{"id":48186,"date":"2022-08-26T14:00:00","date_gmt":"2022-08-26T14:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/application-security\/how-devsecops-empowers-citizen-developers"},"modified":"2022-08-26T14:00:00","modified_gmt":"2022-08-26T14:00:00","slug":"how-devsecops-empowers-citizen-developers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/how-devsecops-empowers-citizen-developers\/","title":{"rendered":"How DevSecOps Empowers Citizen Developers"},"content":{"rendered":"
<\/div>\n

By 2025, total global data creation<\/a> will reach 181 zettabytes. For enterprises, that data is an asset, allowing them to leverage a variety of technology platforms to create highly personalized customer experiences that engender loyalty and attract new business. However, these experiences are dependent on cloud infrastructures using shared security modes. That’s where the risk lies, and it’s increasing as technology grows to incorporate a new army of citizen developers using low-code and no-code platforms.<\/p>\n

Understanding and Overcoming the Inheritance Mindset <\/h2>\n

Gartner<\/span><\/a> estimates that by 2025, 70% of enterprise applications will be built from low-code and no-code platforms such as Salesforce and ServiceNow. Responding with an inheritance-based mindset is a sure way to set more than two-thirds of enterprise apps up for failure.   <\/p>\n

“Inheritance mindset” is an apt descriptor for the problems plaguing infrastructure. It brings to mind a rich, spoiled children who are entirely dependent on the work done and people who came before them. That\u2019s not a good way to build a legacy, and it’s an equally bad way to build a system.<\/span><\/p>\n

When you have a legacy mindset, you assume that the infrastructure is set. The platform is safe, and the security is built in. Trust is assumed simply because the technology was there before the administrator.<\/span><\/p>\n

That inheritance mindset plagues low-code and no-code platforms. Users rely on the safety of a platform to carry them through an entire enterprise infrastructure. Instead, the security of that platform should apply only to that platform.<\/span><\/p>\n

Let’s say Salesforce developers create an automated assignment program for new leads. They use it within Salesforce for internal assignments, and it’s fine. They can rely on the safety of the platform. They decide to expand it to improve automation. They connect that program to an external-facing CRM like ServiceNow, SAP, or Oracle. The inheritance mindset takes over: Salesforce is safe. ServiceNow, SAP or the third-party is safe.<\/span><\/p>\n

So, Salesforce + third party = safe.<\/span><\/p>\n

But, there’s a great deal of unknown in that plus sign. How do you safely and compliantly connect the internal program created in Salesforce to the external program created in the third-party platform? There is a lot of room for error in that single character.  <\/span><\/p>\n

And that\u2019s only one connection. Many programs created in Salesforce touch hundreds of others. That\u2019s hundreds of unknowns being treated like the plus sign described above by people who have little to no development experience.  <\/span><\/p>\n

The only solution is to take that development back down to earth with a return to DevSecOps principles.<\/span><\/span><\/p>\n

Establishing the DevSecOps Framework <\/h2>\n

DevSecOps<\/span><\/a> frameworks have been written, rewritten, and written again since the concept was created. There\u2019s no need to reinvent the wheel when establishing them, especially when <\/span>SAFECode and the Cloud Security Alliance<\/span><\/a> has built six pillars:<\/span><\/p>\n

    \n
  1. Collective responsibility:<\/strong> Security is the responsibility of every person in the enterprise \u2014but people can\u2019t meet standards they don\u2019t know. Leads should be assigned to drive cybersecurity policy and ensure it is disseminated across the enterprise.  <\/li>\n
  2. Collaboration and integration:<\/strong> Knowledge must be shared and transferred. Half the reason that enterprises fall into the legacy mindset is that everyone who knew the old system is gone. Continuous knowledge sharing helps eliminate this issue.<\/li>\n
  3. Pragmatic implementation:<\/strong> Pragmatic implementation ties into the developer experience. Processes that are difficult, mundane, and unwieldy are not followed for long. Security should be baked into development practices \u2014 that is, every line of code requires a line of test. A high-performing enterprise would take that further by using a tool to automate each line of test code.<\/li>\n
  4. Compliance and development:<\/strong> Compliance requirements should guide the development process in a way that does not allow developers to deviate from them. A developer for a financial institution, for example, would work on a platform that is designed to be compliant with the Gramm-Leach-Bliley Act. The developer does not have to know the individual ins and outs of the act to be compliant because they are built into the platform.  <\/li>\n
  5. Automation:<\/strong> Tasks that are predictable, repeatable, and high volume should be automated whenever possible to remove the burden from developers and reduce the risk of human error.<\/li>\n
  6. Monitor:<\/strong> Modern cloud infrastructures change and grow. It\u2019s vital to keep track of it \u2014 ideally, through some form of orchestration that allows an at-a-glance view of all the various interconnections.<\/li>\n<\/ol>\n

    In a <\/span>low- or no-code<\/span><\/a> environment, these pillars are not as straightforward as one would expect. The people using these tools are often business experts with little familiarity with DevSecOps fundamentals.<\/span><\/span><\/p>\n

    Bringing Together People, Processes, and Technology<\/h2>\n

    The use of low-code and no-code platforms can actually help close this skills gap. Employees want to learn new skills. Enterprises can support that by establishing a DevSecOps framework focusing on people, processes, and technology. <\/span><\/p>\n