Rewind And Replay For Web App Vulnerabilities

Blog post info and actions

Blog post body

Security threats develop and evolve with startling rapidity, with the attackers always seeking to stay one step ahead of the S&R professional. The agility of our aggressors is understandable; they do not have the same service-focused restrictions that most organizations have, and they seek to find and exploit individual weaknesses in the vast sea of interconnecting technology that is our computing infrastructure.

If we are to stand a chance of breaking even in this game, we have to learn our lessons and ensure that we don’t repeat the same mistakes over and over. Unfortunately, it is alarmingly common to see well known vulnerabilities and weakness being baked right in to new applications and systems – just as if the past 5 years had never happened!

A recent report released by Alex Hopkins of Context Information Security shines a light on the vulnerabilities they discovered while testing almost 600 pre-release web applications during 2011. The headlines for me were:

  • On average, the number of issues discovered per application is on the rise.
  • Two-thirds of web applications were affected by cross site scripting (XSS).
  • Nearly one in five web applications were vulnerable to SQL injection.

It makes depressing reading, but I’m interested in why this situation is occurring:

  • Are S&R professionals simply not educating and guiding application developers?
  • Are application developers ignoring the training and education? Are we teaching them the wrong things or do we struggle to explain the threats from XSS and SQL injection?
  • Are our internal testing regimes failing, allowing flawed code to reach release candidate stage?
Read more

You Think Changing To Increase Business Agility Is Hard? If IOR Did It, Believe Me: You Can Do It Too

Blog post info and actions

Blog post body

Diego Lo Giudice

Think of a medieval fortress: It was originally used for a small army, it has walls nine meters thick, and it’s surrounded by buildings hundreds of years old. Upon entering, you are confronted with the concept of eternity.

This fortress is located in the smallest state on earth — though it is also perhaps the best-known state in the world. The business housed within the fortress is what many might classify as a SME but with with complexity of a large enterprise, holy but busy, centralized but truly global — its work spans hundreds of countries with hundreds of currencies and hundreds of languages — and it serves very special and demanding clients.

Have a clue yet of where we are?

Zoom on Italy, then zoom on Rome, then zoom on Vatican City, and you can’t miss the round tower (Torrione Sisto V) where the Vatican Bank, or Istituto per le Opere di Religione (IOR ), is located. You won’t be allowed in if you are not a client, an employee, or part of a religious congregation. Change comes hard to institutions this steeped in tradition. To give you a clue, IOR’s previous managing director spent his entire career at IOR — 60 years — and retired at the age of 80. We all know it’s the soft and cultural aspects of transformation that are the hardest part for any organization.

Nevertheless, IOR has been going through a major change since 2008, working to replace its legacy IT system with a modern BT one. The new BT system brings more flexibility for the business, richer business functionality, and greater integration and development capabilities. Enabling fast change is the key driver for IOR’s IT transformation program from IT into BT.

Read more

Agile Software Is A Cop-Out; Here’s What’s Next

Blog post info and actions

Blog post body

Mike Gualtieri

Never has a new trend annoyed me as much as Agile. Right from the get-go, the Agile Manifesto revealed the weaknesses and immaturity of the founding principles. The two most disturbing: “Working software is the primary measure of progress” and “Business people and developers must work together daily throughout the project.” These are

Read more

You Need To Act More Like An Interactive Agency…

Blog post info and actions

Blog post body

Kyle McNabb

Two weeks have passed since our successful AD&D and BP Forums in Boston. I’m still struck by conversations we held there and continue to hold now with many of you on how your teams can help deliver to your firm’s ever-important customer experience outcomes. Following one tip can help you either get ahead of this issue or catch up to the expectations of your stakeholders…act more like an interactive agency!

Note I didn’t say “transform” into an interactive agency. No, at the end of the day you have responsibilities to your organization the agencies your business peers use often don’t – you have to manage, operate, and maintain what’s been delivered. What I did say was “act” like one, and in doing so you’ll need to:

  1. Revisit your talent. For those of you that haven’t outsourced big portions of development, make sure you have great, creative developers, build a high-performance development team, and up-skill your business analysts by putting personas and customer journey maps into their tool kit. Why? The agencies your peers use have and cultivate these skills. At minimum, you'll be in a better position to manage and maintain what they’ve put in place if you have complementary skills of your own. If you have outsourced development, we can help you make the case to bring back the right pieces.
Read more

Don't Think BPM And Customer Experience Are Your Problem? Think Again

Blog post info and actions

Blog post body

Kyle McNabb

Development leaders! Project leaders and business analysts! Application and solution architects! Want to move forward on your business technology (BT) journey and be viewed by your business stakeholders as a valuable team member? Take a tip from last week's Forums held in Boston. Embrace Business Process Management (BPM) And Customer Experience. Don't ignore them, embrace them. Why? They're essential to helping you achieve your business outcomes.

I know, I know. You read the above and now think "Gee Kyle, what's next? Going to enlighten me on some new BPM or customer experience management technology that's going to transform my very existence, my company's future?"

Nope. Let me explain....

Last week we hosted more than 250 of your application development and delivery and business process peers in Boston and focused on how to succeed in the new world of customer engagement. The most impactful discussions I heard were the side conversations we held with attendees, sometimes occurring over dinner and cocktails. We didn't discuss technology. We discussed the skills your peers were developing in two fundamental areas:

  1. BPM - no, not the technology but the Lean and Six Sigma based methods, techniques, and tools organizations use to focus on business processes and not functions; to strive for continuous improvement; and to focus on customer value. 
  2. Customer experience - defined more eloquently by my peer Harley Manning, but I'll summarize as the methods, techniques, and tools used to understand how customers perceive their interactions with your company.
Read more

Customer-Driven Business Transformation: A Discussion With Trustmark CIO Dan Simpson

Blog post info and actions

Blog post body

Mike Gilpin

Dan Simpson understands business transformation - and the critical role the customer plays in it. Before joining Trustmark, Dan led the Enterprise Technology Group at Physicians Mutual in Omaha, Neb., where he was the driving force behind the company’s business transformation strategy and the Greenfield program, which implemented new customer-centric business processes, service-oriented architecture (SOA), a new enterprise data warehouse, and several key business applications. For these efforts, Dan was recognized as Technology Chief of the Year in 2010 by the Applied Information Management Institute.

I spoke with Dan in preparation for his keynote next week at Forrester's Application Development & Delivery Forum.

Q: What are the business challenges and issues that typically motivate the need for business and IT transformation?

Dan Simpson: Common challenges facing business today include changes in market conditions, consumer behavior, and the regulatory environment as well as increasing competition and complexity. The inability to adapt to these changes drives the need to put new business process and technology foundations in place.

Q: How have you approached business process redesign?

Dan Simpson: The most effective approach is to focus on business process first before diving into systems. Depending on specific situations, I’ve seen great value in taking an approach where processes redesign starts and ends with the customer. This customer-driven approach helps drive customer-friendly decisions and efficiencies.

Q: What is a customer-driven application, and why is that concept important to transformation outcomes?

Read more

Goodbye Yellow Brick Road?

Blog post info and actions

Blog post body

George Lawrie

Most Forrester readers certainly understand the importance of empowering their employees to contend with highly informed and increasingly demanding customers. But I’m often asked just how to overcome the process and data integrity challenges of apps or services that empower employees and/or drive continuity of experience for consumers across channels. With the rise of mobile as well as web and call center interactions and with a proliferation of new tools for managing distributed processes and data, most application development and delivery professionals as well as their business process and applications colleagues have to absorb all the arguments before they make decisions that could be critical to their firms’ futures – to say nothing of their own careers.

One pioneer whom I interviewed was immensely proud of his lightning rollout of a guerilla app to support his firm’s front office in advising clients on complex product choices. I asked him about future plans and sheepishly he admitted they would be starting again from scratch because the guerilla app was unable to leverage enterprise services exposing critical data about product offerings. He remarked ruefully that sometimes you do have to follow the IT standards “yellow brick road” rather than just head for the hills, but wouldn’t it be great to have the best of both worlds, with both agile deployment and full advantage taken of enterprise assets and data?

If you need a deeper understanding of the issues and options, then I’d like to invite you to join us at Forrester's Application Development & Delivery Forum, where my colleague Clay Richardson and I will discuss in practical terms how to deliver integrated experiences across multiple touchpoints.

Application Delivery Must Enter The Age Of The Customer

Blog post info and actions

Blog post body

Mike Gilpin

To succeed in today's turbulent business environment, enterprises must drive deeper customer engagement, connecting empowered customers to the valuable services they want across multiple touchpoints. This crucial shift to an outside-in focus, however, brings new demands and challenges to the application development and delivery organization. On June 13, 2011, Forrester convened a group of expert analysts to discuss:

  • How application delivery should partner with marketing to drive deeper customer engagement through the entire life cycle across multiple touchpoints.
  • Best practices for application development to design and deliver improved customer experiences.
  • How to reconcile the need for stronger design with agile processes and continuous delivery.
  • How to optimize your mobile application strategy to serve empowered customers.
  • How to exploit emerging application platforms, including cloud, to empower customers and the business to enable rapid change.
Read more

Agile 2011 Needed More In The Middle

Blog post info and actions

Blog post body

Tom Grant

Fiction writers I've met have said that the hardest section of a novel to write is not the beginning or ending but everything that happens in between. The middle chapters trace the course of the protagonist's struggle in way that must be both engaging and credible. The story of how people adopt Agile successfully also has a beginning, middle, and end. The middle part here, too, poses some of the most difficult challenges. The first chapter is a grabber, with teams energetically and fervently doing daily stand-ups, blazing through sprints, christening a product owner, prioritizing their backlogs, and living through all the other exciting events that happen at the very beginning.

And then the plot takes a different turn. Success at the small team level is fantastic, but how do you fit into a development organization? What if you need to work with an offshore team? How do you maintain velocity when builds take several hours or maybe even a full day? Is it possible to deal with compliance requirements without a significant amount of automation? How do you work better with the ops team so that the speed of deployment matches the speed of development?

Since Agile went mainstream, the number of teams reaching the difficult middle chapters of Agile adoption has increased markedly. Both I and my colleague Dave West answer questions about the middle phases every day. Many of these questions also arise during the yearly conference that the Agile Alliance holds in the US. (This year, it's in Salt Lake City to mark the tenth anniversary of the signing of the Agile Manifesto in nearby Snowbird.)

Read more