devopsy.kinsta.cloud

Author: Tony Bradley

Chef Has Potential Game-Changer with Habitat

Chef is an established leader in the DevOps world. Automation is a keystone of DevOps tools and processes, and Chef’s platform simplifies and streamlines automation. Chef is branching out, though, with the recent unveiling of Habitat—an open-source project to automate the applications themselves.

As companies continue to embrace DevOps and developers continue to create custom applications, it is becoming increasingly difficult to manage it all. Many organizations have infrastructures that span on-premises and cloud—some using multiple cloud platforms—and the applications have to be crafted for the specific infrastructure or platform they’re designed to run on. Habitat seeks to change that. It ostensibly allows developers to focus on the features and capabilities of the app rather than the unique constraints of a specific infrastructure or particular runtime environment.

“We must free the application from its dependency on infrastructure to truly achieve the promise of DevOps,” said Adam Jacob, co-founder and CTO of Chef. “There is so much open-source software to be written in the world and we’re very excited to release Habitat into the wild. We believe application-centric automation can give modern development teams what they really want—to build new apps, not muck around in the plumbing.”

A blog post from Chef describes the premise of Habitat:

Applications packaged with Habitat have the intelligence to self-organize and self-configure. Habitat allows the application to both be portable across independent infrastructure environments and have the intelligence to select the infrastructure features that benefit that application. This makes it easy to run applications across increasingly diverse environments such as containers, PaaS, cloud infrastructure, and on-premise data centers, while also accelerating hybrid cloud environments.

It sounds promising to Michael Glenney, solutions architect at New Context. Glenney said Habitat—if it lives up to what Chef has promised—may represent a paradigm shift in how applications are managed in a data center where configuration management (CM) is prevalent.

“Traditionally, you would use CM (Chef, Puppet, Salt, etc.) to not only lay down the bits an application needs to run, but to manage, redeploy, reconfigure and upgrade that application as well,” explained Glenney. “This type of work is not particularly well-suited for a CM and it mixes workloads unnecessarily. For example, an application deployment could fail because you have some data incorrect concerning log rotation on the host system. This is a manufactured relationship that needs to end.”

Glenney noted that with features such as application-to-container conversion, universal package management, audit and traceability of both buildtime and runtime application dependencies, and advanced management and deployment functionality, Habitat is an exciting addition to the world of DevOps and lean security.

Habitat combines the automation, configuration and management of an application into a single package. “When used in combination with CM it will deliver an unprecedented level of control over applications in all of your company’s environments and provide what I believe has been missing since the beginning,” Glenney said.

Habitat is an open source project under the Apache 2.0 license and is available for immediate download. Check it out and let us know what you think of it.

June 30, 2016
Wake Wants to Help Streamline Your Collaboration

Effective collaboration is imperative to DevOps success. DevOps has many moving pieces working simultaneously and things happen fast, making it crucial that teams and individuals have an easy way to communicate and keep everyone on the same page. Wake is a collaboration tool that may help you do just that.

“Collaboration across the enterprise is critical for DevOps success,” I wrote recently in an article on the importance of effective collaboration. “Great code and development needs to make it over the finish line to production to benefit customers. The challenge organizations face is how to do that seamlessly and with as much speed and automation as possible without sacrificing quality or performance.”

“Just as open source is associated with cost savings and flexibility, DevOps is associated with speed and responsiveness,” stresses Jay Lyman, enterprise software analyst for 451 Research. “Enterprises are increasingly interested in initiating or growing their DevOps thinking and implementations, but they must be aware of the dramatic change it brings not only for technology and tools, but for people and process as well.”

Wake is a collaboration platform used by teams and developers at Facebook, Instacart, Zendesk and other organizations to communicate effectively and share work with others. Wake was created as an internal project at digital agency Bakken & Baeck by Chris Kalani, a former Facebook designer. Silicon Valley companies Medium and Airbnb loved it and begged to be able to use the product themselves, so it was spun off into its own company. When Wake launched last fall, 350 companies signed up in the first month, including Cisco Systems, OpenTable and Uber.

“Adjacent trends such as cloud computing, DevOps and containers are all speeding up the time it takes to iterate and deploy software and the movement of applications and workloads from test and dev to production, but the reality for enterprises is they cannot simply start fresh with a DevOps approach,” Lyman says. “Existing infrastructure, applications, people and process must be considered and integrated so that the transition to DevOps is not only less painful, but more realistic as well.”

Wake ostensibly helps facilitate the increased speed and agility by simplifying communication and collaboration. It has a bit of a Pinterest look and feel to it, but Wake makes it easy to share your progress on what you’re working on without leaving the application you’re working in. It connects with messaging systems such as Slack and HipChat, and you can find what you’re looking for quickly by searching for specific people or tags.

A Wake spokesperson tells me that Wake will soon launch significant updates to its enterprise product as it builds momentum with bigger brands including Capital One, Netflix and Mozilla. You can check out some use cases of Wake at Instacart, GoPro, Intercom, OpenTable and other places in this post on Medium.

Pricing starts at $125 per month for five contributors and 10 spectators. There is a Plus subscription for $350 per month that includes 15 contributors and 30 spectators. Beyond that, pricing is negotiated for larger organizations. You can try Wake for free for 30 days.

June 24, 2016
Black Duck Targets Open Source Code Security Flaws

Open source platforms and projects offer a wide variety of benefits for organizations and developers, but they also can introduce vulnerabilities if you’re not careful. That’s why Black Duck has released Security Checker, a free tool based on its Hub open source security tool to help you identify those vulnerabilities so your applications will be secure.

One of the advantages of open source is also a potential concern. Open source software has benefits from community cooperation and collaboration. More eyes and more hands contributing to the development allow for faster evolution and greater innovation. However, when all of the code is available to the public, and any developer can add or change the code, it also is an opportunity to introduce problems.

While theoretically it is possible for a malicious developer to intentionally add vulnerabilities or exploits, the collaborative nature of open source projects actually makes it less likely. Any obvious attempt to insert malicious code would be detected and thwarted by other developers. The communal nature of open source development is not infallible, though, as evidenced by recent major revelations such as Heartbleed.

Open source projects that are active and properly maintained address these issues fairly quickly. The problem, however, is that organizations and developers need to be able to easily determine whether their existing applications are affected and apply the appropriate patches and updates. There also are many open source tools that are not being actively developed or supported, which means known vulnerabilities may be left unfixed.

Security Checker from Black Duck can help minimize exposure to these risks and give organizations and developers an opportunity to address any known issues. The tool is a drag-and-drop solution that allows you to scan code contained in an uploaded archive file, such as a .tar or .zip file, or in a Docker image. Security Checker then generates a report that shows identified vulnerabilities and security issues.

A recent report from Black Duck found that 67 percent of audited applications contain known open source security vulnerabilities. More than a third of the vulnerabilities identified were classified as “severe.” The most notable finding, however, is that 10 percent of the applications surveyed still contain the Heartbleed vulnerability, which was discovered in April 2014.

“Applications represent the greatest level of risk on the security threat landscape, and we expect that Security Checker scan results will provide an ‘a ha moment’ for many open source users,” said Black Duck CEO Lou Shipley in a press release statement. “Their findings will focus attention on the need to regularly review application code to ensure it’s free of known open source vulnerabilities.”

The process of scanning and generating the report takes about 15 minutes, according to Black Duck, which also noted the maximum file size Security Checker can scan is 100MB.

June 6, 2016
Open Source Is the Secret Sauce of DevOps

DevOps is a relatively recent phenomenon—especially compared to the world of open source. While DevOps and open source are two entirely separate things, though, the reality is that it’s difficult to separate the two at this point. Many open source projects rely on DevOps tools and principles, and DevOps depends heavily on open source applications as both the glue that binds it all together and the engine that keeps everything moving. A new report from devopsy.kinsta.cloud, “DevOps and Open Source,” digs in to understand the symbiotic relationship driving the next generation of IT.

“DevOps and Open Source” examines the role of open source in DevOps, whether DevOps can succeed without open source, the unique challenges of leveraging open source tools, and the benefits of open source partnerships with large corporations such as Microsoft and IBM. The report also includes a list of some of the most widely used open source tools for DevOps, including Chef, Puppet and Docker.

Leveraging open source tools gives organizations and developers much more flexibility and control. Because the underlying code is available, it provides an opportunity to customize it to fit unique scenarios or to create the necessary APIs to integrate the open source software with other tools. The fact that there is no single vendor that “owns” the software also means that organizations and developers can build on open source tools with the confidence that the apps will not arbitrarily disappear one day.

You can definitely develop or use open source applications without embracing DevOps, but is it possible to do DevOps effectively without using open source? “Maybe,” says Randy Kilmon, vice president of Engineering at Black Duck. “But who would want to do it that way? With so many great open source tools and components out there, deliberately shunning them would be a mistake. Besides, there is a piece of open source somewhere in your stack, whether you know it or not.”

That statement seems to be more true with each passing day. The growing momentum of DevOps and the mainstream acceptance of open source software form a powerful partnership that is transforming how applications are developed, deployed, monitored and maintained.

“Organizations want to advance their technology practices and stay ahead in very competitive industries, and do so in a mindful way,” explains Jose Miguel Parrella, senior product marketing manager of Cloud Platform Marketing for Microsoft, in the report. “DevOps can help reconcile the organizational needs, add value to the business, streamline the IT value delivery process and leverage open source innovation.”

The report sums up with this: “The simple fact is that the fundamental concept of DevOps—the culture shift organizations embrace to change how teams cooperate and collaborate so that projects can be delivered more effectively and efficiently—more or less requires a dependence on open source tools. A DevOps environment is too fluid and evolving to sit idly, waiting for a commercial vendor to develop a product with just the right set of features and capabilities.”

The report is available for download here.

June 1, 2016
Understand Why You’re Doing DevOps

DevOps has been all the rage for a few years now. It has quickly matured from a fringe concept to a mainstream imperative, and organizations that haven’t already embraced DevOps are scrambling to understand and implement it to keep up with rivals and remain competitive. Despite its benefits, though, DevOps may not be for everyone. Before diving into the DevOps deep end, you first should consider what your objectives are.

To frame the issue more precisely, it’s not that organizations necessarily should avoid DevOps altogether. It’s just important to go into it with your eyes wide open and to understand why some DevOps projects fail. According to Andrew Storms, VP of Security Services at New Context, it’s always for one of four reasons: cultural roadblocks, failure to identify and take action on mistakes as you go, failure to learn from past mistakes and most importantly, failure to include security—either early on or at all.

Let’s break down those four hurdles.

Face Cultural Roadblocks

DevOps is different things to different organizations, or even to different teams within an organization. There are many definitions of what DevOps is or is not. There is a fairly unanimous consensus, though, that DevOps is first and foremost a function of culture.

Cultural roadblocks, Storms said, are by far the most common reason he sees DevOps fail. “It’s rarely a technical tools problem; usually there’s a disconnect between the DevOps team and executives or other parts of the organization. A concerted effort must be made to get everyone in the organization on the same page. Everyone is fighting for the same thing, but too often, they don’t realize it.”

Fix Mistakes

One of the outcomes of the DevOps culture shift is a fundamental change in corporate bureaucracy and the rigid processes that segregate teams and impede progress. DevOps enables organizations to work more seamlessly and produce results more quickly. It also allows issues and mistakes to be identified and resolved on the fly. “Smaller incremental changes are always easier to handle than a large monster of a release, which can include hundreds of changes,” explained Storms. “For example, teams should look for the single change in a monthly release that resulted in an unexpected security hole, instead of thinking they’ll tackle all changes with a huge release down the road.”

Learn from the Past

One of the most important things for business in general to help them understand is learning from past mistakes. With DevOps, it’s crucial. Organizations often only conduct investigations and postmortem analyses in the event of an issue or catastrophic failure. In that situation, the teams and individuals involved are immediately on the defensive and likely to go into “CYA” mode.

To effectively understand and learn from the past the discussion has to be neutral and without blame or consequence. It’s a difficult concept for organizations to grasp. The key to blameless meetings is to conduct them as a regular occurrence rather than a response to a negative situation, and to foster a culture where failure is acceptable as long as it is used as a learning experience.

Storms also suggests changing the name to “After Action Reports” to remove the negative stigma. “Postmortem implies a dead body. After Actions Reports are imperative after any event regardless of the type of outcome.”

Start with Security

Security is an Achilles heel of development in general, but the rapid pace of development in a DevOps environment makes it even more critical that security be integrated from the beginning. Failing to consider security is a disaster waiting to happen.

Those responsible for security often don’t even know about a project until after it’s already in production. Storms cautions organizations, “Untested and unreviewed code or designs in production represent both a large security risk, but also a risk to the business and your customers. Security needs to be part of the SDLC (software development life cycle) and DevOps from day one.”

DevOps is not a silver bullet. Nothing is. There are a variety of unique advantages and benefits that come from successfully embracing DevOps, but to realize them you need to start with a clear understanding of your own objectives, and how DevOps can be leveraged to help you achieve them.

May 18, 2016
Scaling Collaboration in DevOps

Those familiar with DevOps generally agree that it is equally as much about culture as it is about technology. There are certainly tools and practices involved in the effective implementation of DevOps, but the foundation of DevOps success is how well teams and individuals collaborate across the enterprise to get things done more rapidly, efficiently and effectively.

Most DevOps platforms and tools are designed with scalability in mind. DevOps environments often run in the cloud and tend to be volatile. It’s important for the software that supports DevOps to be able to scale in real time to address spikes and lulls in demand. The same thing is true for the human element as well, but scaling collaboration is a whole different story.

Collaboration across the enterprise is critical for DevOps success. Great code and development needs to make it over the finish line to production to benefit customers. The challenge organizations face is how to do that seamlessly and with as much speed and automation as possible without sacrificing quality or performance. How can businesses streamline code development and deployment, while maintaining visibility, governance and compliance?

Emerging Trends

First, I want to provide some background and share some data gathered by 451 Research on DevOps and DevOps adoption in general. Cloud, agile and DevOps capabilities are important for organizations today—both in perception and reality. 451 sees enterprise adoption of these things, as well as container technologies, growing—including increased usage in production environments.

There are a number of advantages to embracing these technologies and methodologies, such as increased flexibility and speed, reduction of costs, improvements in resilience and reliability, and fitness for new or emerging applications. According to 451 Research, organizations also face some barriers including a lack of familiarity and required skills internally, the immaturity of these emerging technologies, and cost and security concerns.

In the “Voice of the Enterprise: SDI Q4 2015 survey,” 451 Research found that more than half of the respondents (51.7 percent) consider themselves to be late adopters, or even the last adopters of new technology. The flip side of that is that almost half (48.3 percent) label themselves as first or early adopters.

Those general sentiments are reflected in the survey responses to other questions. When asked about implementation of containers, 50.3 percent stated it is not in their plans at all, while the remaining 49.7 percent are in some state of planning, pilot or active use of container technologies. Nearly two-thirds (65.1 percent) indicated that they use agile development methodologies for application development, but only 39.6 percent responded that they’ve embraced DevOps approaches. Nevertheless, while agile software development has been in the industry for years, 451 notes the impressive adoption of containers and DevOps, given they are emergent trends.

When asked what the top three IT pain points are, the leading responses were cost or budget, insufficient staff and legacy software issues. As organizations move to cloud, DevOps, and containers issues such as these will need to be addressed, along with how to scale both technologies and collaboration effectively.

The Current State

The industry—driven in large part by the DevOps revolution—is in the midst of a sea change, where software development is becoming more highly integrated across the entire business. The creation of software is less segregated and is more and more a function of collaboration and socialization.

Concepts and methodologies that were novel or niche just a few years ago have matured quickly to become the mainstream technologies and frameworks that are driving value today. Businesses rely on concepts such as agile, lean, virtualization, cloud, automation and microservices to streamline development and enable them to work more effectively and efficiently at the same time.

To adapt and evolve, enterprises need to accomplish a number of key tasks. The challenge companies face today is how to accelerate development while reducing costs. Organizations need to eliminate the barriers that exist between IT and the rest of the business, and work cooperatively toward a strategy that provides more effectiveness in a technology-driven, competitive environment.

Agile, cloud, DevOps and containers all play a role in that process, but the one thing that binds it all is effective collaboration. Each of these technologies and methodologies provides unique benefits, but the real value comes from the organization as a whole—and the tools and platforms used by the organization—being able to collaborate at scale. Successful DevOps implementations also require participation from other stakeholders beyond development and IT operations teams, including security, database, storage and line-of-business teams.

Collaboration-as-a-Platform

There are services and platforms online—such as GitHub—that facilitate and streamline collaboration. The online platform functions as a code repository, but the value extends beyond just providing a place to store code.

Such a collaboration platform helps developers and teams collaborate more effectively because it provides a community where the code and process can be shared and discussed. Managers can monitor progress and track what code is shipping next. Developers can experiment with new ideas in a safe environment before taking those experiments to a live production environment, and new ideas and experiments can be effectively communicated to the appropriate teams.

One of the keys to more agile development and DevOps is to allow developers to test things and gather relevant feedback quickly. The goal is to produce quality code and features faster, not to waste time setting up and managing infrastructure or scheduling more meetings to talk about it. The GitHub platform, for example, enables more effective and scalable collaboration because code review can occur when it is most convenient for the participants. There is no need to try and coordinate and schedule code review meetings, so the developers can continue to work uninterrupted, resulting in greater productivity and job satisfaction.

Steven Anderson of Sendachi noted that GitHub is a collaboration platform, but it’s also a place for your tools to work with you, too. This means it can help not only with collaboration and continuous integration, but also with code quality.

One of the benefits of a collaboration platform is that large teams of developers can be broken down into smaller teams that can focus more efficiently on specific components. It also allows things such as document sharing alongside code development to blur the lines between technical and non-technical contributions and enable increased collaboration and visibility.

Collaboration is Key

The importance of collaboration can’t be stressed enough. It is a key tenet of DevOps culture, and it’s vital to agile development and maintaining a competitive edge in today’s world. Executive or management support and internal evangelism are important. Organizations also need to embrace the culture shift—blending skills across functional areas toward a common goal.

With that culture established, though, effective collaboration is crucial. A collaboration platform is an essential element of collaborating at scale because it streamlines productivity and reduces redundancy and effort, and yields higher quality results at the same time.

May 16, 2016
Zero Trust Is a Key to DevOps Security

Once upon a time, network and endpoint security was a simple matter of us vs. them—and all you had to do is keep unauthorized stuff outside your perimeter from gaining access to devices or data inside your perimeter. It’s not like that anymore, though. BYOD, mobile devices, cloud service, virtual systems and changes in attack techniques combine to create a scenario where it’s virtually impossible to assure security with any degree of confidence. At this point, it’s almost better to assume you’re compromised, and work from there to minimize the potential impact—especially when it comes to DevOps security.

Consider the fact that threats such as Stuxnet and Duqu were found to have been circulating in the wild for years before they were discovered. According to one recent study, it takes organizations an average of 256 days to discover a malicious compromise—in large part because they’re functioning from the semi-delusional mindset that they’re effectively protecting against such attacks. When you believe that your network is secure, you have no reason to dig deeper and scrutinize activity on the network to detect and identify suspicious activity.

Mitchell Hashimoto, co-founder and CEO of HashiCorp, is an evangelist for the idea of a zero-trust data center. Borrowing a page from the Ronald Reagan national security policy, Hashimoto stresses a strategy of trust but verify. He believes in a security mentality in which all resources are assumed to be compromised—particularly in organizations that have embraced DevOps.

DevOps brings much greater flexibility and agility, but with the more rapid pace of development and deployment also comes increased volatility and potential uncertainty when it comes to maintaining accurate visibility of the assets and data in the environment, and the vulnerabilities you’re exposed to. With the unprecedented scale and automation of modern data centers, the zero-trust model keeps infrastructure secure while still enabling automation.

“As the scale of modern computing continues to increase, our security mindset must change. Automation and DevOps help manage this scale, but introduce more change. With change comes vulnerability,” cautions Hashimoto. “The best way to approach this problem is to assume a zero-trust model. With this mindset, all resources are assumed to be compromised and require specific permissions to connect to other resources in the environment. If the permission policy does not match, the resource gets denied.”

The idea behind this zero-trust approach is to greatly reduce the number of opportunities an attacker might have to gain access, and reduce the scope of potential damage in the event of a successful breach of your network. Applying this concept at scale—in a dynamic DevOps environment—can be more of a challenge. So much changes so quickly that you need to have automated tools capable of managing this process. Attempting to do this with any sort of manual system would be lunacy.

If you still think there is an inside and outside to your network, or that it’s possible to win in a battle of us vs. them, you’ve probably already lost. There is no such thing as impenetrable security, and there is simply too much volatility in any network environment—but especially in a dynamic DevOps environment. Trust but verify. Embrace the idea of a zero-trust data center to improve your security and minimize the potential for attackers to access and compromise your network.

April 21, 2016
Streamlining Cloud Tools, Platforms Management

DevOps and microservices have transformed the way organizations develop, deploy and manage applications—as well as the underlying infrastructure required to support it, be it cloud on on-premise. On the one hand, DevOps and microservices enable much greater speed and agility. On the other hand, that speed and agility come with a heaping side of complexity.

It’s a beautiful thing when all of the elements of DevOps development are working in harmony. The diverse array of tools and platforms utilized, though, often are missing key security features and capabilities IT teams need.

Apcera has a comprehensive portfolio of open source projects that provides customers with the ability to effectively manage and secure applications across various platforms and cloud infrastructures. The Apcera portfolio includes, among other things, NATS, a cloud-native messaging system; Kurma, a flexible container runtime; and Libretto, a virtual machine provisioning library. The company recently announced that it is extending its platform to also support Kubernetes.

“Apcera … allows customers to securely move to any cloud, and deploy, orchestrate and govern the widest range of workloads on any infrastructure—including on-premises,” said Derek Collison, Apcera founder and CEO, in a press release statement. “Customers and developers are rapidly aligning behind Kubernetes as their API of choice when deploying container-based workloads. With its fast-growing ecosystem and strong market momentum, this was the obvious direction for us to take.”

Kubernetes is an open source container orchestration platform, originally created by Google and now managed by the Cloud Native Computing Foundation (CNCF). Kubernetes enables organizations to manage large collections of containers as a single system. Embracing Kubernetes expands Apcera’s sphere of influence to include hybrid cloud management. Apcera also will actively contribute to the Kubernetes open source project.

“We believe delivering trust to the cloud is critical, and Apcera has deep and proven expertise in this area,” said Kelsey Hightower, developer advocate, Google Cloud Platform. “We welcome their support of Kubernetes and future participation in the project.”

Containers in particular have been a major security concern. A blog post from Gartner noted, “Security properties of containers are a largely unexplored field and there is a lot of controversial discussion about whether containers do contain or not. At times it seems that the discussion is driven by (hidden) business agendas, partnerships and financial dependencies rather than by plain technology. So, leaving all of this aside, can you make your containers contain or not?”

A lot of progress has been made in the past year toward more secure container technologies. Hyper-V Containers from Microsoft, Clear Containers from Intel, and recent improvements from CoreOS are all examples of the fact that the container world is aware of—and vigilantly working on addressing—the security problem.

Organizations need to understand how secure their infrastructure is, and be able to answer questions such as, “How can I effectively move into production quickly and with scalability?” Streamlining management of diverse cloud tools and platforms enables IT organizations to balance innovation and speed with safety and stability. Rolling Kubernetes support into the Apcera portfolio may be the key to effectively managing and protecting applications and infrastructure in a hybrid cloud environment.

April 4, 2016
Continuous Testing Improves Speed, Quality

We live in a world that expects immediacy. For a society that gets news updates from Twitter in 140-character increments as it happens while we microwave a complete meal in less than five minutes, anything that takes months—or even weeks or days—seems like an eternity.

When it comes to continuous performance testing, organizations and developers need to keep up with the accelerated pace of development common in a DevOps environment—but without sacrificing the quality of the testing. That’s the real challenge.

Twitter can deliver news virtually in real time, but the quality of the “journalism” is sometimes questionable. It’s possible to microwave a meal in a matter of minutes, but few would argue that the resulting food is actually as good as the same dish prepared the old-fashioned way. When it comes to continuous performance testing, you can’t afford to sacrifice the quality of the testing in the name of expediency.

BlazeMeter thinks it has a way to address that challenge. It recently announced new functionality that allows developers to run tests using Gatling, The Grinder, Locust, Selenium, and JMeter—both locally and in the cloud—in parallel using a single, unified control language.

BlazeMeter referenced statements from Diego Lo Giudice, vice president & principal analyst for Forrester, who noted during a recent webinar the demand for software development speed is pushing teams to look at delivery cycles in terms of weeks, days, hours and even seconds.

The ability to run the tests in parallel shortens the build/test cycles. Developers can add more tests without extending the time involved in the testing cycle. Because all of the tests are run simultaneously, the total time will be only as long as the longest single test in the bunch, no matter how many tests are included in the mix. Running the tests simultaneously allows organizations to achieve greater speed without sacrificing the quality of the testing results.

“Developers that want to excel in the era of continuous delivery need tools that give them the most speed and flexibility possible,” said Andrey Pokhilko, chief scientist at BlazeMeter, in a press release. “We’ve been working with the open source community to develop ideal performance testing tools for any scenario. The new functionality combines the best of our community work with the infrastructure we’ve built up at BlazeMeter, marking a new set of capabilities to bring performance testing to new heights.”

The new BlazeMeter capability also streamlines testing by giving developers a unified control language for managing it all. BlazeMeter developed a “performance-tests-as-code” format that lets developers define tests using common YAML or JSON file formats. Testing teams can create load and performance tests as small fragments using any text editor. The BlazeMeter format enables developers to manage test logic and performance thresholds for various open source tools without needing to be an expert in the separate tools themselves.

A unified solution that allows for simultaneously running multiple test loads in parallel seems like a valuable tool for continuous performance testing. If it works as advertised, it seems BlazeMeter has combined simplicity, speed and quality in one.

April 4, 2016
Protect Your Data with IRMaaS

Anyone who works in information security knows that security is often a treated as a token afterthought. It is the necessary evil that is begrudgingly tacked on with duct tape and chewing gum after a hot new product or technology gains mainstream acceptance. Anyone in information security also knows that security can be done more effectively, at lower cost and with fewer headaches, if it is built into the fabric of the product or technology in the first place. To that end, Vera has unveiled an information rights management (IRM) solution to make it easier for organizations and developers to weave security in from the ground up.

In most cases, security essentially boils down to data security. It’s nice to be able to prevent malware from infecting a laptop or prevent an attacker from compromising your network, but the real goal is to prevent the malware or attacker from gaining access to or exposing sensitive data. The ability to limit and control access to data, track who has accessed the data—including when and where—and monitor where that data goes and how it is used is crucial to providing security.

Vera’s core business is based on the notion of securing data no matter where it goes. Vera’s new product is IRM-as-a-Service (IRMaaS), which uses Vera’s software development kit (SDK) and RESTful APIs to allow developers to directly protect and manage access to data within custom-built applications. The ability to easily integrate IRM into an application and automate as much of it as possible has the potential to make better security accessible to a much larger audience.

“In today’s world, we can no longer afford to treat data security as an add-on or afterthought. Instead, we must establish a security model that can be woven directly into the enterprise software and hardware stack,” said Ajay Arora, CEO and co-founder of Vera, in a press release statement. “We’re building a future where businesses don’t have to worry about where their data travels or who has access. Our team is establishing Vera as the trusted standard for securing and sharing any type of business information. The next step in this journey is to make our IRM platform available as a service to anyone, because this kind of impenetrable and invisible security is key to the success of every business application.”

One of the defining goals of security—at least security that you want people to actually use—is convenience. The negative perception of security is largely a self-perpetuating cycle. Security is often cumbersome and ineffective because it’s tacked on as an afterthought, which leads both developers and users to dislike security and also treat it as an afterthought. Anything that makes it easier for developers to weave security in at an earlier stage and that provides invisible (as much as it can be) security is a definite win-win.

Developers can use the Vera client SDK to include the ability to secure data, set IRM policies and permissions and even revoke access to sensitive data right into custom business applications. Legacy applications can be retrofitted with IRM capabilities using the RESTful APIs in Vera’s cloud platform.

Regardless of its reputation and generally negative perception, effective security is crucial for the long-term success of any application or service. Lowering the bar for implementing effective security—both in terms of cost and complexity—and providing developers with the tools necessary to protect sensitive data is definitely a step in the right direction.

March 31, 2016