devopsy.kinsta.cloud

Category: DevOps Culture

  • Observability Leaders: The Mighty Minority Holding Their Own Against Outages

    Observability Leaders: The Mighty Minority Holding Their Own Against Outages

    The job of IT teams has become much harder thanks to the new realities of hybrid IT, with workflows occurring across on-premises and cloud-based networks and applications. Yet so much rests on your ability to respond to these challenges, all while managing the expectations of your customers and the health of your bottom line. With the growing complexity of ecosystems comes the need for better visibility, both into specific systems and across your entire stack.

    Observability solutions address this by providing visibility across your network, infrastructure, systems, application, database, digital experience and log monitoring.

    In other words, observability enhances your ability to observe your digital ecosystem with more transparency, more effective detection and more intelligent insights. Take, for example, the very timely and pressing issue of outages. On average, the typical business experiences nine brownouts or outages every month, lasting roughly twelve hours each and averaging $13.7M annually, according to new research we conducted at SolarWinds.

    Over the course of the year, that can add up to nearly 1,300 hours, with outages chipping away at your organization’s productivity, reputation and competitive edge.

    It’s not enough to monitor for these outages and address them once they take down your systems. Repeated or prolonged outages signify a gap in the enterprise’s ability to comprehensively monitor and understand its network’s internal state and performance. A robust observability strategy can preemptively detect anomalies and potential issues—before they become full-blown outages.

    According to new data from the 2023 IT Trends Survey released this month by SolarWinds, companies who’ve embraced observability tend to not only lead in detecting, remediating and preventing outages—they’re experiencing better business and IT outcomes, too.

    The technology professionals surveyed shared how observability is helping them achieve better performance, compliance and resilience in digital environments—and how you can follow their lead.

    Observability Drives Better Business Outcomes

    The observability leaders surveyed were 300% more likely to say their organization is doing extremely well with growing revenue and 250% more likely to say the same about their organization’s speed of innovation. Interestingly, they also reported a better employee experience: They were 388% more likely to rate their organization as doing “extremely well” with employee experience and also reported fewer and smaller skill gaps on their teams.

    So, how does embracing observability actually translate into better business outcomes? According to the data, observability leaders are…

    • Investing in top priorities: Data shows organizations using observability solutions to support the priorities most critical to their growth and success: Improve their customer experience (96%), enable faster innovation (71%), reduce time spent solving (71%) and detecting (60%) issues and increase operational efficiency (55%).
    • More automated and integrated: Observability leaders embracing automation and investing in tools that provide enhanced efficiency are 214% more likely to say they are doing extremely well with operational efficiency, 750% more likely to say they are doing extremely well with auto-remediation of complex alerts and 300% better at automatically collecting background diagnostic data for IT support staff.
    • Ahead on IT: The data found that those ahead of the curve on observability are also leading by huge margins when it comes to monitoring, detecting and resolving issues that could otherwise bring the business to a screeching halt. When it comes to IT, they are 233% better at auto-escalation of tickets, 213% better at auto-remediation of simple alerts and 36% better at settling alert levels based on historical behavior.

    How to Reap Observability Benefits in Your Organization

    All told, observability adoption is still in its early days. Only 1% of enterprises are already up and running using observability tools on a regular basis, while another third are undergoing the implementation process.

    That’s good news for other businesses who are ready to reap the rewards—it’s not too late to be an observability pioneer.

    If you’re interested in bringing observability to your own organization, start by addressing a few important factors that can help you sidestep challenges—such as the accelerating pace of change in technology (72%) or insufficient budget (58%)—that might otherwise obfuscate your observability opportunities:

    • Make sure your observability solutions are appropriate for multi-cloud environments: Multi-cloud environments have become standard for many companies because of the many upsides, but they can be challenging for IT teams to manage. Strategically accelerate your organization’s cloud migration with an observability solution designed for complex hybrid and multi-cloud environments​ to save a lot of headaches down the road.
    • Give your teams autonomy—and build toward autonomous operations: Observability brings your enterprise a step closer to autonomous operations. Autonomous operations, where IT systems can govern themselves, providing a proactive approach to addressing issues, rather than reactive, won’t replace your human teams but rather free up their time and brainpower to support the business and drive innovation.
    • Don’t ignore the database: Databases represent the most difficult ecosystems to observe, tune, manage and scale. They require significant computing power, tend to be memory-intensive and likely make up the bulk of your organization’s cloud spending. Tasks crucial to the health and functionality of your business—including troubleshooting, root cause analysis and remediation—simply cannot happen without full, transparent observability across the numerous resources a database needs to engage to do its job.

    Observability helps balance competing priorities and demystify application requirements while increasing your overall DevOps agility, efficiency and speed to market. Observability not only fosters transparency and collaboration but also encourages a system of ongoing review, which benefits the organization, IT teams and—crucially—your customers.

  • Cisco Acquires Splunk to Create Observability Powerhouse

    Cisco Acquires Splunk to Create Observability Powerhouse

    Cisco today revealed it has signed a definitive agreement to acquire Splunk for $28 billion in cash. The deal will add Splunk, one of the most widely-used platforms for managing IT operations, to Cisco’s portfolio, joining the AppDynamics observability platform in addition to a wide range of IT infrastructure equipment.

    Chuck Robbins, CEO of Cisco, told industry analysts the combined entity will be one of the largest software companies in the world. The Splunk and AppDynamics platform creates a comprehensive observability platform spanning applications, networks and hybrid cloud computing environments, Robbins added.

    By combining AppDynamics with the data collected by the Splunk platform, the combined company will be able to provide greater insights into IT operations than any other company, added Robbins.

    Splunk CEO Gary Steele said the acquisition represents the next natural, logical step for Splunk and furthers its long-term partnership with Cisco to keep IT environments secure and resilient. The two companies will also be able to apply artificial intelligence (AI) more effectively to IT operations, he added.

    In its most recent quarter, Splunk reported revenues of $911 million, with cloud revenue accounting for $445 million, or 29%, of the total. Total Splunk revenues are forecasted to be between $3.925 billion and $3.95 billion for fiscal 2024.

    Splunk previously acquired SignalFX, a provider of an observability platform, in 2019. It’s not yet clear how the platform might be integrated into the AppDynamics platform, but Robbins said there is little overlap between the observability platforms the two companies currently provide.

    The Splunk acquisition comes at a time when it’s becoming more apparent that the need for observability extends well beyond DevOps workflows as organizations become more dependent on software.

    Each IT organization will need to determine how long it will wait for the Splunk acquisition to close before investing further in observability. Historically, acquisitions of this scale have been accompanied by price hikes to help fund the merger once the deal is concluded.

    In the meantime, IT and DevOps leaders will likely revisit the way IT is managed in the months ahead. Splunk came to prominence at a time when most workloads were running in on-premises IT environments. While the bulk of workloads continue to run in those environments, many workloads deployed in the cloud are being managed using platforms designed specifically for those environments. Splunk has been making a case for a hybrid cloud computing approach that assumes the management of on-premises and cloud computing environments will become more unified.

    In theory, economic headwinds are driving more organizations in that direction to reduce the total cost of managing IT. But it’s just as feasible to extend cloud tools to on-premises IT environments as it is to extend legacy tools to the cloud. Despite the inevitable outcome, Splunk rivals will spend the better part of the next year coming up with offers to switch platforms both before and after the deal eventually closes.

  • Nobl9 Unfurls Reliability Center for Managing SLOs

    Nobl9 Unfurls Reliability Center for Managing SLOs

    Nobl9 today launched a next-generation platform for managing service level objectives (SLOs) in a way that promised to improve overall reliability.

    Brian Singer, chief product officer for Nobl9, said in addition to enabling DevOps teams to meet SLOs, the Nobl9 Reliability Center also now provides a single source of truth about the state of reliability in an application environment.

    That capability is critical because as DevOps teams add new features to applications, they need insights into how they are impacting the reliability of the software environment, said Singer. No matter how great any new capabilities might be, it won’t matter much if the application environment slows to a crawl or outright crashes, he added.

    Nobl9 Reliability Center addresses that need by providing dashboards and reports to assign reliability scores based on the metrics collected from the SLOs defined. Those scores can then be shared with senior business and IT leaders so they can better understand the actual state of an application environment, noted Singer.

    In addition, the platform will recommend SLOs and policies and can be used to automate runbooks to improve reliability. The goal is to enable DevOps teams to continuously monitor and manage using SLOs via alerts that are received in a way that is timely enough to act on, added Singer.

    That approach enables DevOps teams to make sense of conflicting alerts generated today by multiple monitoring and management tools. A recent survey published by Nobl9 found 72% of respondents are using six or more monitoring and observability tools.

    The Nobl9 platform collects SLOs by tracking workflows through more than 50 integrations with various DevOps tools and platforms.

    SLOs, of course, are not a new idea. They have been used as a metric to track the performance of IT services for decades.

    However, as more microservices-based applications are built and deployed, it’s becoming more challenging to maintain SLOs across applications that have many more dependencies than legacy monolithic applications. Ultimately, each IT team needs to provide some sort of objective benchmark that assesses their overall effectiveness at delivering application services. The Nobl9 platform makes it simpler to track whether SLOs are achieved and maintained.

    That’s crucial because as more organizations depend on software to deliver digital services, any disruption is likely to have a direct impact on profit and revenue. As such, the reliability of application environments has become a major concern. The issue, of course, is that many of those application environments have dependencies on legacy platforms that, in some cases, have been running for years. Each feature and application programming interface (API) added over time conspires to adversely impact performance. In an era where IT teams are now trying to manage distinct services rather than individual applications, latency can significantly slow down response times.

    Each organization will need to determine for themselves how aggressively they need to manage SLOs. But thanks to the rise of digital business transformation, more senior IT and business leaders are focused on them than ever.

  • Innersourcing Open Source Principles in the Enterprise

    Innersourcing Open Source Principles in the Enterprise

    Software development has experienced a seismic shift in recent years, with open source becoming the heartbeat of innovation. A full 90% of enterprise IT leaders say their organization is using open source, according to a Red Hat report. Leading this transformation is GitHub, the ubiquitous platform that not only jumpstarted the open source movement but has also been quietly transforming how enterprises approach development at large.

    But it’s not just tech companies trumpeting the open source creed—academics are on board, too. A paper recently published by the University of Georgia found a hard-to-dismiss correlation between open source innovation and overall business success. “We find a significantly positive association between GitHub activity and future realized net income, suggesting that open innovation is a strong predictor of future earnings,” according to the report.

    I recently met with Chris Reddington, senior manager of developer advocacy at GitHub, to dive into how and why open source is becoming essential for enterprise innovation. According to Reddington, the once-dominant proprietary information mindset is shifting, with open source cultural principles now permeating most companies, a practice also known as innersource. Put simply, open source is now cool in the enterprise.

    Bridging the Open Source-Enterprise Divide

    GitHub’s close ties to the open source space have allowed them to illuminate the parallels between the open source and enterprise worlds. Reddington noted that, nowadays, open source and enterprise aren’t really separate communities but rather intertwined facets of the same software ecosystem. This movement is represented by the open source program office (OSPO) becoming more commonplace in large organizations.

    For an example of innersource in practice, take Porsche, who recently announced the Porsche FOSS Movement to guide internal common values and development principles around open source. We’ve also seen similar large-scale commitments to open source values at Walmart, Spotify, Facebook and others.

    Open source clearly isn’t just for startups—large companies are increasingly seeing an advantage in both using open source software and sharing their own open source components. The growing investment and maturation of OSS initiatives are positive strides, as it’s important to the stability of the free open source software (FOSS) ecosystem as a whole that those using software contribute back to its maintenance, especially to core packages the world depends upon.

    The Power of Innersource

    The study from the University of Georgia brings to light how enterprises increasingly recognize the need to work in sync with their developers and customers to remain competitive. This is a testament to the evolving nature of development—an industry that’s embracing a “team sport” mentality instead of a siloed approach, explained Reddington. And as enterprises align with open source principles, they are discovering the power of innersource, he said. “Innersource is a development methodology where engineers build proprietary software using best practices from large-scale open source projects, like Kubernetes or Microsoft’s Visual Studio Code,” GitHub explained.

    Reddington elaborated on two key elements of this approach:

    • Breaking down silos: The traditional organization-centric structure of projects is being replaced by a more transparent and collaborative approach. Innersource encourages transparency and asynchronous communication, tearing down barriers that previously inhibited efficient collaboration.
    • Engaging responsibly: Reddington emphasized the significance of enterprises giving back to the open source community. Whether through sponsorships, allocating time for engineers to contribute, or open sourcing their projects, companies can foster symbiotic relationships where they benefit from and contribute to the open source realm.

    Essentially, by adopting innersource principles, enterprises foster an environment that promotes collaboration and knowledge sharing, thus enabling innovation to flourish across teams and projects.

    Balancing Open Innovation and Proprietary Software

    One of the most intriguing aspects of this transformation is finding the equilibrium between open innovation and proprietary software. Reddington acknowledged the necessity for businesses to generate profits, which inherently stems from delivering value.

    While reinventing the wheel may be tempting, Reddington highlighted the importance of recognizing existing solutions and incorporating them into ongoing projects. This pragmatic approach maximizes efficiency and enables teams to focus on the unique, value-generating aspects of their work.

    Organizations should also consider what software of their own could be open sourced. From a business perspective, this most likely won’t be the “crown jewels,” said Reddington, but ancillary components that others could benefit from. For example, had it not been for Google open sourcing Kubernetes, Lyft open sourcing Envoy Proxy or Facebook sharing GraphQL, we would not have these standard components for all to use.

    Open Source Movements: Past, Present, and Future

    Over the last decade, we’ve seen significant, more institutional maturation around open source projects. Reddington pointed to the Cloud Native Computing Foundation (CNCF) as a standout. He specifically noted Kubernetes-based Event Driven Autoscaler (KEDA) as a cool project to help scale Kubernetes containers based on the number of events needing to be processed.

    He also underscored the surge of interest in generative AI, evidenced by projects like GitHub Copilot. It will be curious to see how AI assistants incorporate open source at their core, such as open foundational models and community-supported datasets.

    Potential Setbacks To The Open Source and Innersource Movement

    In the dynamic realm of enterprise-scale software development, nurturing innovation can be a complex endeavor. Innersource principles are one way to change the attitude toward development, making it more efficient, collaborative and aligned to the current and future developer experience expectations.

    Yet, this isn’t to say we haven’t had some setbacks recently that could threaten the progress the OSS community has built. For example, HashiCorp recently abandoned its open source license around Terraform in favor of a business source license (BSL). There is also an increasing number of supply chain-related attacks that threaten common open source libraries.

    Gazing Into the Future

    As Reddington aptly summarized, we’re still in the early days of this transformative journey. The developer community’s inclination for experimentation will undoubtedly drive the solutions to the most pressing challenges in open source. And with enterprise adoption on the rise, the future promises more cohesive collaboration, broader adoption of innersource principles and continued innovation driven by open source values.

    Interestingly, we’re seeing more synergy between open source and enterprise domains, which used to feel like separate realms entirely. And it will be interesting to see how businesses continue to balance transparency and proprietary value into the future. No matter what, the lines between them are blurring, enabling companies to harness the power of innersource for enhanced collaboration and innovation.

  • Survey Surfaces Major Observability Challenges

    Survey Surfaces Major Observability Challenges

    A recent survey found the biggest obstacles to observability were the pace of technology change, IT blind spots and the complexity of modern applications. The survey polled 300 IT professionals to identify the biggest challenges they faced in achieving observability. The accelerating pace of technology change (72%) topped the list, followed by IT blind spots and the growing complexity of modern applications (58% each), and lack of funding (52%).

    The survey, conducted by SolarWinds, also found the typical enterprise suffered nine brownouts or outages every month, each of which lasted around twelve hours. The full cost of outages and brownouts averaged $13.7M annually for these enterprises, according to the SolarWinds report.

    Jeff Stewart, field CTO and vice president, global solutions engineering at SolarWinds, said the survey makes it clear that a lack of observability is having a material impact on businesses. Organizations are now moving beyond monitoring predefined metrics to embrace observability platforms that make it simpler to investigate the root cause of issues that adversely impact businesses; these businesses are more dependent on IT than ever, he added.

    In fact, the primary reason organizations are investing in observability is to improve their customer experience (96%), enable faster innovation (71%), reduce time spent solving (71%) and detecting (60%) issues and improve operational efficiency (55%), the survey found.

    While it’s still early days as far as achieving observability is concerned, a lot of progress is starting to be made as organizations realize that complex IT environments require a different management approach. IT teams can no longer afford to navigate multiple monitoring tools in what often turns out to be a vain effort to prevent brownouts and downtime, noted Stewart.

    In addition, many IT teams are becoming increasingly aware that the telemetry data collected via an observability platform provides the foundation for infusing IT operations with artificial intelligence (AI) capabilities, he added. The ultimate Holy Grail is to one day achieve autonomous operations, noted Stewart.

    There is, of course, no shortage of observability platforms, but Stewart contends that providers of monitoring tools such as SolarWinds are in the best position to help IT teams make the observability transition. Rather than ripping and replacing a monitoring platform, a more seamless transition that results in less disruption is preferable, he noted.

    Regardless of approach, observability platforms that enable IT teams to launch queries across complex distributed computing environments are becoming a necessity. Distributed computing environments often have more dependencies than IT teams can manually track. It’s only a matter of time before the most talented DevOps professionals start to migrate to organizations that provide them with the management tools and platforms required to succeed. Otherwise, the stress of managing a complex IT environment will only result in higher rates of burnout among DevOps professionals.

    It may be a while before observability platforms are pervasively employed across IT environments, but as it becomes clear that brownouts and downtimes result in a decline in revenue, business leaders will understand what’s required to maximize profits. In many cases, the answer will be an observability platform that surfaces the insights needed to proactively manage modern IT environments.

  • Oracle Previews Latest Java 21 Innovations

    Oracle Previews Latest Java 21 Innovations

    Oracle today made generally available a Java 21 edition and provided early access to more than 15 proposed enhancements to the Java development kit (JDK).

    Those enhancements were announced at an Oracle CloudWorld 2023 conference, including support for virtual threads to improve overall throughput and adding support for a vector application programming interface (API) that makes it simpler to build Java applications that involve artificial intelligence (AI) models.

    Georges Saab, senior vice president of Oracle Java Platform and chair of the OpenJDK governing board, said the goal is to streamline access to the latest innovations that will be added to future versions of Java.

    Specifically, via Project Amber, JDK 21 delivers improvements such as support for string Templates, record Patterns, pattern Matching for switch, unnamed Patterns and variables and unnamed classes and instance main methods.

    In addition to the Vector API, Project Panama adds a Foreign Function & Memory API. Project Loom, in addition to virtual threads, adds scoped values and structured concurrency support.

    There is also a more efficient garbage collection mechanism being proposed.

    Oracle is committing to offering long-term support for Java 21 for at least eight years to encourage organizations to start working with this version of Java today. Oracle is also making available a Java Playground, an online sandbox on the Oracle Cloud Infrastructure (OCI) service where developers can create Java code using this edition without needing a local runtime or integrated development environment (IDE).

    In general, Java has been experiencing a renaissance after more organizations began contributing to projects once the core platform became available under an open source OpenJDK license. In fact, the Java community is now adopting many concepts pioneered in other programming languages. That enables organizations to, for example, drive digital business transformation initiatives that depend on the modernization of legacy applications. As part of those efforts, the rate at which Java applications are being deployed in the cloud has substantially increased.

    Despite the number of alternative programming languages, many enterprise IT organizations remain committed to Java. Rather than opting to retrain developers, it’s simply been more cost-effective to enable developers to continue to build applications using a programming language they already know.

    Many organizations are currently in the process of shifting to Java 17. It’s not clear how many organizations will skip Java 17 and jump to Java 21 from previous versions of Java, but it’s clear Oracle is committed to making the lag time between moving from previous versions of Java to Java 21 much shorter.

    Most organizations will find themselves continuing to deploy Java applications everywhere from the network edge to the cloud. These applications will be written in a programming language that has persevered for more than two decades and continues to evolve and mature for the next era of application development.

  • Buildkite Acquires Packagecloud to Streamline DevOps Workflows

    Buildkite Acquires Packagecloud to Streamline DevOps Workflows

    Buildkite Pty Ltd today revealed it has acquired Packagecloud as part of an effort to tightly integrate package management tools with its continuous integration/continuous delivery (CI/CD) platform.

    Buildkite CEO Keith Pitt said the goal is to reduce the level of friction that exists between providers of third-party package management tools and CI/CD platforms that DevOps teams are today required to address themselves.

    There is no shortage of package management tools used to configure, install and update software, but the level of integration between these tools and CI/CD platforms has not historically been very high. The acquisition of Packagecloud will result in a package manager becoming a first-class citizen within the context of a CI/CD platform, said Pitt.

    Buildkite will maintain the existing support Packagecloud provides for platforms such as Jenkins, but the acquisition will streamline DevOps workflows and improve overall developer productivity, he added.

    In the months ahead, Buildkite will also add a range of tools to better enable DevOps teams to achieve that goal, said Pitt. In addition, the company plans to add tools to streamline the management of compliance processes as regulations pertaining to application development are becoming more stringent, he added.

    It’s not clear how much IT organizations are reevaluating their CI/CD platforms to improve developer productivity, but platform engineering as a methodology to centralize the management of DevOps workflows is gaining traction. Those efforts promise to reduce the total cost of implementing DevOps at scale and improve developer productivity by making the scaffolding required to build applications more readily accessible. Today, too many developers are spending time managing developer environments rather than writing actual code.

    The challenge, of course, is convincing developers—who tend to jealously guard their tool prerogatives—to embrace a platform engineering methodology and cede control over the development environment to a centralized team.

    One way or another, developer productivity needs to improve as more organizations encounter economic headwinds. Developers are the most expensive resource any organization has, so improving the rate at which high-quality code is created will always be imperative, noted Pitt.

    Today, organizations depend on software to drive revenue. Investors are assessing senior leaders within those organizations on their ability to deliver quality software in a timely fashion. Each new application and subsequent software update now has a direct impact on the profitability of the organization. As such, tolerance for legacy approaches to building software that require more time and effort is dropping.

    The issue, as always, is that switching from one software development platform to another is an expensive proposition, so many organizations may find themselves supporting a mix of legacy and modern platforms. The challenge becomes defining the pace at which that migration occurs as new applications are created and legacy applications are continuously updated.

  • What DevOps Teams Should Know About Phishing and the Supply Chain

    What DevOps Teams Should Know About Phishing and the Supply Chain

    The DevOps pipeline is a critical component in any organization, and it has broader implications that can affect other organizations as well. Some of the biggest cybersecurity breaches of recent years were supply chain attacks, in which attacks infiltrated the development systems of one organization to break into the systems of its customers downstream. Needless to say, this had catastrophic consequences for the organization under attack.

    According to Deloitte, 91% of cyberattacks begin with a phishing email, and supply chain attacks are no exception. By understanding this common threat and preventing it, DevOps organizations can significantly improve their resilience to these attacks. Of course, phishing awareness and prevention should come as part of a broader cybersecurity program that addresses additional supply chain risks. 

    What is Phishing?

    Phishing is a method used by cybercriminals to trick you into revealing sensitive information. They do this by creating a replica of a legitimate website or email and asking you to provide personal information such as passwords, credit card numbers, and social security numbers.

    Phishing attacks can take various forms. Some of the most common include email spoofing, where the attacker sends an email that appears to be from a trusted source, and website spoofing, where the attacker creates a fake website that looks identical to a legitimate one.

    Regardless of the method used, the goal is the same: To trick you into providing sensitive information. Phishing is a serious threat to both individuals and businesses. It’s not just about losing money; it can also lead to identity theft, damage to your reputation, and even legal consequences. Get more background in this detailed blog post about phishing prevention.

    Implications of Phishing for the Software Supply Chain

    Entry Point for Larger Attacks

    The supply chain is a prime target for phishing attacks. This is because it provides an entry point for larger attacks. For example, a phishing attack on a supplier could compromise their security, allowing the attacker to infiltrate organizations that use their software downstream.

    This kind of attack can have devastating consequences. It could lead to the theft of sensitive information, disruption of operations and even compliance risks.

    Information Theft

    Information theft is one of the most significant risks associated with phishing attacks on the supply chain. When a supplier falls victim to a phishing attack, the attacker can gain access to a wealth of valuable information belonging to the supplier and, in some cases, to its customers or partners. This could include everything from financial data to proprietary business information.

    The loss of such information can have severe implications. It could lead to financial loss, damage to the company’s reputation, and legal consequences.

    Disruption of Operations

    Another significant risk associated with phishing attacks on the supply chain is the potential for disruption of operations. A successful phishing attack could compromise a supplier’s systems or the systems of organizations that rely on that supplier, leading to downtime and delays in the supply chain.

    This kind of disruption can cause significant damage to a business. It could result in lost sales, damage to customer relationships and even the potential for business failure.

    Compliance Risks

    Lastly, phishing attacks on the supply chain can lead to compliance risks. Many industries are subject to strict regulations regarding data security. If a phishing attack leads to a data breach, the companies involved could face hefty fines and penalties.

    Additionally, a data breach could damage a company’s reputation, making it harder to do business in the future.

    Practical Steps to Secure the DevOps Pipeline

    1. Implementing Security Awareness Training

    The first and most crucial step in countering phishing risks is implementing security awareness training. This involves educating all team members about the various forms of phishing attacks and how to recognize them. Interactive sessions, workshops and webinars can be very effective in conveying this knowledge.

    Another vital aspect of security awareness training is teaching employees how to respond to suspected phishing attempts. They should know the steps to take, such as not clicking on any links in a suspicious email, reporting the incident to the IT department and deleting the email.

    2. Deploying Anti-Phishing Tools and Technologies

    While awareness and education are critical, they are not enough on their own to protect against phishing attacks. This is where anti-phishing tools and technologies come into play. These tools can help detect phishing attempts and prevent them from reaching the intended targets.

    There are several types of anti-phishing tools available, including email filters that detect and block phishing emails, browser add-ons that warn users when they attempt to visit a phishing website and AI-based tools that can recognize even sophisticated phishing attempts.

    3. Incorporating Security into the Software Development Life Cycle (SDLC)

    Incorporating security into the software development life cycle (SDLC) is another crucial step in countering phishing risks. This means considering security at all stages of software development, from planning and design to coding, testing and deployment.

    Security should be a primary consideration when designing software systems. This includes designing systems to be resilient to phishing attacks, for example, by using secure coding practices to prevent common vulnerabilities that phishers can exploit.

    During the coding and testing stages, it’s crucial to conduct regular security audits and vulnerability assessments to identify any potential weaknesses that could be exploited by phishers. Any identified vulnerabilities should be promptly addressed.

    Finally, during the deployment stage, it’s vital to ensure that all software components are securely configured and that any security patches or updates are applied promptly. This can help prevent phishing attacks that exploit software vulnerabilities.

    4. Regular Phishing Simulations and Drills

    Finally, conducting regular phishing simulations and drills is an excellent way to test the effectiveness of your phishing prevention measures. These simulations involve sending mock phishing emails to employees to see how they respond. The results can provide valuable insights into areas where further training or technical measures may be needed.

    Phishing drills should be conducted regularly and should cover various phishing techniques. The results of these drills should be shared with all team members, along with feedback and recommendations for improvement.

    Phishing simulations should also be used to test the effectiveness of your anti-phishing tools. If a significant number of mock phishing emails get through your defenses, this could indicate that your tools are not effective and need to be updated or replaced.

    Conclusion

    In conclusion, the integrity of DevOps pipelines—and, by extension, the entire supply chain—is increasingly under threat from phishing attacks. This is a grave concern given the potentially devastating implications ranging from data theft, operational disruption, legal consequences and considerable compliance risks. 

    However, organizations can proactively safeguard their DevOps pipelines by fostering a security-conscious culture underpinned by regular training and awareness programs. Deployment of state-of-the-art anti-phishing technologies and the integration of security at all stages of the SDLC can further strengthen defenses. 

    Additionally, regular phishing simulations and drills can be instrumental in testing and enhancing the resilience of these measures. The war against phishing is continuous and staying one step ahead of the threat requires constant vigilance, innovative strategies and robust technical defenses.

  • JFrog swampUP: Addressing the Advent of AI

    JFrog swampUP: Addressing the Advent of AI

    At JFrog SwampUp 2023, the buzz with all about AI, especially with JFrog’s announcement of Machine Learning (ML) Model Management capabilities. These conversations around AI and ML reflected these technologies’ growing influence and importance in the DevOps world. How much of the generative AI conversation is just hype, though? And what does that mean for AI and ML as a whole? Alan Shimel, CEO of Techstrong Group, and I sat down with Stephen Chin, VP of DevRel at JFrog, to find out.

    As far as Chin is concerned, even as more companies create and leverage AI models, these models must be managed like any other software component. Chin said JFrog Artifactory acts as a staging ground to operationalize models using DevSecOps best practices. Algorithms and models will continue to grow in size and complexity, and they will require robust processes around deployment and management – just like any other software artifact. The key, Chin said, is to think of ML as just another development language and leverage tools that standardize and streamline working with it. Compared to traditional enterprise applications, though, DevOps workflows for AI/ML are still relatively immature, but Chin said JFrog’s new model management capabilities aim to provide that missing automation and governance using DevSecOps best practices for governance, security, and licensing compliance.

    Additionally, Chin noted that AI/ML have become essential for development teams to keep up with the explosive demand for code. At this point, AI has become table stakes. In the AI arms race, the winners are those who understand AI has become a vital development tool to enhance productivity. In terms of job security, the losers are the ones who can’t keep up with the volume of code. According to Chin, you are out of the running if you don’t embrace AI.

    Looking ahead, AI will not make developers obsolete, though – quite the opposite. Given the quasi-unlimited appetite for new code, Chin emphasized that developers who embrace AI will have more work than ever. One way to think of it is that AI provides a new form of “outsourcing” to boost human productivity, much like previous waves of innovation in computer science.

    When it comes to security, there are still challenges that need to be addressed; code generated by today’s AI solutions still has significant drawbacks like potential data bias, lack of explainability and simple errors. In the long term, though, Chin believes AI itself will provide the solution to secure an exponentially growing codebase, given its superior scale. Just as AI will make individual developers more productive, it can also supercharge security teams – but it can also empower bad actors. The key will be continuing to democratize the benefits to even the playing field. AI promises to be a transformative technology on the scale of the Bronze Age or Quantum computing, Chin said, but the path forward will require humans and machines working together to ensure it’s used for good.

    It’s clear that the pace of innovation in AI and ML is rapidly accelerating. As these technologies become further democratized and integrated into developer workflows, they promise to transform how software is built and secured, Chin said. Companies must take advantage of this technology innovation by providing the pipelines and governance for this software revolution, he added. Chin believes the future will likely see a more symbiotic relationship between humans and AI assistants collaborating to generate, refine and safeguard code. By proactively shaping the responsible use of these technologies, it’s possible to maximize the benefits while minimizing the risks. While this journey has only just begun, the destination is an exciting new era of human potential unlocked by AI, Chin said.

  • Daytona Unfurls Developer Environment for On-Premises IT

    Daytona Unfurls Developer Environment for On-Premises IT

    Daytona has launched a development environment for on-premises IT environments that provides all the benefits of a cloud-based alternative.

    Ivan Burazin, CEO of Daytona, said the company’s namesake alternative to platforms such as GitHub Codespaces enables DevOps teams to retain control and better secure the intellectual property created by developers while simultaneously making them more productive.

    The Daytona platform enables developers to instantly start coding by accessing a development environment based on a set of preferred tools and frameworks, he added. Platform engineering teams looking to scale DevOps workflows can then take advantage of fine-grained access controls and advanced security features across developer environments spanning hybrid IT environments, said Burazin.

    He added that the ability to centrally manage development environments is designed to appeal to organizations attempting to improve developer productivity in highly regulated industries that are now allowed to use cloud-based alternatives. This is becoming a more pressing issue because as regulations become more stringent, organizations are trying to move source code off developers’ individual laptops that are more easily breached than a server environment, noted Burazin. The challenge is striking the right balance between enabling flexibility and centralizing the management of developer environments, he added.

    Of course, many of those organizations could opt to construct their own internal developer portal (IDP) to accomplish the same goal, but in most cases, that would prove expensive to both construct and maintain, noted Burazin.

    The same core team that created Codeanywhere, a cloud-based integrated development environment (IDE), is also behind the development of Daytona. The issue that organizations previously encountered when attempting to shift development to the cloud is that, in addition to regulations that forbid it, developers could not easily customize their environments. The Daytona platform is designed to enable more flexibility without sacrificing control, said Burazin.

    Arguably, organizations are more focused on developer productivity today than at any time in recent memory. Developers typically spend as much as 70% of their time maintaining environments versus writing code, so there is a clear need to reduce the level of toil. Reducing that toil doesn’t guarantee developers will spend more time writing code, but it does create the opportunity. DevOps teams are, as a consequence, being asked to eliminate as many of the bottlenecks that conspire to reduce developer productivity as possible in furtherance of that overall effort.

    Developer productivity issues are not going to be resolved overnight. Developers will not always be immediately inclined to give up control unless it’s conclusively proven that a platform engineering team will be responsive to their needs. The cultural challenge is finding that fine line between reducing friction while still giving the developer the sense that they can add a tool to a workflow that enables them to innovate.

    One way or another, change is coming to DevOps workflows. Each organization will need to determine how quickly that change will occur, but in the absence of any meaningful change, it’s clear they won’t be able to compete against rivals capable of producing higher-quality code faster.