devopsy.kinsta.cloud

Category: DevOps Culture

DevOps: What’s the End Goal?

In high tech, we have a penchant for not actually having an end goal. We have interim goals but no grand “this is what we need to do.” And yet, every space inevitably has a “this is the reason” attached. So what should the overarching goal of DevOps be?

We started out with streamlining processes as the goal, and quickly morphed into efficiency and being more responsive–all worthy goals, but it is the nature of both technologists and business people (for very different reasons) to not stop when the goal is reached. We went through several more iterations that all basically pulled more under the DevOps umbrella, and then settled on automation. AI will continue this automation trend, but to what end?

Where, exactly, do we want to go? Theoretically, we could make AI write the code, build the code, test the code and deploy the code with only a small contingent of actual people involved in the process. Seriously, if the idea is to let business people crank things out a la the promises of 4GLs, then we are closer than we have ever been to achieving that goal.

But, much like calculators, someone will still have to create these systems, and we are faced with a different conundrum: If no one is writing new code, learning-based AI will struggle to solve new problems. That challenge can, in theory, be overcome by teaching AI to disassemble and abstract existing solutions, but that will take time.

The other thing that business people and technologists share in the modern world is a lack of actual philosophers. I am a technologist, but much of my immediate family enjoys philosophy. So, I dug into philosophy with regard to science many years ago, and philosophers, being esoteric, ruined their ability to influence scientific thought. Focusing on questions like, “What if tomorrow, we found aluminum that wasn’t really aluminum?” was dumb and undermined the core idea of “Science will tell us what we can do, philosophy will tell us what we should do.”

So we’re on our own in that regard, and given a worldwide development community, we can assume that just because you can, someone will. Our question then is, “What does a given enterprise want and need from their DevOps processes?” The rate of change is about to accelerate again, so knowing what is important to your organization will matter in the next five years. A company that uses technology in support roles has wildly different needs than one that uses technology to develop products, and they have very different needs than a company for whom technology is the product.

Is the goal to eliminate the bulk of IT? Or is it to streamline IT even further and make it even more responsive to business needs? Perhaps the goal is to develop entirely new products or markets with the time that AI has freed up. The difference is huge in terms of planning. And these are the types of questions coming. The idea that any given technology can make things (or make them happen) faster and more efficiently without changing staffing is naïve and ignores the history of the auto industry.

Get together, IT and business leaders. Develop a plan. Do you want to do more with less, or do you want to reduce overhead? Do you want to have IT specialize while AI does the mass of generic work? Level one help desk can be taken over by chatbots today. Is that the type of direction the organization wants to go? Tell IT management that change is coming; the question is, how the organization wants to leverage it and conscious decision is far better than accidental results.

devopsy.kinsta.cloud · No No-Shift, DevOps Jobs, AI Tests Your Code, DevOps End Goal

February 21, 2024
Five Great DevOps Job Opportunities

devopsy.kinsta.cloud is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

Indeed.com

Autodesk
Portland, Oregon
Principal DevOps Engineer
$141,400 to $228,800

LinkedIn

Zscaler
Remote
Staff DevOps Engineer
$129,000 to $185,000

CareerBuilder.com

Convey Health Solutions
Fort Lauderdale, Florida
Senior DevOps Engineer
$120,000 to $160,000

Dice.com

DISH
Dallas, Texas
Senior DevOps Engineer
$106,250 to $143,750

SimplyHired

Parsons
Summit, West Virginia
DevOps Engineer
$100,400 to $175,700

February 19, 2024
Pilot or Telephone Operator? Forecasts of Software Developer Demise Are Absurd

Stability AI CEO Emad Mostaque recently grabbed headlines with his audacious prediction that “there [will be] no programmers in five years.” While such statements make great social media clickbait, they don’t accurately reflect the reality of creativity’s role in complex software development. Yes, AI will profoundly change the software engineering profession, but those changes will mostly enable inventive and capable developers to reach new heights of innovation. Software development is already being transformed by generative AI. Microsoft’s GitHub Copilot has more than one million paying customers. Some researchers forecast that between 50% and 80% of software engineering job descriptions will involve generative AI within a few years.

For the foreseeable future, generative AI’s principle value will be automating the mundane tasks that take up so much developer time. Copilots will likely replace many frameworks and code exchanges because they’re faster. They’ll dramatically improve auto-completion and spell check. That’s the grunt work of software development that most programmers will be happy to shed.

Generative AI is expected to be applied most often in testing, vulnerability management and writing code, according to an IDC survey of U.S. developers. However, the same survey found that fewer than 10% of developers expect the technology to have value in such creative disciplines as interface design, prototyping or translating user requirements into applications.

Where LLMs Fail

Building enterprise-grade software requires a keen understanding of business concepts and the ability to design novel solutions. That’s where large language models stumble. Trained on a large corpus of existing data, they excel at quickly spitting out what is already known. That can be of great value, but rewording and repetition aren’t the same as creativity.

Generative AI’s main impact on software development will be reducing mundane tasks and giving developers more time to innovate. Automating manual coding may help dent the chronic shortage of software engineers that shows no sign of easing. However, I have not seen any evidence that technology can think outside the box.

Doom and gloom predictions about automation’s impact on the workforce are nothing new. Occasionally they come true. Thanks to automated switching and direct dialing, telephone operator jobs in the U.S. have fallen by more than 95% since the 1950s. Robots continue to reduce the need for humans to do work no one wants to do.

Up the Stack

The more common outcome is for automation to move jobs higher up the value stack.

● E-commerce and customer self-service were expected to doom the retail industry, but total retail employment is expected to grow nearly 8% through 2030, led by services such as home delivery and specialty merchandise.
● About 90% of a commercial airline flight is now fully automated, yet the shortage of pilots is at an all-time high. That job has evolved from flying the plane to overseeing complex systems and being available for rare but critical emergencies.
● Online banking was supposed to kill bank branches, but there are more today than in 2000. Their role has shifted from processing transactions to delivering complex and customized services to the benefit of tellers and customers alike.
● While travel agent employment dropped substantially with the advent of online booking and the end of airline commissions, the industry is growing again, according to the BLS. Many travel agents have thrived by reinventing themselves as experienced consultants and simplifying the complexities of navigating multiple booking sites.
● Healthcare technology has made huge leaps in diagnostics and patient record management, but the need for human judgment, empathy and complex decision-making ensures that the demand for clinicians will remain strong for a long time.

Is the job of a software developer more like a telephone operator or a commercial airline pilot? Any technology executive will tell you the question is absurd. As a founder and CEO, I believe a top-notch full-stack engineer is more valuable than millions of dollars in venture capital. We’ve only scratched the surface of how software can enrich our lives. Automation will free up developers to spend more time on the tasks that make a difference.

February 15, 2024
IT Professionals Have Mixed Emotions About AI

A survey of 1,213 IT decision-makers working for small-to-medium enterprises (SMEs) in the U.S., United Kingdom and India published today found nearly half (45%) are worried about the impact artificial intelligence (AI) will have on their job.

Conducted by the research firm Propeller Insights on behalf of JumpCloud, a provider of an IT and cybersecurity management platform, the survey also found more than three quarters (76%) agree their organizations should be investing in AI, with 79% viewing AI as a net positive for their organization.

Most respondents also agree their organizations are approaching AI at exactly the right speed (55%), compared to 22% who said their organization is moving too quickly and 19% who said their organization is moving too slowly.

However, a full 62% also noted that AI is outpacing their organization’s ability to protect against threats, the survey finds.

Tom Bridge, a principal product manager for JumpCloud, said while there is no doubt that AI will change roles within organizations, it’s not likely to replace the need for IT administrators. Instead, IT administrators will be able to manage complex IT environments at much higher levels of scale as AI becomes a force multiplier for managing IT. Many of the low-level tasks that conspire to make managing IT tedious, such as generating reports, will become increasingly automated, noted Bridge.

It’s not clear what impact AI will have on IT roles, but it is arriving at a time when IT organizations are being challenged on several fronts. For example, the survey finds that 56% of respondents are more concerned about their organization’s security posture than they were a year ago. Nearly three-quarters (72%) said any cuts to their security budget would increase organizational risk.

More than half (56%) identified security as their biggest IT challenge, followed by new services and application rollouts (45%), increased work burden (44%) and the cost of remote work solutions (42%). Respondents said network attacks were their biggest challenge (40%), followed by software vulnerability exploits (34%) and ransomware (29%). A full 83% also now require multi-factor authentication (MFA), while two-thirds require biometrics (66%) to access some portion of their IT resources. A total of 83% are also still managing passwords.

More than three quarters (76%) also report increased compliance and regulations requirements in their region.

In addition, a full 88% noted increased vendor prices over the last six months, the survey finds. More than a third of respondents need five to 10 applications to manage worker life cycle (37%), but 22% require 11 or more. Three-quarters (75%) said they would prefer a single tool to do their job over several point solutions.

More than three-quarters (76%) rely on a managed service provider (MSP) to manage some portion of their IT environment, with 42% now relying on an MSP to manage their IT environment completely.

Finally, 57% said their organization has experienced layoffs in the last year. In addition to having to offboard those employees, IT professionals will naturally become more uneasy about their own job security.

Arguably, when it comes to managing IT, there is less certainty today than at any time in recent memory. The challenge, as always, is to aggressively embrace automation as much as possible to reduce a level of IT complexity that is rapidly becoming too complex to manage otherwise.

February 14, 2024
Legit Security Adds Sensors to Detect Usage of Gen AI Tools to Write Code

Legit Security today announced it has added the ability to detect when developers use generative artificial intelligence (AI) tools to write code to its application security posture management (ASPM) platform.

The ASPM platform developed by Legit Security already has discovery capabilities for application secrets, for example, enabled by sensors that are now being extended to include generative AI tools.

Legit Security CTO Liav Caspi said the overall goal is to allow DevSecOps teams to identify who uses these tools to write which types of code. Each DevSecOps team can then decide how stringently to enforce policies to either ban or limit usage of those tools, he added.

There is no doubt that generative AI tools are increasing developer productivity, but the large language models (LLMs) that provide the ability to generate code were trained using examples of code of varying quality collected from across the web. Much of that code either contains known vulnerabilities or is simply inefficient, which can manifest itself in the output surfaced by a generative AI platform.

The Legit Security ASPM platform, in addition to identifying generative AI tools being used in real-time, can also be employed to scan the LLM itself to identify security risks such as prompt injection and insecure output handling. Unfortunately, most cybersecurity teams are unaware of the extent to which application code generated by a machine might be insecure, so it currently falls to leaders of DevSecOps teams to determine what is an acceptable use of these tools. It may be perfectly fine to rely on a generative AI tool to create a script that will be used for an internal-facing application. However, using the same tool to write business logic that will be exposed to the internet may not be especially prudent.

It’s not clear how much of the code finding its way into software builds is being generated by a machine versus a human. In the longer term, the goal is to be able to identify that code by, for example, detecting substantial changes in the way code is normally written by a human developer, said Caspi.

Of course, while an ASPM may detect usage of generative AI tools that are connected to a corporate environment, there are still plenty of opportunities for developers to use these tools offline to create code that can later be added to a build using a code check-in tool. After all, many developers have used various shadow IT tools to write code for decades. Regardless of who or what wrote that code, however, it should still be reviewed.

In the meantime, the overall size of the codebase that DevSecOps teams will need to manage and secure will only exponentially increase as developers become more productive. Hopefully, more AI capabilities will soon be embedded into DevOps platforms to further automate the management of software builds at a time when many DevOps teams were already finding themselves overwhelmed even prior to the rise of generative AI.

February 13, 2024
Improve Efficiency With Smaller Code Reviews
In software development, code review plays a significant role in helping detect issues in your application’s source code early and promote collaboration among your team members. Breaking down code reviews into more manageable portions can yield great benefits. Review cycles are shorter and more convenient to comprehend when they are smaller. In other words, smaller reviews are easier to comprehend and provide feedback cycles. As a result, we can reduce development, deployment and debugging times while reducing the scope of change in each iteration.

This article presents a discussion on code reviews, why they are important, their benefits and why smaller code review cycles are more effective than larger ones.

What is Code Review?

Code review is defined as a software development process which involves reviewing code written by other developers. As part of the development process, it aims to improve code quality, ensure compliance with standards and identify and fix problems early on. Code reviews play a role in software development as they help catch errors before they turn into significant issues.

Peer reviews allow developers to detect errors or defects in each other’s code. By reviewing each other’s code, developers are able to identify bugs and flaws in the code. It helps deliver code that is secure and sustainable, adheres to standards and detects and resolves problems early in the development life cycle.

This can either be a formal process, where code is systematically evaluated according to a checklist or set of guidelines, or an informal process, where code is reviewed ad hoc. Code review can be performed by the same developers working on the code or by other developers with expertise in the relevant domain or technology.

By engaging in the exchange of feedback and actively participating in code reviews, we can ensure that the code is well-organized, easy to comprehend, adapt and extend over time. To be effective, it’s essential that everyone on the team is on the same page when it comes to their expectations and goals regarding these reviews.

Here are the key benefits of code review at a glance:
- Identify bugs and issues
- Improve code quality, consistency and maintainability
- Enforce coding standards
- Foster team collaboration
- Promote knowledge sharing
Best Practices of Code Review

Here are some of the best practices you should follow to improve your code review process:
- Review small units of code
- Set clear objectives and guidelines
- Involve multiple reviewers
- Provide constructive and respectful feedback
- Use code review tools
- Prioritize high-risk areas
- Balance attention to detail with time efficiency
- Encourage collaboration and learning
- Set realistic deadlines
- Follow up and close the loop
Automating the Code Review Process

Automated code reviews can help you enhance collaboration amongst your team and reduce the time spent in each cycle. Your developers can improve code quality and maximize productivity by automating the development workflow.

Here are the key benefits of automating the code review process:
- Enhances code quality
- Improves productivity
- Enhances code quality
- Improves collaboration
- Fosters learning opportunities
The Problem With Large Code Reviews

The traditional approach to code review often involves reviewing large chunks of code in a single session. Although this approach is initially efficient, it can lead to multiple problems. You will need more effort and spend more time reviewing large chunks of code. If code reviews are extensive and take longer to complete, it can often result in decreased attention to detail. Due to this, the likelihood of missing crucial errors and reviewer fatigue will increase, resulting in delays in feedback and completing the code review process.

The Benefits of Smaller Code Reviews

When the code review cycle is small, it becomes easier to track deployment changes easily. Smaller code reviews continuously improve development, deployment and debugging times and reduce the radius of a change set. As a result, it promotes faster deployment and helps identify issues easily and early in the software development life cycle.

Once a code review cycle is complete, the code goes through many steps before it finally reaches the production phase. Monitoring the application’s performance and detecting bugs (if any) is much easier when you make only minimal changes to your code. When the changes are small, it is easier to track the application’s behavior and detect bugs.

Here are some benefits of adopting smaller code reviews:

Focused Review

Reviewing smaller chunks of code enables you to analyze the code in a more focused and in-depth manner. This helps reviewers focus on specific functionality or components, leading to more accurate feedback.

Reduced Cognitive Load

Limiting the amount of code to review reduces cognitive overload for both developers and reviewers. Smaller code review cycles can be more efficient because they break down the review process into more manageable chunks. As a result, you’ll be able to evaluate code quality in a much more effective and efficient manner and identify potential issues or improvements more easily.

Faster Feedback Loop

Smaller code reviews can significantly speed up the feedback loop in the development process. Hence, feedback cycles will be faster, i.e., you will be able to receive feedback faster, resulting in quicker iterations and faster software delivery. The smaller the review, the easier it is to digest and the faster the feedback cycle.

Enhanced Collaboration

Smaller code reviews allow for more focused discussions and collaboration between reviewers and developers. Most importantly, since you can handle concerns effectively and efficiently, you can engage in more productive discussions. The efficiency and effectiveness of code reviews improves when the expectations of all stakeholders are aligned.

Measuring Success

To measure the success of smaller code reviews, consider the metrics and approaches given below:

Defect Detection Rate

This is a measure of the number of defects or issues identified during a code review cycle relative to the number of defects found later in testing or in the production environment. Note that a higher defect detection rate indicates you’re able to detect defects effectively.

Review Efficiency

Calculate the time it takes to review a chunk of code to understand the pace and efficiency of the code review process.

Feedback Quality

Assess the quality of the feedback provided during reviews, such as checking if the feedback is constructive, clear and actionable. Note that if the feedback is of high quality, it would typically yield better code improvements and learning opportunities for your team.

Cycle Time

The duration of the code review process is an indicator of efficiency. A shorter cycle time suggests an efficient review process, but quality should not be compromised.

Automated Checks Integration

Evaluate how effectively automated tools are integrated into the code review process to detect common issues and reduce the manual effort required in reviews.

Knowledge Sharing

Assess how well the code review process facilitates knowledge sharing and cross-team learning. This can be observed through the diversity of reviewers and the nature of the discussions in the review process.

Bug Rates Post-Release

Monitor the incidence of bugs or issues in the code post-release. A decrease in this rate can indicate that the code review process is effectively catching and addressing potential problems before release.

Conclusion

Code review helps produce code that is highly performant, scalable, secure and compliant with the recommended standards. Code reviews can make the codebase easily understood, flexible and scalable. A collaborative approach to code review can yield several benefits, such as promoting a culture of continuous development and learning, maintaining an organized codebase with clean code and clear structure, helping detect and resolve issues quickly, etc.
February 13, 2024
Survey: Cyberattacks Aimed at Software Supply Chains are Pervasive

A survey published today finds 91% of respondents work for organizations that have experienced a software supply chain incident in the past 12 months.

The survey polled 368 IT, cybersecurity and application developer professionals responsible for application security in North America and was conducted by the research firm Enterprise Strategy Group (ESG) on behalf of Data Theorem, a provider of an application security platform. The survey found zero-day exploits of vulnerabilities within third-party code (41%) were the most common attack vector, followed closely by misconfigured cloud services (40%), vulnerabilities in open-source software and container images (40%), stolen secrets/token/passwords (37%) and breaches of application programming interfaces (APIs) (35%).

The biggest areas of impact of those breaches are identified as cryptojacking (43%), inability to meet service level agreements (41%), malware infestation (39%), unauthorized access (39%), stolen developer credentials (37%), data loss (37%) and the levying of fines (37%).

Despite these issues, however, nearly three-quarters (74%) of respondents claimed their organization has “robust” software supply chain security capabilities even though a similar percentage said they are making significant investments in software supply chain security, with an additional 25% making moderate investments. More than three-quarters (77%) said they have increased their effort to secure third-party software components and container images in the wake of an attack. The top two areas of focus are new detection rules/analytics (33%) and the adoption of multifactor authentication (MFA) (33%).

Top investment priorities over the next 12 to 18 months include scanning open source code components and third-party libraries for vulnerabilities (44%), followed by discovering and inspecting APIs in source code (39%), using composition analysis tools to create software bill of materials (SBOMs) (38%) and applying runtime API security controls (33%).

The most widely used tools today are automated open source package risk management (34%), static application security testing (SAST) tools (34%), vulnerability scanning of cloud services (32%), automated security as code policy enforcement (31%) and dynamic application security testing (DAST) tools (31%).

Data Theorem COO Doug Dooley said while the survey makes it clear progress is being made, there is still a lack of urgency. It may require additional high-profile breaches to create a large enough public outcry to pass the legislation that is going to be required to address software supply chain security issues more vigorously. In fact, 83% of respondents noted industry regulations are a key driver to ensure they create accurate SBOMs.

In general, the survey finds nearly two-thirds of respondents (65%) have more than 50 Git repositories, with 40% reporting that more than half of their code is composed of third-party software. Half of respondents (50%) said they expected that to rise to more than half in the next 12 months. Well over half (58%) noted more than 30% of their code would be of open source software.

Only 43% report they are completely confident that their developers are only using secure open source software. On the plus side, 90% are prioritizing efforts to shift security left to developers.

Overall, 86% said it’s critical or important to know the composition/inventory of application code in use, where code is stored, and who has access to code components connected to their code. A total of 88% also noted it’s critical or important to have accurate inventory of their third-party APIs and cloud services.

The one thing that is certain in the months ahead is that cybercriminals will put software supply chain security to the test. The challenge and the opportunity now, regardless of what regulations are ultimately passed, is to thwart those attacks before the damage inflicted ultimately forces lawmakers to act in ways that make software development a lot more difficult than it already is.

February 12, 2024
Addressing the Developer Skills Gap
Although organizations are boosting their cloud architecture investments, the developer and database market is experiencing a severe skills shortage. Organizations need to start building those skills from within by giving employees the time and resources they need to be successful.

The ongoing expansion of cloud and cloud-based database architecture expenditure has created a significant gap in the software developer and database market—namely, a shortage of developers with the right skill sets.

The lack of developers and professionals with enhanced abilities was the top challenge in the market for two years running, according to Infragistics’ annual Reveal Survey. More than a third (37.5%) of respondents said they expect to continue to have trouble finding skilled developers in 2023. DevOps engineers, data analytics developers and IT security engineers were highlighted as the most difficult jobs to fill.

Finding skilled developers may be a priority for organizations, but there still aren’t enough skilled cloud architects in the job market, despite the recent tech sector layoffs. This talent shortage is industry-wide, with the U.S. Department of Labor estimating the global shortage of software engineers will reach 85.2 million by 2030.

To overcome this, organizations must adjust their approach. It’s crucial that they adopt effective ways to help employees quickly develop the cloud architecture skill sets their organization–and the industry–requires.

Identify the Skills Most in Demand

The first step towards filling the skills gap is to identify the specific skills IT professionals and developers require to support cloud-based database architectures. These core skills include:
- A proficiency in PostgreSQL and distributed SQL databases
- An ability to build global applications
- A deep understanding of cloud environments
PostgreSQL proficiency is in high demand these days. It’s the number-one database according to the latest StackOverflow survey. Moreover, according to the DB Engines website, PostgreSQL is one of the fastest-growing databases in the market. It’s already ranked as the fourth most-popular database on the market (it runs the majority of applications) and is PostgreSQL-based.

Looking toward the future, distributed SQL, which combines the relational database features found in PostgreSQL with the scalability and availability of NoSQL systems, is poised to emerge as the de facto database architecture for enterprises looking to deliver market-leading applications and services. Distributed SQL allows them to monetize and scale their data regardless of industry or operation size.

In a rapidly developing cloud-native environment, applications and services are increasingly going global, with user bases around the world. Organizations seek developers with experience building cloud applications that are seamless, flat and scalable across all locations. These developers need to be able to build global applications that support business continuity and disaster recovery, comply with data residency laws, and move data closer to users wherever they are based. They must also build geo-distributed applications that span multiple geographic locations and provide high availability and resiliency while enhancing compliance and performance.

Because cloud architectures involve a mix of environments, developers also require a thorough understanding of cloud environments—public, private and hybrid—as well as familiarity with the largest cloud providers. These include the big three: AWS (Amazon Web Services), Microsoft Azure and Google Cloud.

The type of cloud being used can have unique security, compliance and governance requirements, as well app migration issues. Each cloud provider has their own set of procedures that developers should be familiar with.

These skills are all necessary for developers operating in today’s cloud workforce. But the question remains: How can employers fill this skill gap when developers who already have the necessary skills are so scarce?

Building Skills From Within

Investing in hands-on training and upskilling people already on staff is a great way to start enabling developers to acquire the skills they need. Organizations can choose from a variety of learning paths.

One option is to make use of communities of cloud-native developers and database practitioners. A good example is Yugabyte University, a global community offering free training in distributed SQL, provider configurations and cluster replications, and many other useful topics. Communities like this offer database training libraries, developer hubs and content libraries to their students.

Many other vendors and developer groups, including the Linux Foundation, the Cloud Native Computing Foundation and GitHub offer specific cloud-native training with certification, as do companies specifically focused on training.

Organizations need to be aware that one of the biggest challenges with upskilling employees is time. Developers already have a full plate, especially in cloud environments where the emphasis is often on building and deploying applications, services and updates as quickly as possible. These valuable staff don’t have time to spend on learning, studying, and then practicing new skills.

This is where organizations need to make an investment, not just making training resources available to developers on staff but giving them the time required to train. Learning platforms that give employees self-paced learning options, virtual training, and in-person workshops can help. This allows them to learn more easily on the job. It’s also important to tailor any training to focus on developing the skills your organization needs most.

A successful training program will benefit the company by increasing the quality of software development and the employees by enabling them to develop new skill sets that further their careers.

Invest in the Right Kind of Training

The skills shortage afflicting the entire IT industry shows no sign of easing. A significant number of developers with advanced cloud-native skills will not suddenly appear on the job market. Organizations must find ways to upskill their own developers.

Employers need to make resources available, tailor them to meet the highest priority needs and offer courses and workshops in a flexible platform that makes learning on the job practical and stress-free. It’s important that employees have the time they need to learn these vital new skills rather than making upskilling one more burden on the shoulders of already overworked staff.

As cloud environments continue to grow, training and upskilling your existing staff is a necessary investment that promises to pay off in the longer term.
February 12, 2024
Five Great DevOps Job Opportunities

devopsy.kinsta.cloud is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

LinkedIn

Hanwha Vision America
Santa Clara, California
Senior DevOps Engineer
$160,000 to $200,000

Indeed.com

Tecton
Remote
DevOps Engineer
$156,000 to $231,000

CareerBuilder.com

The Pokémon Company International
Redmond, Washington
Senior Technical Program Manager – DevOps
$151,000 to $189,000

SimplyHired.com

JP Morgan Chase
Jersey City, New Jersey
Lead Software Engineer – FinOps/DevOps
$147,200 to $215,000

Dice.com

XTIVIA
Remote
Senior DevOps Engineer
$120,000 to $140,000

February 12, 2024
GitGuardian Allies With CyberArk to Better Protect App Secrets

GitGuardian this week revealed it has allied with CyberArk to streamline secrets detection and management by making it easier to share insights.

Ziad Ghalleb, product marketing manager for GitGuardian, said the two companies have integrated their respective platforms using open source software that integrates GitGuardian Secrets Detection and CyberArk Conjur Cloud, a software-as-a-service (SaaS) platform for managing and rotating secrets as needed.

In addition, CyberArk Conjur Cloud is now integrated with HasMySecretLeaked, a tool for discovering if a specific secret has been exposed on GitHub. That capability enables DevSecOps teams to periodically cross-reference secrets and credentials against a private database of secrets known to have been publicly exposed.

GitGuardian claims to have uncovered more than 20 million publicly exposed secrets on the GitHub repository. While GitGuardian provides tools to discover exposed secrets, organizations rely on the CyberArk platform to manage secrets and remediate issues that arise when they are left exposed.

The immediate challenge is to find ways to integrate secrets detection within the context of larger ecosystems, said Ghalleb. In the longer term, GitGuardian is working toward embedding its tool into integrated development environments (IDEs) to surface exposed secrets as developers build software, said Ghalleb.

Naturally, there is a lot more focus on secret detection, and secrets management is getting more attention as more organizations review their software supply chain processes in the wake of a series of high-profile security breaches. For many organizations, however, it’s still early days as far as adopting DevSecOps best practices to secure those software supply chains, but it’s clear more responsibility for application security is shifting left toward developers and the DevOps teams that support them.

Unfortunately, too many developers still hard-code secrets in plain text into applications to create shortcuts as software is developed. Many forget to remove those secrets before an application is deployed in a production environment. Once an application is deployed in a production environment, it may be months before anyone discovers an issue—if it’s discovered at all.

In the meantime, cybercriminals are becoming more adept at using scanning tools to discover secrets and then exploiting them to compromise applications after they have been deployed.

Hopefully, DevOps teams will implement DevSecOps best practices to address those issues before any fines are levied. But the challenge, as always, is ensuring application security without adversely impacting the rate at which software is currently being built.

It’s only a matter of time before more stringent regulations require organizations to revisit the security of software supply chains. Countries around the world are drafting legislation that would hold organizations much more accountable for the security of the applications they build and deploy. As more fines are eventually levied, the tolerance for leaving secrets exposed in applications is only going to decline.

Secrets discovery and management is, of course, only one aspect of application security, but the more these issues are addressed before applications are deployed the less stressful cybersecurity becomes.

February 9, 2024