
I held off for a long time, maybe longer than was smart as a consultant, but I’ve finally explored AI. I’m still not into the hype of all the large language models and the “use AI everywhere” crowd. I have come around to some useful benefits though. Many organizations struggle with tech debt and application modernization. With the recent announcement of GitHubs Copilot free tier [1] I wanted to share some recent experience with Gen AI and App modernization and discuss some of the benefits and drawbacks I encountered.

## Personal Experience

I worked on a mobile application that was written 5 - 10 years ago and the framework hadn't been updated. The app still functioned but was not able to be easily updated and due to it's age was having issues with the app stores. The original framework was AngularJS and there was no clear or easy update path for the 15 - 20 different components that made up this app. With the help of GitHub CoPilot two developers were able to fully rewrite the application, and add new functionality to bring it into a more modern experience in 4 months. This included understanding the current app, getting necessary access, User Acceptance testing, building a new CI/CD pipeline and deploying to the app store. In fact the initial conversion was done in about 7 weeks with 3 weeks of UAT before a functionally identical app was able to be deployed! The rest of the time was adding in new features to provide an updated experience while using the app.

## Application Modernization

Before we dive in it’s necessary to define Application Modernization. “Application modernization is the process of taking existing legacy applications and modernizing their platform infrastructure, internal architecture, and/or features.” [2] There are many different approaches to modernizing a legacy application often referred to as the 5 R’s (I have seen it as 7 R’s before as well). Discussing what these are, and why modernization is beneficial is better suited for a post of its own. With that in mind some of the benefits of Application Modernization (App Mod) are to make it easier to scale, enable the ability to add new features, and easier maintainability. 

## Generative AI

Generative AI (Gen AI) is a term that has been thrown around a lot recently. I’m not going to get into Gen AI vs LLMs vs ML for two reasons, there are plenty of articles out there that can describe it better than I can, and frankly I’m not interested enough in AI at the moment to dig into the details necessary to fully explain it. It is important that we have a common understanding of what Gen AI is though if I am going to discuss how it can be used to aid in App Modernization. Gen AI “is a subset of artificial intelligence that uses generative models to produce text, images, videos, or other forms of data.” [3] For this article I will be talking about how Gen AI can generate code and provide assistance in research. 

### Quick Words of Caution

As with any code repository any API keys or other security tokens should not be fed into your AI model, most AI models today use prompts and input to further refine the output and this runs the risk of your api keys or tokens being suggested as a solution for someone else. 

## Using Gen AI for App Mod

Now that we have a common definition of Gen AI and App Modernization we can discuss how Gen AI can assist with your modernization efforts. There is no single definition of a “legacy” application; commonly for an application to be considered “legacy” it will have a few characteristics: 

- the program language is no longer commonly used/understood
- the framework version is no longer supported
- the application is not actively maintained. 

These legacy applications frequently will also have limited, out-of-date, or no documentation. All of these factors make it difficult to maintain, let alone update a legacy application to be better suited for modern architecture and development practices. 

#### Understanding Legacy Code

For a developer (or team of developers) to modernize an application they need to first understand the existing functionality, then assuming that a full rewrite from requirements is not in order they need to determine how the existing code and framework is different from the target framework. After determining these differences the slow process of updating every file can begin. Leveraging Gen AI may be able to help a developer understand what portions of code are doing however understanding the existing functionality and the requirements driving modernization are efforts that will still largely fall on developers in the current state of AI. 

#### Converting Legacy to Modern

Once an understanding of requirements and functionality has been achieved the developer can leverage Gen AI to convert the existing code to the target code/framework. This saves the developer from needing to learn an obsolete framework and reduces the time needed to begin realizing value from an updated application. 

#### Benefits & Drawbacks

The reduction in the time it takes to convert the existing application to the target configuration is a huge benefit of using Gen AI to assist in the modernization effort. It is impossible for developers to know every language, framework, and configuration that exists, utilizing Gen AI allows the developer to bridge the gap between what they know and what they need to know for the conversion, reducing the need to learn both current and target frameworks. In my experience, Gen AI does extremely well in converting an existing code base from one framework to another using the proper syntax and configuration. 

When it comes to converting the functionality Gen AI starts to struggle. The more common or simple a feature is or one that may have been done numerous times before are often converted correctly. The specific functionality that might set your app apart from the competition or that covers an implementation that hasn’t been done often is where Gen AI can struggle. In these cases it might generate code that uses non-existent packages or libraries, doesn’t follow current best practices, or that is slightly off in functionality. The benefit from leveraging Gen AI does still exist in these cases, having automated all of the simple pieces the developer can focus on the more complex and often more interesting functionality. 

Gen AI can do more than just the initial conversion. Using Gen AI for troubleshooting errors provides different perspectives that the developer may not have considered. This can help shorten the time to correct the error, however this also is not perfect. When suggested solutions don’t work there are often a limited number of alternative solutions the AI will provide before it starts suggesting things that have already been tried. As with any AI model, how the prompt to the AI is crafted can generate different results, in our case this isn’t a bad thing but it is something to be aware of especially if a team of developers is working to do the conversion since each person may get slightly different code structures. As you convert the application make sure to check new functionality against existing so that you can correct any AI errors as you go. 


Using Gen AI can greatly improve the App Modernization experience for developers and decrease the amount of time it takes to realize value from the update. It does still take well defined requirements and desired target state to have a successful modernization. 

## References 


[1] https://github.blog/news-insights/product-news/github-copilot-in-vscode-free/ 

[2] https://www.ibm.com/topics/application-modernization

[3] https://en.m.wikipedia.org/wiki/Generative_artificial_intelligence

A look at how Generative AI can assist in application modernization efforts and what to watch for in the process.

Robot at Keyboard

Leveraging Generative AI For Application Modernization

Explore the benefits of cloud providers for data backup, network segmentation, and advanced security measures to protect your business against the increasing threat of ransomware attacks.

blue abstract

Leveraging the Cloud to Protect Against Ransomware


Try to think of the most secure application. What comes to mind? For me it is, a simple database with no permitted users, not connected to the internet, on a computer in a locked bank vault. This application has no practical functionality for 99% of use cases. How can we have a secure application, which is still practical, functional, and useable? According to [Techopedia](https://www.techopedia.com/definition/22193/software-development-life-cycle-sdlc) the Software Development Lifecycle (SDLC) is a “conceptual framework describing all activities in a software development project from planning to maintenance”. The SDLC is an overarching concept that covers both agile and DevOps, as development continues to adapt and evolve so does the SDLC. As DevOps shifts to [DevSecOps](https://www.parivedasolutions.com/perspectives/balancing-speed-and-security-with-devsecops), SDLC shifts to SSDLC or Secure Software Development Lifecycle. The SSDLC adds a security contribution to each phase of the SDLC; developers must now understand foundational security concepts so they can apply them during the development and testing of applications.

Security incidents come about in a variety of ways; human error is commonly stated as a leading cause. In addition to social engineering, human error can manifest as coding errors and application vulnerabilities. One cause of application vulnerabilities is that developers do not have security knowledge. Conversely Information Security teams have security knowledge, but do not develop applications. Many applications go through a security review before going to production, however this is not going to be able to catch all possible issues. Software architects should consider security as part of the system architecture, but this cannot cover all the possible application security issues. When a software architect designs an application with the requirement that sensitive data be encrypted, it falls on the developer to correctly implement this requirement which means the developer must know what is considered sensitive data. In developing an application, a developer may grant a wide array of permissions in order to facilitate testing and speedier development, if the developer does not sufficiently narrow these permissions before release it may not be caught until after the application has been compromised and the excessive permissions used maliciously.

We cannot expect developers to know as much about security as the Info Sec team. We can begin to create better applications by following secure coding practices. Some best practices, like the principle of least privilege, may be known but not understood, or simply considered the architects problem. It is not difficult to find guides for secure coding practices. [Snyk](https://snyk.io/), a company aimed at integrating security tools into development tools, has an [article on the issue](https://snyk.io/learn/secure-coding-practices/). [Mend.io](https://www.mend.io/), another application security focused company, also has a [guide](https://www.mend.io/resources/blog/secure-coding/) on secure coding. One of the most well-known initiatives, the [Open Worldwide Application Security Project (OWASP)](https://owasp.org/), not only produces a list of the top 10 most common web vulnerabilities but also provides a comprehensive [quick reference](https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/) guide for secure code.

All of these are good resources, and we don’t need to reinvent the wheel when it comes to secure coding. Developers already have a lot of requirements that need to be met, performance, useability, reliability, and maintainability are a few. Security must be added to the list of requirements to reduce the openings available to attackers. To develop secure applications developers need to familiarize themselves with at least the following concepts: Principle of least privilege, Proper Input validation, Proper configuration of application components, Using trusted third-party components, and appropriate logging levels.

The Principle of Least Privilege is probably one of the most well-known concepts of security. The principle states that a subject should only be granted the permissions and privileges needed to perform their responsibilities. A subject can be a person or application. Applying the principle of least privilege to an application reading inventory means that the application does not have write permission to the inventory. It also means that the developer should not have write access. This principle can be applied to the users of your application as well; only grant the permissions needed based on how they will need to interact with your application, not everyone needs administrative permissions. Proper Input Validation, or don’t trust user input, is gaining more recognition. One of the most common attack types on web applications is SQL injection, there is even an XKCD on the topic. This XCKD effectively highlights when inputs are directly passed to a database or other system the user can craft input in ways that have unintended consequences. In order to mitigate this, any data from an untrusted source, like the user, should be sanitized so that any characters with a special effect, such as quotations which can terminate a string, are properly encoded to limit unintended behavior.

![Bobby Tables XKCD comic illustrating SQL injection](/images/bobbyTables.png)

It is increasingly common to leverage other components when developing applications; this helps reduce the level of effort and complexity. It is necessary to fully understand these components and how to set them up. An improperly configured component opens new avenues for attackers to gain control of your application. One common improper configuration is leaving the default login information. Changing default login information is a low effort but high impact change that increases security. Other configurations such as how the component will communicate with your application and through what format are important to know to reduce misconfigurations that lead to vulnerabilities. Using components, especially third-party components, means you are using someone else’s code in your application. More companies and applications are requiring a [Software Bill of Materials (SBOM)](https://www.cisa.gov/sbom), to compile this you will need to track components and their versions. More importantly though tracking components source and version enables you to ensure you aren’t using other libraries or code that have known vulnerabilities that can be used to compromise your application. Any interaction with external components in your application should have sufficient logging around it so a developer can debug the interaction. Logging helps developers and operations understand the state of the application during failure and trace errors. Developing and debugging applications is easier when the state of the application is easily understood, this is one of the reasons that a “debug” log level exists. An application in production needs different logging than it does when still in development. Using the same level of DEBUG logging can have the unintended consequence of providing information to an attacker that they then use to force an error or compromise your application. Developers, operations, and security teams rely on logs to understand the state of an application and detect potential attackers. At the same time information in logs may provide an attacker information needed to compromise the application. Understanding the factors at play when determining what to log allows developers to enable internal teams while limiting an attackers ability to use the log for information gathering.

Application security is not one and done. The concepts discussed here are a starting point to provide developers with a better understanding of security considerations. Answering the following questions can help developers discover new ways of thinking about the level of security needed for the applications they develop. 

- “What types of data is my application be handling?”
- “Who are the users of my application?”
- “Where is the application running?”

If you are interested in learning more there are a lot of great resources. The OWASP quick reference guide is a great starting point. Another resource I found particularly interesting is the free book Secure Programming HOWTO by David Wheeler, you can find a few different was of accessing the book at https://dwheeler.com/secure-programs/. Applying the concepts covered here will allow developers to begin to build more secure applications and be prepared for the threats they face every day.



Security threats are everywhere. Todays developer needs to understand a few security concepts in order to build applications that can withstand the environment they are deployed in.

Gray background with applicaitons icons covered by a lock

Developing More Secure Applications

From MFA to Zero Trust, are current trendy security topics new or just old principles re-envisioned?