Working in the business software industry for over 30 years, I’ve seen my fair share of pretenders–amateur software posing as professional business software.
The problem is, this “amateur software” is often hard to detect. It looks great in the demo. Unfortunately, its limitations become apparent after you’ve already purchased the software…when it’s too late to go back.
Today, I’d like to share some tips that will help you separate business-focused application development software from the “amateur” software. I’m focusing on web application development software because that’s our area of expertise (we’ve been doing this for quite a while), but I’m sure these tips apply to most any business software.
So, what separates the pretenders from the legitimate, built-for-business software? Architecture and security. The cheap amateur software focuses mainly on the look and feel, but skimps on the architecture and security. Application development software that’s truly designed for business will include flexible architecture and business-class security features.
What types of security features should good application development software include? I’ve compiled a list of 7 security features that are absolutely essential in professional business application development software:
1. Application level security
Application level security is pretty straightforward: It lets you control application access on a per-user role, or per-user basis. This typically includes a role-based menuing system, which displays different menu options to different users based on their role.
Why is this so important? Unless every employee in your organization should have access to every application, application level security is a must-have. For instance, your CEO might have access to all applications, while your HR department can only access applications related to HR.
2. Row-level (or multi-tenant) security
A critical aspect of B2B, BI, and reporting applications, multi-tenant security lets you control data access within a single application at the row level. This means that multiple users can access the same application, but only view the data they’re authorized to see.
Why is this so important? As mentioned above, different users (or groups of users) must have varying levels of data access. For instance, suppose you need to build a sales report, but each salesperson should only have access to his/her sales figures. Rather than building separate applications for each user, multi-tenant security lets you create one application that displays different data to each user.
3. Single sign-on
Single sign-on (SSO) is a session/user authentication process that lets users enter their name and password in only one place, and access multiple related applications. It authenticates the user for all the applications they’re authorized to access and eliminates login prompts when switching between applications in a single session.
Why is this so important? SSO reduces the number of passwords end users must remember, and cuts down on “forgotten password” support requests. It also improves end user productivity as users no longer need to log in to each new application.
4. User privilege parameters
User privilege parameters are used to personalize features and security to individual users or user roles. These user privilege parameters are saved to a user’s profile and accessible throughout every application.
Why is this so important? User privilege parameters are incredibly flexible. They can control an application’s look and feel, add or hide user options, limit user capabilities, and more. For instance, suppose your company had a customer listing application. User privilege parameters could be set to display an “Update Customer Info” button only when accessed by a manager. While all employees could access the same app, only managers could see the option to update data.
5. Flexible authentication options
Many businesses already use multiple application authentication sources. For instance, your CRM system might authenticate users against one user table, while your email system might use a completely different authentication source. Business-focused application development software should offer flexible authentication options–letting you authenticate your applications using whatever authentication sources you already have in place.
Why is this so important? This means you don’t need to change your current authentication methods or create and maintain yet another user table. It lets you take advantage of the authentication methods you already use.
6. User-specific data sources
This security feature is similar to row-level security, but on a database level. It means you can build a single application that accesses different data sources depending on the user.
Why is this so important? This security feature provides flexibility, as it lets developers dictate which database each user can access. For instance, suppose two companies are merging. While employees from each company must now use the same applications, employees from Company A might need access to a local database, while employees from Company B might need access to data in a completely different database. With user-specific data sources, the application will point to the correct database based on the user.
7. Application activity auditing
Application activity auditing lets developers log end-user activity for signon/signoff activities. This lets IT departments quickly see when a user has logged in, which application they accessed, and when they logged off.
Why is this so important? When managing application security, it’s quite useful to know who is logged in to your system. On a non-security note, activity auditing also helps your company understand which applications are being used and which are being ignored.
Conclusion
The difference between good application development software and bad application development software is like night and day. Before you purchase development software for your business, make sure it includes the 7 security features listed above.