devopsy.kinsta.cloud

Author: Antony Edwards

How to Make DevSecOps a Reality

DevSecOps is an increasingly popular term; however, security vulnerabilities in software continue to proliferate. 2019 saw a surge in web application breaches shining a spotlight on the fact that DevSecOps remains elusive. The latest data from the Verizon Data Breach Investigations Report (DBIR) identified that web application vulnerabilities had doubled in the last year alone.

With the rapid pivot to all things digital in 2020, the pressure on software and applications continues to intensify. Security needs to be a fundamental part of software development in our digitally dependent world. This requires organizations to focus on more than the speed of delivery and turn their attention to the quality of software as they try to accelerate the pace of digital transformation.

Achieving DevSecOps

Organizations striving to achieve DevSecOps need to adopt the following steps to embed security throughout the entire software development life cycle (SDLC).

Make Security a Priority From Day One

Security can’t be a bolt-on at the end of the SDLC if your goal is to make DevSecOps a reality. The recent Zoom failures put security flaws in the spotlight and showcased the risks resulting from delivering innovative services without factoring in security. Every member of the team spanning product developers to technical architects to scrum specialists must consider security for it to be an intrinsic part of each stage of development.

Achieving this transformation to DevSecOps means rethinking how to determine success. Many organizations measure it solely in terms of velocity of time to market without evaluating software quality. Developers remain reticent to incorporate security and turn attention to the quality of code. As a result, software is released more rapidly but with scant regard for the quality, resulting in many applications not being ready for mass adoption.

One Size Doesn’t Fit All With Security

Don’t make the mistake of approaching security as a monolith. Instead, accept that it’s wide-ranging, incorporating multiple different areas spanning authentication to access control to confidentiality to integrity to non-repudiation, to name a few. Based on this broad scope, a single approach can’t hope to address all the different facets of security.

Teams need to rethink security and look at what it means to them and what is essential to their users. This could be keeping customers’ personal identifying information confidential and establishing the types of attacks that are most likely to occur. For example, if your product is inside a corporate file, then compromised credentials and password attacks are a significant risk while denial-of-service attacks are unlikely.

Every member of the team needs to understand security threats and techniques, so they have enough knowledge to deal with recurring issues. Threat models can include an employee unwittingly doing something wrong to trying to protect data from government-sponsored cybercrime professionals. Focusing your training on these areas will help address the vast majority of problems and ensure applications are secure. It’s vital to view security as a science rather that than an art.

Don’t Overcomplicate Security

Security is viewed by many as a problem that can only be solved by highly skilled and paid consultants who specialize solely in security. While there is an absolute need for these skills when reviewing architectures and carrying out audits, there is no requirement for this level of expertise when it comes to basic security checks, such as ensuring that the latest release hasn’t changed the authentication mechanism.

The vast majority of threat models are solved using standard static and dynamic analysis tools. Once this is accepted, you can resolve 90% of security issues through a combination of tools testers and developers. This enables security to infuse every part of the development life cycle and puts an end to the practice of being an afterthought.

Conclusion

Once organizations incorporate these three steps in implementing DevSecOps, they can ensure that achieving security becomes a core component of software delivery. Failure to do so will see that it remains an afterthought and security vulnerabilities will continue to grow.

July 20, 2020
Five Don’ts When Scaling DevOps

The DevOps market is expected to reach $50 billion by 2022. However, despite the growing market, many organizations are struggling to make the transition from the successful implementation of a DevOps project to scaling across an organization. Gartner anticipates that 75% of DevOps initiatives will fail to fully meet expectations through 2022. If organizations are to buck this trend, then they need to consider some of the common hurdles they will encounter as they embark on the path to scaling DevOps.

Making the transition from isolated project to the broad adoption of DevOps presents significant challenges that span culture, systems and technology. Before diving into scaling, organizations should consider the following pitfalls that have derailed others in their quest to embrace DevOps.

Don’t Start Without Resolving the Conflict Between IT and the Business

The key to setting yourself up for success is to establish goals before trying to scale. A critical hurdle to overcome is to reach consensus on the pace of software updates. IT teams traditionally want to continually release software as quickly as possible while the business prefers incremental change, with the goal of minimizing customer friction that frequently results from the constant software updates. Before trying to scale, organizations need to agree on a way forward that everyone accepts and works toward. Otherwise, the silos between teams will not be broken down. This requires leadership, especially the CIO, to take an active role. Without addressing this hurdle, it will be almost impossible to scale.

Don’t Expect Immediate Cost Savings with DevOps

Many are surprised as they try to scale DevOps that it doesn’t result in cost savings. It’s important to remember the DevOps mission is to deliver more reliable software at speed by increasing automation. By doing this at scale, the benefits to the broader business are significant as organizations are able to better serve their customers and compete more effectively in the market.

Don’t Forget About Environment Management

Environment management is another hurdle that occurs when scaling, and it’s tough to solve if you have a lot of complexity. Don’t think it’s just technology, especially if you have multiple customized legacy systems. These present a significant challenge when trying to scale DevOps, so don’t underestimate the time it will take and don’t give up at the first challenge you encounter. However, once you have solved this challenge you will be able to manage these systems more efficiently and with less risk.

Don’t Get Distracted by Tools

From a technology perspective, the plethora of tools available can be overwhelming. As you scale, don’t be distracted by playing with tools. Go back to your goals and focus your efforts on the solutions that help you achieve these rather than being distracted by what is new and cool. Don’t be fooled into thinking that by investing in the latest Jenkins tool it will help accelerate the adoption of DevOps. Having the latest and greatest automation toolset doesn’t ensure that you will be able to scale DevOps.

Don’t Underestimate the Cultural Change Required

Scaling DevOps requires a significant cultural shift for every organization irrespective of industry. It’s relatively easy to carve out a project and make progress on DevOps, particularly as most companies start with an area where the teams will be more willing to collaborate. Scaling requires significant cultural change that will take time, and you will encounter many setbacks as you undertake this transformation.

Blurring the boundaries between teams is the foundation for scaling DevOps. This transformation requires changing the dynamics of how operations and development teams interact and breaking down silos. Scaling is dependent on cultural change, and that’s when organizations tend to stumble as they encounter resistance and many efforts stall.

Scaling DevOps is not a simple endeavor that can be achieved overnight and you will encounter a myriad of challenges along the way. By taking into account these five common pitfalls, scaling is much more likely to become a reality rather than an elusive goal that remains out of sight.

— Antony Edwards

October 24, 2019
How AI is Transforming Testing Today

Currently, there is much debate about how artificial intelligence (AI) will transform our lives. One of the technology’s key benefits lies in its power to transform traditional approaches to app development and software testing. Gartner identified AI-driven development as one of its top three strategic technology trends for 2019.

Digital transformation is dependent on better-quality software, and software testing matters more than ever. However, the growing complexity of our software-driven world means that new, smarter and quicker forms of testing are critical in the race to build better software faster. But in a hyper-connected and complex environment, this is no simple task, and this is where AI-driven testing can help.

AI Transforming Testing

Like any new technology, there are exaggerated claims. However, when it comes to testing, AI is already delivering real improvements and making intelligent automation a reality. AI has moved far beyond an academic concept and is driving business benefits as opposed to hints to those organizations that have adopted it. Below are four of the key ways that it’s already transforming testing.

Auto-Generation of Test Scripts

There are undoubtedly complex test cases for which AI can’t auto-generate all the code. However, AI can easily auto-generate the code that clicks the buttons on the screen, fills out a form, logs into the app and other similar functions. Organizations that have deployed AI-driven testing are able to auto-generate 80% of code reliably, delivering substantial efficiency improvements. Along with auto-generation, AI achieves auto-maintenance: Tests are rebuilt when something in the digital product changes, ensuring continuous quality is maintained and further reducing the resource burden on human testers.

Test Optimization

If you’ve ever used Amazon, then you know that recommendation engine technologies are not that futuristic. AI can be applied to testing in the same way to help companies determine which test is most likely to find a defect based on the risk information gathered. Rather than taking a haphazard approach to testing, AI enables you to home in on the areas at risk—not only delivering efficiency gains but also ensuring a quality experience that delights.

Release Impact

Neural networks, combined with test history and data from current test runs, can predict how an upcoming release will impact users. For example, will customer satisfaction go up or down? Armed with this information, companies can make any adjustments necessary to ensure their users continue to be delighted by their digital experience.

Customer Impact

This is a key benefit of deploying AI-driven testing as you can determine the impact on the business from release updates. Neural networks, machine learning and other AI techniques can be used to understand how technical factors impact business performance. For example, are load times negatively impacting conversion rates? By understanding how releases will affect the business, you can make changes that will quickly have a positive impact.

What Does the Future Hold for AI-Powered Testing?

In addition to the core benefits that AI-driven testing is already delivering, organizations can expect to see additional benefits within the next 12 months that will further accelerate their ability to fully automate the entire testing life cycle.

Failure Determination

Current testing compares the result of a test with a pre-defined known good result. That methodology simply will not work with dynamic systems, such as an internet of things (IoT) device that interacts with multiple other devices which are constantly changing. AI is a key part of the solution: A well-trained AI system can determine whether a real user would consider the actual result correct or not.

Persona Testing

One size doesn’t fit all, and the ability to understand how your app reacts under different personas will allow organizations to understand what parts of the app are particularly good or bad for different personas. Armed with this information, you can optimize your app for your target audiences, ensuring an experience that delights.

As every organization races toward digital transformation, delivering a high-quality digital experience is essential for survival. To create compelling digital experiences, companies need tools that can navigate applications intelligently, learn where quality issues are most likely to occur and identify the critical data correlations that will help developers resolve issues quickly. This is where AI is already delivering significant advantages to organizations that have adopted it.

It’s clear that AI-driven testing is not a passing fad. Rather than taking a wait-and-see approach, it’s time to jump in and experience how AI can help transform app development and software. With AI-driven testing making a real and measurable impact on the business, you can’t afford to be late to this revolution.

— Antony Edwards

May 30, 2019