devopsy.kinsta.cloud

Author: Joe Franscella

  • DevOps, Security, AI Convergence on Horizon

    DevOps, Security, AI Convergence on Horizon

    DevOps is regarded as practice that can drive performance advantages. Artificial intelligence is showing very real promise across the security market. Most public and private-sector organizations know that they must explore new and different ways of defending their networks against modern threats. These three factors make it clear that DevOps, AI and security are ripe for convergence.

    Defining AI

    Anyone reading this post doesn’t need me to explain to them what DevOps and security are; both of these categories are well-defined. However, AI is really in an emergent stage, with different types in use and many definitions floating around. Because of this, I think it is important to let readers know that in this post, AI refers to a class of technology that can:

    • Consume data, learn and get smarter on its own
    • Automatically identify and solve problems
    • Operate independently, without human supervision
    • Scale massively
    • Move at near real-time speed
    • Achieve levels of accuracy that are beyond human capabilities

    DevOps and Security are United

    DevOps and security have merged. For several years now, organizations have been leveraging automation technologies and DevOps practices to continuously deliver security and compliance policies across data centers and clouds.

    Further legitimizing the union is the fact that leading DevOps and automation players such as Puppet, Chef and Ansible have formed numerous partnerships that deliver effective security capabilities to their customers.

    There are, of course, other signs that show how successful the DevOps and security marriage has been. One of which is the emergence of the term “rugged DevOps.” It is now so widely recognized that it commands its own section on this site and is often the subject of discussion at several notable security conferences.  

    DevOps and AI are Dating

    The relationship between DevOps and AI is in the early stages, with the courtship between the two well underway. Examples of its progress are found in numerous blogs and articles, several of which include:

    DevOps and AI have certainly not yet intertwined as deeply as DevOps and security have. These examples (and others out there) do show they the two will continue to integrate beyond what we are currently witnessing.

    DevOps, Security and AI

    DevOps and security are wed. DevOps and AI are moving closer toward each other. It’s only a matter of time until all three get together.

    Because several DevOps leaders are already in the business of security, it’s logical to assume that a partnership between one of them and an AI-driven security provider will be what ultimately leads to a marketable solution.

    DevOps provider candidates with the potential to move on a partnership that can combine DevOps, security and AI have a raft of new and established security providers available to work with. Several of the startups in this class are recognized in the CB Insights AI 100 2017 infographic. Companies such as Cloudera (NYSE: CLDR), which is using AI and machine learning to solve security problems, are among the more established providers that may make for a perfect partner. 

    How quickly will the market see such a partnership? That remains to be seen. However, with DevOps now fully accepted as a methodology that can positively impact bottom lines, AI coming into its own, and the need for new and different ways of defending organizations against attacks at a critical stage, it seems almost certain that the convergence will be upon us sooner rather than later.

    — Joe Franscella

  • Digital Transformation Top of Mind at PagerDuty Summit 2016

    Digital Transformation Top of Mind at PagerDuty Summit 2016

    Digital transformation may seem like the enterprise tech buzzword of the moment, but it completely came to life for attendees at the inaugural PagerDuty Summit. C-level executives, industry leaders, developers and IT operators all came together to discuss why and how companies are navigating our digital world with operational maturity and excellence.

    picture1PagerDuty Summit was described as one jam-packed day filled with an impressive lineup of speakers, panelists and industry leaders including Gene Kim, author, researcher and founder of IT Revolution; Maynard Webb, chairman of the board at Yahoo!; and execs and ITOps folks from Google, IBM, Airbnb, Netflix, Splunk and more.

    Digital Dependencies

    Jennifer Tejada, PagerDuty’s CEO, kicked off the conference with an opening keynote noting digital is no longer just a convenience, but a dependency. Based on the flurry of tweets from the audience, her message about the importance of delivering digital experiences to consumers and how DevOps fits into the greater picture resonated with the audience of C-level execs, VCs, IT managers and engineers alike. Tejada pointed out how the importance of micro-moments matter in a world where the stakes are higher than ever before and just how much the end-user experience suffers if applications or services go down.

    Getting the Crucial DevOps Piece Right

    Soon after, Gene Kim took the stage to share his top five DevOps surprises and learnings for digital transformation, delivering key insights from his 17-year journey of studying high-performing technology organizations. He was preaching to the choir when he noted that the business value of DevOps is even higher than thought, and all agreed that he made a compelling case for the importance of measuring code deployment lead time. Surprise No. 5 on Kim’s list was that DevOps isn’t just for the unicorns; it’s for the horses, too. DevOps enables dynamic, learning organizations—and, equally as important, digital transformation itself, for companies in all walks of life, whether they are legacy enterprises or agile startups.

    picture2Twitter activity made it clear that attendees were particularly pleased to receive advance copies of Kim’s latest book, “The DevOps Handbook,” which has been five years in the making.

    Highlighting New Features

    No event would be complete without the announcement of new features. There were positive reports when PagerDuty took the stage to demo and share details around new platform features to make incident management and response better than ever, including:

    • Workflow Extensions: Building on PagerDuty’s ecosystem of more than 175 native integrations, organizations now can configure operational workflows between PagerDuty and other third-party services. This bi-directional flow of information helps provide consistent information across teams and services for faster incident resolution.
    • Live Call Routing: This feature allows anyone inside the organization to directly reach the operations team to report a problem by simply calling a number. Calls get routed via the same on-call schedules and escalation policies in place, and the ability to report incidents in real-time helps restore services faster.
    • Response Notes: This capability ensures that all relevant contextual and human generated data around incidents are captured and time-stamped, creating a clear timeline of the actions taken and the people involved. Response Notes delivers clear visibility on the current status of incidents and a historical record for postmortems, resulting in a reduction of future resolution times.

    Wrapping up PagerDuty Summit 2016

    picture4From the fireside chat with Maynard Webb discussing cloud wars, containers and where he sees the industry going over the next five years, and the inspiring breakout sessions on all things ITOps, the first-ever PagerDuty Summit was, from all accounts, both informative and poignant. Attendees said it spoke to how DevOps and operational excellence form the backbone of successful digital initiatives and transformation, and all walked away with strategies, best practices and use cases for adapting to the evolving digital landscape.

    For a more in depth look at PagerDuty Summit 2016, visit the blog: https://www.pagerduty.com/blog/pdsummit16-event-recap/.

    Joe Franscella is a regular devopsy.kinsta.cloud contributor and full time Bhava Communications employee. PagerDuty is a Bhava Communications client, but Joe Franscella does not work on the company’s account.

    — Joe Franscella

  • The DevOps Force Multiplier: Competitive Advantage + Security

    The DevOps Force Multiplier: Competitive Advantage + Security

    Several years ago, DevOps started hitting the eyes of enterprise business leaders when news outlets such as The Wall Street Journal and Forbes began reporting that the IT culture and methodology was helping adopters to gain a competitive advantage. Since then, we’ve seen story after story about how DevOps-focused employees are becoming the driving force behind the software and applications the world relies on for everything from mobile banking transactions to ride-hailing to gaming. Even the Pokemon company can’t get enough DevOps engineers.

    It looks as if DevOps soon may be recognized as more than just a force for fast and agile software development and deployment. Evidence is emerging that it also may be having a positive impact on security.

    Security Researcher Sees Trend

    Screen Shot 2016-07-21 at 9.03.00 AM
    Bugcrowd Security Researcher OJ Reeves

    Bugcrowd Researcher OJ Reeves sees his fair share of weak security. As a full-time white-hat penetration tester and researcher running attack simulations for enterprises that want to improve their defenses, he’s seen everything from unpatched vulnerabilities in software to the perilous journeys overshared credentials take as they’re passed between multiple administrators across various communications channels.

    Recently, Reeves noticed that in our facepalm-ridden world of security blunders, organizations with a DevOps focus seem to have better security.

    “DevOps is young and still being defined differently across organizations,” said Reeves. “I have noticed recently that when I engage with businesses that employ DevOps-focused people, a security mindset often accompanies.”

    The reasons behind why DevOps is assisting with creating more secure environments are wide and varied, Reeves cited several.

    DevOps Checks Boxes — All of Them

    “Check box security” can be a bit of a dirty-word term when it comes to protecting systems and data, as it frequently refers to compliance—something many cybersecurity and risk professionals consider to be the bare minimum when it comes to protecting data and systems. At the intersection of DevOps and security, it actually can mean something very different, Reeves said.

    “Organizations that actually have DevOps people in place tend to do a better job checking all boxes and making sure security is in place,” he said. “When you have a DevOps person who is doing the job properly, they (organizations) have a much better chance of defending themselves.”

    DevOps Makes Fewer Mistakes

    One company Reeves attacked had developers, operations and infrastructure employees in place but no DevOps-focused team members. He noticed right away that there was no clear definition of who was responsible for security or who was in charge of protecting application life cycles.

    “There were credentials everywhere—all spread out and all mismanaged in different ways,” he noted. “You don’t want anyone with malicious intent, who can compromise a developer’s’ desktop, to get access to credentials.”

    When running simulations for organizations with DevOps employees in place, he’s observed that those kinds of mistakes happen less frequently.

    “More often than not I’ve found that the credential management process is much better when DevOps people were present. When there is a person in charge, who is also conscious of how others are using credentials, a credential security champion tends to emerge,” he said.

    DevOps Communicates

    Reeves, like many other practitioners I’ve spoken with, emphasized that communication between IT members is critical to effective defense. That’s something he said DevOps-focused organizations seem to be especially good at doing.

    When privy to conversations taking place between developer, security and DevOps employees, Reeves has noticed that everyone involved is interested in improving processes all around—processes which include security.

    “Direct human interaction that takes place between those who are responsible for defense tends to result in improved security,” he added. “Just the fact that awareness for these [security] issues is being raised and discussions are taking place is having a positive impact.”

    Reeves indicated the discussions taking place within DevOps environments he’s observed are focused on the right things.

    “These human-to-human interactions make things more secure and they pay attention to organizational security, where we should be having our discussions,” he noted. “Let’s not talk about the latest AV (anti-virus), etc.; security is an organizational process and problem. The best security in the world doesn’t matter if employees in the organization aren’t aware of what’s taking place.”

    DevOps: Harder to Crack

    At the end of the day, companies such as Bugcrowd and pen testers such as Reeves are paid to find exploitable gaps in systems so they can be closed before the nefarious can take advantage of them. While DevOps isn’t typically thought of as a security enabler, organizations that don’t have dedicated DevOps employees may want to consider Reeves’ parting words: “When organizations I am researching have a DevOps focus, it is generally more difficult for me to compromise them.”

  • DevOps Security in Spotlight as Gartner Names vArmour Cool Vendor

    DevOps Security in Spotlight as Gartner Names vArmour Cool Vendor

    News Reports vArmour CEO Eades Nabbed $41 Million Ahead of Trump Presidency

    In May, Gartner named 2016 Cool Vendors in several security categories. Given the focus of this column, I was interested in several of the companies chosen for the designation, especially those named in the Cool Vendors in Cloud and Emerging Technology Security 2016 report. Interestingly enough, only vArmour, one of the new-era cloud security and visibility providers, was noted for supporting security in DevOps environments.

    Click to Tweet: Cloud Security #CoolVendor @varmour noted by @Gartner for #DevSecOps, datacenter vis. The latest @devopsdotcom: http://ctt.ec/uSRLd+

    In the report, analysts Joerg Fritsch and Brian Lowans wrote:

    Supporting the vision of a software-defined data center, all of the capabilities of the vArmour platform are exposed and consumable programmatically via APIs, providing support for highly automated and DevSecOps-type development workflows.

    The analysts also noted vArmour enables application-aware microsegmentation anywhere, from the data center to the cloud and all hybrid points in between. They also highlighted its capabilities that extend security to virtualized environments and containers—security anytime and all the time. Pretty cool, indeed.

    The report provides deep validation for a message vArmour has been pushing since its emergence from stealth—visibility. While many security vendors have interlaced the keyword into their marketing content, this report makes the claim for vArmour all the more true. According to the report:

    vArmour’s distributed security platform combines a scalable fabric with advanced security analytics that offer full visibility from a deep packet inspection engine. This deep visibility enables other cool use cases, such as network-based threat detection and the visualization of workload traffic. This is required in environments where the workload, the network and the security policies are interacting much more closely than we have been used to in traditional environments.

    Validation from firms such as Gartner can carry heavy weight among buyers, especially among deep-pocketed enterprise influencers. I’ve had conversations with C-level security execs at numerous mega corporations in the past who have stated point-blank that they won’t approve expenditures for any technologies that aren’t noted in recognized industry reports.

    vArmour also announced recently the closing of a $41 million round led by Redline Capital and Telstra. This D round lifts the software-defined security provider’s total investment to $83 million.

    In the official company release, vArmour stated it will use the capital for “global expansion and to accelerate worldwide software distribution of its Distributed Security System (DSS) through strategic partners in Asia-Pacific, EMEA and in North America.”

    Although the Presidential race wasn’t mentioned in the release, it was reported by CNBC’s Ari Levy that the real reason CEO Tim Eades sought funding now was in anticipation of a Donald Trump presidency. Eades was quoted in the CNBC story as having said:

    It really does matter what people think of the U.S. as we lead up to the election,” said Eades, a native of the U.K. who moved to the U.S. 18 years ago. With Trump, “the conversation he’s had around Mexico, trading abroad, his position on immigration — everybody outside America looks in and says, `What’s going to happen?’

    Levy continued:

    With Trump having closed the gap on Clinton in the polls less than six months before the election, Eades said it’s definitely time for start-ups to be padding their cash positions. He isn’t comforted by the fact that Trump is a businessman himself.

    To most reading this, vArmour being named a Cool Vendor and handily raising $41 million likely isn’t coming as a surprise. Starting with Eades, the company has an impressive cybersecurity and business leadership pedigree, especially when it comes to startups that are shaking up security thought and practices around the data center, cloud and DevOps movement. Eades is even viewed as a thought leader—likely one of the reasons why he is an occasional guest on global news shows such as Fox and Bloomberg, where he has been called to provide expert analysis on everything from cyberwar to breaches to investment.

    His vision to extend security to the rapidly growing trends of DevOps, cloud, containers  and automation is certainly smart, as these are directions most enterprise IT organizations are headed. Said Eades in a company issued release on the funding:

    It has been an amazing 18 months since we launched our company. We now have hundreds of customers adopting the vArmour Distributed Security System on a global scale, including some of the world’s largest telecom companies, banks, healthcare, retailers and U.S. government agencies. We believe Gartner’s ‘Cool Vendor’ recognition further validates the positive impact and true value we’re providing our customers. We’re offering them the industry’s simplest, integrated data center and cloud security solution to prevent, detect and remediate advanced persistent threats inside their network.

  • Murphy’s DevOps: The Internet Apocalypse

    Murphy’s DevOps: The Internet Apocalypse

    I’ve been immersed in cybersecurity for a good stretch, since it was known as just “infosec” and “security.” Over time, I’ve had opportunities to work with some brilliant minds and young-gun “hackers” (I’m not a name dropper, so I’ll refrain from using them as SEO-bait). I’ve watched attackers transition from being basement-dwelling teenagers to organized intruders to APTs. At one point or another, I’ve met all of Five Horsemen of the Internet Apocalypse: Scam, Extortion, Embarrassment, Theft and Death.

    The biggest cybersecurity news story of all time is still Edward Snowden. Fancying himself a “whistleblower,” champion of the Constitution and privacy rights expert, this fugitive data thief accused of espionage by the United States government has done more to force businesses and individuals to think about digital security and privacy than anyone or incident before him.

    Snowden aside, there are thousands of other stories about just how fragile our online lives and businesses are. If you were at the devopsy.kinsta.cloud Rugged DevOps event at RSA 2015 and caught the presentation by Wired cybersecurity and privacy writer Kim Zetter, “2015 — The Year in Hacks,” then you had a chance to get a great overview of some of 2015’s biggest digital crimes. You might have even noticed the Internet Apocalypse Horsemen riding through.

    With an ear to the ground on everything the NSA and APT-using hackers are guilty of, @KimZetter never fails to intrigue readers and live audiences. Whenever you read her stories or listen to her speak, you always walk away reassured that when all the smoke and headlines have cleared, the great deep-down reality is that everything we digitize is subject to the whim of Scam, Extortion, Embarrassment, Theft and Death. If you didn’t have a chance to attend, please enjoy some of the highlights listed below.

    China vs. U.S., Spy vs. Spy

    Internet Apocalypse

    She kicked off with the biggest hack of 2015: the one that penetrated the U.S. Office of Personnel Management (OPM). The full extent of the damage done and who the actual attackers were may never be fully realized. Were they Chinese spies, rogue hackers or a combination of both? What we do know is that it exposed millions of identities tied to covert U.S. operatives and their family members listed on security clearance forms. It may have even exposed personal information on everyone who has ever applied for a job with the federal government. One for-sure lesson is that even after several decades of security product development (with more than 800 available for review at RSA), the world is still in need of innovation in the space.

    Men Behaving Badly …

    Internet Apocalypse

    Some might argue that Embarrassment made a special appearance at Ashley Madison, but the fact that suicide was part of that hack leaves me to think that Death was the lead actor there. @KimZetter pegged the data theft as the most brazen hack of 2015. With 30+GB of account information stolen and dumped, login credentials for 32 million accounts purloined, credit card transaction information accessed and even several suicides tied to the incident, the hack again reminded the world that the great deep-down reality is that everything we digitize can be used by attackers to scam, extort, embarrass, steal and even kill us.

    From the Keyboards of Babes …

    Anyone at the presentation must agree that Embarrassment really stole the show in the hack of CIA Director John Brennan’s AOL email account. Allegedly perpetrated by a teenager, Zetter describes the incident more deeply in her October story: Teen Who Hacked CIA Director’s Email Tells How He Did It

    Internet Apocalypse

    Keep Calm and Internet On

    Anyone reading this may be walking away with a rather pessimistic view of our chances of remaining secure online. The truth, however, is that the existence of determined hackers should do no more to stop individuals or businesses from going online than road rage should to prevent anyone from getting behind the wheel of a car.

    If any lesson can be learned from news articles pumped out by @KimZetter and her peers, it’s that the world should continue to take full advantage of the Internet but to also take the time needed to apply effective security. Quite simply, we all should keep calm and Internet on …

  • Murphy’s DevOps: 7 Habits of Rugged DevOps

    Murphy’s DevOps: 7 Habits of Rugged DevOps

    Attendees of Rugged DevOps Connect at RSA packed Moscone West’s second floor Feb. 29 to immerse themselves in security. Among the presenters of the daylong event was Forrester analyst Amy DeMartine, who provided a tutorial on how security, developers and operations folks can work together better in the new DevOps world.

    Through a slide show, DeMartine laid out her Seven Habits of Rugged DevOps, three of which are discussed in this column:

    1: Increase Trust and Transparency Between Dev, Sec and Ops

    We live in a world where technology’s goal increasingly is to automate everything, with less reliance on humans—at least, that’s what many marketers would have us believe. However, DeMartine emphasized that Security and Risk groups, if they are going to play a key role in DevOps, need to speak to the practice’s true owners—App Dev and Infrastructure and Ops—in a language they can understand. Here, it’s not automation that matters most. It’s communication—among actual human beings—that’s paramount.

    She emphasized a real disconnect between these groups, with AppDev being perceived as the department of “Anything Goes,” Infrastructure and Ops thought of as the division of “No,” and Security and Risk seen as the “Persistent Nagging” sector.

    7 Habits 4
    Imagine for a minute, a family unit comprised of Mom, Dad and a highly motivated teenager. The teenager is fast, full of energy and always pulling the trigger; Mom is pragmatic, a disciplinarian always having to tug at the teenager’s reins; and Dad is constantly frustrated that no one listens to his determined warnings. The family’s living room is the scene of many “heated” debates, where each side scores its share of wins but there are really no common agreements that satisfy everyone’s needs. When the teenager wins, it’s because Mom simply doesn’t have the energy to resist any further. When Mom wins, the teenager turns on the iTunes, plugs in the headphones, withdraws and possibly even starts searching for a new family. Dad’s victories are often followed by a series of door slams and the silent treatment.

    Now imagine if the three sides found a common language? One that not only got each to see the others’ viewpoints but also developed a system where the teenager was set free to operate within defined boundaries, and where he or she even wore enough safety gear to keep risk to a minimum. We’d have a much more harmonious place, one where the teenager continued to grow without risking the family ship.

    Interestingly enough, there really isn’t any technology available that addresses this very real human communication challenge. No mater how counter intuitive it may seem, an effective Rugged DevOps environment is highly dependent on human-to-human relations.

    3: Discard Detailed Security Road Maps in Favor of Incremental Improvements

    The U.S. Office of Personnel Management (OPM), Sony, Hollywood Presbyterian, Anthem—each of these organizations experienced a security breach of massive scale. If these breaches all shared a word in common it would be PANIC—or at least headlines would have us believe this. The OPM breach was the ultimate example, wherein almost as soon as the alarm bell rang the government announced an elaborate plan followed by the big “Sprint.” Although, it might have been wiser just to beef up phishing defenses (smiley face).*

    It turns out that a detailed long-term plan may not be the answer to data breaches, ransoms and system shut-downs.

    DeMartine said outright that a comprehensive road map for addressing threats should be discarded in favor of a vision for real-time measurement and incremental improvements. Below is the “circle of life in security and DevOps,” as envisioned by DeMartine:

    7: Test Preparedness with Security Games

    Who doesn’t like competition? Not many. I think security folks and hackers are probably some of the most competitive people around; visit a Black Hat conference and watch as attendees intently capture flags, break out of handcuffs and hack signs.

    With that in mind, it makes sense that this is one of the seven habits. There’s little doubt that simulations will do more to prepare people for real-life situations—after all, practice makes perfect.

    Communication is a Rugged DevOps Essential Tool

    Increasing trust between Dev, Sec and Ops mandates effective and, likely, improved communication. Perhaps one of the biggest takeaways is that, for all the technological bells and whistles the industry throws at combating cybercrime, in the end an age-old skill—communication—is at the foundation of the most-effective security.

    *Phishing is assumed the most likely cause of the OPM breach; it is important to disclose that one of my clients, PhishMe, is a phishing defense solutions provider.

  • Murphy’s DevOps: Is Security Causing Things to Go Wrong?

    Murphy’s DevOps: Is Security Causing Things to Go Wrong?

    “Rugged DevOps,” “DevSecOps”—am I missing any? About the only thing more abundant than the volume of terms emerging to describe different facets of how security supports DevOps are the number of vendors now claiming to provide products and services that “solve” related security problems.

    There have been some interesting offerings we’ve seen emerge at this point and most of them probably have merit, in that they likely can accomplish the job they claim to do. Regardless of whether that “job” is actually something that needs to be done to solve a DevOps-related security issue, that is something for the professionals in the developer, operations and security worlds to determine—and hopefully something they will be interested in discussing here.

    This new column’s point is to go looking for problems and solutions. Specifically, it’s focused on how and if DevOps is causing things to go wrong in security (and from time to time in other spots) and what DevOps-focused organizations are doing to correct course.

    Security Questions to Ponder

    Is it true that security can’t keep pace with “continuous?” Will “agile” and security always be oil and water? Will DevOps and security never achieve a harmonious “peanut butter and chocolate”-like relationship? Or, is the talk about how DevOps is the best thing that has ever happened to security and a great opportunity, actually the new reality?

    Another great question this column seeks to answer is whether any of the “so-called” security problems DevOps is creating are anything new, or if they are the same old challenges that have existed since the first bit of sensitive data was exposed to the Internet decades ago.

    There are times when I may mention specific vendor solutions in this column, but only if an actual end user or practitioner is attached to the reference. If that happens, I will always point out if any are clients of mine at my day job.

    It’s no coincidence that this column is being launched just ahead of RSA 2016, as DevOps Connect: Rugged DevOps @ RSA Conference is a major part of the big show, and, that is where the world will be talking DevOps and security after all. Here’s hoping the event will expose problems and provide solutions.