devopsy.kinsta.cloud

Category: Continuous Delivery

Continuous delivery is a software engineering discipline that allows organizations to consistently develop and release quality software at a rapid pace. It is achieved by automating the software development lifecycle, enabling tasks such as development, testing and release to occur concurrently and continuously.

  • Dell Brings DevOps to Edge Computing Environments

    Dell Brings DevOps to Edge Computing Environments

    Dell Technologies today updated its edge computing platform this week to make it simpler to programmatically provision infrastructure using DevOps best practices.

    Phil Burt, senior director of project management for edge computing at Dell Technologies, said version 2.0 of Dell NativeEdge adds additional declarative blueprints based on YAML files and the Topology and Orchestration Specification for Cloud Applications (TOSCA) framework.

    Blueprints for Telit, Litmus and PTC for manufacturing use cases, Deep North for retail, Dell Streaming Data Platform for analytics and Rancher Labs K3s for Kubernetes environments are provided.

    Those blueprints make it simpler to either deploy applications on a lightweight operating system that Dell developed optimized for edge computing platforms or any other software stack an IT organization may prefer, he added.

    Dell is also adding support for the virtual Trusted Platform Module (vTPM) and UEFI Secure Boot capabilities to apply zero-trust IT principles to edge computing platforms using hardware-based cryptography and secure storage for encryption keys, certificates and passwords.

    Finally, Dell is also making available a three-year subscription plan for NativeEdge to lower the total cost of deploying edge computing platforms.

    Dell relies on virtual machines it developed for edge computing platforms to deliver software. IT teams can then opt to deploy monolithic applications or container-based applications running on an instance of Kubernetes deployed as an extension of the virtual machine provided by Dell. Those platforms can then also automatically connect to a network to provide the connectivity required.

    Regardless of approach, Dell is providing a method to programmatically orchestrate the management of highly distributed edge computing environments, noted Burt.

    In the longer term, Dell is also researching how to apply generative artificial intelligence (AI) to the management of edge computing environments using the data its monitoring tools provide, he added.

    While edge computing has been around in one form or another for decades, as more organizations start to process and analyze data at the point where it is created and consumed, the number of applications deployed at the network edge has increased substantially. As such, the number of applications that need to be built and deployed at the edge using DevOps best practices is growing exponentially. In fact, managing those workloads is only going to become that much more challenging as more AI models are deployed at the network edge.

    Of course, not every workload at the edge is managed by an IT team. For years, many organizations have relied on operational technology (OT) teams that have historically deployed applications at the network using manual processes. Organizations that embrace DevOps practices to automate the deployment of workloads at the edge will naturally have to navigate some cultural issues alongside the technical challenges encountered when programmatically deploying software.

    It’s not clear how much software will be running at the network edge in the years ahead, but as the capabilities of the IT infrastructure made available continue to increase, so will the complexity of the applications that will be deployed. The challenge, as always, is going to be finding the best way to manage all that distributed software at what will soon be an unprecedented level of scale.

  • What Does Build Quality Look Like in Software Design?

    What Does Build Quality Look Like in Software Design?

    With rapid developments in artificial intelligence (AI), mobile applications and modern software in the last year, the enterprise software market is expected to grow exponentially. Market revenue is projected to reach $292 billion in 2024, and developers are constantly implementing innovative measures into the software development life cycle (SDLC) to ensure a seamless, high-quality creation process. One of the best ways to achieve this is by leveraging modern build health tools to monitor a multi-faceted project’s overall quality and performance.

    Build health tools automate the creation of executable applications from source code and encompass several areas to ensure the stability and health of the software build process. From automated testing to security scanning, developers rely on these tools and processes when defining a modern approach to software development. Before diving into the intricacies of build health quality, it is necessary to grasp the complete significance of the SDLC when attaining the final product in a global marketplace.

    The Significance of the SDLC

    The SDLC is the process in which developers plan, write, modify and maintain software. This methodology applies to software developed for computers, mobile phone applications, video games and other systems. Adhering to this process allows developers to reach the optimal outcome for the final product. The life cycle includes everything from the planning and brainstorming stage to setting up maintenance and operations after the product has launched. It ensures success by providing a more structured approach to building and developing software. This becomes increasingly important as the software market’s value continues to rise.

    Since 2020, the demand for software engineers has doubled. Because it’s essential for business leaders and developers to keep up with the latest trends and innovations, the need for software knowledge will continue to grow exponentially. Currently, software is typically delivered in one of two ways:

    • On-premises. End users install and run the software themselves on the desired device. This serves as a more secure delivery method for highly-regulated industries.
    • Software-as-a-service (SaaS). This cloud-based method allows end users to access the software online rather than through a traditional download/upload. This enables providers to offer a subscription-based/pay-as-you-go structure for users. The provider is responsible for the hosting and maintenance.

    Developers rely heavily on build health tools to ensure a smoothly running life cycle. Build health tools play a huge role in determining a seamless development process.

    The Role of Build Health Tools in Modern Software Development

    Build health tools essentially fill the gaps in the development process and enhance the software build quality. These tools deliver automated testing methods by creating multiple testing scenarios to ensure full functionality. They help developers see the different data points necessary for garnering a 360-degree view of the software and its status.

    The tools also impact resource utilization and response times. Using key performance indicators (KPIs), they monitor the build quality while enhancing build production to ensure it is better than what was previously developed. In that way, it is constantly growing and improving to guarantee the project reaches a smooth and seamless completion for the developer. From there, the tools can create multiple datasets in less time, which significantly reduces overall software development time.

    Common Challenges of Build Health Tools in Software Design Projects

    There are several challenges with using build health tools. The most common obstacle is that automated tools and testing lack the human touch that comes from developers and their manual work. Although build health tools can perform simultaneous tasks quicker than a more manual approach, they overlook the full spectrum of available resources to improve the build. These tools are so focused on functionality that they fail to incorporate the prior research and available resources that often serve as key building blocks for a successful development project. For this reason, it is important to have developers working in conjunction with build health tools to provide a balance between manual and automated software testing.

    Developers can leverage build health tools to seek out the KPIs that determine the software’s quality at a given stage of the SDLC, from initial development and quality assurance (QA) to the final phases of staging and production. Some of these KPIs include:

    • Exceptions. Make sure there are no new exceptions from the previous build versus the production stage.
    • Test coverage. Ensure that adequate testing is performed on the current build by defining what application programming interfaces (APIs) need to be included for certification, along with the number of executions required.
    • Automated data validation. Make sure data is accurate and useful while remaining enforceable by the designated standards.
    • API testing. Test the overall interface for smooth performance with trustworthy data to advance the program/project. It is also important to compare performances during different SDLC stages to confirm the status of the API, dependency, database, and functionality.
    • Memory/CPU usage. Measure the overall usage of the central processing unit (CPU) and its memory to ensure stability and efficiency.
    • Requests per minute. Evaluate the rate at which the software can receive and execute certain requests delivered by the end user to ensure optimal efficiency.
    • SQL coding standards. Enforce standards and limitations for the overall coding within the interface by measuring quality, security, efficiency, and sustainability.

    While these are only a few of the KPIs detectable with the aid of build health tools, it is essential to note how these tools can benefit a successful software release. Developers can compare the differences between current and prior builds throughout the SDLC to fully gauge any changes, developments, improvements, or downgrades during production to a successful launch.

    Current Events and the Future of Build Health Quality for Developers

    There are many examples of current organizations effectively leveraging available build health tools for project success. Software developers will continue to adopt new and innovative methods using AI and automation capabilities to ensure more efficient testing and higher build quality.

    The future is bright for contemporary software engineering. As unexpected as the AI boom of 2023 was for the tech world, the future of modern software development may hold even more surprising developments. Build health tools are expanding and perfecting the creation process for enterprises and developers worldwide. As build quality improves on the back end, the customer experience for global industries will improve on the front end. The potential for software enhancements and innovations in this way is what makes the journey exciting.

  • Why DevOps is Key to Software Supply Chain Security

    Why DevOps is Key to Software Supply Chain Security

    DevOps is designed to increase business value and responsiveness through rapid, high-quality service delivery, made possible through fast-paced, iterative IT service delivery. The term DevSecOps emerged as a way to remind us that security was always intended to be part of the software delivery process. However, with the barrage of attacks on the software supply chain showing no signs of abating, the question now is whether even the tightest DevOps pipelines can maintain the pace-protection balance.

    It’s important to note that the term “software supply chain” has been used primarily to refer to the tools and processes used to build and deploy software applications. Now, however, with the rise of infrastructure-as-code (IaC), the term also refers to tools and processes used to build and deploy IT infrastructure.

    Meet Mandates, Reduce Risk

    Software supply chain attacks such as SUNBURST, HTTP/2 Rapid Reset or the breaches associated with the MOVEit vulnerability have fed news cycles for the last few years, and that likely won’t change anytime soon. Attacks on the software supply chain increased 742% since 2020. What we are seeing as a result are new concerns about supply chain security and DevOps requirements. This has led to confusion and often a mish-mash of tooling that may exacerbate rather than mitigate supply chain security issues.

    Arguably the most impactful salvo over the software supply chain security line was president Biden’s 2021 Executive Order 14028, which established new mandates, including the delivery of SBOMs, as minimum requirements for software used by the U.S. federal government. More recently, the FDA has mandated that “all medical devices running software must create and maintain” SBOMs. I expect to see government and industry requirements increase over time.

    These are just a couple of relatively recent examples. There are many more—and no doubt many more to come.

    So, if you’re moving at the speed of DevOps, how do you address these current and future mandates for software supply chain security, as well as the continually emerging vulnerabilities and attacks? I would venture to say that only by moving at the speed of DevOps—and within the parameters of the DevOps model—can organizations not only meet mandates but also effectively reduce risk for the business.

    Indeed, it’s not a matter of whether DevOps is viable within the current security climate but what requirements need to be added to support and enhance current DevOps work.

    New Guidelines, New Processes, New Tools and New Data

    In response to these new threats and regulations, the software community has been working on developing and updating guidelines to help organizations improve the security of their supply chains—for example, SLSA, NCSC UK supply chain security guidance and NIST cybersecurity supply chain risk management. However, these new guidelines can be complicated and require new processes and new tools.

    Before adding any new tooling or changing any processes, it’s critical to examine existing tools to determine whether and to what extent they satisfy supply chain security mandates. Organizations must also evaluate how well existing processes work to protect the business, then strategically add/subtract from there as needed.

    No matter what solutions are leveraged, more and different tools generate reams of more and different data. What’s important — and to whom? How do I manage the data? When can I trust it? Where do I store it? What problems does the new data help me solve? Organizations will need a way to effectively sift this information and deliver the right data to the right teams at the right time. To preserve the ability to quickly and continuously innovate, it will be important to focus on shifting security left as well as integrating automation whenever and wherever possible.

    As new security metadata becomes available, such as from SBOMs, new solutions for managing that metadata will be key. An open source initiative sponsored by Google, GUAC is designed to integrate software security information, including SBOMs, attestations and vulnerability data. Users can query the resulting GUAC graph to help answer key security concerns, including proactive, preventive and reactive concerns.

    Continue to Shift Security Left

    Another way that organizations can maintain their DevOps momentum while protecting the software supply chain is to continue to invest in shifting security left in the software supply chain. The software community has been talking about this for some time, but many organizations struggle to implement impactful changes. Security teams must work to understand how software is built and collaborate with development and DevOps teams to ensure that improvements are made to both application and infrastructure-as-code supply chains.

    We need to go beyond shift-left vulnerability analysis to ensure that we are evaluating the quality of configuration-as-code (for both applications and infrastructure), that we are taking advantage of new recommendations, and that we are leveraging new attestation solutions designed to work with pipelines such as sigstore and Tekton Chains. After all, the sooner an issue is discovered, the more quickly it can be addressed and the less disruptive and costly it is to fix it.

    No One-Size-Fits-All Solution

    While all of these solutions mentioned here are helpful, there is no single product or framework that will enable organizations to maintain the security-innovation balance. Success, rather, will require a focus on agility, flexibility and effective communication and collaboration—the very hallmarks of the DevOps model.

    Rather than being obviated by the demands of software supply chain security, DevOps provides the opportunity to integrate the kinds of protections that can prevent or mitigate supply chain vulnerabilities and breaches. DevOps also enables organizations to quickly and effectively respond to new threats and new requirements.

    With that said, there’s no doubt that organizations will need to think differently about how they manage software security, including the strategic evaluation and integration of tools that will meet current and future regulatory mandates and, more importantly, protect the business over time. Organizations may also need to think about weighing security over speed, at least until all of the pieces of the software supply chain protection puzzle are in place—but also when future circumstances warrant a fresh look at how to best balance the DevOps pace-protection balance.

  • Skillsoft Taps ChatGPT to Improve Developer Training

    Skillsoft Taps ChatGPT to Improve Developer Training

    Skillsoft today revealed it plans to add generative artificial intelligence (AI) capabilities to its Codecademy online training platform to provide developers with hands-on experience using ChatGPT to write code.

    Kunal Ahuja, general manager for Codecademy consumer business at Skillsoft, said the goal is to give developers a more curated path toward teaching them how to define prompts that will result in better code being generated. These enhancements will be made available to Codecademy Plus and Pro users as well as enterprise customers in the coming months, he noted.

    There’s no doubt that developers are relying more on generative AI to write code, but not all the output generated by platforms that are based on a general-purpose large language model (LLM) is going to be consistent. Codecademy provides a more immersive experience that enables developers to refine their prompt engineering expertise, said Ahuja.

    AI-enabled capabilities include code explanations and project hints to improve debugging skills, along with other real-time feedback surfaced via a virtual coding assistant. There are also courses such as “Prompt Engineering for Software Engineers” available.

    Finally, Skillsoft is also providing access to a mock interview simulator that developers can access to help determine if they are ready for a job interview.

    As it becomes more apparent that prompt engineering is a skill application development teams will need to master to build and deploy software, there’s a clear need to teach nearly everyone in IT how to craft prompts efficiently. Ultimately, the number of prompts used to generate code will have an impact on the total cost of building software.

    In the longer term, Skillsoft plans to build its own LLM using data it collects via its platform to provide training using an LLM that has been trained using code that has been curated, said Ahuja. One of the issues with a general-purpose LLM is that it is trained using examples of code pulled from across the web that varies widely in quality. That can result in outputs of code that have known vulnerabilities or that simply run inefficiently. Of course, it may be just as likely that a developer augmented by generative AI is, depending on their level of expertise, actually delivering higher-quality code.

    Despite those concerns, however, it’s still important to provide developers with the training they need today to remain competitive, said Ahuja.

    It’s not clear how much code these days is being generated by machines versus humans, but as the volume increases, the number and size of the software builds that need to be managed is only going to increase. Hopefully, as much AI will be applied to the DevOps workflows used to manage those software builds as there is being applied to writing code, but in the short term, at least, DevOps teams might soon find themselves overwhelmed.

    The one thing that is certain is DevOps teams have a vested interest in making sure the code being written by developers is of the highest quality possible. After all, whenever there is an issue with that code, it usually falls to the DevOps team to fix it.

    Image source: https://vecteezy.com/programming-background-with-person-working-with-codes-computer-e1679047506780.jpg

  • Embracing the Future: Navigating the Waves of AI in DevOps

    Embracing the Future: Navigating the Waves of AI in DevOps

    In the rapidly evolving digital landscape, the advent of generative AI and large language models (LLMs) has ushered in a new era of innovation and transformation. As IT organizations pivot toward DevOps, DevSecOps and SRE mastery, leaders find themselves at the crossroads of excitement and anxiety. This dual sentiment stems from the vast potential of AI to revolutionize operations and the inherent challenges that accompany generative AI’s integration. In this article, we’ll explore the reasons behind this excitement and anxiety, outline the top use cases for generative AI and provide strategic guidance to ensure a smooth DevOps and digital transformation journey.

    The Catalysts of Excitement

    1. Enhanced Efficiency and Innovation: Generative AI, with its ability to automate complex processes and generate new ideas, promises unprecedented efficiency. It enables IT organizations to streamline development pipelines, reduce manual errors and foster innovation, making the leap toward DevOps and DevSecOps not just a goal but a tangible reality.
    2. Improved Decision-Making: Large language models offer sophisticated data analysis capabilities, turning vast datasets into actionable insights. This empowers leaders to make informed decisions rapidly, optimizing operations and enhancing service reliability in line with SRE principles.
    3. Competitive Advantage: In the digital age, staying ahead means adopting the latest technologies. Generative AI provides a unique competitive edge, allowing organizations to deliver superior digital experiences, innovate products and services and respond to market changes proactively.

    Top Three Generative AI Use Cases in DevOps

    1. Automated Code and Test Generation and Review: AI-driven tools can generate code and test snippets, conduct code reviews and testing and suggest optimizations, accelerating development cycles and improving code quality.
    2. Security Enhancement: By integrating AI into security protocols, organizations can predict and mitigate potential threats more effectively, enhancing their DevSecOps initiatives with proactive rather than reactive measures.
    3. Incident Management and Resolution: AI can automate incident response workflows, predict outages before they occur and suggest remediations, aligning with SRE goals of maintaining high availability and reliability.

    Sources of Anxiety

    1. Ethical and Privacy Concerns: The potential for misuse of AI technologies, including privacy violations and biased decision-making, raises significant ethical questions, creating apprehension among leaders.
    2. Skill Gaps and Workforce Impact: The shift toward AI-centric operations necessitates new skills and roles. Leaders worry about the existing workforce’s ability to adapt and the challenge of filling emerging skill gaps.
    3. Integration and Compatibility Issues: Integrating AI into legacy systems and ensuring compatibility across the digital infrastructure poses technical challenges, complicating the transition to advanced DevOps and SRE practices.

    Navigating the Digital Transformation Journey

    To harness the benefits of AI while mitigating its risks, leaders should consider the following strategic actions:

    1. Foster an AI-Ready Culture: Cultivate a culture of continuous learning and adaptability. Encourage your team to embrace AI tools and methodologies, emphasizing the importance of upskilling and reskilling.
    2. Implement Ethical AI Guidelines: Develop and adhere to ethical guidelines for AI use, focusing on transparency, accountability and fairness. Ensure privacy and security measures are integral to your AI initiatives.
    3. Invest in Talent and Training: Address skill gaps by investing in training programs and partnerships with educational institutions. Consider hiring AI specialists to bridge the gap between traditional IT roles and AI requirements.
    4. Prioritize Seamless Integration: Adopt a phased approach to AI integration, ensuring compatibility with existing systems. Leverage APIs and microservices architectures to facilitate smoother transitions.
    5. Establish Governance and Oversight: Create a governance framework to oversee AI initiatives, ensuring alignment with organizational goals and compliance with regulatory requirements. This should include monitoring AI performance and its impact on operations and workforce dynamics.

    Summary: Seize the AI Opportunity

    As we stand on the brink of a transformative era, the fusion of AI with DevOps, DevSecOps and SRE practices represents a significant leap forward. While the journey is fraught with challenges, the potential rewards are immense. By embracing AI with strategic foresight, ethical consideration and a commitment to continuous improvement, IT leaders can propel their organizations toward unparalleled efficiency, innovation and competitive advantage.

    In conclusion, the integration of AI into DevOps to further accelerate digital transformation is not just an option but a necessity for staying relevant in the digital age. The journey requires careful navigation, but with the right approach, IT organizations can emerge stronger, more agile and better equipped to face the future. Let’s embrace this opportunity to redefine the digital landscape, ensuring our transformations are not just successful but sustainable and responsible.

    Embrace the future; embrace AI.

  • 6 Transformative Mainframe Predictions for 2024

    6 Transformative Mainframe Predictions for 2024

    The success of organizations in today’s digital economy demands speed — the ability to quickly respond to market trends with new applications and services, instant access to critical data, and resolution of issues even before they affect service. As we move into the new year, the adoption and adaptation of emerging technologies on the mainframe will enable enterprises to embrace changing market forces, turning them into a competitive advantage.

    Below are six predictions of how mainframe organizations will leverage new technologies to advance the platform in 2024.

    Prediction: AI/ML Adoption Grows

    The roles of artificial intelligence (AI) and machine learning (ML) and their adoption across the mainframe, from application development to monitoring to data management, will continue to grow.

    The generative AI revolution is real and here to stay. In the coming year, organizations will continue to explore best-use cases for its integration into mainframe management. Development teams will leverage key AI-recommended insights into automated workflows and code generation, improving developer productivity. Database administrators (DBAs) will look to automate data management processes to efficiently handle the demand for the diverse datasets required by generative AI tools, and mainframe operations teams will increase their reliance on AI-driven predictive analytics and root cause analysis.

    As adoption increases and experience is gained, organizations will work past their AI trust issues and begin to harness the power of automation to become a fully autonomous digital enterprise. At the same time, there will be a growing need to govern AIOps and MLOps to ensure the validity and accuracy of ongoing model development.

    Prediction: DevEx Comes to the Forefront of Companies’ Innovation Strategies

    With the long-awaited shift of mainframe workforces from those with decades of experience to a new generation of stewards now in full effect, organizations will find a new imperative to attract and retain top talent by providing developers with familiar tools and development environments.

    Professionals who have recently graduated from college or are moving from other platforms bring with them an expectation of integrated and automated DevOps practices. The move towards enterprise-wide DevOps and continuous integration and continuous deployment (CI/CD) pipelines will continue, with many companies also looking to employ cross-platform tooling. By giving developers the freedom to use their integrated development environment (IDE) of choice, organizations can decrease onboarding time and get new mainframe developers up to speed faster, enabling them to understand code and its function quickly and easily, and creating a seamless, frictionless way to make changes, debug, and deploy.

    Prediction: Database DevOps Bridges the Gap Between DBAs and Developers

    Changing customer demand and the need for agility will accelerate the drive for developers to seamlessly access and manage data sources. The demand for an agile development environment that extends from applications to databases will increase the inclusion of database DevOps in CI/CD pipelines, including version-controlled database schemas and data, automated database provisioning, and database testing as part of the pipeline.

    By embracing agile practices, such as incremental database changes and rolling deployments, organizations will bridge the gap between DBAs and developers and ensure that mainframe databases evolve alongside application code. This cohesive approach will enhance collaboration, reduce conflicts, and expedite application development, positioning mainframes as agile and adaptable components within the rapidly changing IT landscape.

    Prediction: Democratizing Mainframe Data

    The move ― and the need ― to democratize mainframe data, making it available to AI/ML analytics engines, will gain momentum.

    Organizations have matured their data lakes and gained valuable insights from data housed on distributed and cloud platforms, but the efforts needed to extract and transform mainframe data stored on tape and virtual tape libraries (VTL) has left volumes of business-critical data behind. By operationalizing mainframe integration with the cloud, organizations can make it easier and faster to access mainframe data and transform it into open formats, making it accessible to analytics engines and AI/ML applications.

    The ability to realize the hidden potential of data they already store will make cloud-based storage of mainframe data a prerequisite for enterprises looking to digitally transform their businesses and gain competitive advantage.

    Prediction: Object Storage Becomes Critical for Security

    Mainframe-dependent organizations will seek to integrate hybrid cloud object storage to fortify mainframe data protection against escalating cyberthreats and ransomware attacks.

    In 2024, cyberthreats will almost certainly increase in number and sophistication. The European Union’s Digital Operational Resilience Act (DORA) seeks to ensure that organizations remain vigilant and protect their systems and their customers’ data against increasing threats.

    With DORA set to come into effect in January 2025, and further regulations and guidelines on the horizon, managing mainframe data across diverse locations while prioritizing immutable data copies will be imperative. Organizations will pivot towards proactive strategies, aligning their mainframe infrastructure with hybrid cloud solutions to meet evolving compliance standards and shield against the growing sophistication of cyberthreats.

    Prediction: Innovation Takes the Lead

    Organizations will adopt ruthless prioritization, shifting focus from maintaining services and applications to building new ones for the future.

    Having seen firsthand the success of ongoing mainframe modernization efforts, organizations will place a new focus on building skills and specialties that align with future goals and product roadmaps, putting them in a position to capitalize on coming trends and giving them the ability to quickly respond to changing market forces with innovative new products and services.

    As companies mature their approaches to AI on the mainframe, many will turn to building “applied AI” teams tasked with developing proactive solutions to better analyze data and forecast trends. In short, organizations will think logically about how to embrace AI rather than being embraced by it.

    In 2024, mainframe organizations will accelerate the adoption of emerging technologies like AI and the cloud to increase the adaptability, resilience, and efficiency of the platform while situating it for even greater success in the future. The mainframe will continue to be a platform of innovation, integrating with new technologies and practices borrowed from other platforms to further the evolution of a hybrid IT environment that meets and exceeds the demands of the modern digital economy.

    The role of AI, the impact of data governance regulations, the mainframe skills gap, affordability, and interoperability requirements are all brewing a perfect storm around the mainframe that will mark 2024 as a year of significant transformation that will define the leaders from the laggards.

  • ReversingLabs Applies AI to Better Secure Application Binaries

    ReversingLabs Applies AI to Better Secure Application Binaries

    ReversingLabs this week launched a binary analysis tool that uses machine learning algorithms to identify risks before and after applications are deployed.

    Erik Thoen, vice president of product management for ReversingLabs, said Spectra Assure makes use of the same core artificial intelligence (AI) technologies the company uses to discover malware within binaries to analyze the entire software package, including first-, second- and third-party components, to identify potential threats.

    Thanks to the use of AI, Spectra Assure is able to scan applications that are gigabytes in size in minutes or hours, depending on their complexity, noted Thoen.

    That approach is critical because attacks launched against applications are more often aimed at binaries that are deployed in production applications rather than the source code used to create them, he added.

    In addition, Spectra Assure can be applied to both open source and proprietary software, said Thoen. In contrast, many legacy scanning tools are designed to only surface potential issues in open source software, he noted.

    Spectra Assure is designed to be used by both producers of software and the organizations that deploy software, said Thoen. Organizations that develop software need to be able to identify any security potential issues that may have arisen during the build process, while organizations that consume software need to be assured that there are no issues that will later compromise their IT environments, said Thoen.

    ReversingLabs is attempting to fill a gap that exists in many software supply chains between when a software build is completed and deployed, said Thoen. While developers may scan source code for vulnerabilities, it’s not uncommon for changes to be made during the build process that inadvertently create vulnerabilities, said Thoen.

    It’s still not clear which teams within organizations are assuming responsibility for the software supply chain. In many cases, DevSecOps teams are securing the software supply chain, but in other instances, cybersecurity teams have been tasked to lock them down. Among organizations that consume software, responsibility for application security might be assumed by either the cybersecurity teams or a procurement office responsible for purchasing software.

    Regardless of how software supply chain security is managed, the number of attacks against them has risen sharply. A recent ReversingLabs report found there has been a 1,300% Increase in malicious packages found in open source software platforms since 2020.

    Ultimately, it’s only a matter of time before more stringent regulations force the software supply chain security issue. A recent executive order issued by the Biden administration requiring federal agencies to secure software supply chains is a harbinger of stricter controls that enterprise IT organizations must implement. DevSecOps teams, in the meantime, have an opportunity to revisit the workflows that were created in an era where developers tended to overly trust the integrity of software components downloaded from open repositories.

    Of course, it may require a catastrophic event to truly galvanize organizations into action, but one way or another, application security is going to improve. The only issue remaining to determine is how expensive a proposition that will be given the potential fines that are likely to be one day levied.

  • Software Development in the Age of AI: How to Balance Quality and Speed

    Software Development in the Age of AI: How to Balance Quality and Speed

    There’s no mistaking the reality of AI’s influence. Across industries, businesses are calling on tech workers to make the most of this transformative technology as demand skyrockets and companies race to overcome the competition. A flagging economy only pushes expectations for AI use—in software especially. To contend with arduous workloads, 92% of developers are already using AI code generators, according to GitHub. That’s an overwhelming majority, not to mention that this usage is poised to continue generating steam.

    In light of this, we must ask ourselves a critical question: How can businesses ensure developers retain the quality of their AI-generated code? AI is a useful complement to human developers to maximize their time and allow them to focus on projects best suited to their skill sets. That said, companies have to put safeguards in place to harness the technology, not just for boosting developer productivity but also for quality outputs.

    AI Can’t Replace Human Developers

    AI code generators are a useful tool for a developer’s toolbox. Efficient, easy to use, and helpful (in a fairly rudimentary way in these early AI days), they give developers the ability to outsource some code-writing, which helps alleviate mounting demands as companies expect them to produce massive amounts of code — and fast. As most developers continue to buy into AI for productivity benefits, though, comes the responsibility to gut-check what these AI tools produce.

    There are multiple limitations and risk considerations when it comes to AI-generating code. Lack of source knowledge and context is one of them. AI pulls from what it’s taught (i.e., past data, natural language processing, machine learning), meaning it combines too many sources to trace specific pieces of coding back to one place; it’s impossible to trace the code back to a single developer or project. Security, too, becomes an issue; you can’t guarantee that what is produced is safe or clean as is. And, finally, AI doesn’t check for quality, which increases the likelihood that the code will be difficult and costly to maintain. All this ladders up to the mounting technical debt companies are already contending with.

    Developers can’t assume that any AI-generated code is of quality to be put directly into production. Human workers must review code thoroughly to ensure it meets clean code attributes–secure, reliable and maintainable. Ignoring these tenets puts businesses at risk of falling victim to the trillion-dollar cost of bad software. That said, there are still undeniable benefits to using AI in a coding environment that make it an invaluable tool for any company that wants to stay at the top of their software game.

    Working Responsibly With AI in Software Development

    Despite its potential shortcomings, when used safely and effectively alongside a clean code solution, AI brings a tremendous opportunity to the software space that has already made it a key tool for developers as their workloads and demands mount. For one, AI has the incredible ability to churn out code at a speed that far outpaces its human counterparts. This tech can complete tedious work that may take valuable time out of a developer’s day in a matter of seconds. AI can not only move a project forward at a faster rate, but its quick coding capabilities can also give developers a jump start on their projects and help them figure out where to begin.

    While the source of AI’s knowledge base can present a challenge, the vastness of that knowledge is a benefit. As long as a developer can input their preferred language and their specific needs, AI can share the best approach to solving a problem. Its algorithmic assistance can help lead a developer through parts of their projects step by step. This also alleviates the burden of research from developers, who can spend less time checking for accuracy than they would trying to understand different programming concepts or code snippets outside their area of expertise. AI can also handle the slog of documentation, which can not only bring clarity to what didn’t work during the development process but reduce time to delivery overall.

    Developers who don’t harness AI do so at the risk of falling behind the competition as this tech becomes such a vital piece of everyday work in software. But there’s no mistaking the fact that to best incorporate AI, developers still need to ensure its accuracy before any code generated by AI makes it to production.

    GenAI Requires Automated Tools as Safeguards

    As I previously said, developers can’t assume that any AI-generated code is clean and fit for production. That means human skills are still required to check the output. However, this kind of work can often fall to developers or DevOps, and having human workers check code on their own creates an incredible workload that can even negate the use of AI in the first place.

    The best way for companies to mitigate this and mitigate technical debt is to implement automation in the part of the process that scans and monitors AI-generated code. But that can’t be done without developer buy-in. Those creating the software are the people who will best understand the development process as they work through it day in and day out, so their input is required to make the most out of automation.

    There are developer tools that can handle this kind of work while still including developers in the process. For example, introducing code-scanning into the CI/CD process can not only help continuously monitor AI-generated code for bugs and issues, allowing developers to focus on other more challenging aspects of their projects, but it also gives them insight into errors and allows for speedier resolutions. These tools aren’t necessarily new to development, but their ability to identify bugs can help developers prioritize other aspects of the process, particularly as the amount of code reaches exponential levels compared to decades ago with the introduction of GenAI.

    Static application security testing (SAST) also allows for the identification of security vulnerabilities that can potentially arise from AI-generated code. This is critical in the software development lifecycle (SDLC) so developers can spot vulnerabilities before the code goes into production. AI-generated code is only as strong or secure as that source, and since it’s not entirely possible to verify, developers need to take every precaution available to avoid security issues that rack up costs in the long term.

    The vital part of using these tools is ensuring they’re integrated into the process in a way that makes sense for developers rather than creating additional work and headaches with a cumbersome process that doesn’t fit the way teams think and work. But, the need to check AI-generated code shouldn’t be underestimated. Developers can’t simply trust what they’re given. By including a level of automation within the development process—and doing so early and often—developers are in a position to produce better-quality, more secure software to push a business forward.

    Effective Adoption of AI Will Encourage Business Growth

    While it’s difficult to predict exactly where AI will take us in the years to come, it’s equally undeniable that it will play a critical part in the future of software development. Yes, AI is already helping to streamline processes and letting developers prioritize the tasks that best take advantage of their skills. But, as noted above, that doesn’t mean the code output is entirely safe, secure or accurate. Developers still need a level of automation to deliver code that best takes advantage of AI while keeping their workload manageable and their focus on other parts of the development process.

    With the right guardrails in place, developers can guide AI to create the kind of clean, secure, and reliable code that aids businesses rather than create costly problems for them, both now and down the line. Human skills, with a boost from AI, plus code scanning safeguards, give organizations the winning combination to put themselves in the best possible place to succeed in a rapid, fierce competitive landscape of digital business.