DevSecOps and Salesforce SaaS – Daniel Riedel, Copado

This is Textron TV. Hey guys. Thanks for the throw.

We're here with Dan Rydell. Who's the senior vice president for digital business transformation at capado and we're going to be talking about devsecopson and unusual place in many people's minds at least. com platform Daniel.

Welcome the show. Thank you for having me. What is different exactly about devops in they can sense of a Salesforce environment versus a traditional environment and then by extension what's different about devsecops?

It's a great question. So fundamentally between a traditional software environment and a Salesforce environment. Not a lot if you think about it because if you look at both environments, there's some level of story development.

There's some sort of composure of what you want to do. There's issuing of those stories. There's a environment where you have to do that development work and then they get to pushed in production in Salesforce.

You have boxes and the sandboxes get elevated production in a more traditional environment. You might have a Dev environment on your laptop. We might have a test environment that's you know, you know in sort of a cloud environment and production environment, but other than that fundamentally the basic constructs and cultural concepts are about the same.

To your second point on security whenever we're doing development no matter what that environment as soon as we start putting New Logic on a given environment. We have the ability to potentially make State mistakes. Those mistakes can be accessed controls.

It could be other things but, you know routing that logic through and so it's always good to guardrails in there to protect the people who are actually doing the development so they can focus on a job. Is it also similar in the sense that one of the issues that we have today is devsecops is kind of necessary because the fact that matter is most developers don't have a lot of security expertise for the most part. It was an elective that very few of them actually took so we're trying to kind of retro fit a few things here as we go along and is that part of the thought process here with the guard rails?

It's just a prevent them from making a mistake because it's not like they get out of bed this morning and said, let me go build something that's insecure. Right? Absolutely.

Everyone fundamentally wants to do the right thing. But if we actually look at the Salesforce ecosystem, it's even more important because that Salesforce ecosystem is trying to democratize application development. So most anyone can actually get there you mentioned going to courses and getting trained and in a more traditional environment.

You may actually have someone who has comps I agree that may have snooze to the security classes. Hopefully not but you know, they have some fundamentals in there and this isn't developer. Intention of making anything that's insecure.

However, it's even more important in this environment to even help them along because they're still learning. They're learning all they're just learning how to build applications and there's a lot of things that we need to do to make sure that they do that in a safe manner. How many citizens developers are there out there?

Because I mean professional developers are troubling enough when it comes to security but imagine what citizen developers might do without anybody watching what they're up to because you can wind up deploying something that is just like totally wide open. Um, I'm going to answer the question slightly differently and Gardner puts out most applications 70% of new applications are going to be developed in a low-code no code ecosystem. And so my guess is in the millions and in the tens of them, right if we actually look globally and what's going on here and we look at a you know, any Enterprise.

We're trying to make it. So almost anyone in that Enterprise can actually develop code. So that's gonna far out Pace the number of Engineers that we have that are more traditionally tracked.

Why do I need a dedicated platform for the Salesforce environment? At least my understanding it has something to do with the way Salesforce is built around an object framework, but maybe you could explain a little bit more. Well Salesforce is great at phenomenal environment to build, you know sales tools HR tools Health Care tools.

You have a whole bunch of different clouds that are there and what it is done that allows a citizen developer to rapidly be able to create you know application is taking care of a lot of those fundamentals fundamental objects, like the sales and customer object or a healthcare record or a patient record. Right? These are very complex objects that in a traditional sense.

You have a lot of development around actually creation of that and so out of the box you get that with Salesforce. Now the key thing is how do you customize that for your Enterprise and that's where the cicd and testing come in which are really important to make sure as you customize it and as your environment As you a don't break the environments for the active users and be you know, Health Care has a lot of compliance, you know, we have security access control lists again. How do we start building that so that we protect those folks building that New Logic?

One of the benefits of devops in general is it's made the application development process more streamlined. We have more agility. We're able to respond better to the business.

And I wonder if we're approaching a point where soon the business itself is gonna adopt some of the devops principles in terms of how it operates to better reflect the fact that software is coming Fast and Furious. You know, I really like your point of view there. I mean devops is always a cultural concept of how do you break silos down and get humans communicating with other humans about what they're trying to do right that prevents blind spots the business understanding where it needs to go how it wants to get there and how to iterate as fast as possible and the more that we can actually create this environments give the business the tools for visibility.

So they know how they can move more rapidly is phenomenal. So yes, absolutely but you know bringing it back to that that sort of Salesforce ecosystem, you know, those organizations that decide not to go down this environment are going to be stuck in a manual process for all this. So I think the key thing we're talking about when you talk about that business process is how do we Implement automation to allow organizations to move those great ideas through a process communicate on what they need to do to protect that process and build in automated controls to get there and the more that we're gonna allow the business.

Do that the more they can be a data focused business focusing on the metrics and focusing on deployment of those great new ideas and applications. Now some folks in the security realm especially would say that we're building apps too fast. We're not making them secure.

We're kind of having the equivalent of a Ralph Nader moment. We're unsafe at any speed. Can we build secure applications just as fast as we're building what we're calling applications today.

One thing I would never want to do is try and slow down Innovation because when you try and slow down Innovation, you simply cannot it will find its way through all the cracks that you try and put there and so in case in that case, I actually think if you're trying to slow it down you're gonna actually gonna get more more insecure code you're gonna get more environments because people are just gonna route around it and they're gonna do whatever we can do to get that application out the door. So it's best from a security mindset is coming in a point of enablement. How can we be able to this is the faster?

What are the tools that we can build that allow them to make decisions or allow them to protect their decisions, you know through testing through automation. How do we start putting that in there so they can go faster because if you try and slow down Innovation Innovation will get through. It just won't be as secure as we like it to be How should people be thinking about SAS platforms like Salesforce these days initially.

It was always kind of like here's an application in the cloud. But as far as I can tell people are now using that as almost like that foundational framework for a customizing their applications from there. It's kind of like having a prefabricated house and then build it on top of it and and to that prefabricated house.

A lot of the engineering has been taking care of for you. You know, Salesforce is built phenomenally secure platform. So the question again is as you adapt that platform and as you make that house do new things, how do we you know, how do we continue that protection?

But the thing is is that out of the box with these environments you're gonna be much further along and what you want to accomplish for an Enterprise then if you tried to build these things from scratch A lot of the people building these apps are relatively new to application development. Do you think it's easier to teach them best devsecops practices today than it is to maybe teach people who've been at this for a while. You know, I think it's going to be a continued Journey.

It took us decade plus to get the more pro-code environment, you know fully into the deaf secops movement. And I think we've done a very good job of doing that. I've seen now deaf Cyclops a term is gone International.

It's a term that our governments use and so I think again, it's gonna be awareness. You have to let people know as a citizen developer when you start building something you just need to ask some questions and those questions usually lead to you know, looking at tools that help protect you it's going to be a journey, but I think it's a journey that these tools the cicd testing tools. We'll help build those guardrails as much as we can.

But you always need to be helping the awareness security word again that goes beyond just Salesforce that goes to just any interaction with your laptop your phone. We're always trying to let people be aware that they're in an environment. They need to be careful with their credentials.

They need to be careful with their environment from a personal perspective and a corporate perspective. All right. You've been at this a while so alive.

What's the one thing that you see people doing on a regular basis? That just makes you shake your head and go are we still doing that? Thinking that that the entire process can be a technology Only Solution, right, you know for us, you know, I think humans are the peace that we always have to remind their part of this process and humans are amazing, but they're also fallible.

So we need to be aware of that and remind yourself that that's the fundamental point. So whether we're building devops tools cicd tools, whether we're realizing that you know, that the human interaction was just, you know, the password any of these things. We need to realize that culture the culture of your Enterprise in a culture the organization you you create is going to be your best chance for security.

And then you need to give them the automation tools to be able to go as fast as possible and release that code and in a professional security way. All right, and what's the best way to achieve all that do I just throw everybody in the room and lock the door and hope for the best or or they're like, you know actual training modules that people can take and these are the things we're gonna like walk people through. So at capado we've actually built a great defect offs training course that actually starts teaching all of these things that we I have been talking about today.

So, you know again as I said, it's the human that's the most important. So what we need to do is we need to train those humans and so we've we've released training materials that go through and help people learn. What a cicd environment.

What is a cicd environment inside of Salesforce. What is testing? Why is testing important?

How do you do security automation testing? How do you do compliance automation? How do you go ask your organization?

What do I need to protect? And what do I need to what is sensitive? So again humans get them trained get them up to speed and Empower them to be citizens developers.

We can democratize this environment so they can go produce phenomenal applications. All right, folks. I heard it here first devsecops is going to be everywhere soon, but you that's way to figure out what that means is to open up a module 2 and start with some self-training.

Daniel thanks for being on the show. Thank you, sir. Thank you and back to you guys in the studio.