Author: contributor

  • 8 Ways to Focus on Cloud Software Security

    8 Ways to Focus on Cloud Software Security

    Cloud Software Security Examined

    Cloud software security is critically important. Take, for example, health care: Doctors and other healthcare professionals are one of the biggest users of cloud software, yet recent studies demonstrate that more than 15 percent are considered to be operating at a high risk of security breaches, and more than half are operating at a medium risk.

    Security breaches can be devastating to almost any large industry. Companies must take accurate measures to ensure the safety of cloud computing software, as hackers are all too eager to break into a computer system and do what they seem to do best.

    Fortunately, there are a number of ways to increase security of data and apps in the cloud. Increasing cloud software security is almost like an insurance policy that affords valuable protection.

    Taking Steps to Increase Cloud Security

    The first step in building an effective cloud security plan is to conduct a complete internal audit that includes all current cloud providers. All internal security personnel should participate in the auditing process.

    Once the auditing process is complete, companies should take the following measures:

    1. Security personnel must take steps to ensure all company data is correctly encrypted. Having a secure encryption process in place will increase cloud security significantly.
    1. IT and/or security department should create an authentication process, which will help ensure all cloud software, as well as highly confidential internal information and related files, are secure.
    1. All new internal applications should undergo in-house developmental testing. Well-organized developmental testing procedures will guarantee that new applications are secure at the time they are released. This procedure is highly effective and also should increase cloud software security, when done correctly.
    1. Security solutions must be created that accurately scan and store various binary codes. What’s more, security solutions must be created internally. Runtime makes it extremely difficult to detect any security breach or potential vulnerability. Failure to detect or recognize a potential security flaw can prove disastrous for any organization.
    1. Use a web application scanning program for better security and safety. Use a provider that secures and monitors all web applications on a continual basis, as well as multiple scanning on a single platform. Multiple scanning will produce increased accuracy as well as unified results.
    1. Use one platform for all multiple assessment tasks to heighten cloud security. Using one platform will enable security personnel to identify and address an open-source risk quickly.
    1. Utilize streamline compliance centralization tools, which permit access to direct access to applications for compliance. Applications for compliance should include access to PCI controls and CWE. Both PCI and CWE can be used to make sure corporate compliance requirements are being met.
    1. Develop a system of continual compliance., which will monitor the system for any existing vulnerability or security concern. In addition, this unique system will fully access and examine any and all applications before they are released or deployed. Finally, the system of continual compliance will automatically conduct regular searches to identify all web applications that are related to a specific company domain. Any temporary sites also will be searched and properly identified. A continual compliance system is highly effective when properly utilized.

    There are many ways in which cloud software security can be enhanced. It may be a wise decision to consult with a security and compliance specialist. Many large and small organizations are now utilizing the services that security and compliance companies can offer.

    The Importance of Cloud Security Enhancement for Businesses

    In this of age of advanced computer technology it is becoming easier for hackers to access highly sensitive information from just about any organization. It is sad to say, but there are people who have made careers out of computer hacking. Many computer hackers are never brought to justice. Therefore, it is critical that organizations take the necessary steps to protect all computer software as well as sensitive company information that should never be released to the public.

    Having efficient software testing tools is the first step when looking to increase or improve cloud software security. Efficient testing tools will help an organization to better identify any security problem or vulnerability that may be present. If vulnerability is identified, the next step is to fix the problem and prevent additional security breaches in the future.

    Keeping company software and critical files safe must be a No. 1 priority. If critical internal information is compromised, it can cause severe damage that may be irreparable.

    About the Author / Reed Gusmus

    gusmusReed Gusmus the director of Marketing at QASymphony. Gusmus is an award-winning, passionate and innovative B2B marketing leader who excels at prescribing winning strategies for new customer acquisition and revenue-driving solutions for SaaS companies looking to get more from their marketing investment. Connect with him on LinkedIn and Twitter.

  • A Ferrari and DevOps: More Similar Than You Might Think

    A Ferrari and DevOps: More Similar Than You Might Think

    In a world where customers aren’t short of options, all businesses are characterized by the need to achieve customer delight. From a technological standpoint, a large part of that hinges on fast-tracking the release of high-quality software. A release every quarter is being replaced by a release every week and sometimes even sooner. Expectations have skyrocketed while the timelines have shrunk even more. It is now imperative for all the different components to sync together effectively to create a competitive advantage for the business that can be sustained over a period of time.

    All the water-cooler talk around DevOps notwithstanding, it’s true identity still varies vastly based on the passionate opinions of participants with varied schools of thoughts. It also bears mentioning that while all of their varied opinions carry a sliver of truth, they also are significantly separated from the heart of the matter.

    To better understand the situation, let’s jump into a story: Once upon a time there was a monk who owned a Ferrari and had no interest in selling it. Every morning when the monk left to teach his mindfulness class, there were three blind men who were captivated by the sound of its engine and the smell of burning rubber. And, yet, they couldn’t see the very object that had captured their fancy. So, one fine day they decided to touch the Ferrari and exchange notes.

    The first man touched the broad wheels of the Ferrari and exclaimed that it was a large contraption made of soft rubber. The second man ran his hands across the exquisite curves of the car and said it was like an ancient Greek statue, while the third one placed his hand on the Ferrari’s windows and concluded it was a moving glass palace on wheels. Although each was right in his own way, none came even remotely close to capturing the essence of a Ferrari.

    By now, you don’t need a monk to tell you that the story of DevOps is very similar. For some, DevOps is all about inculcating the right culture so that different groups can work together seamlessly to achieve a unified goal. For others, it is about establishing the right processes and practices that are in sync with an organization’s business goals. And for those with an axe to grind or proprietary tools to sell, DevOps is all about achieving automated nirvana.

    However, the ground reality is that software development teams constantly are facing increased pressure from business leaders to deliver faster than ever before. The business leaders, in turn, are under the hammer of market forces that require them to accelerate or die. The need of the hour is to deliver high-quality software at the rate of knots, while untangling any that might impede the time to market.

    Continuous Everything

    We at Happiest Minds believe the simple approach to DevOps is one that is “continuous” and at its core has the agile mantra of “people over processes and processes over tools.” The idea of continuously evolving and adapting to changing requirements and demands has been captured in what we call the 7Cs of DevOps:

    picture1The main objective is to ensure agile delivery by embracing continuous planning, continuous development, continuous Integration, continuous deployments, continuous testing, continuous monitoring and continuous feedback.

    However, the cultural component of DevOps cannot be overemphasized. A large part of the success or failure of any DevOps engagement depends upon how willingly it is embraced within an organization and the kind of executive sponsorship it receives from the powers that be. The three widely recognized cultural models that most organizations come under are pathological, bureaucratic and generative. Needless to say, organizations that are riddled with a pathological or bureaucratic culture are likely to experience the least amount of success with DevOps because such organizations tend to cover up failures and eventually pin them on the most susceptible scapegoats.

    The breeding ground that DevOps needs to flourish is a generative culture where information is shared freely and openly, the leadership encourages employees to learn and experiment with new ideas and failure isn’t looked at as the end of the world but rather an opportunity to learn and grow.

    Eventually, organizations will have to embrace DevOps as an integral part of their strategy and not just as a liberal, forward-thinking experiment that scores them some brownie points. But it will take some doing, both at the grass roots and in the board rooms. One has to remember that a lot of people are easily attracted to a Ferrari, but perhaps not to the grind that goes into owning one.

    The idea of having a successful DevOps program is much the same—it’s not just about engaging the best vendor or choosing the right tools or paying lip service to creating the right culture; ultimately, it requires overcoming organizational inertia, resistance to change and making a long-term commitment to the philosophy that takes a larger view of how DevOps can help businesses stay one step ahead.

    About the Author / Arsalaan Kashif

    arsalaan-kashifArsalaan Kashif is associate director of Marketing, Product Engineering Services at Happiest Minds Technologies and has a keen interest in all emerging areas of technology and innovation. Having worked with Unisys, Oracle and HCL Technologies for over a decade, he has experience with taking to market products and services across areas as diverse as application services, cloud computing, DevOps and big data analytics to name a few. Outside of work, Arsalaan enjoys watching noir films and reading John Irving classics. Connect with him on LinkedIn.

  • Don’t Cancel the Retrospective

    Don’t Cancel the Retrospective

    Not too long ago, I noticed a lot of teams rescheduling or cancelling retrospectives. Sometimes it was because key people were going to be out of office. Sometimes it was because a major deliverable was due and everyone was crazy stressed. Sometimes it was because the project wasn’t as far along as they thought it would be, and they wanted to wait for more data. In each case, the retrospective was cancelled only because of something deemed completely logical and understandable.

    But it bothered me a lot.

    I turned to the internet to back me up—to give me some context as to why retros never should be moved or cancelled that I could then send out triumphantly to our teams—but instead I found a dearth of thinking on retro cadence and scheduling. Denied the collective wisdom of the internet, I was forced to look inward to better understand why these scheduling changes bothered me so much. Is it just that I’m a compulsive rule follower who can’t handle change? That’s always a possibility worth examining. Were there things I wanted out of these retrospectives and was annoyed to have delayed? Not exactly, since I wasn’t actually participating in any of them, but that was a bit closer to the reason.

    As a manager, one of the things I read over and over is to never cancel a one-on-one meeting with a direct report. If you have to reschedule, it should be as close as possible to the original time. Rescheduling and cancelling one-on-ones is a sign to your reports that spending time with them is not important to you, and should be avoided if you actually respect your colleagues.

    The retrospective feels the same way to me. The person who reschedules it is probably a product manager or a tech lead, dutifully reviewing the schedule for the team and realizing there might be a problem. He or she invariably sends a message to the effect of, “Hey guys, this seems like a really bad time—anyone mind if we move it to next week?”

    Which of you would raise your hand and say it’s not OK? I’m a pretty forceful person, and I’m not sure I would. It’s a tall order to demand the time of the whole team.

    So, what’s the big deal about retrospectives anyway? Are we all beholden to the Agile Manifesto, following the pattern just because it says to? I really hope not, and I can say from my experience some of the best innovations on my team have come from retros. To me, a retrospective is like a one-on-one for the whole team, and can serve the same purpose.

    These are my favorite things about the retrospective format:

    • Enforced thinking time. We all spend our days running at top speed, and taking 15 minutes at the start of a meeting just to think about a topic is incredibly valuable. Taking time before the meeting would be even more impactful, but, baby steps.
    • Individual contributions. The format encourages every single member to contribute to the discussion. The mix of written and verbal discussion affords avenues for people with different communication styles to all have their feedback heard.
    • Venting. In the same way that sometimes a one-on-one needs to be a blow-off-steam session, group venting in a retro can be cathartic—and much healthier than silent stewing.
    • Pulse-taking. Teams are most healthy when every member has things to say, positive or negative, and is willing to discuss them out loud with the group.

    While it’s helpful to understand why retrospectives are so vital for the health of your team, it still doesn’t explain why it’s such a big deal to reschedule. Well, maybe it isn’t. You are not likely to get great thoughtful ideas out of people who are stressed out and are staring at their laptops the entire time. On the other hand, if it happens a lot, it can send a message that the team doesn’t value retrospecting (and probably also is oversubscribed).

    I found that just reminding teams that retrospectives are a first-class calendar system was enough to effect positive change. When push came to shove, my team wasn’t deprioritizing retros, but we realized that we were actually just in a format rut, so we decided to try the sailboat retrospective. Pro tip: It’s more fun if you add pirates.

    About the Author/ Cat Miller

    catmillerCat Miller is senior software engineer at Flatiron Health. She received her Bachelor of Science degree in Mathematics and Master of Engineering degree in Computer Science, both from MIT. Connect with her on LinkedIn.

     

     

  • 7 Best Practices New MongoDB Users Should Know

    7 Best Practices New MongoDB Users Should Know

    Being a developer in today’s technology landscape is tricky. While the proliferation of different cloud services makes it faster and simpler than ever to turn ideas into reality, this rapid development comes at a price. Developer responsibilities have grown to include not only product/feature development, but also other application-critical tasks such as configuring and managing a database deployment, in this case, MongoDB.

    While this guide looks at MongoDB databases specifically, the broader (and proverbial) fork in the road for developers is this: Manage a production database deployment yourself or go the database-as-a-service (DBaaS) route. A DBaaS manages the database on a developer’s behalf, so the developer can focus more on feature and product development operations instead of database ops. However, sometimes this isn’t an option. If you’re embarking on a MongoDB journey and don’t use a DBaaS, consider this checklist to ensure you have the best practices down before getting started.

    Host Your Application in the Same Data Center as Your Database

    Your application infrastructure and your database should be located in the same local network (i.e., data center/cloud region), as it will be the most secure method of deployment and will minimize latency between your application and database. For example, if you are hosting your application in Azure West US, you should also host your database in Azure West US.

    When you connect to your database from within the same data center/region, you communicate through your cloud hosting provider’s internal network. All major cloud hosting providers provide a good deal of network security infrastructure to isolate tenants. The hypervisors they use do not allow VMs to read network traffic addressed to other VMs; thus, no other tenant can “sniff” your traffic.

    Use a Replica Set for High Availability and Review Deployment Best Practices

    MongoDB Replica Sets synchronize data over multiple redundant servers and protect your application from downtime in the face of node failure. Should your primary node fail or become unreachable, your application will automatically fail over to a secondary node, ensuring the availability of your database.

    AWS users should take special care to deploy their replica set nodes across separate Availability Zones to protect against zone failures.

    Not all workloads have the same requirements, so there are multiple strategies for deploying a replica set. You can find a list of considerations in the MongoDB documentation here.

    Host Different Environments on Separate Hardware/VMs

    In addition to the production environment, you may be responsible for setting up environments for development and staging applications. Create a separate database deployment for each of your application environments, with each deployment running on its own VM or hardware to protect against resource contention (CPU, RAM, etc.) across your multiple environments.

    Enable Database Access Control

    MongoDB does not require authentication by default. Protect your database against unauthorized access by enabling database access control. Enabling access control also allows you to limit actions that particular users can perform on the database.

    Use an Application Driver Maintained by the MongoDB team

    MongoDB is a very popular database technology with a large community behind it. As a result, many third-party drivers have been created. However, third-party drivers may become abandoned or outdated over time. It’s critical to find a driver that is well-maintained and stays up to date with the latest MongoDB features.

    If possible, use an official driver by the MongoDB team. You can find a list of drivers that are maintained by the MongoDB team here.

    Index Early and Often

    Without question, the most common database performance issue is due to improper indexing (or a complete lack thereof). Proper indexing is critical because even one unindexed query is enough to prompt significant performance degradation.

    If you’re unsure about indexing best practices, we’ve created a list of indexing tips for improving your MongoDB performance.

    Schedule Regular Backups

    While replica sets can offer redundancy to protect against system failure, they will not protect you from accidents caused by human error such as dropping a collection or even your database. Backups are crucial for ensuring you do not lose valuable data.

    Two common backup strategies are to take filesystem snapshots or to use the mongodump utility. Schedule frequent, recurring backups to keep your data safe!

    About the Author / Chris Chang

    chris-changChris Chang is a developer advocate at mLab. At mLab, Chris has provided database support to thousands of developers. Previously, Chris has held IT roles at VMware and NetApp. He is interested in developer tools, fitness, and house music. Chris holds a B.S. in Computer Science from the University of California, San Diego. Connect with him on LinkedIn and Twitter.

     

  • Mainframe Apps and the Long View of DevOps Strategy

    Mainframe Apps and the Long View of DevOps Strategy

    IT is constantly under intense short-term pressures. Line of business (LOB) executives demand a competitive advantage in digital customer engagement now. Marketing leaders demand better customer analytics now. Legal demands better audit reporting now.

    In fact, much of the investment that companies are making in Agile, DevOps and continuous delivery is due to the urgent, short-term demands of the business.

    But short-term actions alone are insufficient for business success. IT leaders must also strategically navigate the vagaries of the digital economy over the long term—or, as Wayne Gretzky’s father taught him, to “skate to where the puck is going to be.” Otherwise, today’s small wins inevitably will lead to tomorrow’s egregious failures and inefficiencies.

    And integration of your mainframe apps and data into your enterprise DevOps tool chain is central to that long-term digital strategy.

    Here’s why.

    The Mainframe: Big, Nimble Iron

    A DevOps tool chain is only as fast as its slowest link. For most large enterprises, that slow link is the mainframe.

    Slow, waterfall-bound and underautomated mainframe dev/test processes are non-trivial—because mainframe applications and data are non-trivial. They typically are an organization’s most important apps and data. So if you can’t modify your mainframe application logic quickly or leverage your mainframe data in new ways easily, you’re uncompetitive toast in today’s fast-moving markets.

    Also, mainframe applications and data typically serve as the back-end systems of record for front-end mobile and web-based systems of engagement. Your ability to innovate and remain competitive when it comes to digital engagement and digital perceived value is, therefore, almost universally contingent on lessons learned from frequent and timely mainframe code drops.

    In other words, everything IT is under pressure to deliver—new mobile apps, better analytics, fulfillment of increasingly stringent compliance mandates, etc.—depends on bringing Agile, DevOps and (ultimately) continuous delivery to the mainframe.

    Just about everyone realizes this. Sure, there are some holdouts who still advocate something they call “bimodal IT”—which prescribes allowing the mainframe to languish in obsolete waterfall and dev/test practices while the rest of the enterprise moves forward. But bimodal lT has proven to be a mistake. An Oct. 31, 2016, Forrester Research report titled, “Predictions 2017: CIOs Push For Speed Amid Volatility,” shines a light on the fatal realities of bimodal IT:

    “In early 2016, many CIOs fell for the false promise of a bimodal strategy. They only pushed part of their team to adopt an accelerated pace — and left others unchanged. But those CIOs are already experiencing the shortcomings of operating at two speeds. Business peer frustration, polarizing and deteriorating cultures, and unsustainable operational complexities will continue, ultimately spurring most of these CIOs to course correct in 2017.”

    Given the explosion of mainframe-related innovation that has taken place in the past couple of years, enterprise IT leaders and industry analysts agree that “mainstreaming” it into enterprise DevOps is the right and necessary strategy (see as examples here and here).

    Some Good Things Take Time

    While instant gratification may be the order of the day—and gain without pain may be an all-too-frequent vendor promise—the reality is that great IT achievements all require effort, investment and time.

    Inclusion of the mainframe into your cross-platform DevOps tool chain is no exception. No CIO can achieve mainframe agility and cross-platform DevOps orchestration by simply waving a magic wand. But there is a clear, practical path to these goals for those with the requisite foresight and leadership.

    That path includes:

    • Modernizing the developer workspace. Most mainframe development is still performed in “green screen” TSO/ISPF environments that require specialized knowledge and limit staff productivity. A modernized, graphical workspace as part of a preferred DevOps tool chain will allow staff at all experience levels to perform dev/test tasks on both mainframe and non-mainframe applications.
    • Graphical visibility into existing code and data structures. Mainframe applications typically are large, complex and poorly documented. These attributes are a major impediment to mainframe transformation. The right tools enable new participants in mainframe DevOps to quickly and easily “read” existing application logic, program interdependencies and data relationships.
    • QA “shift left.” Early detection and correction of quality issues is a central principle of modern programming—and it’s particularly important on the mainframe, where there’s an especially low tolerance for error.
    • Initial Agile training and adoption. Once you put the right development environment in place, you can start shifting your process from a traditional waterfall model with large sets of requirements and long project timelines to a more incremental model that allows teams to quickly collaborate on user “stories” and “epics.”
    • Use operational data throughout the dev/test life cycle. By using operational data in the dev/test life cycle, your DevOps team can ensure that applications perform optimally in production. They also can significantly reduce your MIPS/MSU-related costs by avoiding excessive CPU consumption caused by inefficient code.
    • Agile-enable source code management (SCM) functions. Traditional mainframe SCM environments are inherently designed for waterfall development and thus are incapable of supporting Agile requirements such as parallel development on user stories. The shift to Agile-enabled SCM is, therefore, absolutely essential for mainframe transformation.
    • Automated release management. To keep pace with today’s fast-moving markets, you must be able to quickly get new code into production. That means automating and coordinating deployment of all related development artifacts across all targeted environments.
    • Cross-platform DevOps. Ultimately, you need to fully de-silo your enterprise environment so the mainframe becomes “just another platform”—albeit an especially scalable, reliable, high-performing, cost-efficient and secure one—that can be modified quickly as needed to meet the relentlessly evolving needs of the business.

    ‘What’s My Motivation?’

    With as much as IT departments have on their plates, it’s easy to continue putting off mainframe DevOps integration. But, ultimately, there are only two alternatives to doing so:

    • Re-platform your mainframe applications. This alternative has proven to be a costly and extremely risky undertaking that delivers zero benefits while it consumes resources and potentially disrupts IT operations, or
    • Continue doing nothing. This alternative puts your company at further competitive disadvantage and hastens the day when you’ll experience total mainframe paralysis due to the loss by attrition of all your veteran mainframe developers, QA specialists and operations staff.

    Viewed in this context, genuine investment in the mainframe—whether you call it modernization, mainstreaming or “Millennializing”—is the only reasonable course of action. Such investment starts improving your digital competitiveness immediately, while paving the way for a future where you can make the most of all your resources and confidently transfer platform responsibilities to your next generation of IT professionals. Including the mainframe in your broader DevOps efforts (while extremely valuable) does require commitment, and there are resources available to help. Just be wary of those who may talk a good game, but whose actions don’t really convey a strong commitment to users’ best interests. Fortunately, there are truly dedicated experts who can help every step of the way, and have direct experience modernizing on platform within their own organizations.

    It’s the smart, viable long-term DevOps strategy every CIO of a mainframe-enabled enterprise needs to adopt ASAP.

    About the Author / Christopher O’Malley

    chris-omalley2Christopher O’Malley is CEO of Compuware. He has nearly 30 years of IT experience with past positions including CEO of VelociData, CEO of Nimsoft, EVP of CA’s Cloud Products & Solutions and EVP/GM of CA’s Mainframe business unit, where he led the successful transformation of that division. Connect with him on LinkedIn and Twitter.

  • Infrastructure Management in the Age of DevOps

    Infrastructure Management in the Age of DevOps

    DevOps has emerged as the de facto cure-all for all that’s wrong with enterprise IT, breaking down silos and replacing them with agile and transparent relationships between developers and operations and seamless, fast workflows that drive greater efficiencies across IT. But legacy IT systems still need tending, even in a DevOps world. They must be secured and scaled, load-balanced, configured, backed up and monitored for compliance, without interruption to the enterprise—all considered infrastructure management tasks.

    And that’s a problem, because these tasks often are handled manually using pre-DevOps processes, which breaks down the very promise of agility, speed and rapid service delivery that DevOps delivers.

    Oleg Chunikhin, chief architect with EastBanc Technologies, emphatically agrees. “If an organization goes down the DevOps path, invariably old habits get carried over into the new world over. For example, if there’s a glitch with release management or a broken disaster recovery process, these problems are dealt with as they occur, or not at all, until they reach a point of critical mass.”

    Chunikhin and I sat down to further discuss the issues and infrastructure management options available to any organization embarking on a DevOps strategy. Here’s our conversation.

    Wolf Ruzicka: Why do infrastructure management tasks pose such a risk to DevOps success?

    Chunikhin: One of the key problems is that there is a limited set of clear leaders in the DevOps tools and architectures market. There are tools for one thing (e.g. containerization) and tools for another (software configuration), and so on. But the market lacks a repeatable, standardized, off-the-shelf solution for infrastructure-level problems.

    Instead, organizations could look to re-architect what’s already there. But this can turn out to be a risky, painful and expensive business. So, you’re left with few options.

    As a result, making the move to DevOps becomes a challenging and risky endeavor for any CIO. If they take that risk, they end up attached at the hip to the time-consuming and manual processes that they already know—which go against the very promise of DevOps.

    Ruzicka: What are the key DevOps infrastructure management considerations that IT needs to bear in mind?

    Chunikhin: First and foremost, don’t delay. CIOs must recognize the problem of infrastructure management in a DevOps environment, before it’s too late. As they explore DevOps, forward-thinking organizations need to consider how its concepts and challenges can fit their organization:

    • How can manual processes be eliminated?
    • How can you strike a balance between the demands of the business and the need to operate in a compliant, stable and secure environment?

    By addressing these challenges early on, you’ll ensure that each of these co-interdependencies is manageable. Before processes break down and critical systems are out of sync.

    Ruzicka: Don’t emerging trends like cluster management and containerization address this very problem?

    Chunikhin: Yes and no. Cluster management is an important part of any DevOps architecture. By abstracting out everyday management tasks, such as backups, and using orchestration to introduce efficiencies into complex environments, it’s a useful tool. But, cluster management software is notoriously difficult to set up for production use. While it can help developers manage many aspects of complex production environments, it isn’t a complete solution in and of itself.

    Containerization helps with multitude of DevOps-related problems (software configuration, package conflict resolution, dependency management, etc.), but containerization alone is also not a complete solution.

    Cluster management software combined with containerization, a.k.a container orchestration technologies, on the other hand, is the most recent and very promising development in the area of DevOps technologies. It promises out-of-the-box SaaS-like capabilities for fast service delivery, production quality, reliability, security, disaster recovery and so on—with less expertise needed for overarching DevOps workflows. This relieves much of the pressure on DevOps teams by eliminating the need for custom software development, lowering maintenance costs and introducing automation.

    Although each solution has its benefits, neither is a panacea for DevOps infrastructure management. Today’s cluster management software, containerization and container orchestration systems differ wildly in their capabilities and are often incompatible with older/legacy software. The task of integrating each with existing back-end systems and ensuring compatibility with existing environments is a perpetual challenge in hybrid deployments, where everything must work together for seamless DevOps. In our experience, each presents unique issues that prevent them from becoming standard on any client project.

    Ruzicka: Without a standard “one-size-fits-all” offering, how do organizations address their DevOps infrastructure management challenges?

    Chunikhin: There are several key capabilities that organizations should be looking at:

    • Portability and vendor-independence.
    • Extensibility and openness, i.e. compatible with widely used modern DevOps standards.
    • Easily deployable business components (such as data storage systems, deployment and release cycle automation tools, application server clusters, etc.)
    • Ease-of-use and immediate readiness for production deployments.

    That’s a lot to check off, but key to this approach is a combination of best practices and the use of open-source DevOps containerization and cloud technologies such as PaaS. PaaS is critical here since it uniquely provides the extensible and ready-to-use pluggable infrastructure services needed to easily configure new services, introduce development efficiencies and take care of the operational concerns that can impinge any DevOps strategy.

    DevOps automation and container orchestration technologies also augment cloud strategy and multiply its benefits by an order of magnitude.

    About the Author /  Wolf Ruzicka

    wolf-ruzickaWolf Ruzicka is chairman of EastBanc Technologies, joining the company in 2007 as CEO. During his tenure, he has overseen the organic growth of the company, taking it from 35 employees to more than 150, with staff turnover of virtually zero. He serves on numerous boards and groups, including the Microsoft Customer Advisory Board for Microsoft Azure and the World Economic Forum’s “Partnering for Cyber Resilience” initiative. Prior to joining EastBanc, Wolf served as president of APIphany (now part of Microsoft) and held leadership positions with MicroStrategy, Mercedes Benz, Lufthansa and more. Wolf holds an Master of Business Administration from Ingolstadt School of Management.

  • Accelerating DevOps with Service Management (and Vice Versa)

    Accelerating DevOps with Service Management (and Vice Versa)

    One of the great misconceptions of service management is what it means. This also is the reason why so many service management initiatives fail. Consider a call center, for example, with many people answering phones and replying to emails. It’s true that a service desk is one of the functions (and in some organizations, maybe even a cornerstone) of service management. It’s also true that the customer or user is one of the main characters in the story of service management. The very word “service” implies there is a customer at the end of that service.

    However, service management is, at the very core, about designing, delivering and redefining services to the customer base—whether those are internal, external or occasional users of the service. User roles may vary over time and users may become part of the supplier chain, and vice versa. A great example of this is knowledge management, wherein users are typically both consumers and producers of information and, thus, the service.

    When we take this higher-level view of the service management practice, our eyes open to new possibilities. In particular, we can see beyond the service desk. The scope of service management widens to the end-to-end delivery of the services in question, retaining the focus on the customer.

    Finding the Cure: It’s All About the Customer, and Communication

    The happy medium and the much sought-after goal of the harmonization of service management and DevOps can be achieved when stakeholders find common drivers. In both worlds, the respective goals focus on the business, delivering value and doing so quickly.

    The following sections present actionable recommendations that can be implemented incrementally across the entire organization. They offer a bottom-up approach. In conjunction with implementing them, senior management needs to support the culture change that is a vehicle, a catalyst and a byproduct of the improvements. In this way, the full benefits of the changes can be analyzed and achieved.

    Tip 1: Stop playing ping-pong with issues

    We’ve all identified an issue with a system, logged it with IT as a ticket and received updates of the progress while the ticket is handed over from team to team—only to discover weeks later that the development team knew about the bug but had de-prioritized it due to lack of interest.

    Surely, by the time the final bit of information reaches users, they are less than satisfied with the result. What’s more, the organization has wasted everyone’s time, not least the time of network, storage and other team members who had to prove it wasn’t their fault in the first place. Finally, development team members could have prioritized their work correctly if they had known about the customer need in the first place.

    With so many implications in the above scenario, why does this happen? The reason is simple: less than optimum process interfaces and lack of information flow. When you’ve identified the problem, the solution is easy: Include relevant data from the development teams, such as defect information, in your chosen IT service management solution.

    Sometimes, the easiest way is to integrate the defects created in development’s chosen tool set to IT service management’s “problem” records. This way there is no need to change the processes per se, as problem records can be linked to issues (or incidents) easily in the service management tool. The integration simply allows for the information to flow between systems and enables a collaborative approach to issue handling.

    In this scenario, when the development team opens a defect, it creates a problem record in the service management system, which, if feasible, could be displayed automatically to users on a self-service portal. Thus, users can search known errors before logging a ticket, resulting in time savings across the whole organization.

    Tip 2: Communicate bugs and known issues to everyone impacted

    But what happens when a user finds a new issue that has emerged due to a bug that has yet to be discovered by developers and testers? Traditionally, the user might log a ticket, which is then analyzed by the IT service team and forwarded to developers for analysis, coding and testing. That might be last of the ticket the user sees, as the feedback loop often is missing.

    The benefits of forwarding the defect information from the user to developers are realized only when there is a way to easily track the whole life cycle of the issue regardless of where it has been initiated. Instead of batch importing records from one system to another, the most advantageous way is to mirror the record sets in the two systems.

    In this example, the feedback loop between the customer and the service desk to the development team is achieved when synchronizing problems and defects in the two solutions.

    Tip 3: Empower the customer by crowdsourcing bugs and new features

    One key metric that contributes to employee satisfaction and retention is the ability of employees to do their jobs well. To accomplish this, they need resources. When employees have all the resources they need to do their job well, more often they are happy than not.

    We are all dependent on technology; there are few professions that do not require technical resources to perform their jobs. If there is a hiccup in the finance solution, for example, the finance assistant may well be the first to find an issue after a version upgrade. Or, a team-wide brainstorming session may result in some great “if-only-our-analytics-software-could …” ideas of how to improve the efficiency of the team.

    But how best to communicate these issues, and capture the many ideas? Possibly, you might even perform real-time impact analysis on which improvement ideas are important to various business processes, and communicate the urgency of each one to the development organization. The inherent problem in many organizations is that users have only one touchpoint to the “DevOps cycle,” most commonly through the IT service management practice. Meanwhile, the rest of the IT organization may use a number of disparate systems to communicate and assign current work tasks that form a basis of shipping new features and functionalities.

    Again, it may be useful to look at the tools already employed throughout the organization, and understand the existing processes and practices. Understanding team functions is important as well, though many teams are fluid in their roles and tool sets used. Once relevant tools are identified, look for mutually beneficial interfaces between them to ensure that users’ requests for new features are not forgotten but logged and picked up by the development team.

    In this example, you could integrate a tool that supports the back office (such as a defect management tool) and tools that support users (such as requirements management and project management tools). This allows you to effectively crowdsource and track upcoming features and bugs, keeping the whole organization informed.

    Tip 4: Don’t forget suppliers

    Include the entire software supply chain in the equation. After an era of outsourcing, insourcing, and multisourcing, many organizations have a diverse supply and sourcing strategy. One of the main reasons for this is to manage risk and ensure business continuity.

    Thus, the last remark is to ensure that all the above examples work in a multisupplier environment. This typically involves contractual preparation. New frameworks such as service integration and management (SIAM) help identify risk and reward in supplier collaboration. These are useful tools for both IT service management and DevOps practices.

    A great example of supply chain integration is an end user reporting an issue. Once it has been reported, it is then centrally analyzed to find the root cause of the issue and the underlying problem is routed to the correct supplier automatically. By synchronizing the information between supplier and customer, not only is each party kept up to date about current issues, but the pipeline and project customer demand are built by integrating incidents, projects and requirements across the software supply chain.

    One of the core aims of both service management and DevOps initiatives is to respond to customer demand as quickly and effectively as possible. Real-time synchronization between solutions is merely a technical solution, but one that has true potential to elevate the response speed.

    Reflections

    Having examined the above four ways to improve the collaboration of DevOps and service management, there are clear solutions to reforming the partnership to drive quicker customer response and satisfaction. But be forewarned: The four recommendations offered are but advice to improve; an organization’s leadership must truly be committed to a culture change to make change happen.

    About the Author /Tuuli Bell

    tuulibellDr. Tuuli Bell is a Partner Account Manager, EMEA at Tasktop. She is a member of the BCS, the Chartered Institute for IT, and the Institute of Physics. For her, happiness is about discovering opportunities to challenge the status quo and about embracing change, be that organizational change, or professional or personal development. Tuuli’s interests outside work include art, science, and nature. Follow her on Twitter or find her on LinkedIn.

     

  • Foster Creative Workers, not Assembly Lines

    Foster Creative Workers, not Assembly Lines

    Why do we keep building assembly lines of creative people?

    Why do tech companies still structure their developer workforces around ideas invented during the industrial revolution over a century ago? It’s ignorant, lazy and, worst of all, it pisses everyone off. Most of these archaic ideas must die if we are to take fully enlightened advantage of the impending internet revolution.

    Internet Revolution? What?

    Before I explain my thoughts about what old ideas are holding our workers back. it is important to understand the one big similarity between the workers of the industrial age and developers of today. Both are the backbone of an exploding economy that has changed nearly everything about the way we live. Without these two types of workers, both revolutions (industrial and internet) would collapse. But this is where the similarity ends.

    For me, the most important difference between the two is that developers are highly creative and highly skilled, and are required to be highly intelligent workers. This creative worker requires a very different environment to ensure “productivity.”

    Let’s dive deeper into this idea, and see if we can uncover the problems with sticking to century-old concepts.

    ‘Work’ in the Industrial Revolution

    In 1913, Henry Ford installed the first assembly line for the mass production of automobiles. From there the industrial revolution exploded. Quality of life boomed. Life-changing products became affordable. Life expectancy increased. Everything was going up and up. (Except, of course, animals and the environment, but I’m going to stay on the subject of work.)

    The industrial revolution redefined the way we measure work. The world moved to a strict schedule of productivity, and was no longer tied to the weather or the sun. Hans Rosling shows it the best here.

    But more than 100 years have passed. We are very clearly going through another work revolution, yet we still cling to the archaic concepts of the Industrial Revolution. The nature of the work we need is drastically different. Ideas about 9-to-5 work hours, productivity, vacation and work/life balance just don’t apply to the work we are trying to do today.

    This was work back then, done by people who could do the task without creativity.

    If Henry Ford lived today, what would he do? Would he make an assembly line of computers on which programmers would write line of code and pass it down the line to the next programmer, who would do the same, until you had a complete application? If you think that’s stupid, why are we working like that? Here is a bug, go fix it! Shouldn’t we be reinventing these 100-year-old concepts instead of applying them as they are?

    Industrial Revolution ‘Work’ Causes an Unhappy Workforce

    Before the Industrial Revolution, most manufactured products were made individually by hand. A single craftsman or team of craftsmen would create each part of a product.

    Now that most assembly lines are automated, today’s work requires individuals to be craftspeople once again. We no longer hire developers just to tell them what to do and how to do it. Developers, like all creatives, don’t like to be told what to do. Creative workers like to be given a problem and they love creating a solution.

    We no longer need to make sure that our employees are working. We need to make sure that they are inspired.

    Take, for instance, the job of an overseer/manager. In the industrial age, this type of person made sure everyone was on task and meeting quotas. They were task masters, and they were often feared. Today, small startups rarely hire task masters (or as we now call them, project managers) to ensure worker productivity right out of the gate. Even if a company does hire PMs, they are no longer micromanagers; they are process optimizers. They make sure that the team is fully informed about what problems need to be solved so they can reach their highest creative potential. Today, if a tech company goes down the route of micromanagement, it loses its most talented people. This change tells us something: Today’s tech workers want to be engaged. They want to solve problems. They want to work for the sake of the creativity.

    No More 9 to 5 and Hourly Rate

    An hourly rate only makes sense when you need someone to complete the same task x times a day. If you need to assemble a thousand cars a month, then you need to make sure you can guarantee numbers. This makes hiring and firing simple: If workers can’t fill their quota, then they are replaced with those who can.

    If you work in the tech industry today, it’s obvious why the above concept is idiotic. Ask any creative worker—software developer or otherwise—when they are most productive and if it helps to be given tasks and blindly assume deadlines. They will quickly tell you that what matters most is the breakthrough, and that could happen at any time of the day. I can’t tell you how many breakthroughs I’ve had on weekends, or in the last thoughts before sleep. And once the breakthrough happens, we developers furiously code toward the finish line to test the validity of our breakthrough. No one needs to tell us to get the work done. We WANT to get the work done and we understand the business requirements; don’t worry, we won’t slip—assuming, of course, that the work is engaging and interesting.

    Let’s separate the concept from the workforce for a second. No painter sells his or her art based on the hours spent creating it. The price is based upon the value of the work in of itself. We give an intrinsic value to the final product.

    A developer could make a million-dollar contribution in a single day. Another developer could make a series of contributions over two years that made it possible for that one developer’s million-dollar solution. Both are equally valuable and necessary.

    The creative workforce should be valued similarly. It is impossible to measure productivity-ensuring work eight hours a day, five days a week. A million-dollar contribution achieved in a single day or over two years—both are equally valuable and necessary. Neither can be reached by giving tasks. They can only be reached by giving problems, and as much time as it takes to solve that problem.

    Creative Problem-Solving

    In a task-based scenario one software engineer might fix a bug quickly, but then it crashes the system next time it runs. In a problem-solving scenario, the creative thinker would figure out that this particular bug is a symptom of a large underlying problem that needs to be fixed to prevent an even larger failure. This type of creativity we seem to attribute to the arts alone. However, engineering is not different: Here is what the founder of YC, Paul Graham, who said in his amazing book, “Hackers and Painters”:

    “Like painting, most software is intended for a human audience. And so hackers, like painters, must have empathy to do really great work.”

    We must remember that just like making a new product is creativity, writing code at its core is creative work. After all, it is not the application of the paint that is creativity. It is how you decide to apply the paint that takes a creative mind. Similarly, it is not the act of coding that is important. It is how you code that is the creative part. In software development, the creativity scale may vary per problem, but if the creative aspect is not nurtured then we encourage mere task completion.

    How Do We Fix These Problems?

    First, we must work on our definitions. Now that we understand where the crux of the problem is, we can start re-engineering how we communicate our concepts of success and failure. I discuss my ideas about this in my previous article, “4 Inspiration-Killing Concepts That Need Redefining.”

    See you there.

    About the Author / Devrim Yasar

    devrim_yasarDevrim is the CEO of Koding, a San Francisco-based software development automation platform vendor. Connect with him on LinkedIn and Twitter.

     

  • Debating the Future of DevOps

    Debating the Future of DevOps

    Change happens at an astronomical pace in the DevOps world, and I constantly see organizations shifting in their needs as the weeks and months go by. One week, the most essential need will be a specific configuration management tool and the next, it will be an urgent requirement to work on containerization.

    Many companies forget that simplicity often is the key and the focus should be on transferring to engineers the requirements of the business and product owners. It’s not always about implementing every new tool just because another awesome engineering team is using it—they might have different business needs and end goals than yours.

    Whether you are consulting for another client or working on your own internal applications, is your focus on how exciting the new container management system is or how to build the best possible end product that the business requires? Your DevOps organization should be focused on understanding these needs as well as the needs of every team across the technology function and more. So how, then, do we find the line between leading, following or resisting trends to create the most competitive advantage for our organizations?

    The DevOps movement will continue to break down silos and increase collaboration. I see DevOps and big data coming closer together; for example, our DataOps teams will have the usual deep understanding of infrastructure, the ability to automate processes, write scripts, build CI pipelines and continuously deploy new code. However, there also will be increasing demand to work with the likes of Splunk and Hadoop to process large sets of data as well as monitoring and logging.

    The cultural idea of bringing our teams closer together, to understand each other and to increase productivity will drive such shifts in skill sets. Other technology touchpoints such as containerization and serverless architecture will continue to spread deeper into organizations, while security and privacy may creep further up our list of priorities as we continue adopting more technologies into our organizations. However, it may take some tough learning curves before we really understand the implications caused by not taking SecOps seriously.

    Every organization has different needs based on the stakeholders, the tech stack, the infrastructure architecture and more. DevOps will continue to shift, take on other aliases and functions, but the truth is that the future of DevOps is simply the future of your organization.

    Understanding what that future holds, however, is up for debate. That’s why we’re hosting an event designed to push DevOps thinking beyond current boundaries among practitioners of varying backgrounds. The Future of DevOps Debate, an invitation-only event, is happening Nov. 10. Salt, host of the event, plans to share footage of the event as well as posting further blogs and articles, providing everyone a glimpse into the day’s conversations and, well, debates.

    The day includes a dedicated session discusses the pain points, experiences and successes leaders have had in their past and current positions. The day’s conversations will be in debate-style format so that everyone gets their opportunity to share thoughts and contribute. The core focus is to work toward the future of DevOps.

    This is the first Future of DevOps Debate, and Salt plans to run a series of events on a quarterly basis. It also contributes to the local New York DevOps community, sponsoring events such as DockerNYC and hosting ServerlessNYC, to name a few.

    It’s clear we are at an inflection point in DevOps, as new technologies and processes strive for attention. Together, we can help shape the future of DevOps and push the industry well beyond its current boundaries.

    About the Author / Conor Delanbanque

    conordelanbanqueConor Delanbanque is managing consultant and head of DevOps USA at Salt. Previously, he was supporting and consulting clients across Europe with their DevOps transformation efforts. Connect with him on Twitter at @ConorDevOps.

  • From the Trenches: Zesty.io’s Google Cloud Migration

    From the Trenches: Zesty.io’s Google Cloud Migration

    Zesty.io recently migrated its sites to the Google Cloud Platform from Rackspace—a process the company believes will make it more agile while streamlining its operations. Zesty.io community manager Phil Ballew recently spoke with Chris Hiestand, Zesty.io’s DevOps leader, to discuss some of the reasons for the migration and get a feel for just what the new cloud system brings to the company.

    Ballew: So what exactly is Google Cloud, and how does that compare to Rackspace?

    Hiestand: Google Cloud Platform is similar to AWS, Rackspace or Azure; they manage infrastructure and services to host your applications and data on. With Zesty.io being SaaS, there are servers running the user’s website that we will manage, and these names are the companies that provide the infrastructure.

    Ballew: So what about Google Cloud made you choose that over Rackspace?

    Hiestand: The difference is that Rackspace has been around for a long time and has produced great business tools, but Google’s tools, which they have been using internally for a while and are now making publicly available, will fit the needs for Zesty.io as we scale out at a rapid pace. Some tech that Google created about 10 years ago is considered cutting-edge today.

    Ballew: What was the reason and initial appeal for moving from Rackspace to Google Cloud?

    Hiestand: Google’s infrastructure is a well-designed fit for containers using the Kubernetes project. Their architecture is designed to minimize operations work, saving labor. Using GCP, we can focus more on writing good software and less on the drudgery of making that software run. Google’s network is remarkable in every respect: good security, bandwidth within the data center, between data centers and out to the greater internet. And their compute nodes are set up in such a way that when they do maintenance, they can move our systems around and we don’t even know it. We stay running and focused while they maintain the hardware.

    Ballew: Kubernetes? What is that exactly?

    Hiestand: Kubernetes is a container orchestration tool based on Google technology that we use on GCP to help us automate and scale the deployment of our software and websites for the users. It helps us think about our applications first and operations a distant second. It also empowers Zesty.io engineers to own what’s running in ops.

    Ballew: What other technologies are you using?

    Hiestand: Kubernetes is built on container technology, so we also use Docker extensively in development.

    Ballew: What were some of the major obstacles that you ran into when migrating to Google Cloud?

    Hiestand: The technical parts are pretty straightforward. The hardest part is probably coordinating with customers. We are mitigating this by keeping Rackspace and Google Cloud in production at the same time, giving customers time to update their DNS records.

    DNS instructions can be found at: https://developer.zesty.io/docs/satellite-sites/launching-a-satellite-site

    Ballew: What are some of the benefits Zesty.io users will see from this switch?

    Hiestand: The most obvious benefit will be the faster page load speeds of Zesty.io-developed websites, including slightly faster application load times for Zesty.io developers. In the not-too-distant future, international load times will be very good, particularly for our enterprise customers. In addition, we are pushing a lot of new features to Zesty.io that will be on the Google Cloud version soon for people to try out. The rollout to GCP also improves our software engineer development velocity so we can get improvements delivered to our customers faster.

    Ballew: Even though Zesty.io users have not all been moved to Google Cloud, is there the option to move now if somebody wanted to, and if so, how can they do that?

    Hiestand: Sure! I would love to help out with that. They can send me an email at support@zesty.io. After we migrate their site, they can update their DNS to point to the new CNAME when they are ready, and customers won’t be able to update their Rackspace website anymore. They will also want to update their bookmarks because the administration URLs have changed, but for the time being, they will get automatically redirected to the new ones. We can help them with any questions they have. Eventually, we will be updating all websites for all users. If you do not update your CNAME, it will take a little extra time for your site to load because of additional network routing from Rackspace to GCP.

    About the Author / Phil Ballew

     

    philballewPhil Ballew is the Zesty.io community manager, working with developers and building the Zesty.io community through many unique outlets. Connect with him on LinkedIn.