devopsy.kinsta.cloud

Category: DevOps in the Cloud

Protecting CI/CD Pipelines to Secure the Software Supply Chain

Cloud-native applications have become increasingly complex. Composed of an infrastructure stack of mash-up code, hundreds of open source and commercial components, services and APIs, today’s software supply chain is fraught with security risks. At the same time, the ability to manage existing application requirements while building innovation and taking on new areas of responsibility like security is stretching DevOps teams beyond their capacity. The concern for the number of connected and exploitable weaknesses across the software supply chain are now requiring organizations to take a proactive approach to protect their continuous integration and continuous delivery (CI/CD) systems, as they have become a target through which attackers infiltrate multiple production systems. But meeting this requirement is no easy feat as it often requires organizations to choose between how much security to enforce in the build cycle while quantifying their risk to build and deploy quickly.

A recent survey revealed that nearly all (97%) of an organization’s assets—and security issues—are now in the cloud. And yet, only 29% of an organization’s assets are associated with cloud-specific policies. Addressing this gap requires organizations to have a proactive approach to protect their technology infrastructure, especially securing the artery of their software supply chain: The CI/CD pipeline. By embracing new security and compliance strategies within their governance approach, organizations can better protect their CI/CD pipeline and cloud applications.

There is a growing shift toward programmable infrastructure and infrastructure-as-code (IaC) practices to build out infrastructure and manage configuration files. But with this practice comes the increased risk of exposing application credentials, API keys, encryption keys and digital certificates. Tools supporting the CI/CD pipeline have now become the artery of cloud applications, and it’s becoming more challenging to store, transmit and audit data securely. In addition, when CI/CD tools interact with other systems in the DevOps environment, it increases the risk of exposure for configuration files. A compromise in the build system, for example, can be used to get access to production systems that can result in the exposure of sensitive information or the injection of malicious code, corrupting the entire CI/CD pipeline and thus the software supply chain.

A recent Unit 42 Cloud Threat report revealed that overly permissive credentials created added risk opportunities in the CI/CD pipeline. The study found that 63% of IaC templates contained misconfigurations and 91% of container images contained high or critical security vulnerabilities. To address this, organizations need to catch security problems in the build process before cloud workloads are provisioned. During the SolarWinds compromise, for instance, attackers used custom malware designed for the company’s build cycle to observe each step. The sophistication of the intrusion in this attack during the software build process is a key lesson for DevOps and DevSecOps professionals and revealed how security needs to be approached.

One way to address this is by being able to identify CI pipeline misconfigurations, which can improve security in the software supply chain. Because CI pipelines are configured in the code, the same policy-as-code approach can be used to identify IaC misconfigurations or open source vulnerabilities to surface CI/CD weaknesses. DevOps and developer teams can keep configurations accessible to just a small group who are building for production release. By establishing enforceable permissions to the pipeline, there is better control over who can commit code changes to the repositories, create containers and deploy code to different environments.

Strong chains of trust throughout the build cycle are not commonplace today. But as organizations look at ways to strengthen their risk posture by shifting left, security and DevOps teams can work toward proactively hardening pipelines with the right CI/CD tools and frameworks and push the industry toward a more secure software supply chain.

October 7, 2022
Linux 6.0 is Faster, Cooler | Debian Goes Proprietary | Google Africa Region

Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

This week: Linux 6.0 promoted to Stable, Debian 12 will include closed-source binaries, and Google Cloud opens its first Africa region. (more…)

October 6, 2022
What’s Next for Cloud Computing? Distributed Cloud
The public cloud has greatly advanced IT by allowing teams to interact with their data and write new applications in a cloud-native way. The cloud simplifies the application development process, provides services on demand and allows you to pay as you go. There has been phenomenal growth in public cloud use and all estimates show that it is likely to keep growing in the near future.

Nevertheless, most IT computing still takes place outside of the public cloud, simply because there has been no effective way to consume cloud-native services outside of data centers (or “regions”) operated by the hyperscale cloud providers. This location constraint negatively affects cloud computing in three main ways: Performance (latency, throughput), data sovereignty (residency, regulations) and commercial considerations (legacy architecture, pricing).

As a result, to realize the cloud’s fullest potential, many enterprises are turning to a recent innovation in cloud computing: Distributed clouds that are untethered to specific locations or regions.

How does this work? Through APIs, the distributed cloud connects to any IT stack in any location and provides cloud functionality as if running on a hyperscale cloud. However, instead of running in a dedicated location, it runs on existing infrastructure on top of any IaaS, virtualized environment or bare-metal machines. It is agnostic to the stack’s underlying physics and doesn’t require any installation or capex. It runs workloads in any environment: Commercial data center, on-premises facility, edge microcenter or even in a multi-facility hybrid environment.

How the Cloud is Transforming Enterprise and SMBs

Modern application development lives and breathes cloud computing. It’s been the enabler for much of the recent progress with modern applications—such as those dedicated to IoT, smart cities and personal health, for example—and will continue to be the infrastructure on which enterprises and small businesses develop new innovations. But as more and more businesses employ a cloud-first approach using cloud-native architectures and technologies, “IT budget” has become synonymous with “cloud budget.” And this is often a very expensive proposition.

Therefore, the next step for many businesses is to manage cloud computing costs while supporting legacy and cloud-native applications as well as cloud migration. Their computing strategy may be simultaneously on-premises, bare metal and hybrid across multiple continents. And so they need a cloud with architectural latitude to match their needs as well as their budget.

This flexibility is provided by the customizable distributed cloud. By facilitating interoperability with existing infrastructure, it enables enterprises to deploy and infinitely scale applications anywhere they need. The more openness they have in terms of where they run applications, the more freedom they have to optimize their budget.

Who is Driving Cloud Computing Innovation?

Amazon, Microsoft and Google have gone from being the innovators in cloud computing to being the incumbents. Innovation in the cloud is coming from startups as well as legacy IT companies. Here are a few examples:
- Kyndryl has emerged as one of the system integrators of choice when the Fortune 500 look to innovate and modernize their IT and application infrastructures. Kyndryl has been engaged by large companies to solve many of the challenges that cloud computing has created. One of the innovations they have championed is the distributed cloud.
- NetApp has spent over $2 billion on more than a dozen acquisitions to build their cloud portfolio. Their focus has been on creating a portfolio that gives enterprises the ability to bridge their various compute and storage infrastructures to the cloud. As opposed to assuming that their customers will have greenfield implementations on cloud infrastructure, NetApp has built a portfolio that allows them to meet their clients where they currently are in terms of architecture and to shift from there into more cloud-native capabilities.
- Zenlayer has built cloud infrastructure in diverse geographies, giving them global reach that even the hyperscalers can’t rival. Zenlayer claims to provide cloud infrastructure that is so globally distributed that they are within 25 milliseconds of latency from 85% of the world’s internet population. This focus on physical infrastructure locations that enable global performance is an important innovation for many modern applications.
Emerging Cloud Computing Innovations

The distributed cloud, which integrates programmatically into any existing local infrastructure, is an innovation that drives businesses forward by providing them with a cloud that can be customized for specific locality requirements. Without requiring any installation, its cloud-native building blocks leverage existing servers to run application workloads in any environment—private, public, on-premises and hybrid.

As a result, application owners are able to build an optimized cloud computing strategy, taking advantage of existing and available infrastructure in the location—or multiple locations—of their choosing.
October 6, 2022
Driving Organizational Success With the 2022 State of DevOps Report
“Ship it!”

We have just completed the research and analysis for the 2022 Accelerate State of DevOps Report (SODR) and oh boy, do we have some interesting things to share! First, let me take a short step back for those of you that may be new to the DevOps Research and Assessment (DORA) and our annual report, the SODR. DORA is an academically rigorous research program that seeks to answer the questions, “What practices enable teams to be high-performing software teams? And how do these practices impact organizational performance?”

Since 2014, we have surveyed 33,000 practitioners around the world spanning all major industries. The project is intentionally–and staunchly–tool- and platform-agnostic. The research builds on itself, and each year we seek to both evaluate previous findings and expand in other directions or areas of research. This is important to note because many of the core findings, such as “software delivery performance drives organizational performance,” have been validated year after year. I would encourage you to go back and read all the reports from years past.

Security

This year, we doubled down on our 2021 research into software supply chain security by looking at the technical practices that improve software supply chain security and the non-technical practices that impact an organization’s ability to excel at securing their software supply chains. We leveraged two frameworks to focus our research: Supply Chain Levels for Software Artifacts (SLSA) and NIST’s Secure Software Development Framework (SSDF). Below is a summary of some of our key findings in this area:
- Shifting left on security is a broadly adopted practice. Our research shows that two-thirds of respondents are actively pursuing software supply chain security by seamlessly baking security into the development process.
- Culture is the primary driver of security practice adoption. One might expect that technology is the primary driver, but our research showed that a generative organizational culture (eg. performance-oriented, highly cooperative, shared risk) leads to healthier software practices.
- Technical practices around CI/CD predict success in security. Companies that use source control, continuous integration (CI) and continuous delivery (CD) have more established SLSA practices. These practices shift security left to the developers and ensure consistent security scanning.
- Cloud enables secure software practices. The five characteristics of cloud computing as defined by NIST enable the successful adoption of software supply chain security which, in turn, predicts greater organizational performance.
Our research showed that companies who prioritize and excel at securing the software supply chain experienced fewer service outages, anticipate fewer security breaches and demonstrate high levels of both software delivery performance and organizational performance. The data showed that through the use of modern practices like continuous integration, teams can improve their security posture and even amplify the positive impact these security practices have on software delivery metrics (MTTR, deployment frequency, lead time-to-restore service) and overall organizational performance.

Culture

We saw above that the biggest predictor of an organization’s application development security practices was the presence of a generative organizational culture based on shared risk and information sharing. We also see that elements of these types of cultures lead to higher overall organizational performance, as well. Our research showed that high organizational performance can be achieved by fostering environments that are:
- Supportive: Teams that felt supported and that they had buy-in from leadership (e.g., more financial support, more allocation of resources, sponsorships, etc.) were associated with high-performing organizations.
- Stable: Teams that did not experience much change in membership over the last 12 months were more likely to be a part of high-performing organizations.
- Flexible: Organizations with higher levels of working flexibility around where work was performed–remote, in-person or hybrid–were higher-performing overall.
We also looked at burnout again this year and expanded the scope to understand which elements of culture contributed to lower levels of burnout. We found that generative culture, team stability and work flexibility all contributed to a reduction in burnout among employees.

Reliability

In previous years, our research told us that those that excelled in technical practices also excelled at organizational performance. This year, we have more nuanced data about this topic. This year, we saw that software delivery does not predict strong business outcomes unless these practices were paired with reliability. Think about it–will a customer be satisfied with new features if the service isn’t stable? What is the benefit of pushing code quickly into a fragile environment? Reliability is an essential component of driving organizational performance through software delivery performance.

We also see that site reliability engineering’s (SRE’s) impact on organizational performance is non-linear; reliability engineering practices often do not result in additional reliability or organizational performance until a certain maturity is reached. It’s important for teams to know this and approach their SRE practice as an investment. It will likely not be sparkly ponies and unicorns initially as you build the reliability muscle but, as you advance, high performance and success are likely.

Cloud

Public cloud use is up a whopping 36% over 2021, whereas companies reporting no cloud usage at all are down by 50%. The use of hybrid cloud is up by 25%. Unsurprisingly, the use of cloud computing was associated with higher organizational performance. In past years we saw that it wasn’t “using cloud” per se that led to organizational performance, rather it was the achievement of the five essential characteristics of cloud computing–on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. This year, we saw that cloud computing enabled things like reliability, continuous delivery and improved supply chain security which drive organizational success.

Over 50% of folks who took our survey reported that they leveraged multiple cloud providers. We asked respondents what benefits they realized from using multiple cloud providers. Here are the top three:
1. Availability
2. Leveraging the unique benefits of each provider
3. Trust is spread across multiple providers
Given the fact that reliability seemed to be the key to being a successful software delivery shop as well as a successful organization, it is not surprising to see availability listed by almost 63% of respondents as a benefit derived from using multiple clouds.

Summary

Our research continues to progress and we continue to dig deeper and deeper into the capabilities and practices that impact your business. We see broad adoption on the topics of security and reliability which are both heavily anchored in culture. Good culture leads to success. Period. There is no magic culture button and it takes work, but it is very achievable. Start by defining organization-wide or line-of-business-wide goals and then just start continuously improving. Don’t worry about creating a three-year plan for improvement; create a one-month plan and just get to work instead. At the end of that month, evaluate your learnings, refine your focus and get back to work. With a commitment to hard work and continuous improvement, your investments should start paying off and, as an added bonus, you’ll have a better culture.

We hope you have enjoyed these juicy findings as much as we have and we encourage you to read the entire 2022 State of DevOps Report.

Also, please join us at dora.community to continue the discussion about these findings and to share and discuss your experiences on your journey toward excellent software delivery and operations.
October 6, 2022
EvolveWare Further Automates App Modernization Tasks

EvolveWare today announced it has added an Agile Business Rules Extraction capability to its Intellisys application modernization platform.

EvolveWare CEO Miten Marfatia said the Agile Business Rules Extraction capability eliminates the need to freeze code development while applications are either being shifted to the cloud or refactored. Instead, the Intellisys platform will now keep track of updates to code and apply them once the application has been modernized, he said.

Code updates can now be transferred automatically into the extracted business rules repository without affecting the rules that are not impacted by the updates. For rules impacted by the updates, a report is generated that highlights the changes. IT teams can now also update business policies and modernize applications concurrently via the repository that also keeps track of documentation such as diagrams, logic, database details and critical dependencies, said Marfatia.

In addition to presenting logic in multiple formats, including pseudo-code, flowcharts, decision tables and business analyst language, it enables consolidation and optimization actions to be reverted to their original state if required.

In general, IT teams have been struggling with application modernization efforts that require them to either lift and shift a monolithic application running in an on-premises IT environment into the cloud or refactor it into a set of microservices that run natively in the cloud. Eventually, most organizations will refactor monolithic applications, so the debate becomes to what degree to undertake those efforts before lifting and shifting an application into the cloud. Most monolithic applications were not designed to run in the cloud, so when the app is shifted it’s not uncommon for any number of performance issues to be encountered.

EvolveWare claims that its Intellisys platform reduces the cost of application modernization by as much as 60% by eliminating much of the manual effort that would otherwise be required. Modernization efforts, in general, are hindered by manual processes that should be automated, said Marfatia.

The issue that most DevOps teams encounter when modernizing an application is that it is not a task they regularly perform. As such, many of the processes required have not been automated with the same level of zeal they’ve applied to more routine manual tasks. The Intellisys platform is designed to enable IT teams to automate the most common tasks associated with migrating an application to another platform.

The biggest driver of those migrations these days has been digital business transformation efforts that have accelerated since the start of the COVID-19 pandemic. Organizations of all sizes are moving applications to the cloud to ensure greater availability and resiliency to limit the amount of disruption that might be encountered should the pandemic worsen, or in case some other unexpected event makes accessing IT services difficult.

The challenge, of course, is moving applications—and the database they depend on—from one platform to another is not easy. It can take some organizations months, sometimes even years, to make the transition. Given the backlog of applications that many organizations are looking to migrate to another platform, it’s clear there is a need for much higher levels of automation to accelerate a transition that, on its present trajectory, might take years to complete.

October 4, 2022
From Cloud Chaos to Cloud Smart With Multi-Cloud Services

Organizations that embrace multi-cloud services experience real results and a heap of advantages—including greater resiliency, agility and data sovereignty. This is why it’s no surprise the majority of enterprises today are using two or more public clouds, with 81% reporting in a recent survey that they plan to adopt a multi-cloud strategy by 2024.

But despite the benefits, it’s also been proven that multi-cloud can be complicated and even overwhelming. It requires an entirely new approach to optimize workloads, simplify development and tackle a growing pattern of operational complexities. This has been described as cloud chaos, where greater cloud choice has led to a massive spike in complexity. Most report that building new apps is slow and cumbersome, and managing their entire app portfolio across disparate clouds is difficult and expensive. No wonder, when each cloud requires its teams to use proprietary tools that are siloed and incompatible with one another. Meanwhile, for the average employee, getting fast, secure access to critical apps from anywhere is imperative, yet it’s often a challenge. All this complexity has broad repercussions on the business, from managing costs to attracting and retaining top talent.

Tackling this multi-cloud complexity needs to start with creating a layer of abstraction that spans various, diverse cloud environments and doesn’t hinder access to each cloud provider’s unique services. However, organizations must take it a step further to solve the challenge of how best to build, manage, govern and optimize apps and workloads across a multi-cloud environment.

Multi-Cloud Services

Multi-cloud services—a fast-emerging category of IT services—are the key to helping organizations implement a multi-cloud strategy that simplifies and streamlines development, operations, networking and security across clouds. A multi-cloud service provides a consistent API, object model, identity management and other core functions across clouds. And, it has one or more of the following characteristics:

1. Runs on a single cloud but supports interactions with at least two different clouds
2. Runs on multiple clouds and supports interactions with at least two different clouds
3. Runs on any cloud or edge, even in disconnected mode, and basic operations are fully automated

Multi-cloud services can be used to standardize cloud infrastructure and operations into one platform to reduce the complexity of individually building or consuming the equivalent native services from multiple clouds. In this model, public clouds, data centers, private clouds and edge locations are all verticals, and multi-cloud services are horizontals that provide functionality across these environments.

Let’s take a closer look at the five most common categories of multi-cloud services and when to use them.

1. Application Services

Application services allow teams to use core services in a standardized manner across clouds. These core services include observability, replication, backup, and restoration. By implementing application services, enterprises can increase their speed of innovation and make their technologies easier to use. Examples of application services include developer tooling, databases, modular development platforms, artificial intelligence, machine learning and serverless and CI/CD capabilities.

2. Infrastructure Services

If your organization chooses to run its applications as VMs, containers, or both, using infrastructure services is the right move to standardize management and operations across the clouds. Different types of multi-cloud infrastructure services include the ability to manage and observe compute, storage and network services leveraging VMs or containers, infrastructure automation and Kubernetes management solutions. When applied, infrastructure services can improve resiliency, security, performance, interoperability and portability.

3. Security Services

When using multiple clouds, an issue enterprises run into is that each individual cloud has its own security tools and approaches, making it difficult to ensure your enterprise is protected against cyber threats. That’s where multi-cloud security services come in – centralizing security operations and secure software supply chains. Some examples of multi-cloud security services are network detection and response, endpoint detection and response, next-gen antivirus and secure access service edge. These services enable organizations to achieve cohesive visibility, context and control by providing a single interface.

4. End-User Services: Access to Data and Services

No matter how big your enterprise is, or how many applications you use, it’s necessary to provide the right level of access to applications and data. But this can prove difficult when you have a multi-cloud infrastructure. Multi-cloud end-user services, which consist of virtual desktops, device management and end-user application delivery, will provide your organization a uniform way for all employees to have quick, secure access to your applications, all while simplifying device management.

5. Data Plane

In the past, workloads were restricted to a single data plane contained within a single public or private cloud or edge location. Now with the rise of multi-cloud services, enterprises can run workloads in the multi-cloud data plane. A prime example of workloads running in the multi-cloud data plane is a distributed application that runs in multiple cloud provider environments. Part of the application might run in the private cloud and the other services are deployed in a public cloud. The multi-cloud data plane is where the containers, services and data exist and where user interaction occurs.

From Cloud Chaos to Cloud Smart

The desired destination of every multi-cloud journey should be to move from a position of cloud chaos to one of cloud smart. Being cloud smart means taking an architected and planned approach to multi-cloud and digital transformation. As more enterprises adopt multiple clouds, multi-cloud services will be key to becoming cloud smart by helping to reduce complexity and risk and proving the freedom to select the right cloud for all situations based on technical and business requirements.

October 4, 2022
Dynatrace Adds Grail Data Lakehouse to Observability Platform

Dynatrace today announced it has added a data lakehouse, dubbed Grail, to the Dynatrace Software Intelligence Platform to make it simpler to aggregate all the observability data an IT team collects.

Bob Wambach, vice president of product marketing for Dynatrace, said Grail will initially drive analytics of log data but in time will also be applied to additional types of application development, security and business intelligence data.

The goal is to streamline processes such as data indexing and rehydration across a unified observability platform that eliminates the need to maintain multiple disparate repositories, he added.

Grail, at its core, is a causational data lakehouse based on a massively parallel processing (MPP) analytics engine that will initially be made available on the Amazon Web Services (AWS) cloud. IT teams can use the Dynatrace Query Language (DQL) to query data stored in the data lakehouse. Additionally, the Davis artificial intelligence (AI) engine that is already embedded within the Dynatrace Software Intelligence Platform will be able to apply machine learning algorithms to the data stored in Grail.

Data lakehouses have recently emerged as an approach to enable organizations to apply the structure of a data warehouse platform to massive amounts of data that previously would have been stored in a data lake. In effect, a data lakehouse combines the attributes of both types of platforms for centralizing the management of data. One of the biggest issues with any approach to observability is the massive amount of data that winds up being stored to allow DevOps teams to track issues over time.

Of course, it’s up to each individual IT team to determine how much data they want to save to drive analytics, but the more data they save the more cloud storage costs will naturally increase. Grail provides a purpose-built means of consolidating data silos in a way that reduces the total cost of observability, noted Wambach.

In general, because of the need to embed a data lakehouse capability, most observability platforms will be consumed as a software-as-a-service (SaaS) application. That means the number of IT teams that will likely build and maintain their own observability platform will be limited. IT teams are also now struggling to manage increasingly complex IT environments made up of both cloud-native applications built using microservices and legacy monolithic applications. In fact, a global survey of 1,303 CIOs and senior IT practitioners commissioned by Dynatrace found 71% of respondents believed the explosion of data produced by cloud-native technology stacks is beyond the ability of IT staffs to manage without help from an AI platform.

It’s not clear how quickly IT teams will be migrating from legacy monitoring tools that are designed to track specific metrics to observability platforms that promise to make it easier to identify the root cause of an issue by simplifying the launch of queries against a massive pool of data. However, as organizations continue to become more dependent on software, it’s apparent that the level of tolerance for any kind of disruption is steadily declining; it’s now more a question of when rather than if a different approach to managing IT will be required.

October 4, 2022
Cosmonic Previews Deployment Platform for Distributed Wasm Apps

Cosmonic has made available a preview of a platform for deploying applications built using the portable WebAssembly (Wasm) binary format that enables applications to be deployed on any platform.

Cosmonic CEO Liam Randall said the company is providing early access to the Cosmonic Platform Developer Preview platform to enable developers to experiment with a new type of software artifact that will be used to build a new class of cloud-native applications.

The Cosmonic Platform Developer Preview platform is based on wasmCloud, an open source application runtime that hosts components written as Wasm modules that can then be loosely connected to build applications. Originally developed under the auspices of the World Wide Web Consortium for building browser applications, Wasm is a portable binary instruction format for building software that describes a memory-safe, sandboxed execution environment.

That approach replaces the current predominant method for building software that relies on the aggregation of software components that tend to lack distinct boundaries. It’s that lack of distinct boundaries that enables malware to flow so easily from one software module to another. The wasmCloud runtime, originally developed by Cosmonic, provides a platform for deploying distributed Wasm applications and is now being advanced under the auspices of the Cloud Native Computing Foundation (CNCF).

Prior to Wasm, Randall noted, every format for building applications led to the creation of ‘walled gardens’ that resulted in developers being locked into a platform. Wasm is the first software artifact that enables applications to run on an platform, including Linux and Windows, without any modification required, said Randall.

It may be some time before Wasm becomes the preferred artifact for building applications, but it’s clear the walls that have separated one IT platform from another are about to crumble. Once applications become much more portable, the longstanding goal of writing an application once and then deploying it anywhere may finally be achieved. Just as importantly, those applications will run in a memory-safe sandbox that is more secure than what can be enabled in legacy IT platforms. In fact, as more organizations review the security of their software supply chains, they may decide to accelerate their embrace of Wasm to build more secure applications.

Naturally, the transition to Wasm will have major implications for DevOps teams, as it represents an opportunity to streamline deployment processes across multiple platforms. In effect, the total cost of application development and deployment would decline as processes spanning multiple platforms become more automated using platforms such as wasmCloud. Ultimately, much of the infrastructure complexity that developers need to navigate today would be eliminated, noted Randall.

It’s not clear just yet to what degree Wasm will drive a transition to another era of computing, but the potential to change almost every aspect of IT is on the horizon. Ultimately, the issue will be decided by how quickly developers are willing to embrace yet another software artifact for building and deploying applications. What is clear is that the number of platforms that will make it possible to experiment with Wasm are starting to multiply.

October 3, 2022
Business Leaders Will Trade Speed for Security

A global survey of 600 C-level executives conducted by CloudBees found that when it comes to building software, more than three-quarters of respondents said it is more important to be secure and compliant than fast and compliant.

As a result, more than three-quarters (77%) also noted their organization is implementing a shift left strategy for implementing security and compliance even though 58% recognized that those efforts created additional burdens for developers.

Three-quarters of respondents also conceded that compliance (76%) and security (75%) challenges limited their company’s ability to innovate. Nevertheless, 83% said shift left is important for them as an organization despite the fact that 88% of executives said their software supply chain is secure or very secure. However, only 33% of respondents said their software supply chain is completely compliant.

Not surprisingly, 86% are focusing on compliance more now than they were two years ago and, in the wake of a series of high-profile breaches of software supply chains, 82% are more concerned about attacks.

CloudBees CEO Anuj Kapur said it’s clear there is a greater need to reduce security and compliance burdens for developers by putting guardrails in place that automate DevSecOps processes. The survey noted that only 22% of executives believed their software delivery supply chain is completely automated, while another 37% said it is close to being automated. Only 22% said their compliance process is completely automated, with 35% believing it is almost completely automated.

Three in five (59%) executives said they have all, or mostly all, external tools for security and compliance issues and 29% said they have a mix of internal and external tools. Only 11% use mostly internal tools. A full 90% said their risk management team has the tools, knowledge and expertise to build and/or maintain a secure software supply chain.

The real challenge, of course, is that while compliance issues are relatively static, new security issues arise all the time. Developers make mistakes or a new zero-day vulnerability is discovered after an application has been deployed in a production environment. It’s critical for organizations to embrace automation to enable developers to address those issues as part of a continuously automated update cycle, noted Kapur.

As more responsibility for compliance and security is shifted left, the degree to which DevOps workflows will need to be adjusted will naturally vary by organization. However, the days when developers could ignore security issues during the application development process are all but over. The leadership of organizations of all sizes are making it clear they want to see a reduction in the number of security and compliance issues that arise in production environments.

Ideally, efforts to build more secure and compliant applications would not slow down the rate at which applications are being built and deployed. However, the CloudBees survey made it clear that more executives are willing to prioritize security and compliance over speed of application development. The issue is how to strike a balance between what are clearly two competing priorities.

October 3, 2022
CloudBees Acquires ReleaseIQ to Advance DevOps Orchestration

CloudBees announced today it has acquired ReleaseIQ, a provider of an orchestration platform for automating software delivery via a software-as-a-service (SaaS) platform.

Sacha Labourey, chief strategy officer for CloudBees, said the addition of ReleaseIQ to the CloudBees platform will provide more visibility into and control over software delivery on an end-to-end basis.

CloudBees already provides a Flow orchestration engine within its continuous delivery platform. However, ReleaseIQ provides a similar capability across multiple continuous integration/continuous delivery (CI/CD) platforms using a SaaS platform that is more accessible.

The ReleaseIQ platform is designed to enable DevOps teams to both create and maintain pipelines using a no-code tool. That enables greater transparency into workflows via dashboards that also provide optimization recommendations. That capability makes it much simpler to troubleshoot software deployments.

Labourey said that while ReleaseIQ can be integrated with multiple platforms including CloudBees CI, Jenkins, CircleCI, GitLab, Bamboo, ArgoCD and others, the primary focus will remain on the open source Jenkins platform that still owns the lion’s share of the DevOps market. The overall CloudBees goal remains to employ automation and remove as much friction as possible from DevOps workflows as part of an ongoing effort to improve developer productivity, he noted. CloudBees, however, regardless of the level of DevOps maturity within any organization, is committed to meeting customers where they are versus requiring them to rip and replace existing investments, Labourey added.

The overall level of DevOps maturity may vary widely both within and between organizations. However, as more organizations realize the extent to which they depend on software to drive digital business transformation processes, the need to further automate application development and delivery becomes more apparent. While CI is widely used today, the number of organizations that have consistently implemented CD is fairly limited. The underlying infrastructure that software is deployed on typically has a unique set of application programming interfaces (APIs) that each CD platform needs to support. Platforms such as ReleaseIQ provide a higher level of abstraction through which managing the pipelines that deliver software becomes simpler.

In general, most organizations are trying to strike some level of balance between centralizing the management of DevOps workflows and enabling development tools to adopt whatever tools they prefer. It’s not uncommon for application development teams to independently adopt any number of tools that ultimately need to be integrated with a DevOps toolchain. Each of those tools, however, contains metadata that needs to be shared with a centralized orchestration engine that automates a range of tasks across multiple pipelines based on the metadata collected from each tool.

There are, of course, still a lot of manual DevOps processes that should be automated. CloudBees is positioning ReleaseIQ as the orchestration engine for both unifying the management of pipelines and, ultimately. enabling value stream management across increasingly complex application development environments. It may take a while to fully realize that ambition, but with the acquisition of ReleaseIQ, a new foundation is being laid.

September 28, 2022