developers also often come to rely upon production behaviors that may not be officially documented, an effect known as Hyrum’s Law. This can cause unstable integrations as APIs version over time.

    Thus, for these reasons and more, it’s a good practice to adopt continuous API testing. With the surging interest in site reliability engineering, spotting API errors early on will become an important aspect in reducing mean time to recovery (MTTR). Testing third-party APIs could also expose production latencies to inform cloud investments.

    “As the pace of change is going up, how do we deliver great quality to our customers?” Belcher asked. API testing is one answer to address this rapid change, and is growing in importance for the software delivery life cycle. It especially rings true for headless frontend experiences, where the API-driven backend isn’t transparent to QA testers.

    Low-code capabilities for API testing could help tear down silos inherent in the development process, enabling more people to participate in testing integrations. Belcher also stresses the importance of improving the usability of API testing for developers and non-developers alike. “We need to integrate with tools developers are already using for verification,” he added.

  • How to Mitigate Low-Code Security Risks

    How to Mitigate Low-Code Security Risks

    Gartner predicts that by the end of 2025, over 65% of development projects will use low-code builders. The field of low-code continues to expand. But what security implications does low-code introduce?

    Low-code refers to tools that enable application construction using visual programming models. Adopting drag-and-drop components instead of traditional code, no-code and low-code platforms enables non-technical folks to construct their own workflows without as much help from IT. Yet, handing power to citizen developers with less security training can be risky. Plus, low-code platforms may hold compromised propriety libraries or leverage APIs that may unknowingly expose sensitive data to the outside world. There’s also the possibility that low-code could increase shadow IT if not governed well.

    Low-code opens the door to more producers. But, does it open the backdoor, too? I recently met with Chris Wysopal, CTO and cofounder of Veracode, to discuss the growing security risk posed by low-code applications. According to Chris, hardening low-code environments involves a combination of compartmentalization, dynamic and runtime techniques, and adopting the “least privilege as possible” rule across the board. Below, we’ll expand on potential low-code risks and see what other methods Wysopal recommends organizations employ to secure the emerging low-code paradigm.

    Low-Code Security Concerns

    Verizon’s 2020 Data Breach Investigations Report (DBIR) found 43% of all breaches are connected to a vulnerability at the application layer. Thus, securing these applications, or in the case of low-code, the layer that generates them, is essential for business to function smoothly.

    When it comes to low-code, Wysopal notices a few key risk areas:

    Proprietary libraries with hidden vulnerabilities. By their nature, low-code platforms typically use a good deal of proprietary software, making securing them a bit opaque. These systems could involve a proprietary language, proprietary libraries and proprietary frameworks. If you trust a low-code platform, you place a lot of faith in the low-code vendor to have a strong security process in place.

    Some platforms do generate traditional code, which organizations can export to run on a Node.JS or Java server. Yet, this often involves a mix of code and proprietary libraries, says Wysopal. While you could run traditional static analysis on the generated code, you may miss some context.

    Lack of citizen developer security training. Citizen developers have little technical knowledge, let alone DevSecOps training. If runtime applications present vulnerabilities, expecting no-code users to mitigate them is unrealistic.

    API integrations. If low-code platforms expose an API or generate a web application via an API, the platform could be exposing sensitive data.

    Ways to Harden Low-Code Environments

    To respond to these areas, Wysopal offers some advice for securing low-code environments:

    • Perform static code analysis: Perform your own static analysis on any generated code and test for common errors. “Look at the code, and understand where it interacts with the outside,” Wysopal recommended.
    • Audit proprietary libraries: Whenever possible, Wysopal said he recommends pushing back on the vendor to question them on their application security standards and examine proprietary libraries for potential risks.
    • Verify partners: Similarly, take precautions when working with third-party partners around low-code tools. Partner tools should be carefully vetted and hold some sort of application security certification from the low-code platform.
    • Secure the API layer: Understand what APIs the application interacts with. These connections should be tested dynamically and automatically with an API scanner. Along your journey, consider these API security testing best practices.
    • Compartmentalize: Wysopal also recommends traditional isolation techniques. Consider more than just the application layer; Wysopal recommended isolating the app and running it in a virtual machine or a container.
    • Security training for citizen developers: Since citizen developers are typically not trained on appsec practices, hold security exercises to train them on fundamentals. A helpful demonstration could involve directly attacking an app to find flaws.
    • Apply the least-privilege-as-possible rule: When assigning user capabilities, whenever possible, use secure-by-default settings and allow access only to those that need it.

    By applying dynamic and runtime techniques, you may catch vulnerabilities, such as a cross-site scripting error. However, if you’re working with proprietary low-code systems, you may not be able to fix it immediately! You may have to send a request to the vendor and wait for the bug to be patched. Thankfully, most technology providers take more immediate action in response to bugs than to feature requests, Wysopal noted.

    Change the Attitude Toward Security

    On the low-code spectrum, there is the attitude that “people aren’t really doing mission-critical applications — they’re mainly doing prototyping, or back office automations,” Wysopal said. Or, since low-code applications often do not publicly expose an application, they are deemed low-risk and fall to the bottom of the security team’s inbox and list of to-dos. “We’re still in a world where people don’t secure all applications,” he said.

    However, these attitudes are a bit short-sighted, since “applications aren’t islands,” Wysopal said. Even if applications are intended for internal use only, phishing attempts could expose credentials and gain access to the network. Here, attackers could leverage sensitive resources or steal infrastructure for compute power.

    Thus, all low-code users should be aware of potential threats and change habits to address these risks accordingly. However, the onus is also on low-code vendors to sufficiently arm their systems. Having a vulnerability disclosure, bounty program and an easy means to accept bug reports from white hat security researchers will be necessary to continually patch issues.

    No-Code ≠ No-Bug

    Low-code continues to permeate more and more digital operations, opening up novel potential for citizen developers. While the low-code movement promises impressive returns, it also brings potential risk.

    To mitigate these concerns, we must level up our security understanding and evolve our approaches, Wysopal said. “Any application can have flaws and security bugs in them.” Just because you’re not writing a function in C and are relying on a visual programming model doesn’t mean you’re not introducing flaws.

    Disseminating the real risk of resources and dependencies, along with helpful consumer-facing documentation, will set the superior low-code platforms apart from the rest. Otherwise, putting faith in proprietary libraries will be a tough pill to swallow.

  • Why a Low-Code Platform Should Have Pro-Code Capabilities

    Why a Low-Code Platform Should Have Pro-Code Capabilities

    If you want to build a house, you could get a lot done yourself. You could sketch out a simple design, start assembling materials, maybe even nail down some floorboards and install drywall. But to make it truly functional, and to respond to all the unknown fixes — big and small — that would surely arise, you want professional support to enhance and reinforce the job you’re doing. Plus, not everyone is an expert in plumbing and electric.

    The same is true of app development.

    Low-code platforms are available for both professional and less-experienced developers to build apps more quickly than ever. The speed and practicality of low-code has injected a newfound approachability to the coding process, yet can’t account for the full range of user experiences at work within the modern enterprise company of today.

    If this sounds like a takedown of low-code, it’s far from it. As an approach, low-code is transformative. And here to stay. By empowering non-coders (citizen developers), you enable development of responsive web apps using visual tools and pre-built components and save precious development and IT resources.

    Low-code can free IT departments from a constant onslaught of demands and requests for support and create new ways to digitally advance products and services. Plus, IT leadership can be freed up to focus on the strategic needs of the business and maintaining momentum within major digital transformation initiatives. Therefore, it’s worth understanding why not all low-code platforms are the same, and how they’re viewed through the lens of the professional developer and enterprise architect.

    Using Only Low-Code Means You Can Fall Short

    The simple, unvarnished truth is that, when it comes to coding, there is no one-size-fits-all solution. Things are never that simple, or easy.

    There are many crucial components to the app development process that require time, attention and expertise to succeed. The best low-code platforms support the specification of automated workflows and — this is very important — can integrate with various enterprise systems, applications and sources of data. Enterprise systems can be incredibly complex and manage multiple data sets and processes, and some can be outdated. To build enterprise apps with a low-code platform, you need to be able to connect to these systems and customize with the same nuance and security that a pro-code platform provides.

    Take, for example, the Facebook app. While it’s simple and easy to use even on a mobile phone, just imagine all the complexity that makes up the backend: data, algorithms, ad networks, moderation, reporting, etc. — all updating in real-time for billions of users. The same goes for other apps with complex backends but simple front ends, such as those used to manage health insurance companies, retailers, government agency portals, wayfinding apps for big box stores … These are just a few examples that customers of ours offer solutions for built using HCL Volt MX. HCL Volt MX allows organizations to build applications for any audience — consumers, partners and employees, across any device — native mobile, web and wearables. It also provides improved efficiency and higher developer productivity. The platform has robust services for identity, integration, orchestration, business-process automation and rules management. Paired with its low-code design environment, you can create consumer-grade apps across multiple touchpoints — fast.

    Learn more about HCL Volt MX

    Giving developers — and thus, the full enterprise app dev operation — a connected arsenal of front- and back-end tools to design and maintain a dynamic framework includes combining low-code accessibility with power tools that pro-coders expect. Hence, companies can ensure they’re not sacrificing customization, scalability and sustainability, even with the need for design velocity and speed-to-market.

    Bridge Front-End and Back-End Capabilities

    When you are deciding on your approach for delivering your next digital experience, you should have the best of low-code with a pro-code foundation that manages the complete software development life cycle on the terms that a full-stack developer expects. Meaning, you expect the platform to increase your velocity, offer rock-solid security and give you integrated DevOps and automated testing, simplified backend integration and the ability to use advanced technologies such as blockchain, augmented reality (AR) and conversational apps and more, with ease.

    Also, what happens when the application needs features or functionality not included in the pre-built building blocks? How do teams fill in the gaps that inevitably occur when connecting to existing enterprise systems? How will low-code provide the highest level of security over a full range of unique workflows and handle enterprise systems of dizzying complexity?

    In our experience, there is always a time when a full-stack developer experience can get the very most out of the low-code platform, especially when the app demands complexity in the integration and orchestration, needs to scale to millions of users and have a sticky, “pixel perfect” user experience.

    As Simple As You Want, As Expert As You Need

    Professional developers are looking for software that can boost productivity without sacrificing features that allow them to poke around and see what adjustments a given app needs to deliver a full-native mobile, web or wearable app experience. A low-code platform with pro-code support, such as HCL Volt MX, bridges gaps in the entire software development life cycle and brings the business stakeholders, digital innovators, designers and professional developers together to achieve their digital vision.

    You Get the Best of Both Development Options

    • Lightning-fast capabilities for implementing front-end experience, workflows and functions that enable the business to see how their vision comes alive.
    • A professional-grade infrastructure that can respond to the needs of the front-end features and handle the more complex integration and coding demanded by any enterprise business requirements.

    If you’re solely investing in a low-code platform to build web apps, your operation can quickly run out of steam. Being pro-developer grade means you can respond immediately to the intention of the app’s development concept, no matter the complexity and scale required — native mobile, web and wearables. After all, creating apps is never a “one-and-done” pastime; we all know it’s an iterative approach that wins the day. Make sure your low-code platform choice is pro-developer grade.

    Learn how HCL’s Volt MX provides a low-code approach that includes back-end support.

  • ServiceNow Adds Low-Code Tool to Platform

    ServiceNow Adds Low-Code Tool to Platform

    ServiceNow today made available an update, dubbed Quebec, to its Now platform that adds a set of low-code application development tools.

    Marcus Torres, general manager for IntegrationHub and vice president of platform product management at ServiceNow, said the Creator Workflows tool leverages existing App Engine and IntegrationHub capabilities in the platform to make it possible for both end users and professional developers to build custom applications faster using a visual development tool dubbed App Engine Studio. A set of templates that provide a set of pre-built workflows is also included.

    The goal is to make it easier to develop applications that would otherwise not be built because professional developers, using existing tools, would simply not have the time, Torres said.

    The Quebec release of the software-as-a-service (SaaS) platform is also used for IT operations management (ITOM), adding artificial intelligence (AI) capabilities in the form of ITOM Predictive AIOps that surfaces potential issues before they become a major issue. It is now also easier to set up the virtual agents that ServiceNow makes available to enable conversational AI, and there is now an AI search capability built into the ServiceNow portal. ServiceNow gained these capabilities via its recent acquisitions of Loom Systems and Attivio.

    Finally, ServiceNow has added process optimization and workforce optimization modules, along with an engagement messenger module that extends the self-service capabilities it provides to third-party portals, and a universal request tool that enables agents to collaborate and transfer tickets across departments while keeping employees informed of the status of their ticket.

    Thanks to the general enthusiasm for digital business transformation initiatives being accelerated in the wake of the COVID-19 pandemic, reliance on low-code tools to build applications has significantly increased. The challenge organizations encounter, however, is that a low-code tool can build a relatively simple application. However, development means may need to drop down to a lower level of abstraction to address more complex issues as an application continues to evolve. The Creator Workflows tool from ServiceNow is designed to provide development teams with that option.

    In general, ServiceNow is making a case for building applications on the same platform that many IT organizations already employ to manage IT. Many organizations already take advantage of workflows that ServiceNow has built to extend its core platform to address a wide range of uses cases involving, for example, human resources applications. The addition of the low-code tool will make it easier for IT teams to create applications that address use cases unique to their organization.

    Of course, there is no shortage of options when it comes to low-code and no-code tools these days. IT teams will need to decide to what degree platform-specific low-code tools make sense versus adopting low-code tools that enable them to build applications that can be deployed anywhere. Regardless of the path forward, however, it’s clear the number of applications that need to be deployed is dramatically increasing with each passing day.

  • Citizen Development Program: Enabling Citizen Developers

    Citizen Development Program: Enabling Citizen Developers

    In part one of this series, we made the case for embracing citizen developers to close the developer demand-supply gap while delivering true business agility. We outlined the foundational elements that are consistent across successful citizen development programs: 1) adopting a low-code application platform, 2) embracing the citizen development journey and 3) marketing (internally) citizen development successes.

    citizen development 2

     

    We also discussed finding the right citizen developers – individuals with the right aptitude and attitude to be successful building applications using low-code tools. Now that we have identified the right use cases and the ideal citizen developer, we will focus on the key decisions for enabling (and empowering) citizen developers.

    Enabling (and Empowering) Citizen Development

    To enable citizen developers, you must focus on the individual and set them up for success through training, support, and recognition. Empowerment addresses the citizen development process, the life cycle of an application and, more importantly, reducing the organizational friction associated with both.

    citizen development 3

    As you look to build out a citizen development enablement program, you need to answer the following questions about training, support and recognition of your citizen developers:

    • Training
      • What is the training curriculum for citizen developers? Do learning paths differ based on developer category?
      • Is there organization-specific content that needs to be included in the training? If so, who owns the creation and maintenance of that content?
      • How will developer proficiency be assessed?
    • Support
      • How will citizen developers obtain ongoing support?
      • Will you schedule office hours hosted by subject matter experts?
      • Will there be an online community?
      • Will citizen developers be aligned with a specific SME / pro developer?
      • How quickly do you want to scale the program?
      • What are the appropriate checkpoints / milestones associated with scale?
    • Recognition
      • Will you formally recognize training accomplishments? Perhaps though gamification via badges?
      • How will you track, celebrate and reward successful applications?
      • Does demonstrated competency equate to increased developer access?

    It is important to remember that the role of “citizen developer” is frequently an additional responsibility beyond an individual’s day job. As such, it is critical to educate them, support them and celebrate their wins in order to ensure success.

    In order to empower your citizen developers, you need to consider both the application development process and the overall application life cycle. You need to answer the following questions about the process and the life cycle:

    • Application Development Process
      • What is the overall objective for citizen development? What metrics will you use to track progress?
      • Does each application require a separate approval or are developers, once approved, able to build multiple applications?
      • What are the technical standards and best practices specific to your organization?
      • What is your development process? Who has authority over development, testing and deployment?
      • Is your core development team / center of excellence structured, resourced and funded to support citizen development?
      • How will citizen developers and pro coders collaborate on applications?
    • Application Life Cycle
      • What is your application intake process? Who evaluates new app requests for platform fit, redundancy, cost, etc.?
      • Once an application is moved to production, who is responsible for the ongoing support and maintenance?
      • What is your process for rationalizing and deprecating applications?

    As low-code platforms continue to evolve, the capabilities that facilitate the collaboration between the citizen developer and the pro coders are critical to deliver a successful application. It is not uncommon for a pro coder to collaborate with a citizen developer to deliver the last 5% to 10% of an application’s necessary functionality.

    We have identified the right use cases and the right citizen developers in part one. We have enabled and empowered the citizen developers in part two. In part three of this series, we will explore establishing technical guardrails to protect the platform from the citizen developers, and the citizen developers from each other.

    This post is the second in a three-part series that provides real-world insights on delivering business value from citizen development initiatives.

  • Survey: DevOps Growing Pains in Salesforce Environments

    Survey: DevOps Growing Pains in Salesforce Environments

    IT organizations that have adopted software-as-a-service (SaaS) application platforms from Salesforce in part to jumpstart their digital business transformation initiatives are experiencing some DevOps growing pains.

    A survey published this week of 230 executives, managers, and members of Salesforce delivery teams conducted by Beagle Research on behalf of Copado, a DevOps platform for IT teams building custom applications, shows that while 82% have increased or maintained the size of their Salesforce development teams, the change fail rate jumped from 23% last year to 33% in 2020 when compared to a similar survey conducted a year ago. The survey also notes time to recover increased from 110 hours in 2019 to nearly 196 hours in 2020.

    Andrew Leigh, chief marketing officer for Copado, said those results generally reflect the nature of the more complex application initiatives being launched on top of Salesforce applications. The survey also noted 55% of respondents don’t consistently automate their Salesforce deployments, with less than a quarter of respondents (23%) having a way of automatically deploy a configuration from development through testing to production.

    In fact, in teams with fewer than 10 members, only 28% of survey respondents automated Salesforce deployments compared to 56% of teams with more than 100 developers that have automated their deployments, the survey found.

    The survey also noted that more than a third (34%) of respondents said features that development teams create may not be adopted. That issue suggests there is more work to done in terms of better aligning development teams with the goals of the business, Leigh said.

    Organizations building applications on top of Salesforce don’t typically embrace DevOps best practices until development teams have 25 or more members, Leigh noted. Salesforce environments generally require their own DevOps platform, because applications are constructed using a set of objects and tables unique to the platform. Those objects and tables are most often invoked using a set of low-code application development tools. Nearly three-quarters of respondents (73%) employed at least one commercial Salesforce development tool.

    Overall, the survey finds 82% of organizations have increased their budgets for or effort toward digital transformation, with 53% reporting they have exceeded their performance goals for the year. The survey also identifies a set of elite DevOps performers that are reporting 30x shorter lead times; 46x more frequent deployments; 5x lower change fail rate; and 37x shorter time to restore. Elite performing teams are 65% more likely to have adopted continuous integration than low performing teams, the survey notes.

    More than half of respondents (53%) said that they found it easy to find people who have DevOps experience in a Salesforce environment, with salaries typically in the $90,000-$140,000 range.

    The survey also finds the majority of organizations (82%) expect the systems integrators they contract to build applications to help define their DevOps processes.

    As organizations continue to adjust to new business realities in the age of COVID-19, there’s no doubt more custom applications will be built and deployed on top of SaaS application platforms such as Salesforce. The challenge is finding the best way to accelerate the development of those applications in a way that consistently produces the desired result.

  • CloudBolt Software Aims to Bridge DevOps and IT Divide

    CloudBolt Software Aims to Bridge DevOps and IT Divide

    CloudBolt Software today released a Winter update to its cloud management platform that aims to bridge the divide between DevOps teams and traditional IT administrators.

    IT administrators can now employ the CloudBolt platform to invoke the open source Ansible framework for automating IT processes and workflows using a graphical user interface (GUI) surfaced via a OneFuse Ansible Tower module.

    Additionally, the OneFuse Scripting module will now make it possible to automate script creation for anyone who creates a script using, for example, Terraform, and package that script in a way that IT administrators can invoke via a graphical tool.

    Jeff Kukowski, CEO of CloudBolt Software, said the goal is to make it easier for IT teams across the organization to reuse code created by a DevOps team. OneFuse provides IT with a codeless integration tool. In addition to the core cloud management platform, CloudBolt Software also provides access to a Kumolus service that enables IT teams to optimize cloud costs and provides additional governance capabilities such a generating an audit trail.

    Other capabilities added in the Winter release include deeper cost optimization analysis for VMware vCenter and Microsoft Azure environments, support for the latest release of VMware vRealize and additional C-level dashboards and reports.

    As the number of workloads deployed in production environments increases, there is going to be a greater need for some form of détente between DevOps teams and traditional IT administrators. Site reliability engineers (SREs) can typically manage a much wider range of workloads than an IT administrator. However, SREs are both expensive and hard to find and retain. IT organizations will need to find a way for IT administrators that, at best, have limited programming skills, to pick up some of the slack.

    Those IT administrators can play a critical role in minimizing the number of misconfigurations arising from provisioning IT infrastructure as code. Misconfigurations as a result of developer mistakes are rife across the cloud, and IT administrators are more inclined to check for these than are developers who are racing to deliver their next application.

    The truth is, there are a wide range of tasks that DevOps teams would just as soon see managed by IT administrators, especially if a script or runbook that addresses common issues has already been created. The trick is making that script or runbook easily accessible.

    In the meantime, IT organizations are racing to keep up with complexity in IT environments, often by applying automation at scale in a way that is both repeatable and well-documented. Whether IT professionals like it or not, the days of writing automation scripts and failing to document them are coming to an end. The real issue is ensuring that what does get automated actually works as expected, each and every time a script is applied.

  • Using Automation to go All-Digital, Fast

    Using Automation to go All-Digital, Fast

    Before the pandemic, digital transformation was a five-year plan for many companies — or in some cases, a distant vision that kept getting kicked down the road. Now, companies in every industry face an urgent imperative to adapt to an increasingly online-first world: If you don’t go digital, fast, you’re simply out of the game.

    Increasing productivity has been critical for companies as they make this shift. But too often, speed is hindered by time-consuming and repetitive processes that companies can and should easily automate. By automating mundane tasks, employees and businesses can focus on what really matters — increasing scale in today’s work-from-anywhere world, and improving experiences for both employees and customers.

    The Benefits of Automation

    Fundamentally, automation is about digitizing existing business processes to streamline results, and it will be a key element in helping businesses survive and get back to growth. Until now, many companies have focused on applying these tools to the front office: sales, marketing, commerce and supply chains. With most employees now working remotely, it’s harder than ever for team members to do their jobs efficiently. Automating the back office and improving the employee experience is key for businesses to achieve the speed they need to thrive right now.

    Here are three key advantages of bringing automation to the back office:

    1. It improves productivity.In virtually every industry and role, employees are still spending hours every week on mundane and labor-intensive tasks, such as data entry. Automation can speed up these repetitive tasks and streamline lengthy processes, freeing employees up to focus on the “human” aspects of their jobs, like interacting with customers, planning ahead, making decisions or learning new skills. By taking over routine tasks and allowing employees to concentrate on what matters most, automation makes workers more efficient and productive.
    2. It increases scale.There’s only so much an employee can do manually. The time-consuming processes that worked yesterday can’t scale to meet the demands of an all-digital environment.  Automating repetitive tasks means that employees can achieve more in the same amount of time, allowing them to scale their workloads. With time-consuming tasks being taken care of in the background, workers can spend their time on more meaningful work and customer relationships.
    3. It enhances employee experience.Nobody enjoys entering numbers into a spreadsheet. An often overlooked aspect of automation is that it leaves employees more satisfied and engaged with their companies and their jobs. Having fewer tedious tasks on their plates gives employees the chance to tap the skills that machines aren’t as good at, like creativity, communication and decision-making. This is especially beneficial at a time when most employees are juggling more responsibilities at work and at home. Making a more valuable contribution and more meaningful connections is not only rewarding for employees, but also translates to higher satisfaction among the customers they interact with.

    Real-World Examples

    Not everything can be automated, but there’s a lot of room to take the drudgery out of most roles. Take onboarding, for example. Traditionally, when a new hire started, everything happened in person: They attended an orientation, picked up their laptops at the tech bar, met with benefit providers — all of which required orchestration on the part of human resources. With automation, all of this manual coordination can be replicated with an intelligent workflow capable of guiding employees through an onboarding process customized to their specific role and location.

    In another example, HR departments are facing an unprecedented volume of queries about policies around caring for children and other dependents. Using low-code development, companies can easily set up automated, online bots to handle frequently asked questions and guide employees through processes needed to enroll in new services. Automating these queries with bots not only makes the employees themselves more productive, but it also delivers better experiences for both the HR team and the employees seeking answers.

    Automation is Here to Stay

    In today’s world, there is no alternative to a digital business model. Automation is the recipe that will help companies achieve the speed they need to survive now and the edge they need to thrive in the future.

    And there is no turning back — automation is here to stay, regardless of the trajectory of the pandemic. The process of change is never easy, but done right, automation not only leads to a more agile workforce, but also to a happier one.

  • Low-Code, High Risk? Closing the Security Gap of Exposed Source Code

    Low-Code, High Risk? Closing the Security Gap of Exposed Source Code

    There’s no denying that low-code is a rising trend in application development that’s likely to stay for the long run. Its impressive benefits in terms of agility and development time are convincing the enterprise, so it’s no wonder that the industry is on its course to achieve fivefold growth between 2017 and 2022.

    In low-code platforms, building custom cloud applications can be achieved by reusing components through a simple drag-and-drop interface, which means reduced engineering efforts. Then, APIs can be used to hook components together and maximize compatibility.

    Although many steps of the way can be achieved without actively writing a single line of code, many low-code apps include advanced logic written in JavaScript. So, when it comes to understanding the threat model of low-code platforms, we must consider security considerations that arise from using JavaScript code.

    Low-Code and JavaScript

    Because JavaScript needs to be interpreted by a browser to work, it is exposed and anyone can access, read and modify it. This becomes problematic because companies store important business logic on the client-side, which is often unavoidable due to the inexistence of a back end or the need to avoid performance losses. So, companies’ proprietary algorithms and logic end up running on an adversarial environment, which opens the door to a series of attacks—namely, automated abuse, piracy, intellectual property theft and data exfiltration.

    When it comes to protecting code, typically we’re led to the concept of encryption. However, JavaScript encryption is not a feasible strategy; the browser always needs to interpret JavaScript so that it works. If we have a decryption key, we need to supply it to the browser; if that key becomes compromised, all the code will be easily accessed.

    A suitable approach to protect JavaScript is transforming it into a new version that is extremely difficult to understand while also preventing attackers from debugging or tampering with the code.

    When it comes to enterprise or commercial applications, JavaScript must be protected with maximum resilience—that the protected code will prevent attackers from using automated tools against it. On top of this, the code should contain runtime defenses that break the application whenever attackers try to debug or tamper with the app’s source code.

    Conclusion

    Low-code still means a lot of code. Even though most of it will not appear on the front stage, development teams must not forget that it should always be protected. Attackers love low-hanging fruit and unprotected source code of enterprise apps is certainly a low-effort, high-gain venture.

  • 3 Steps for Organizational Agility in the COVID-19 Era

    3 Steps for Organizational Agility in the COVID-19 Era

    While COVID-19 forced a fundamental shift in the way we work nearly overnight, many companies have been able to continue operations with minimal disruption, effectively transitioning to a remote workforce with speed and agility. These organizations that were further along in their digital transformation journeys before the start of the pandemic faced minimal disruption in the transition to remote work, allowing them to maintain operations during a very critical time.

    As we enter the next chapter of work, the trend of “working from anywhere” will continue as the status quo. But how can companies completely overhaul their processes in a way that lets employees remain productive, while still giving them the ability to connect and collaborate? While there’s no one-size-fits-all approach to managing this shift, it’s clear that mastering both speed and agility will be key.

    Achieving Agility

    To help achieve both during this critical time, organizations must take three key steps: automating workflows, enabling citizen development to build low-code and no-code applications and investing in centers of excellence.

    Automating Business Critical Digital Workflows

    Think about all of the business-critical processes that span today’s organizations—communications that are routed around in email and tracked in spreadsheets—each of these processes are digital workflows that can be automated. In fact, today’s workers spend over 30% of their days squandered in redundant or administrative tasks that can easily be automated.

    Automating these workflows is the catalyst that starts the change in making organizations more agile. When done right, automating and digitizing workflows will fundamentally improve business operations and boost speed and productivity. And by incorporating advanced automation and machine learning into workflows, companies can also improve decision-making speed and effectiveness—meaning employee time is spent on strategic tasks that create value for the company.

    Digitizing internal business operations also means IT leaders can spend less time thinking about yesterday’s problems and more time focused on solving tomorrow’s challenges. The COVID-19 crisis is pushing IT leaders to prioritize productivity, shift resources to innovation and increase the speed at which companies operate—all of which require creating great experiences for workers. Automating workflow digitization can drive efficiency and productivity, as well as create an environment for better decision-making.

    Fueling Innovation With Citizen Developers

    The COVID-19 pandemic is pushing organizations to be more agile, creating more demand for citizen programming. With low-code and no-code platforms that generate code automatically with point-and-click or visual interfaces, non-technical employees are boosting productivity throughout the organization by creating applications that simplify employee workflows across departments.

    While the idea of unlocking employee productivity with low-code/no-code tools is not new, the pandemic has illuminated the value of these tools with companies racing to come up with quick, digital solutions that help navigate remote work needs and remain agile. Before the pandemic, the Achilles’ heel of low-code/no-code projects was they lacked the right organizational setup to make them successful. But now IT leaders recognize the need to expedite the app development process and are embracing low-code efforts to digitally transform at a much faster rate.

    In action, citizen development enables organizations to transform existing applications while creating new ones. It empowers end users to create customizations and configuration changes on their own, while letting developers and other IT leaders work on more complex applications and stay focused on keeping operations up and running.

    After all, to remain agile during this rapidly evolving landscape, companies must be able to create, deploy and scale apps quickly to respond to employee and business needs. For example, the city of Los Angeles doubled down on low coding to build a portal that supports drive-through COVID-19 testing—in less than 48 hours. The app gives individuals the option to easily conduct drive-through testing so they don’t have to wait in line and risk exposure. After launching the app, 50,000+ tests were booked in a couple of weeks with 1.5 million visitors, and the app has scaled to serve 25 locations throughout the county.

    Low-code applications such as this one are truly becoming the saving grace to help organizations and individuals as they continue to navigate new challenges and uncertainty, enabling an amazing “force multiplier” impact on businesses and ultimately allowing them to be more agile during this critical time.

    Scaling Delivery With a Center of Excellence

    The final step in achieving organizational agility is creating a center of excellence to help continue digitizing business workflows. A center of excellence brings together business and IT teams for strategy, business engagement and delivery and innovation to help organizations reach value, speed and agility much faster. A center of excellence also removes the organizational silos that can crop up in the transition to remote work by eliminating barriers and consolidating workflows.

    Furthermore, a center of excellence can provide best practices and no-code tools to empower citizen developers while allowing developers themselves to tackle more complex issues for the business. After all, having a center of excellence means citizen developers can easily access the information required to build low-code apps and developers have a streamlined way to deliver software updates more rapidly to different lines of business.

    When done right, the payoff is significant. Successful centers of excellence are able to realize—and accelerate—time to value across the enterprise, empowering teams to be more productive, innovative and agile in everything they do.

    The Agility Bottom Line

    The COVID-19 pandemic has given many businesses the rare opportunity to pressure test their digital transformation progress and overall organizational agility. Work is never returning to the way it once was, and businesses that are changing their operations to be more agile will adapt faster to this environment.

    Delivering speed and agility at scale has never been more important, but getting there doesn’t happen overnight. By doubling down on automating workflows, driving innovation with citizen developers and scaling delivery with centers of excellence, organizations can take the fast path to speed and agility at scale.