devopsy.kinsta.cloud

Author: Mike Vizard

  • VMware Extends vSphere Hybrid Cloud Reach

    VMware Extends vSphere Hybrid Cloud Reach

    VMware this week extended its campaign to automate IT environments based on its hypervisors by adding a link capability that enables the VMware vCenter platform to manage instances of VMware vSphere running on-premises and in public clouds such as Amazon Web Services (AWS) and IBM Cloud from the same console.

    Mike Adams, senior director of cloud platform product marketing for VMware, said the linking capability added to VMware vSphere will enable DevOps teams to deploy the VMware hypervisor anywhere without having to invest in a separate management framework for each environment.

    At the same time, VMware is also updating VMware vSAN storage software that, among other capabilities, adds a self-healing feature designed to minimize disruptions in the event of underlying hardware failure.

    Version 6.7 of VMware vSphere and VMware vSAN also now support enhanced client software based on an HTML5 interface that can manage VMware NSX network virtualization software, vSAN and vSphere along with additional third-party products.

    Other new features in VMware vSphere include ESXi Single Reboot, which reduces patch and upgrade times by halving the number of reboots required to one, and vSphere Quick Boot, which will skip hardware initialization steps to gain further re-start efficiencies.

    VMware is also adding support for persistent memory to speed vSphere performance and adding support for graphics processor units (GPUs).

    There’s also now support for both Trusted Platform Module (TPM) 2.0 Support and Virtual TPM 2.0, which serves to protect virtual machines and hosts from being tampered or compromised by the loading of unauthorized components or allowing a guest operating system running on the hypervisor to circumvent existing security controls.

    Finally, VMware is making available an instance of VMware vCenter management software running on a dedicated appliance.

    Adams said VMware today has 500,000 customers running VMware vSphere, compared to 10,000 that have elected to also run VMware vSAN storage software. The goal for the company is to enable more IT organizations to embrace hyperconverged infrastructure by moving storage software on to the same server where VMware vSphere runs. That approach dramatically reduces the total cost of operations for most organizations, he said.

    As VMware makes an arguably belated push into the public cloud, the unit of Dell Technologies is counting on a massive installed base of on-premises customers to move and expand their existing investments in VMware vSphere on public clouds. While there’s no doubt that approach will appeal to significant part of the VMware installed base, many customers have already invested in the hypervisor platforms used by AWS, IBM and Microsoft.

    When it comes to lifting and shifting an existing legacy applications into the public cloud, VMware clearly has the inside track. But when it comes to development of greenfield cloud-native applications, VMware vSphere is not often the first choice of application developers, many of which view VMware vSphere as part of an inflexible on-premises legacy IT environment that they deliberately left behind.

    To its credit, however, VMware is making significant strides in embracing advanced automation technologies that one day soon might put those developer concerns to rest once and for all.

    — Mike Vizard

  • Study Traces Cybersecurity Issues to Lack of App Supervision

    Study Traces Cybersecurity Issues to Lack of App Supervision

    A global survey of 400 application developers conducted by Vanson Bourne on behalf of Veracode, a unit of CA Technologies that provides software development lifecycle tools, shines a light on how big an issue cybersecurity has become because of organizations failing to update components. The survey finds only 52 percent of developers using commercial or open source components in their applications update those components when a new security vulnerability is announced.

    Pete Chestna, director of developer engagement for the Veracode, says the root cause of the many cybersecurity issues is that developers routinely incorporate libraries into their applications. But, after completing that task, there is no bill of materials that enables development teams or cybersecurity professionals to keep track of when those libraries need to be updated and for what reason. Without that bill of materials, it’s easy to miss a critical update addressing a newly discovered cybersecurity vulnerability, Chestna says.

    The survey finds 83 percent of developers are using commercial and/or open source components, with an average of 73 components being used per application. But only 23 percent test for vulnerabilities in components as they are updated, even though there are an average of 71 vulnerabilities per application built using third-party components. Furthermore, the survey finds only 53 percent of organizations keep an inventory of all components in their applications.

    The reasons organizations rely so much on open source and commercial software versus writing their own code span everything from best practices (53 percent) and an ability to work faster (51 percent) to being able to access advanced capabilities (47 percent) and company policy (47 percent). Whatever the reason, it’s apparent that more applications are being assembled rather than being developed completely from the ground up.

    The top factors considered when selecting modules to be included in an application include functionality (62 percent), performance (48 percent) cost (44 percent), known security vulnerabilities (42 percent) and reliability (40 percent).

    Unfortunately, there’s not much in the way of DevSecOps processes spanning the development process. This report shows that development (44 percent) or security (31 percent) teams are most likely to be responsible for the maintenance of third-party commercial and open source components. But the number of organizations that enable developers and cybersecurity teams to work together remains relatively small. A quarter admit (25 percent) admit they don’t even have a formal application security (AppSec) program in place.

    On the plus side, more organizations (41 percent) say they are likely to choose DevOps as their IT methodology, which, longer term, should put them in a better position to embrace DevSecOps.

    When it comes to open source software, Chestna says that IT organizations would do well to remember that free software is much more akin to a free puppy versus say a traditional gift. Puppies require ongoing food and maintenance that comes at a cost to the owner. When IT organizations elect to employ open source software, they are assuming a set of responsibilities that many of them still don’t fully appreciate, notes Chestna.

    Of course, the good news is that it’s lot easier to swap out a module of code than it is to return a puppy.

    — Mike Vizard

  • Akamai Extends Scope of DevSecOps Reach

    Akamai Extends Scope of DevSecOps Reach

    Akamai pressed its case for becoming a strategic DevSecOps platform by adding a range of security capabilities to its network service platform that help isolate applications from cybersecurity threats.

    The company has added support for scripting to automate application security using its Kona Site Defender web application firewall as well as improved management and versioning support for application programming interfaces (APIs). Those capabilities complement an Akamai API Gateway for securing and managing APIs.

    Akamai is also updating Akamai Bot Manager, adding a client SDK for mobile applications to help mitigate distributed denial of service (DDoS) attacks. The company also is adding capacity to its scrubbing centers to further defend against large-scale DDoS attacks.

    Ari Weil, vice president of product marketing for Akamai, said the company is evolving into a platform that securely provides web applications with access to caching software and network infrastructure that dynamically scale up and down as required.

    The goal is to make the Akamai network a seamless extension of any DevOps processes that developers can programmatically invoke on demand regardless of whether their applications reside in a public cloud, on-premises or in a third-party hosting center, said Weil. Because Akamai sits between users and production applications, Akamai now plays a critical role in terms of bother DevOps and DevSecOps, he said.

    In term of accomplishing that goal, Weil conceded Akamai doesn’t have as much visibility in the DevOps community as it would like. The company has integrated its platform into continuous integration/continuous development (CI/CD) platforms such as Jenkins to reduce as many steps as possible for DevOps teams. But developers are not always fully cognizant of the security services that Akamai makes programmatically available, he said.

    Weil noted that as DevSecOps continues to gain ground, Akaimai expects many developers will increasingly appreciate those security services, especially as cyberattacks become both more frequent and lethal. A 2017 security report published by Akamai finds DDoS and web application attacks rose 14 percent and 10 percent, respectively, year over year.

    In effect, Akamai turns web application security into a large-scale zero-trust managed service that is available on thousands of points-of-presence (PoPs) around the world. In time, developers will only have to express their intent concerning the level of security to be applied. The execution of that intent will all be automated, Weil said.

    In an ideal world, all cybersecurity battles would be fought as far away from applications as possible. Rather than focusing solely on the edge of the corporate network, Akamai is encouraging DevOps teams to think in terms of layers of defense that starts where applications are cached at the edge of the network. In theory, platforms such as Akamai provide a lot more visibility into what types of cyberattacks are circulating in the wild hopefully long before they ever get a chance to impact an application. The challenge, however, lies in distinguishing between what security technology needs to be embedded in the application itself versus an on-demand service that’s only a simple API call away.

    — Mike Vizard

  • HashiCorp Extends Secrets Management Reach

    HashiCorp Extends Secrets Management Reach

    Secrets management is core to DevSecOps—how credentials are managed can make all the difference in preventing an application from being compromised in the first place. The challenge is making it as simple as possible for developers to access where most of those credentials are stored in the enterprise.

    HashiCorp this week released an update to the open source Vault secrets management software that adds support for both the Microsoft Azure Active Directory Auth Method and the identity and access management (IAM) engine used in Google Cloud Platform (GCP). Those new capabilities complement existing support for LDAP, Amazon Web Services IAM, Kubernetes, GitHub, Okta or others.

    In addition, version 0.10 of Vault adds support for a graphical user interface (GUI). Previously, the GUI was available only in the enterprise version of Vault that HashiCorp supports. But Andy Manoske, a product manager for HashiCorp, said organizations are making it clear they want developers and cybersecurity professionals to make use of the same core secrets management framework. Because most cybersecurity professionals don’t know how to program it became necessary to add a GUI to the core Vault open source software, Manoske said.

    In general, Manoske says developers and cybersecurity professionals are starting to work more closely together. Microsoft Active Directory is the most widely used platform for storing credentials. As enterprise IT organizations start to move more Windows applications to the cloud, enabling developers to programmatically access the credential data is becoming a bigger requirement, he said.

    Additional capabilities in version 0.10 of Vault include the ability to automate the rotation of root credentials at specified intervals and support for versioning. That latter feature is critical for both compliance and disaster recovery purposes, as well as enforcing temporary changes to secrets keys during the investigation of a potential cybersecurity breach, Manoske said.

    From a DevSecOps perspective, Manoske said the biggest challenge remains the reliance on manual efforts to manage secrets within the applications rather than storing them externally in a secrets management platform. Cybercriminals increasingly are making use of automation tools to scan applications for vulnerabilities that enable them to compromise credentials. Vault provides a means for managing credentials that encrypts credentials that can be applied across thousands of applications at scale. It’s hard to see how organizations can address application security without finding some way to automate secrets management, he said.

    Progress in DevSecOps so far has been slow, but steady. Most organizations won’t be able to address DevSecOps effectively until they master DevOps fundamentals. Once that occurs, organizations need to establish a workflow between developers who want to address every function with application programming interfaces (APIs) and cybersecurity professionals that define corporate policies.

    Embracing DevSecOps is, of course, as much about the processes and culture as it is about new technologies. The real challenge is finding a way for developers and cybersecurity professionals to collaborate without seriously compromising the rate at which applications are being developed.

    — Mike Vizard

  • Google Taps Netflix for Open Source Canary Analysis

    Google Taps Netflix for Open Source Canary Analysis

    Google and Netflix today jointly announced an open-source automated canary analysis service, dubbed Kayenta, that applies statistical analytics to optimize DevOps processes.

    Andrew Phillips, a product manager for Google Cloud Platform (GCP), said goal is to make it easier to consume advanced analytics by integrating Kayenta with the open source Spinnaker continuous delivery pipeline platform developed by Google. However, because Kayenta is based on software developed by Netflix, an IT organization can feed data from any cloud or on-premises IT environment into the canary analysis service, said Phillips. Kayenta also can ingest data from a broad range of monitong tools, including Stackdriver, Prometheus and Datadog.

    Phillips said the goal is to continually iterate on Kayenta to make it simple enough for almost any organization to take advantage of canary analysis, which enables DevOps teams to track metrics such as memory usage of a critical component. Kayenta fetches user-configured metrics from their sources, runs statistical tests and provides an aggregate score for the canary. Kayenta can automatically promote or fail “the canary” or trigger a request for human approval based on those test results.

    Specifically, Kayenta creates a pair of control/experiment time series datasets and calls a canary judge, which performs statistical tests, evaluating each metric individually and returns an aggregate score from 0 to 100 using preconfigured metric weights. Depending on the configuration, the score is then classified as “success,” “marginal” or “failure.” Success promotes the canary and continues the deployment, a marginal score triggers a human approval path, and a failure triggers a roll back.

    The basic canary concept involves routing a small subset of production traffic through a deployment that reflects the changes (the canary) and a newly deployed instance that has the same code and configuration as production environment, which serves as the baseline for testing. The analytics engine then compares the metrics between the canary and the baseline to identify any significant impacts the changes might have on the production environment. Kayenta in effect provides a mechanism for modeling risks based on proposed changes to the production environment, said Phillips.

    Google and Netflix expect third-party vendors will soon be incorporating Kayenta into a variety of DevOps tools and cloud platforms. In the meantime. Google views Kayenta as one more way of enticing DevOps teams to take advantage of Spinnaker to manage their DevOps pipelines in the cloud.

    Historically, setting up a canary analysis system has been a complex endeavor requiring significant engineering skills. Google is moving to democratize canary analysis by making it available as a service that can be invoked on demand, said Phillips.

    Phillips said Kayenta provides access to data that can be used to drive a wide range of predictive analytics applications that can be used to automate DevOps processes. It will be a while before Kayenta data is used to drive artificial intelligence (AI) models to automate those DevOps processes.

    Given the rate at which applications are being added and updated in production environment relying on manual testing is quickly becoming unfeasible. The days when DevOps teams needed to manually create their own statistical analytics models are clearly coming to a merciful end.

    — Mike Vizard

  • NGINX Extends Microservices Ambitions

    NGINX Extends Microservices Ambitions

    NGINX has extended the reach and scope of a namesake application platform that the company is positioning as a bridge between legacy applications and emerging microservices architectures.

    The NGINX Application Platform now includes NGINX Unit 1.0, an open source application server designed to simplify microservices across multiple application types simultaneously using a single instance of a server. It supports Go, Perl, Python, PHP and Ruby, with additional support planned for Java and JavaScript support soon. Sidney Rabsatt, vice president of product management at NGINX, said NGINIX Unit 1.0 is different from other application servers in that it is configured via an application programming interface (API) and is 30 percent faster than existing app servers.

    NGINX in the second quarter plans to add new monitoring dashboards, alerting and management via NGINX Controller R1 offering that provides the capabilities of a service mesh for microservices without having to set up a separate dedicated framework. Service meshes are a critical capability because they provide a means to manage interdependent microservices at scale.

    Finally, NGINX Plus R15 for enterprise customers builds on new HTTP/2, gRPC and JavaScript features that have been added to the core open source NGINX platform to provide support for high-availability clustering and OpenID Connect capabilities. These capabilities extend the ability to deploy NGINX as a web server, load balancer, API gateway, Kubernetes Ingress controller and sidecar proxy, said Rabsatt.

    Rabsatt noted most IT organizations do not want to set up separate infrastructure for managing microservices. Managing legacy and microservices-based applications in DevOps environments will be a fact of life for years to come, he said, adding that based on the number of downloads of NGINX software being used on Kubernetes platforms running Docker containers, that message is already resonating.

    NGINX claims users have pulled a billion NGINX instances from the Docker Store, including more than a million pulls of the NGINX Kubernetes Ingress controller. According to the company, more than 3 million NGINX instances are deployed in production microservices environments across more than 250 customers. That’s critical for the company because some rivals have positioned service meshes as an existential threat to the NGINIX platform. Overall, NGINIX says there are more than 11 million instances of NGINX are downloaded each month, an average of four instances every second.

    Rabsatt said most developers have made it clear they don’t have the patience to wait for IT operations teams to stand up dedicated microservices infrastructures. Most IT operations teams still don’t have the skills required. NGINX provides the ability to deploy microservices at scale using a platform most developers already know how to programmatically invoke on their own, he said.

    At the same time, NGINX is also committed to making available best practices that DevOps teams can employ when trying to manage what amounts to a new type of hybrid computing environment spanning legacy applications and microservices, he added.

    It remains to be seen exactly where the divide between microservices and legacy applications will be laid down inside most organizations. Some will draw a proverbial line in the sand, while others will look to deconstruct existing applications into series of microservices. Regardless of the approach taken, all those existing legacy applications will not be disappearing anytime soon.

    — Mike Vizard

  • VMware Adds Analytics to Automate IT Operations Based on Intent

    VMware Adds Analytics to Automate IT Operations Based on Intent

    VMware is moving to make it easier for organizations to automate data centers and public cloud based on its core hypervisor technology by injecting advanced analytics into its VMware vRealize Suite, enabling them to manage IT environments based on intent rather than having to manually manage every process themselves.

    At the core of those update is the Capacity Analytics Engine, which is being added to version 6.7 of vRealize Operations. Mahesh Kumar, senior director of product marketing for cloud management at VMware, said the capacity analytics engine makes use of Autoregressive Integrated Moving Average (ARIMA) techniques to forecast future system events based on historical data points that identify a long-term trend of sudden spikes in usage. Armed with that data, vRealize Operations can now provide cost analytics that include advice on ways to adjust application size and reclaim idle resources on either a public cloud or inside a local data center. IT organizations can also run “what if” scenarios, Kumar said.

    On top of that capability, VMware is also now adding predictive analytics that enables IT organizations to define a set of intents such as workload balancing to reduce software license cost, prioritize one set of application to maintain a service level agreement (SLA) or make sure certain workloads only run on servers that have been shown to comply with a specific regulation or mandate. Tighter integration between vRealize Operations 6.7 and vRealize Automation 7.4 then can be continuously employed to automate DevOps processes in a closed-loop manner at higher levels of scale without having to add additional headcount, Kumar said.

    In addition, the latest version of VRealize Automation includes more than 120 free, curated blueprints and OVF (Open Virtualization Format) files out of the box. VMware has teamed with Bitnami to add 20 new blueprints and 100-plus new OVFs of applications and databases including GitLab, Hadoop, Jenkins and MongoDB to speed application development and deployment. VMware also updated the Custom Form Designer and added multitenancy capabilities.

    Finally, VMware vRealize Operations is sporting a new user interface and integrates with VMware Wavefront monitoring software.

    Longer term, Kumar said vRealize Operations will be where VMware applies machine learning algorithms to enable artificial intelligence (AI) models to automate the management of VMware environments.

    Collectively, Kumar said the VMware vRealize Suite moves IT organizations that have standardized on VMware in both their local data centers and in the public cloud much farther down the DevOps maturity curve. In effect, VMware vRealize Suite creates an “easy button” for managing complex VMware environments spanning multiple clouds, Kumar said.

    VMware is also betting that AI models will make it a lot easier for organizations to make a cultural adjustment as the management of compute, storage and networking becomes more unified. It’s not clear how long it will take for those machine learning algorithms to manifest themselves in VMware management software. But it’s clear most IT organizations running VMware soon will need to rethink who is responsible for running what inside an IT operations team.

    — Mike Vizard

  • IBM Unfurls Cloud Platform for Building Microservices

    IBM Unfurls Cloud Platform for Building Microservices

    IBM has unveiled a new development environment in the cloud designed to make it easier to build microservices.

    John Duimovich, IBM CTO for Java, said Microclimate provides a complete framework building applications based on microservices written in Java, Node.js or Swift.

    Microclimate runs on an instance of IBM Cloud Private, a private cloud based on Docker containers that is hosted on the IBM public cloud. Once those applications are developed, organizations can either deploy them on-premises or in a public cloud of their choice.

    Microclimate makes use of Kubernetes and Docker containers to create and orchestrate the microservices development process, which can quickly become a complex endeavor. Because of the issue, Duimovich said, more organizations will be pushing development of microservices into cloud computing environments that provide access to what amounts to a turnkey application development pipeline.

    Duimovich noted it’s possible to more closely mirror the production environment an application will be deployed on using compute resources that can be invoked on demand. Instead of developing an application on a laptop, developers can stress test microservices in the cloud by, for example, engage in “chaos monkey” testing, wherein developers allow a microservice to fail to see how the overall application reroutes requests to other microservices, said Duimovich.

    Developers also can engage in A/B testing in a way that would not be economically feasible to engage in when applications are developed on-premises simply because of the amount of additional IT infrastructure that would have to acquired and provisioned, said Duimovich.

    The cloud also makes it easier for teams of developers to collaborate on the development of microservices-based applications regardless of geographic location, Duimovich added. Developers may still choose to write code on their local PC, but when it comes time to load it into an application, the Microclimate platform makes it easier for everyone on the team to observe how that microservice behaves within the context of a larger application.

    IBM will also make available diagnostics tools to enable developers to more easily discover why their applications might be behaving in a certain way.

    While not every application may lend itself to being constructed using microservices, many organizations are now concluding they are simply a better way to develop reliable software. In addition, developers can be given ownership of specific sets of microservices end to end, which not only gives them more control but also makes them accountable for their overall quality. Of course, building applications made up of hundreds of microservices is going to require organization to implement DevOps best practices, which Duimovich said IBM is more than willing to share with customers.

    No one knows for sure when most applications running in a production environment will be made mainly of microservices. But given the rate at which they are now being used to develop applications, it’s now only a matter of time before such applications become dominant.

    — Mike Vizard

  • Google Unveils Suite of APM Tools

    Google Unveils Suite of APM Tools

    Google today announced that it is making available application performance management (APM) tools based on the same technology it employs to manage its internal IT environment.

    Morgan McLean, a product manager at Google, said Stackdriver APM is based the open source StackDriver Trace and Debugger tools Google originally developed for its DevOps teams.

    The APM offering, available in beta, also includes Stackdriver Profiler, a tool Google developed to enable DevOps teams to explore how their code is running in a production environment.

    Google also said it has integrated Stackdriver Debugger with GitHub Enterprise and GitLab to extend the number of repositories developers can use to create mirrors of their code.

    DevOps teams will have the option of deploying Google APM tools either on-premises or on a public cloud.

    McLean noted that rather than throwing additional compute resources at a performance issue, Stackdriver Profile enables DevOps teams to discover and remediate issues and ultimately reduce costs. To minimize the impact of Stackdriver Profile on the performance of a production application, Google opted to employ statistical methods to create a profile of a piece of code. Specifically, Stackdriver Profiler collects data via lightweight sampling-based instrumentation that runs across every instance an application. Data showing CPU time, wall time, RAM used and contention, for example, is then displayed on a flame chart.

    At the core of the Google APM toolkit is a the Stackdriver Trace software the company developed to collect latency data about applications deployed in a distributed computing environment. McLean said that in the age of microservices it’s not feasible to managed modern distributed applications without any ability to instrument them. For many IT organizations, however, the cost of acquiring APM software or employing a cloud service has forced them to limit their use of APM technologies to only their most critical applications.

    Google is trying to remove cost as significant APM factor, which ultimately will result in the applications deployed on the Google Cloud Platform (GCP) becoming more robust and reliable. The Google APM tools can be applied to applications running on virtual machines and containers, as well as the Google AppEngine, a framework Google exposes on its cloud service to enable the development and hosting of applications. In effect, Google is making it easier for organizations to consume open source tools that IT operations previously would have had to stitch together on their own.

    Reliance on APM tools is at the heart of any DevOps process. But DevOps processes are not universally employed, largely because in addition to acquiring new tools, organizations must evolve their processes and culture. The debate many of them have comes down to an argument over whether they need to buy tools before they change those processes or change their processes to justify buying the tools. Most often, it’s the initiative of handful of developers that force the issue. It’s only once that team is successful that senior managers start to think about replicating the DevOps process employed by that team across the rest of the organization. Via Stackdriver APM, Google is clearly hoping to accelerate the rate at which those transition to DevOps occur.

    — Mike Vizard

  • Barracuda Networks Survey: DevSecOps Is Hard

    Barracuda Networks Survey: DevSecOps Is Hard

    Organizations that have adopted DevSecOps processes may be making progress when it comes to improving cybersecurity, but it’s far from easy. A survey of 618 IT decision-makers conducted by Dimensional Research on behalf of Barracuda Networks, a provider of IT security software and appliances, finds half have adopted either DevOps, DevSecOps or a continuous integration/continuous development (CI/CD) platform. A full 93 percent of those IT decision-makers said they faced challenges integrating security into those practices.

    Top challenges cited include: Existing security technologies don’t integrate with application development environments (63 percent), application developers are not comfortable with security (48 percent), and security processes have not evolved (48 percent).

    Much of the frustration can be tied to reliance on firewalls that don’t feature application programming interfaces (APIs) or are natively integrated with a public cloud, said Tim Jefferson, vice president for public cloud at Barracuda Networks. Each cloud service provider has a unique environment that requires providers of IT security software to write code that natively integrates with that platform. IT organizations can’t simply cut and paste security controls created for on-premises IT environments mainly because the cloud provider has already implemented its own controls at the infrastructure level. The IT organizations need to develop their own controls for the application layer, each of which then must be layered on top of the controls put in place by the cloud service provider.

    In the absence of those capabilities, developers get frustrated because a firewall running on a virtual machine on a public cloud presents them with a graphical user interface (GUI) rather than an API. Developers in the age of the cloud are not going to engage with any technology that they can’t programmatically invoke via an API, Jefferson said.

    Not surprisingly then, the survey finds the most requested firewall capabilities requested are cloud-native integration (74 percent), ease of deployment and configuration by cloud developers (59 percent), ability to regulate traffic flows between on-premises IT environments and public clouds (56 percent) and distributed policy enforcement (53 percent).

    Because many IT professionals don’t have these capabilities many of them conclude on-premises IT environment are more secure than public clouds. More than half the respondents (56 percent) say on-premises cybersecurity is still superior to a public cloud. Clearly, there a lot of technical and emotional factors that go into those assessments, but regardless of the truth, perception remains reality.

    Regardless of the approach taken, however, organizations that deploy firewalls in the cloud are expecting to pay for those services on a consumption basis, which doesn’t always align with taking a firewall running on virtual machine and then deploying it on a public cloud.

    Jefferson said that as cybersecurity in the age of the cloud continues to mature, expectations are rising regarding the capabilities a firewall should be able to provide—especially when it comes to controlling the flow of traffic coming into and out of a public cloud.

    Obviously, anything to do with DevSecOps these days is still evolving. But whatever the cybersecurity future holds the relationship between on-premises and cloud security is far more nuanced than many appreciate.

    — Mike Vizard