devopsy.kinsta.cloud

Tag: no-code/low-code

  • Can ChatGPT Fix Bugs? ‘Wolverine’ Dev Says YES

    Can ChatGPT Fix Bugs? ‘Wolverine’ Dev Says YES

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Instead of AI aids for programming, what about for debugging? The pseudonymous “BioBootloader” says he’s persuaded GPT-4 to make his code self heal. (more…)

  • Empowering Pro and Citizen Developers

    Empowering Pro and Citizen Developers

    When I was the CISO years ago, we had a talented team build the incident management system for our new CIRT. The team built intake forms, interfaces with some of our tools and the workflow to hold it all together. We were fortunate to have the resources of one of the largest companies in the world (at the time), which we used to make our incident response processes faster and more efficient. Thanks to this system, we saved many thousands of hours per year.

    That was 15 years ago, and now organizations are automating processes without the need for talented (and expensive) developers. In fact, this year’s moniker is “Year of Low-Code”—the beginning of a new era. Gartner predicts low-code will continue to evolve, stating that by 2025:

    • 70% of new applications developed by enterprises will use low-code or no-code technologies (up from less than 25% in 2020) and
    • 75% of large enterprises will be using at least four low-code development tools for both IT application development and citizen development initiatives.

    As Gartner’s forecast on low-code applications comes to fruition, product and IT leaders collectively have a lot of work to do to not only provide these tools to customers but internally for their teams, as well. As organizations rise to meet the demand for automation to streamline their customers’ and their own processes, it’s important to remember that this is new territory for many.

    The absence of a well-established route for migrating to automated processes can create challenges if not done correctly. As organizations look to pioneer low-code, I’d like to offer a two-step guide for leadership to begin this low-code journey through personal insights and real-life examples–providing an “automation blueprint” for IT leaders.

    Getting Developers on Board

    Although low-code is about bringing capabilities to non-technical resources, don’t neglect the importance of getting your existing developers on board early. Chris Byers wrote this great piece on why developers should not be worried they will become “extinct” by this new outlook. On the contrary, your core developers are going to benefit from these changes–freeing them up from tedious low-value work and allowing them to focus on higher-order challenges.

    Change of any sort can be daunting, and as with any shift like this, transparency is key. I often write quick blogs in our project management system or update my developer community in their dedicated collaboration platform channel to update the team on any new processes or changes with complete transparency. My team can ask me questions directly on the platform, and they are usually pretty direct. This visibility is key, allowing everyone to feel like they have a say and stake in how the company is accomplishing shared goals.

    It’s instrumental to partner with your DevOps team and ask their advice, as they are your “low-code” experts while you navigate these waters—either creating software with these offerings in your product portfolio for your customer base or deploying tech internally with low-code tools. With the former, your developers really should have no problem getting on board.

    Introducing the Concept to Citizen Developers

    Next, we must empower people to adopt the role of citizen developer by equipping them with the knowledge they need to be successful. Otherwise, we will find ourselves back at square one with the work developers did to create low-code workflows wasted. Whether you’re working with customers, partners, or your internal teams, here are a few ways to building your citizen developer crew:

    • Bring back the lunch-and-learn (hey, they were popular for a reason) via videoconference or collaboration channel: Send out gift cards for participants to order lunch and host a live session to walk through workflows and answer questions.

    • Provide on-demand tutorials: Beef up your company’s video library with a couple of “how-to” videos on using workflows for ongoing reference. Everyone loves an excellent how-to explainer.

    • Write a guide of your own: One of our technical partners is known for its workflow, and they’ve written a guide to their low-code product’s capabilities. It’s available online, and it’s geared towards citizen developers. So it might be worth taking the time to do one in-house; a one-stop-shop for everything low-code.

    Workflows are everywhere you look – not one team in an organization operates without interacting with identity workflows. Take HR, for instance; you might think, “HR deals with people; they don’t need to build workflows.” This overlooks how many HR processes are workflow-driven. Imagine if an organization could tap HR as citizen developers—the department could establish a workflow unique to onboarding, for example. A new hire’s manager receives an automatic prompt to approve access to applications needed for that role. Imagine the time saved, which means more time spent on other business-essential tasks like recruiting quality candidates.

    The investment you make today getting buy-in from developers and educating your citizen developers will pay off in the long run. Now is the time to get started. The road of innovation is always bumpy, but that doesn’t mean you shouldn’t try to make it as streamlined as possible. To play a role in pushing boundaries forward amidst the digital transformation we are experiencing, you will need everyone—developers and citizen developers—on the same (web)page.

  • Low-Code is Table Stakes for Enterprises

    Low-Code is Table Stakes for Enterprises

    Enterprises across all industries are facing mounting pressure to deliver business value with speed and agility. In the digital age, companies that can’t keep pace often fall to the wayside, especially in light of increasing customer expectations and dynamic regulatory requirements.

    Speed has become table stakes. And business leaders have risen to the challenge across the board—focusing on efficiency and streamlined operations. However, despite enabling speed, many organizations still struggle to deliver value and continuously improve performance using technology.

    Traditional software development methods can no longer keep up with the demands of modern users. And so, to achieve speed and generate significant value, business leaders must leverage customized software with low-code capabilities, thereby empowering professional IT developers to develop and deploy business applications rapidly and seamlessly.

    Speed is Table Stakes, But So is Low-Code

    Low-code application development is certainly not a new phenomenon—in fact, the term low-code was originally coined in 2014. However, since its advent, an amalgamation of digital disruptions, hyperautomation and new technologies has led to an exponentially rising demand for low-code tools.

    According to Forrester, “Low-code development platforms are emerging as a key strategy to accelerate app delivery to support digital business transformation. And they have the potential to make software development as much as 10 times faster than traditional methods.”

    So, not only is low-code an absolute imperative in today’s business environment, it is the key to unlocking speed and agility in your operations.

    Fabrizio Biscotti, research vice president at Gartner, further states that, “Globally, most large organizations will have adopted multiple low-code tools in some form by year-end 2021. In the longer term, as companies embrace the tenets of a composable enterprise, they will turn to low-code technologies that support application innovation and integration.”

    What Does Low-Code Mean?

    When you Google “low-code” you’ll find a number of different definitions. Low-code means different things to different people, depending on their industry, their business needs and their experience with IT.

    Perhaps the most common interpretation of “low-code” refers to “no-code” development, wherein citizen developers are enabled with declarative, drag-and-drop tools to create applications without having to depend on IT.

    This type of low-code works well in cases where users are attempting to streamline simple workflows and automate standardized use cases. However, when business needs become more complex, the “no-code” approach can fall short.

    A low-code platform, in the truest sense, offers a broader and deeper set of capabilities, enabling professional IT developers to use a modeling-driven environment to rapidly develop and deploy mission-critical applications and address complex, content-driven business needs.

    Generating ROI From a Low-Code Platform

    The right low code platform enables far more than just speedy app development. By investing in one comprehensive low code platform, you can:

    • Simplify your complex, content-driven business needs
    • Enable mobile app development
    • Develop customer-facing and customer support applications
    • Streamline internal workflows
    • Create transaction-oriented standalone applications
    • Develop content-driven workflow applications
    • Modernize legacy systems
    • Reinforce backend systems to handle larger volumes of data and transactions
    • Build portals for internal and external users
    • Deliver an enhanced customer journey across multiple touchpoints
    • Deploy your applications in a cloud-based or hybrid environment
    • Scale your applications with agility

    Low Code is Here to Stay

    Gartner predicts that “Low-code application building would gather more than 65% of all app development functions by the year 2024 and with about 66% of big companies using a minimum of four low-code platforms.”

    So, not only is low code a business imperative today, it is only increasing in utility and ubiquity as we move into the future.
    For enterprises striving to stay on the cutting edge, the right low-code platform is an investment that will keep on generating significant returns. From enabling speedy app development to providing the agility and scalability to keep up with dynamic business needs and customer expectations, low-code is the key to continuous innovation and ongoing success.

  • How No-Code Will Transform DevOps

    How No-Code Will Transform DevOps

    In the years that low- and no-code development tools have been available, the movement has been slow to gather pace. Until recently, the vast majority of app and workflow development has remained firmly in the hands of professional coders.

    That is about to change—and fast. Gartner forecasts that the global low-code development technologies market is on track to reach $13.8 billion in 2021, an increase of nearly 23% over 2020. Other research suggests that 20% of all workers use no-code tools today, including 56% of coders. And 71% of those who use no-code tools within IT adopted them within the last year.

    No-code development is reaching a tipping point, and this trickle of adoption has turned into a torrent, driving more and more business demand daily.

    Drivers for the No-Code Movement

    The reason for this acceleration is simple: Digital transformation requires speed. If businesses are to digitize the full universe of processes across all departments, then they need tools that can be adopted quickly and with little ramp-up time.

    No-code tools are an ideal solution to this problem, and not just for a short-term fix. If the investment is seen solely as a short-term fix to immediate problems, it’s very likely that a company’s digital transformation efforts will continue to die on the vine. Digital transformation is not a “one-and-done” process; it’s only the start of a new business strategy based on continual innovation, where new apps and tools are built and rebuilt, time and again, to keep up with changing market dynamics and customer/employee requirements.

    The long-term trend of digital transformation has been accelerated by two shorter-term trends. First, obviously, is the COVID-19 pandemic. The social distancing measures used to control the virus meant that businesses had to create new apps and workflows (in hours or days) if they were to survive. No-code tools played an important role in helping businesses adapt at a breakneck pace, and gave them a taste of just what’s possible with intuitive app and workflow development.

    Second, a shortage of skilled developers. The population of 24 million global developers accounts for just 1% of the overall workforce, leaving businesses short-handed and looking for ways of empowering non-coders to take control of app development for themselves. As well as plugging skills gaps, no-code also meets demand from employees for more autonomy and more control over their operations, projects and workflows.

    Unlocking Innovation

    The net result of these drivers is that no-code is now a bona fide movement, and technology companies large and small are taking advantage of market innovations to transform what it means to build websites, software applications, workflows and mobile apps.

    The impact on enterprises will be profound. As Accenture highlighted in its 2021 Technology Vision, no-code is part of the broader democratization of IT, where the ability to create technology solutions to address business challenges is extended to everyone in the organization. This trend will unleash a wave of “grassroots innovation” that will help companies reinvent themselves in the years ahead. Those that fail to take this opportunity now may struggle to keep up with more inventive and agile competitors later.

    What No-Code Means for Developers

    For developers, this trend will undoubtedly lead to many questions. What is the role of the professionally trained coder in a no-code world? Will DevOps become extinct as “citizen developers” take over? Far from causing detrimental effects, no-code and low-code will likely prove to be hugely beneficial overall. Here are four key reasons why:

    Reduced workload/stress. With no-code-based roles, organizations are able to expand their technical capabilities without needing to hire more developers or coders. What’s more, by spreading basic app and workload development tasks across the organization, developers’ time is freed up. For teams that are already understaffed and under pressure, this can make a huge difference in the workplace experience and enable developers to spend more time focused on delivering high-quality software.

    A more strategic role in the enterprise. With tactical software development carried out within business units, developers can spend more of their time focused on the ‘next big thing,’ whether that’s mixed reality, quantum computing or AI. Developers and the wider IT team can act as “futurologists”, assessing new tools for the best fit within the business and guiding purchasing decisions to ensure the best possible outcomes.

    Accelerated innovation. For more complex software development that requires coding expertise, developers can leverage the speed of no-code to spin up proofs-of-concept and test them before investing time and resources on full-scale development. In fact, research suggests that many developers are already taking this approach, with 38% stating that they use no-code for prototyping a new product.

    New roles and opportunities. No-code will have a deep and broad impact on the enterprise, changing how work is done and creating new roles in the process. Many of these roles will provide new career paths and opportunities for developers, such as no-code consulting (helping businesses find the optimum no-code framework and tools for their needs) and roles that revolve around optimizing processes, building solutions and discovering ways to easily automate and streamline the day-to-day work within their organizations.

    DevOps teams, long the drivers of digital transformation, are now finally feeling the effects of those efforts. A new world of work is emerging where everyone is a technologist; using intuitive tools to rapidly build solutions to their business needs as they arise. This approach will free developers from their traditional role as gatekeepers of innovation, allowing them to focus on strategic technology decisions and channeling their specialist skills to areas where they will make the most impact.

    The rise of no-code is good news for everyone. It accelerates digital transformation and unlocks the innovation potential of all employees. And it’s great for developers, too; making their work more interesting, less stressful and with new career paths and opportunities for development. No-code can provide a growth driver to all enterprises, and arm early adopters with a significant competitive advantage.

  • Lessons Learned on a Low-Code Journey

    Lessons Learned on a Low-Code Journey

    The popularity of low-code/no-code tools are on the rise as organizations chase the promise of creating ‘citizen developers.’ The idea of using these tools to empower non-technical developers and/or to free development teams from writing code line by line is certainly compelling.

    About a year ago, a friend reached out to ask if I would critically review a book he was writing about citizen development. At the time, the expression was new to me but after reading and reviewing the book, I was intrigued. It challenged me to embark on my own citizen developer discovery. I want to share several applicable lessons I learned along the way.

    Intrigued: Citizen Developer Tools Versus Dev Teams

    The curious part of me was trying to understand if these were tools that would remove the need for expensive development teams. The previous, well-intentioned attempts had fallen short of their promise—think Computer Aided Software Engineering (CASE) from the 1990s as an example.

    Around this time, I discussed the topic with the CTO of a progressive client. His business users would not wait for technical resources when they needed apps to address persistent problems. He was quick to point out  that low-code was preferable to shadow IT. The architecture for these low-code/no-code tools meant database administration was in his team’s hands. He was supportive of business units building small tactical pieces of functionality with a clear business case, and he supported them where possible through training and allocating resources to their projects for data integrations and other functions.

    The Challenge: Write an App

    Encouraged, I decided to challenge myself over one weekend to see if I could write a commercial application. I had studied programming languages like Fortran and C in the 1980s, but I’d never worked as a developer and had never written commercial code.

    Start of Day One

    I selected a low-code tool at random. I would recommend, however, that a citizen developer engage the IT team rather than choosing at random, as most low-code/no-code tools have an underlying programming language. If your organization is a Java shop, for example, then it would make sense to pick a tool that has the same language—in this case, Java—at its source.

    I purchased a six hour training course on YouTube for $20. This would prove to be a wise decision. Learning the tool I selected was not straightforward, but the training course allowed me to pause the tutorials, rewind and repeat to ensure I was understanding concepts and could follow along with the ‘how to.’

    First task: write ‘Hello World.’ I recommend that citizen developers start here. If you can do this, then it’s more than likely you can build something more complicated.

    Three hours later (of which two were a system error) … it was done.

    low-code

    Clicking on the green button produced the screen below.

    low-code

    At this point, I still had more questions than answers. The GUI for the development tool was point-and-click within a Windows directory structure. There was no command line editor. I was even more encouraged. Could it be this straightforward?

    A note: while it took less than an hour to complete the ‘Hello World’ task, I encountered a Windows system error which pointed to a server port error. The vendor’s help desk didn’t operate over the weekend, but their documentation was adequate; it took a further two hours of effort to fix the problem, which arose because my Windows Surface Pro was both a client and a server.

    Would an ‘average’ citizen developer have been able to overcome this problem? I’m not sure. I recommend when trying low-code/no-code tools that you also trial the help desk, even if you need to pay for it. While many software tool companies try to force software engineers to work through wikis to solve problems, citizen developers may need more hand-holding.

    The next step was to build an application. Most non-technical people tend to describe applications from a graphical perspective and as business functions. This is very much in keeping with how I worked for a further two hours, at which point the ‘Home’ web page looked like this:

    low-code home page

    Using data from our in-house spreadsheets, I created the data model below with relative ease. I believe a citizen developer would benefit from asking an in-house database expert to review this ‘design’ to save time later when maintaining the application.

    low-code design

    This work was undertaken at the same time as I was building a second tier of pages to amend data. So, for example, the automatically generated customer page which allows a user to search, add, edit and delete customer records looked like this:

    low-code edit page

    This was completed in four hours. Once the table was created with the correct columns, the creation of the web pages was automatic. In fact, it became repetitive and I found it was easy to lose my concentration and make errors.

    I was learning to save every small change to ensure that the live web and mobile application builds were working. A professional developer would see this as a form of continuous integration for the citizen developer.

    I don’t recommend having teams of citizen developers working together, at least at the outset, as it introduces branching and versioning and the concept of ‘breaking a build.’ Professional developers would need to be consulted at this juncture.

    End of Day One

    I had a real sense of achievement at the end of day one and was eagerly anticipating day two. Citizen developers should note that, at this point, I had produced what developers would call a prototype. It would be possible, upon reaching this point, to approach IT to assign a developer to finish the job. If IT does not have capacity, then keep going.

    Start of Day Two

    Having designed screens and a database, the next task was to add business logic.

    low-code logic

    Creating flows of work with rules was a more engaging task, but still accomplished via drag-and-drop or point-and-click. Boolean logic operators like if- then- else allowed me to quickly build logic and attach it to visual elements on the webpage.

    low-code flow

    This is an event registration flow where data is accepted from a web page and, based on a true or false response, treated differently depending on that response.

    As before, the first workflow took some time to learn. There were many ways to both trigger an action and direct the subsequent work. After a further half day, I had produced enough working code that I felt I probably couldn’t learn a whole lot more and the application was roadworthy.

    low-code mobile app

    From there, creating the mobile version of the app was as simple as pushing a button. At the outset, I had set a switch for mobile deployment. The web and mobile editions were always in sync, and the GUI was adjusting automagically for the deployment platform. Citizen developers should check on in-house standards for web and mobile app deployment configurations and ensure their selected tool supports them.

    End Day Two

    Lessons from My Discovery

    Organizations that want to adopt low-code or no-code tools will need to ensure IT support and training for business users that want to self-service their app dev needs. I recommend early engagement and frequent retrospectives with IT colleagues.

    Business functions should consider ‘easy’ and tactical opportunities for piloting.

    Allocate an uninterrupted period of time to focus on the task. Learning a new tool over a weekend was a really good idea, too. There was zero context switching, apart from my wife dropping in with coffee for a chat.

    I recommend citizen developers try to be a little bit Agile for these engagements. Using a ‘Plan, Do, Check, Act’ methodology means that you are not ‘all in’ on this—you are simply taking small discrete steps to see if you can solve problems more efficiently than you would if you instead waited for IT.

    Professional developers should ensure that any low-code/no-code tools produce code that can be imported into their standard IDE and that the citizen developer’s code is not locked into the tool.

    As a DevOps Institute Ambassador, O’Reilly helps empower DevOps Institute community members with the SKIL framework to advance the Humans of DevOps with skills, knowledge, ideas and learning. Learn more about O’Reilly’s work in DevOps here.

  • How Low-Code Makes DevOps Stronger

    How Low-Code Makes DevOps Stronger

    While its roots can be traced back to rapid-application development (RAD), low-code application development started to gain serious momentum about three years ago. Initially, some in the DevOps community dismissed the trend, even as myriad approaches—from no-code to low-code for professional developers—started to enter the market.

    At the time, enterprises of all sizes had embraced agile software development processes, moving to cloud infrastructure for some critical workloads and using test automation tools widely. DevOps emerged as an essential discipline, and it was assumed that its dominance would overshadow low-code.

    Fast forward to 2021, Gartner predicts that the low-code development market will increase by 22.6%, to a total of $13.8 billion in one year, so it’s clear that the obituary for low-code was premature. The growth of the low-code market hasn’t restricted growth of DevOps, either. Thousands of medium to large enterprises either are already adopting or planning to adopt low-code for professional development, and DevOps’s growth continues. Low-code platforms for professional development haven’t replaced the DevOps model; instead it places an emphasis on a robust software development life cycle working with the business and IT to increase the velocity of transformational digital experiences.

    The Need for Speed

    During the early days of the COVID-19 pandemic, many organizations were compelled to accelerate their digital innovation to adapt their business activities to the new normal, or find new ways to compete against more nimble competitors to stay afloat. To enable delivery of their services to suddenly distributed customers and employees, they began to switch to low-code development platforms to deliver solutions faster.

    Low-code software is easy customizable, can fit any organizational needs, doesn’t require in-depth coding skills and speeds up development. Low-code platforms feature a host of pre-made tools to develop an app in a matter of hours instead of weeks or months.

    Some low-code development platforms feature integrated DevOps services and automated testing capabilities. Cutting edge platforms use AI to generate test cases to be executed on the cloud as part of the continuous integration/continuous delivery (CI/CD) pipeline). While these platforms It don’t replace developers, they can help to automate their work so they can focus their time on new features and big ideas, rather than on coding repetitive but essential tests, or on figuring out the back end complexities.

    A Confidence Booster

    With a low-code platform, DevOps teams get automated tools for testing, deployment, security, data management — all of the back end development necessities — plus front end and design capabilities. This is a very different set of skills and expertise, but using low-code platforms to simplify development processes allows almost any developer to work on any app through its full life cycle.

    Even if an aspiring coder from the organization’s marketing team builds an internal app, DevOps team won’t have to worry about build validation or version control, because low-code enables a continuous process.

    One small DevOps team can efficiently and confidently manage building and deploying an app from any developer. It can also deploy these apps across multiple devices — with very little upskilling of different programming languages required. Low-code platforms include pre-wired components, templates and sample apps for smart speakers, wearables, AR, PWA, native mobile and other real-world use cases.

    Strategic Focus

    Once low-code frees the organization’s DevOps teams from repetitive tasks and eases workload burdens, teams can concentrate on more complex problems, like upgrading and maintaining existing enterprise-class apps — enterprise resource planning comes to mind — or work on other high-value digital and operational strategic initiatives.

    Long Live DevOps and Low-Code!

    Low-code for professional developers is best suited for developing consumer-grade mobile and multi-experience apps. Whether an organization is trying to digitize an old process or create new ways to engage with consumers, business partners, customers or employees, low-code development helps organizations be more responsive and agile — just like a good DevOps culture. With the ever-rising demand of a digital economy and the subsequent shortage of development talent, by adopting the velocity of low-code development approaches, we can enhance the power of the developer (and the DevOps) models to meet the next business challenge.

  • Salesforce Pilots Series of DevOps Initiatives

    Salesforce Pilots Series of DevOps Initiatives

    At its online TrailheaDX 2021 conference, Salesforce today unveiled a DevOps Center pilot that provides a portal through which organizations can track and manage changes to Salesforce applications along with a unified command line interface (CLI) for all its applications.

    In addition, Salesforce plans to add Salesforce Functions to enable developers to deploy code in a serverless environment.

    The company has also promised to extend its low-code App Builder tool to include support for Dynamic Interactions, a capability that enables both professional and citizen developers to add reusable components to any application. The company has also added a Customer Identity Plus tool that enables developers to consolidate and manage customer identities.

    Finally, Salesforce is adding an Einstein Automate tool that employs machine learning algorithms to both integrate data and automate workflows that can invoke, for example, an existing MuleSoft Composer tool for integrating applications using a Flow Orchestrator that will be made available as a pilot project this summer. MuleSoft is a subsidiary of Salesforce. There is also now an Einstein Data Detect tool that ensures organizations adhere to data privacy laws by employing machine learning algorithms to discover when developers might have inadvertently exposed sensitive data.

    Dynamic Interactions, Salesforce Functions and CLI unification are expected to be generally available in the winter of next year, while the Einstein capabilities are expected to arrive this summer.

    Ryan Ellis, senior vice president of product management for platform at Salesforce, said the company is making a concerted effort to make it easier for both professional and citizen developers to build applications within the same environment by fostering collaboration via a DevOps Center portal that is expected to be generally available in the spring of 2022. Today the skills that any citizen developer can bring to bear are generally limited, largely because they don’t typically know how to build a well-designed, secure application that will truly scale in an enterprise IT environment.

    Salesforce

    However, as more artificial intelligence (AI) capabilities are added to low-code tools the amount of developer guidance being provided will increase over time. That additional guidance will enable citizen developers to build robust applications more reliably, noted Ellis.

    In the meantime, the primary beneficiaries of low-code tools continue to be professional developers that employ them to build applications faster than they could otherwise using procedural code.

    In general, Ellis said the relative DevOps maturity of organizations building and deploying custom applications on top of the software-as-a-service (SaaS) platform managed by Salesforce continues to increase steadily. In the wake of the COVID-19 pandemic, many organizations opted to extend existing SaaS applications provided by Salesforce to accelerate digital business transformation initiative using low-code tools rather than developing every application from scratch using procedural code.

    Of course, as the rate at which those applications are being built continues to accelerate, the next big challenge is managing the application life cycles after they are deployed.

    It’s not clear what the ultimate mix of applications built using low-code tools versus procedural code will be. Millions of lines of code are now being regularly deployed on Salesforce platforms, noted Ellis. It may be a little while before Salesforce is able to bring DevOps best practices to all that code, but, starting today, the journey has begun.

  • Get the Benefits of Low-Code Without the Risks

    Get the Benefits of Low-Code Without the Risks

    Today, more than 300 vendors and various platforms offer different flavors of low-code solutions. However, the majority of these low-code tools are really no-code tools that benefit individuals or groups trying to solve a specific program. The list of benefits of low-code tools in your environment is long and compelling; however, there are security risks that businesses should be aware of when working with these powerful tools.

    When evaluating or using a low-code tool, it’s important to remember that while low-code tools abstract the process of writing code, code is still being written. Applications created with low-code tools are susceptible to the same attacks as any other web application. However, companies don’t have control over the code generated by a low-code tool, so the burden of developing secure applications is largely shifted to the low-code tool vendor. Therefore, the best way to minimize risk when using a low-code vendor is to properly evaluate that vendor’s security practices and test applications created using these tools as vigorously as you would any application developed using a traditional/pro-code approach.

    Risks to consider include access control and authentication (permissions, multifactor authentication), data security (encryption in transit and at rest) and application security from vulnerabilities and attacks (network security and intrusion detection). Other risks to consider are risk mitigation covering areas such as DDOS (distributed denial of service) attacks, backup and disaster recovery, and security incident handling. Responsibility for management of these risks belongs to the low-code vendor, the hosting provider and the company using the low-code tool.

    The following tips should be considered when bringing new low-code tools into your environment to minimize security risk. Remember, it’s critical to perform due diligence of the vendor. Items to consider include:

    Hosting Platform: Be sure the vendor is using a reputable hosting provider, ideally Amazon Web Services (AWS), Google Cloud Platform, Salesforce or Microsoft Azure. Leading players will offer secure, highly available platforms that address the aforementioned risks and will have completed third-party audits and certifications demonstrating their commitment to security.

    Vendor Infrastructure Management: Low-code vendors typically have some level of responsibility for management of the upper tiers of the overall stack; this is generally referred to as the shared security model. Review the vendor to ensure they have solid controls and processes in place to properly manage and secure the infrastructure. Ideally, the vendor regularly submits to some form of recognized audit, such as a SOC 2 Type 2 or ISO-27001. This helps ensure controls and processes are in place in areas such as security, availability, confidentiality, privacy and processing integrity to address the aforementioned risks in the area of the hosting platform the vendor is responsible for.

    Formal SDLC: The vendor should follow a documented software development life cycle (SDLC) and change management process used for the development of their low-code tool. A good SDLC process includes using a source code management system, dependency checking process, static code analysis, automated unit and regression tests, peer code review, secure coding practices training, application vulnerability scanning, quality assurance testing process and third-party penetration testing.

    Policies and Processes: Documented policies and processes covering information security, business continuity, disaster recovery, security incident handling, infrastructure hardening and more should be in place at the vendor. This helps demonstrate that the vendor is committed to providing a secure, highly available and high-quality offering.

    The company adopting the low-code tool itself should also consider internal processes and how it’s using the low-code tools. Items to consider include:

    Formal SDLC: Even though the company uses a low-code tool, there’s still the need to follow a formalized SDLC. It’s important for the company to emphasize and embrace secure programming practices, even for low-code developers. Low-code tools have the ability to implement customer-developed code snippets or components and it is recommended companies follow programming standards and secure programming practices as outlined by the Open Web Application Security Project (OWASP) foundation. Another area of emphasis that can sometimes be overlooked is the need for testing, including functional and security-oriented testing.

    Security Testing: Consider performing a penetration test of the completed low-code application. While ideally, the vendor has performed these tests on the tools itself, it’s a good idea to also perform one on the completed low-code application.

    Access Control and Authentication: Configure access and permissions according to the least privilege model. Leverage advanced authentication mechanisms like multifactor authentication and single sign-on where possible. Ensure an access removal process is in place to remove access for terminated employees.

    Data Security: Verify the application is configured to use HTTPS and that all databases are encrypted. Low-code vendors may or may not provide a database, and either way, the company likely has some level of responsibility for securing the data, regardless of who is hosting it.

    Policies and Processes: Documented policies, processes and related training for team members helps mitigate risk. Some level of formality is recommended for documentation and training for the SDLC, business continuity planning, disaster recovery and security incident handling. For example, the team responsible for the low-code application needs to know how to handle a security incident if one occurs, whether it’s due to an issue in the low-code application, the low-code tool or the hosting infrastructure.

    The benefits of low-code tools far outweigh the risks of introducing these tools into your environment, but with a little effort up front, you can save a lot of headaches down the road.

  • Unqork Extends Automated No-Code SDLC Platform

    Unqork Extends Automated No-Code SDLC Platform

    Unqork today announced it has extended a no-code platform for managing the software development life cycle (SDLC) to include the ability to automatically document changes to application programming interfaces (APIs) and data models in addition to adding a point-in-time rollback capability.

    Ken Gavranovic, head of strategy and engineering for Unqork, said Unqork 2021.5 also adds a range of dashboards for monitoring application dependencies, service logs, revisions, logs and metrics.

    Finally, Unqork is adding tools to analyze, test and debug configurations along with enabling workflows to subscribe to events and adding a search capability for release candidates.

    Unqork is designed to present IT teams with a set of visual tools through which they can manage SDLC processes without having to build and maintain a platform made up of disparate offerings that they need to then integrate, said Gavranovic. The goal is to reduce the overall size of the team required to maintain an application development environment to enable organizations to allocate more time and resources to building applications, he added.

    The auto documentation for APIs is being added at a time when IT organizations are starting to employ a larger number of APIs as they transition toward building and deploying microservices-based applications. In addition to making it easier to reuse APIs, Unqork also now makes sure documentation for those APIs is always current, said Gavranovic.

    At the same time, Unqork is now providing a means to automatically document changes to data models based on a data store that is integrated in the platform, noted Gavranovic. That capability enables organizations to implicitly add governance capabilities to workflows with a minimal amount of friction.

    As organizations look to accelerate the rate at which applications are being developed to enable multiple digital business transformation initiatives, Gavranovic said more of them are starting to realize their existing processes are too complex and cumbersome to achieve that goal. Unqork is based on a data store that is shared by all the modules that make up the platform, which, in addition to enabling reusability, makes Unqork easier to deploy and manage, added Gavranovic.

    In addition, Gavranovic also noted that, over time, complex processes only increase the overall burnout rate of the development team. It’s hard enough to hire and retain developers today without requiring them to navigate a complex application development environment, he added. Eventually, the best talent will migrate to organizations that make it as easy for them to write code as possible, said Gavranovic.

    It’s not clear to what degree IT organizations will be revisiting the way they build software in the months ahead but as more of them realize how dependent the business now is on the timely delivery of software it’s only a matter of time before pressure to automate as much of the software development process as possible starts to mount. The cost of replacing an application development environment is, of course, not insubstantial. However, continuing to do the same thing with the expectation of producing a different result is, by definition, insanity.