devopsy.kinsta.cloud

Author: Sagar Nangare

  • Secure Your Network: How to Integrate EDR and DevOps

    Secure Your Network: How to Integrate EDR and DevOps

    DevOps and Endpoint Detection and Response (EDR) solutions converge when no human element is required while deploying applications or detecting the threat and executing preventive measures. In this article, I am evaluating how the DevOps process integrates EDR solutions for securing services operations at various endpoints in the network.

    What is DevOps?

    DevOps has an impact on the mindset and technology landscape of software development companies to build cloud compatible services in a highly competitive market environment. Unification of development and operations is streamlined in DevOps that results in more innovation in technology domain driven by software. With DevOps, automation has become a more critical element than software development cycles. Now, updates, fixes and patches to software application services become easy with DevOps.

    DevOps Challenges

    Over time, it is realized that security is overlooked while moving to DevOps culture. Here are some of the challenges the DevOps approach might have:

    Absence of Security Knowledge: It is a known fact that a lack of knowledge of secure coding and ignorance of robust security practices by developers can cause a long development cycle. It can happen due to training to developers for following security methods and guidelines while writing code and committing for the build. It has to be addressed at the development level by companies.

    Open-Source Software Security: Use of open source frameworks has increased over time in a DevOps approach. With open-source projects, DevOps teams get pre-made code snippets to enhance the functionality of applications. But a striking fact is that 41% of cyber-security applications found high-risk open source vulnerabilities. To encounter this challenge, the DevOps team should be literate to track updates to open source frameworks used in DevOps toolchain, apply fixes to vulnerabilities as it becomes available. Also, to integrate open source, only use the trusted repositories.

    Inverse Speed for Security Testing: DevOps introduces automation with agility in developing and releasing software applications. The speed at which developers commit code and build an executable does not allow the testing team to deep dive into code efficiently. In the traditional model, testers used to get a fair amount of time before applications go live. With the new agile approach, the duration for testing becomes much lower. To tackle this, automation in testing needs to be in line with development.

    What is EDR?

    EDR solutions offer a new approach to continuously monitor network endpoint devices for malicious activity and prevention of the attack and trigger a further course of action based on the pattern of attack. These solutions analyze endpoint data actively to provide detection and prevention in real-time. EDR solutions analyze the behavior of endpoints users and/or devices for suspicious activity and send alerts to the system.

    EDR replaces the use of digital signatures to detect threats and provide behavior-based solutions for proactive security threat intelligence. All the processes of EDR solutions are based on activities, events and interactions on endpoints or with endpoints. 

    In the realm of CyberSecurity, EDR security offered to enterprises has the topmost priority due to its nature of being proactive and automated. 

    How Does EDR Solve DevOps Challenges?

    DevSecOps is all about introducing and utilizing tools/solutions to secure continuous integration, development and delivery of applications. These applications made for services run at either server-side or endpoint devices. EDR solutions work actively in systems where endpoints have participated. EDR solutions can be integrated within the DevOps cycle so malicious activity can be tracked and hunted down by developers. This can be the quickest and automated way to tackle security threats.

    The public cloud provides an environment for developers for the development, testing and execution of applications. The DevOps approach is mostly consumed by public cloud vendors with their set of supporting tools. But the cloud has its security concerns—such as any misconfiguration or code glitch in the application resulting in a huge attack. Also, cloud resources are mostly accessed by various types of devices which may or may not be secure. Some developers use their own devices for the development and monitoring of the application. EDR solutions can help in both cases by applying itself at endpoints as well as at public cloud infrastructure end.

    Conclusion

    EDR solutions are based on machine learning technologies that generate actions based on analytics information provided by sources/endpoints. EDR tools integration with the DevOps toolchain takes automation in process execution at much further level to track security breaches in run time and hunt down vulnerabilities within code before the application goes live. Additionally, it has seen that endpoint devices are more significantly emerged in generating security incidences. It has become imperative for DevOps teams to look after endpoint protection.

    — Sagar Nangare

  • An Overview of Cloud Migration and Open Source

    An Overview of Cloud Migration and Open Source

    Most businesses are moving toward making their business processes more user-friendly, through digitization. This shift of business modernization comes with a heavy price for them in terms of money and in terms of time. It is going to take time and a great amount of investment in new innovative technologies.

    Cloud computing is the biggest trend in digital transformation due to its ability to make business applications and infrastructure easily accessible. In the roadmap toward cloud migration, businesses are looking to save capital investment or expenses (CAPEX) and operational expenses (OPEX). 

    Open source technologies come to rescue for such businesses. Be those who are present at public cloud platforms such as AWS, Azure or Google Cloud, or private data centers. The role and emergence of open source technologies simplified the equation of overall expenditure for all enterprises and organizations of any industry domains. Year by year, more open source projects are coming up and solve major challenges which businesses are facing. Companies such as Red Hat and communities like Linux Foundation have a major role in promoting open source projects at the heart of digital transformation.

    Why Open Source at Cloud?

    • The main reason to adopt open source technologies in the process of cloud migration can be avoiding vendor lock-in in the future. Most public cloud vendors have a similar portfolio of open source supports in their offerings. As open-source projects are not owned by one company and its overall framework is common to all of its consumers, any updates to its core files have an impact on all projects. And businesses can simply move their application environment from one cloud to another without worrying about backend environment that is powered by open-source projects. There can be a seamless integration of applications and services developed or deployed by different businesses and vendors.
    • Open source adoption for cloud will help in interoperability with other enterprise solutions that can be located in different data centers. Though, other data centers should be equipped with the same open source projects. This interoperability enables the reuse of software stacks, libraries and components. Such interoperability can help deploy multi-cloud environment for businesses.

    The Cloud-Native Approach in Cloud

    Application containerization has been adopted by many solutions providers and vendors in the last few years and has become significantly popular. This containerization surge has triggered the use of cloud-native applications. Most of the popular cloud-native projects are hosted in Linux Foundation’s CNCF (Cloud Native Foundation) community which nurtures the development of various open source projects. Some of the popular projects are Kubernetes, Prometheus, Envoy, Helm, rkt, Linkerd, Etcd, Jaeger, etc.

    The cloud-native approach involves the utilization of tools for handling containers, micro-services, service mesh, DevOps and continuous integration (CI) and continuous deployment (CD). Cloud-native tools for CI/CD can be Check, Ansible, puppet, etc., and service mesh can be Istio, Linkerd, etc.

    Most of the enterprises tend to involve open source projects from various umbrella’s to build the Cloud migration strategy. Moving to cloud-native management of application can be a prominent requirement for many enterprises.   

    Open Source Cloud Migration Tools

    There are open source tools and frameworks that help with cloud data migration. These tools require modification in terms of coding to make the migration process that suits your infrastructure. To make coding customizations in these tools you might need investment for skilled resources.

    The above projects help enterprises to move data. Bluethroat is an open source project which can be used for migration of overall infrastructure from data center to data center, data center to the cloud, cloud to data center and cloud to cloud. Currently it is powered with limited features and used specifically for AWS. It offers the following features:

    • Migration of infrastructure to AWS.
    • Agentless.
    • Environment discovery.
    • Automatic network creation and server deployment.
    • Linux server migration.

    Conclusion

    Cloud migration has its own challenges in terms of uptime, security and data loss. Most public clouds are evolved to handle data as well as application workload migrations. There are many benefits to open source projects, as discussed in this article. The main advantages of migrating open source frameworks to the cloud are cutting back on expenses and avoiding bottlenecks.

    — Sagar Nangare

  • OpenStack and Open Source MANO: Technologies for NFV Deployment

    OpenStack and Open Source MANO: Technologies for NFV Deployment

    We have experienced how open source software technologies revolutionized the application development process, which ultimately resulted in digital transformation across various industry verticals. Open source technologies now are disrupting the telecom sector for building 5G internet, which will be powered by network functions virtualization (NFV) and software defined networking (SDN). With NFV and SDN, multiple network functions and control and management operations in telecom networks will be software-driven; enabling the cloud-native and DevOps approach.

    There are various communities emerged to innovate the software stack behind NFV and SDN technologies such as OpenStack, ONAP, ETSI Open Source MANO (OSM), OPNFV, OpenDaylight, Open Networking Foundation (ONF), Open Contrail, Open Baron, On.Lab, CORD, Kubernetes, ONOS and Open-O. In this article, we will take a look at how a combination of data center management platform management platform, OpenStack and ETSI Open Source MANO (OSM) will be useful for NFV deployment.

    OpenStack for NFV

    As we know, OpenStack is mainly known to be the largest pool of open source projects that collectively form the software platform for cloud computing infrastructure. This infrastructure is used widely in private cloud use cases by many enterprises. After an introduction of NFV by ETSI, OpenStack has emerged as a key infrastructure platform for NFV. In most of the NFV deployments, OpenStack is used at the VIM (virtual infrastructure manager) layer to give a standardized interface for managing, monitoring and assessing all resources within the NFV infrastructure.

    Various OpenStack projects (including Tacker, Neutron, Nova, Astara, Congress, Mistral and Senlin) are capable of managing virtualized infrastructure components of NFV environments. As an example, Tacker is utilized to build a generic VNF manager (VNFM) and NFV Orchestrator (NFVO), which help in the deployment and operation of VNFs within NFV infrastructure. Additionally, integrating OpenStack projects introduces various features to NFV infrastructure, including performance features such as huge pages, CPU Pinning, NUMA topology and SR-IOV; service function chaining, networking slicing, scalability, high availability, resiliency and multisite enablement.

    Telecom service providers and enterprises that have implemented their NFV environment with OpenStack include AT&T, China Mobile, SK Telecom, Ericsson, Deutsche Telekom, Comcast and Bloomberg.

    Open Source Mano (OSM) for NFV

    The management and orchestration (MANO) layer is responsible for orchestration and complete lifecycle management of hardware resources and virtual network functions (VNFs). In other words, the MANO layer coordinates NFV infrastructure (NFVI) resources and maps them efficiently to various VNFs. There are various options available as three-dimensional software stacks for MANO. But ETSI-hosted OSM is largely preferred due to large activity at the community level as well as its highly mature framework, production readiness, ease of initiation and constant feeding of use cases by members.

    Virtual network functions (VNFs) forms network services and may need updates for feature addition or patch for functionalities. OSM provides a method to invoke the VNF upgrade operation with minimal impact in the running network service.

    With the continuous community support and involvement for feature innovation, OSM has now evolved to bring a continuous integration and continuous delivery (CI/CD) framework at MANO layer.

    The latest release 4 of OSM has brought a large set of features and enhancements to the OSM framework, impacting functionality, user experience and maturity, which enables various enhancements for NFV MANO from usability and interoperability perspective.

    OSM has steadily adopted the cloud-native principles and can be easily deployed in the cloud, as installation is container-based and runs with the help of container orchestration engine. A new northbound interface aligns with ETSI NFV specification SOL005 and provides dedicated control of the OSM system. Monitoring and closed‐loop capabilities have also been enhanced.

    The next version of OSM release 5 is expected to be launched in November and will be bundled with more 5G-related features such as network slicing and container-based VNFs.

    Why OpenStack and Open Source MANO for MANO layer in NFV?

    Both OpenStack and OSM have a large community known for its rapid pace for innovating NFV and higher contribution by all scale companies to enhance current features and develop new capabilities for core projects under it.

    For NFV, OpenStack standardizes interfaces between NFV elements and infrastructure. OpenStack is used for commercial solutions offerings by companies including Canonical/Ubuntu, Cisco Systems, Ericsson, Huawei, IBM, Juniper, Mirantis, Red Hat, SUSE, VMware and Wind River. A large percentage of VIM deployments are based on OpenStack due to the simplicity in handling and operating various projects targeted toward providing full potential storage, compute and networking for NFV.

    With last two releases (3 & 4), OSM has evolved to support integration for cloud-native approach by enabling CI/CD frameworks into orchestration layers. Cloud readiness involvement of OSM is the key benefit along with OpenStack, which has proven architecture for private as well as public clouds. OSM deployment into NFV infrastructure has become very lean, where one can start with importing docker containers into production. On the other hand, OpenStack is known for enabling simplicity to manage virtualized and containerized infrastructure. Organizations can realize the full benefits out of integration as NFV MANO using OSM and OpenStack due to lean and simple management and deployment.

    Conclusion

    Since the introduction of NFV and SDN, telecom service providers and vendors were evaluating the use case offered for telecom networks, and due to this application of both, were in under maturity stage. Service providers and vendors were concerned about dynamic orchestration and automation of infrastructure deployment and constantly upgrading virtual network functions (VNFs). But due to contribution by open source communities such as OpenStack and Open Source MANO (OSM), they are now at the stage to apply cloud-native principles to 5G network implementation and operations. Furthermore, with contributions by communities to OpenStack and OSM projects, we will see more enhancement to 5G network enhancement technologies including network slicing, mobile edge computing (MEC) and cloud radio access network (cRAN), which will benefit emerging technologies including IoT, AI/machine learning, real-time analytics, augmented reality (AR) and virtual reality (VR) with low latency and high-bandwidth features.

    — Sagar Nangare

  • How DevOps Can Create Smarter, More Agile 5G Telecom Networks

    How DevOps Can Create Smarter, More Agile 5G Telecom Networks

    There is no doubt DevOps revolutionized software development with its introduction of lean and agile techniques. By applying continuous deployment and continuous integration methodologies into software development, enterprises can build, test and deploy applications and release new services more rapidly. In this article, we will see how the DevOps approach is being utilized in 5G telecom networks with the rise of software-defined systems.

    Emergence of Software in Legacy Telecom Networks

    In last few decades software has changed our lives in myriad ways—mostly for the better. Now, software is starting to disrupt the telecommunication industry with the eagerly anticipated 5th generation of telecom network, also known as 5G. It is expected to provide low latency and high bandwidth network connections to serve use cases including artificial intelligence, smart city, 3D video, industry automation and self-driving cars, and to provide end-to-end real-time experiences such as virtual reality and augmented reality. A variety of these use cases have different network requirements and dependencies, and 5G is expected to provide such flexibility along with agility.

    Software-defined networking (SDN) and network functions virtualization (NFV) form the backbone of the upcoming 5G network, enabling service providers to deliver lucrative services to their customers and realize a competitive advantage. SDN makes the network programmable and centrally controlled, while NFV replaces dedicated network appliances with software packaged in virtual machines on top of high-performance servers. SDN and NFV enables:

    • Better control over overall network.
    • Reduction of manual network configuration processes.
    • Lower CAPEX.
    • Network resiliency.
    • Orchestrate network dynamically.
    • Faster time to market, i.e. faster introduction of new services and features to customers.

    Application of SDN and NFV technologies in 5G telecom networks indicates the use of software in the legacy telecom network, wherein many network functions including firewall, content delivery network (CDN), network address translation (NAT), routers, deep packet inspection (DPI) and broadband remote access server (BRAS) can be virtualized and serve as virtual network functions (VNFs) in NFV architecture. This stands as the core feature of upcoming 5G networks, as most of hardware-dependent operations will be performed by software, providing higher performance with tons of benefits to end users.

    Cloud-Native Enables DevOps

    Virtual network functions (VNFs) are the software representation of network function appliances in NFV environment and a core element in 5G networks. Services can be provided by chaining different VNFs developed by different vendors. There are complexities associated with having multivendor VNFs, as each VNF has its own performance and operational issues including manual integration in NFV infrastructure, utilization of NFV hardware resources, lack of interoperability and multitenancy. For a 5G network to deploy successfully, each VNF must be configured and managed in automated way.

    As software becomes part of telecom network, the term “cloud native” becomes part of the vernacular for VNFs.

    By harnessing a cloud-native approach—including containerization, microservices-based architecture and dynamic orchestration—VNFs with their own life cycle enable:

    • Decomposition of sub processes into microservices—resources required will be automatically scaled and communicated with other services using APIs.
    • Management and simplified orchestration of VNFs.
    • Deployment within containers and connected by APIs.
    • Orchestration by container scheduler—manages provision into service and lifecycle management.
    • Portability to different NFV environments.

    More importantly, a cloud-native approach allows VNF vendors and service providers to impose DevOps (continuous deployment and integration) methods to automate process of building, validating and deploying VNFs into NFV environments.

    A DevOps approach in 5G networks brings benefits for overall network operations, enabling deployment automation and management of service chains and 5G network slices. Complete automation is required, especially for 5G network operations, which may increase operational efficiency and decrease human error, saving OPEX and decreasing expensive downtime.

    For 5G networks, requirement of DevOps methods in VNF can be for:

    • Automated onboarding and deployment of VNFs in NFV environment.
    • Automated performance testing and benchmarking for VNFs.
    • Enabling self-scaling of VNFs—automated resource provisioning for VNFs.
    • Rnabling self-healing after an error in VNFs residing in VMs or containers.
    • Real-time monitoring of VNF activities for analysis.

    More ‘Intelligent’ Network

    Cloud-native capabilities and a DevOps approach opens the possibility of incorporating artificial intelligence in 5G telecom network operations analysis and real-time monitoring. Cisco Systems has already introduced its solution based on machine learning, which it calls Intent Based Networking. We can imagine a network operation having “zero touch” feature by just providing an intent to complete network for any configuration or specific network-based instruction. The collected analysis data can be used in the management and organization of NFV for corrections of network errors, adjustments in VNF and NFV elements configuration and self-healing/scaling of network functions.

    Summary

    Development of 5G network is still in process. By taking into account a revolution in SDN, NFV, cloud native and DevOps, it is expected that we will have 5G networks by some of leading players Verizon, AT&T, Telefonica and Vodafone reasonably soon.

    — Sagar Nangare