devopsy.kinsta.cloud

Category: DevOps in the Cloud

  • CircleCI Adds Free Unlimited Access Tier to CI/CD Service

    CircleCI Adds Free Unlimited Access Tier to CI/CD Service

    CircleCI has added a free unlimited access tier to its continuous integration/continuous delivery (CI/CD) platform.

    Jim Rose, CircleCI CEO, said in contrast to other ‘freemium’ offerings, CircleCI’s free tier provides developers and DevOps teams with frictionless access to all the premium capabilities of the platform. Those capabilities include up to 6,000 build minutes per month, unlimited users, the ability to fine-tune pipelines using caching, concurrency, test splitting, security tools and health metrics.

    CircleCI claims more than 200,000 teams now employ its CI/CD platform. The freemium tier is intended to make it easier for a DevOps team to take advantage of a CI/CD platform as they begin an application development project, noted Rose. As that project evolves and matures, many of those teams will eventually require commercial support and other services provided by CircleCI, he added.

    The free tier of the CircleCI cloud service comes as many organizations attempt to accelerate the rate at which they can build and deploy applications. Digital business transformation initiatives, in particular, have become a much higher priority in the wake of the COVID-19 pandemic. A free tier of a CI/CD service is likely to encourage more experimentation simply because it reduces the level of overhead associated with setting up an application development environment.

    As the number of applications being developed continues to steadily increase, competition among CI/CD platform providers is becoming more intense as the number of organizations adopting DevOps best practices to accelerate application development increases. At the same time, more DevOps teams than ever are relying on cloud services to host CI/CD platforms in the wake of the COVID-19 pandemic.

    It’s still not clear whether DevOps teams will opt to rely on a proprietary platform versus an open source platform. While an open source platform prevents organizations from vendor lock-in, the ease of use of a cloud service may lessen those concerns as the cost of switching from one cloud service to another declines.

    One way or another, usage of CI/CD platforms will increase sharply in 2022. It’s not uncommon for different DevOps teams within the same organization to employ different CI/CD platforms despite efforts to encourage standardization. In the name of productivity, DevOps teams tend to exercise a fair amount of autonomy within many organizations.

    The biggest challenge, of course, will not necessarily be building applications but deploying them. Despite the availability of CI/CD platforms, the processes that most organizations rely on to deploy an application are still largely manual. In the age of the cloud, however, it should become easier to automate application delivery thanks to the APIs cloud service providers expose. In fact, 2022 may be the year that DevOps teams finally master CD. Providers of CI/CD platforms, of course, have a vested interest in making sure the full promise of an integrated CI/CD platform finally becomes an everyday DevOps reality.

  • Survey Predicts Massive Migration to the Cloud

    Survey Predicts Massive Migration to the Cloud

    A global survey of 1,600 enterprise IT decision-makers found more than half are working for organizations that plan to eliminate the use of data centers over the next two years.

    The survey was conducted by Aryaka, a provider of a secure access service edge (SASE) platform, and found a quarter of the respondents have closed 25% to 50% of their office sites; 75% of respondents said at least a quarter of their employees will remain remote permanently post-pandemic. Just under a third (32%) expect at least half of their workforce would be permanently remote.

    Despite the apparent accelerated shift to the cloud, the report found a full three-quarters of respondents (75%) are projecting at least a 10% growth in IT spending, with a quarter expecting IT budgets to grow 25% or more. Nevertheless, more than a third (36%) report they have IT cost concerns.

    David Ginsburg, vice president of product and solutions for Aryaka, said the shift to the cloud in the wake of the COVID-19 pandemic is being driven mainly by digital business transformation initiatives that require applications be quickly built and managed by IT teams that are working from home themselves. With the pandemic entering the third year, a hybrid workforce that regularly shifts between home and the office is now permanent, he noted.

    Consequently, with more people working from home, nearly two-thirds of respondents (64%) said they will shift toward a SASE-based approach over the course of the coming year to provide secure access to cloud applications over a software-defined wide area network (SD-WAN). Over two-thirds of those respondents said they will opt for a managed SASE offering rather than build and maintain these platforms themselves.

    SASE was originally coined by Gartner to describe a cloud-delivered service that brought together networking and security offerings. Those offerings should include a firewall-as-a-service (FWaaS), secure web gateway (SWG), cloud access security broker (CASB) and zero-trust network access (ZTNA). In effect, it’s a secure software-defined wide-area network (SD-WAN). As organizations adopt SASE-based platforms and services, just under a third of respondents (61%) are recognizing that dynamic bandwidth reallocation will be a very important requirement as workers shift between the office and home.

    The transition to SASE involves setting a strategy (35%), phasing out of legacy virtual private networks (32%) and consolidating cloud security with zero-trust (29%). Top desired capabilities include SWG (47%), SD-WAN (36%) and FWaaS (28%). A full 41% reported that responsibility for networking and security decisions have now been consolidated into a single team. However, only slightly more than a third (34%) said security is a major priority.

    The implications of a shift to the cloud at this rate and level of scale are likely to have a profound impact on DevOps teams. While cloud infrastructure is designed to scale on demand, accessing applications across an SD-WAN can have a significant impact on application performance. The survey, however, finds only 29% of respondents are concerned about whether applications will perform properly. Nevertheless, well over two-thirds (69%) said there will be an increased focus on observability and control, while 42% noted identifying slow performance for remote and mobile users will be a key issue and 37% expected slow performance at the branch office to also be an issue. Lackluster application performance is a time sink, according to 42% of respondents.

    Naturally, many IT teams will add new tools and platforms to deploy and manage cloud applications. The Aryaka survey found that only slightly more than a quarter of respondents are concerned about the newness of the technology they might employ.

    The coming year is shaping up to be incredibly disruptive to the IT landscape. The challenge is making sure balance is maintained between cost, flexibility and application performance.

  • Enabling Cloud Adoption in the Government

    Enabling Cloud Adoption in the Government

    In 2022, federal agencies are estimated to spend $7.8 billion on cloud computing. While this spending on cloud computing is necessary, it’s imperative that the government uses its allotted funding appropriately to leverage the cloud’s full potential and avoid common pitfalls.

    Avoiding Common Cloud Adoption Pitfalls

    I’ve frequently witnessed government agencies get locked into a cloud reseller that doesn’t give them the full capabilities offered by AWS, Google Cloud or Microsoft Azure. Most people outside of the federal market don’t realize that the government does not buy cloud directly from the cloud providers—apart from some very large contracts like the upcoming JEDI replacement contract vehicle, JWCC. They buy through a network of reseller partners that offer volume discounts and try to bundle managed services to help with cloud management.

    This approach gives the reseller, not the customer, the power to hold the keys to their kingdom—and can make it difficult for the customer to easily switch between cloud providers in the event of poor performance, lack of access or billing transparency. The federal government would benefit from keeping a small, but purposeful, cloud project management office (PMO) in-house. Thus ensuring that root access is available to all the accounts, subscriptions and projects to provide freedom to the agency to more easily change partners as their cloud maturity evolves.

    I’ve also seen government customers unfocused on the holistic end-user experience of actually using the cloud. The result is fragmented collections of different systems, processes and steps that cause engineers to be frustrated and inefficient. Customers must transform the end-to-end cloud provisioning process so that self–service is paramount and existing technology investments are seamlessly and transparently integrated to the end-user. When done correctly, innovation will be the byproduct, because focus can go towards developing the next generation of mission systems and tools—rather than trying to determine how to get a cloud account to begin a project.

    Three Steps Government Agencies Can Take to Get Value from Cloud Infrastructure

    Challenges exist, but there are proven steps the government can take to get the most value from their cloud infrastructure.

    • Define purpose: First and foremost, understand the purpose the cloud infrastructure intends to serve. Are you looking to reengineer cloud architecture, become more cost-efficient, or transform the innovation potential within your organization by introducing new services that can take you farther, faster? Understanding this purpose and your goals will go a long way towards success.
    • Quantify ROI: To get the best return on your investment, understand what resources are already available and which are necessary for your operations. To fully take advantage of the cloud, it is important to make sure basic costs are under control, such as ensuring AWS EC2 or Azure VM instances are not overprovisioned or underutilized. It’s equally important to make sure you take advantage of reserved capacity reservations for your predictable workloads; these can save you 30% or more. Last but not least, keep a focus on fully leveraging technology solutions to help bring all the pieces together in an integrated user-friendly experience across cloud providers.
    • Consider the outsourcing approach: Bringing in cloud resellers and contractors can provide guidance to your organization and help you make better choices. Just like building or renovating a house, agencies need general contractor-type companies that can help to manage and orchestrate the process of migrating to the cloud and all of its moving pieces. These contractors can also help to locate the various specialists required to get the job done for each unique situation. Long term, having a small, efficient cloud PMO is something every agency should strive to have in-house; however, given the demand for cloud engineering talent, the near-term focus should be to ensure flexibility into engagements with partners, so that they don’t hold back the potential of the organization.

    As digital transformation and cloud migration continue, it’s important for the government to stay on pace with its adoption. As of now, most agencies are still relying on manual steps to validate controls and get Authorizations to Operate (ATOs) approved. Making the simple swaps to more automated processes, learning how to leverage cloud resources to their full ability, and outsourcing operations to contractors can make acceleration easy.  There has never been a greater need for cloud enablement. The time to scale up is now.

  • 2022 Predictions: AI, Security and Cloud

    2022 Predictions: AI, Security and Cloud

    It is difficult to find a single area of the technology landscape that isn’t incorporating artificial intelligence (AI) into products and services. As we move into a world where distributed computing is the norm for business operations, AI is a requirement given the increasing level of complexity in computing environments. While there are many different ways AI is penetrating computing, I think that there are a few specific areas where we will see a huge amount of growth in terms of innovation and investment. 

    AIOps will be at the forefront of monitoring and managing distributed computing environments.

    2022 will be a busy year for AIOps vendors and product offerings. Expect that, in 2022, you will see a massive number of large enterprise software companies bringing AIOps offerings to market—either as part of distributed computing management suites or as individual tools. In addition, there will be a flurry of well-funded startups entering the space. One of the first areas where AI models are productized is in the area of AIOps. AIOps provides the ability to apply machine learning models and automation based on data about the patterns and anomalies within IT operations. AIOps is an implementation of observability and helps businesses monitor and manage their IT environment based on collecting and managing data about operational patterns that are expected and correct. It also determines when there is an action that is outside of the norm, and provides either an automatic correction or offers IT operations management the ability to correct errors before they impact business operations. 

    Expect a year of consolidation in advanced analytics, security and solution clouds. 

    We’ve already seen 2022 kick off with a flurry of acquisitions. While we haven’t seen blockbuster buys, we have seen smaller acquisitions by big vendors that need more to sell their existing customer base. One exception is Alteryx, which purchased cloud-native analytics vendor Trifacta for $400 million in cash. In contrast, IBM recently purchased Envizi, an Australian data analytics firm focused on analytics for environmental, social and governance (ESG) requirements. This is just the beginning. We expect there to be a flurry of acquisitions in the hot observability market (solutions focused on analyzing how well the internal states of a system can be inferred from knowledge of its external outputs).

    As security continues to grow in importance, key emerging security vendors also will be hot commodities in the acquisition space. For example, Microsoft has acquired RiskIQ, a security software vendor focused on gathering threat intelligence about a wide range of cyberattacks across multiple public and private clouds. We also predict that many of the large cloud vendors will move aggressively to buy cloud business solutions.  

    Looking Forward

    It is easy to get caught up in the flurry of announcements and acquisitions coming at us fast and furious. However, the reality is that businesses need to know that whatever new shiny objects are introduced, these solutions need to be able to solve real customer problems that impact revenue and growth. It may sound obvious, but I think that vendors need to pay a lot more attention to customer pain. 

  • IT Ops Trends: Cloud, Containers and COVID

    IT Ops Trends: Cloud, Containers and COVID

    Almost all companies are modernizing their IT infrastructure to remain competitive, with the focus firmly on migration to the cloud and the use of dynamic infrastructures. In a recent Trends in IT Ops 2021 survey, more than 160 IT professionals were asked how the implementation of IT strategies affected their day-to-day work. The results provided an impressive insight into the current work priorities of system administrators and IT Ops in general.

    According to the survey, most administrators believe that monitoring cloud (79%) and container (73%) environments will take on a more important, or much more important role for them in the future. Additionally, 59% of those surveyed agree that their job role has evolved over the years due to cloud computing and containerization.

    Not all IT Teams are Equal

    However, the data also shows that the changes are not affecting every IT team equally. For example, 37% of all respondents say that cloud solutions are not relevant—or less relevant to them on a day-to-day basis. This response shows that on the one hand, system administrators see cloud computing as an essential topic. However, on the other, the impact in practice is not felt to the same extent by every administrator. These responses show that not every administrator has to deal with cloud platforms on a day-to-day basis, with some being ‘siloed’ into dedicated teams that may not interact with the broader corporate cloud strategy. In addition, not every organization has fully committed to the cloud, with some finding their migration hindered by applications that are not suited to cloud migration.

    In the survey, 45% of respondents also said they believe the importance of monitoring physical infrastructure will not change in the next few years. However, 43% believe that monitoring physical systems will become more important or much more important. Conversely, a mere 1% replied that they thought physical infrastructure monitoring was less critical. 

    Taken together, these responses demonstrate that, despite the excitement around the cloud, many organizations take a hybrid approach to infrastructure. IT Ops and administrators recognize the importance of monitoring cloud systems and dynamic assets while, at the same time, the monitoring of local systems remains relevant or is even expected to gain in relevance.

    Network Management and Automation

    Cloud and containers enable faster growth of IT environments and promote digitalization. However, they also lead to a sharp increase in data traffic and more complex networking of systems. As a result of these changes, the demands on local networks are growing. This increasing demand demonstrates the importance of network management tools. 81% of respondents said that solutions in this area are relevant, or very relevant to them in their day-to-day work.

    This year, the move to a home office joined the trend towards migration to the cloud, containers, and network monitoring. In the wake of the COVID-19 pandemic, many IT departments had to adapt their infrastructure to allow employees to work from home offices. However, most administrators were relatively stress-free, with 54% saying they had no trouble adapting infrastructure to meet remote work requirements.

    Automation is also a key issue. For example, 81% of all respondents say projects that deliver deployment and configuration automation have been relevant in their organizations in the past 12 months. In addition, 92% say that automation tools are relevant, or very relevant to them on a day-to-day basis. 

    Cloud, Containers and COVID

    The Trends in IT Ops 2021 survey shows that system administrators are concerned with cloud computing and containers and several other topics. In addition, most administrators recognize the increasing importance of monitoring cloud environments and containers. That said, administrators continue to see monitoring networks and other physical infrastructure assets as critical, and some system administrators see increasing importance in monitoring this vital area. 

    In addition to the topics outlined here, respondents also provided feedback on topics such as virtualization, application performance monitoring and network management.

  • Enable Multi-Cloud Networking With Automation

    Enable Multi-Cloud Networking With Automation

    As we enter a new era of technology, we’re experiencing a “third wave” of cloud innovation that brings new complexities into the IT landscape, mainly centered around multi-cloud networking. With every wave of cloud technology advancement, networking components are becoming more complex and distributed across multiple groups. Further, multi-cloud networking brings new challenges around connecting and managing across dispersed environments comprising private and public clouds, along with physical data centers. Organizations must unify their network operations in a way that enhances their capabilities into a new level of skill and efficiency. 

    Augment Strategies

    Looking forward to new capabilities offered by automation tools, technology leaders can augment their 2022 IT strategies. How?

    • Support a more seamless transition to cloud within hybrid IT infrastructures.
    • Cultivate new values brought to an organization from network engineers.
    • Enable executive leaders to easily align operations across multiple teams – spreading innovation across the entire organization.

    Connecting Hybrid IT Infrastructures

    As more IT leaders invest in an assortment of digital tools to streamline network operations – some engineering teams might feel more reluctant to leave behind old processes or feel intimidated by the multitude of new capabilities at their fingertips. With modern tools and processes gradually being incorporated into the workflow of IT departments, it’s critical to find the right balance in this “hybrid” environment, which will include a combination of both traditional on-premises systems with new cloud applications. Automation can help smoothen the transition to new technologies by simplifying manual processes previously relied on, while also bridging together the plethora of systems for easier management.

    Leveraging Cloud-native automation

    When bridging together disparate systems, leveraging cloud-native automation solutions that provide API capabilities can make all the difference. These solutions not only build the appropriate connectivity required between different applications but also provide the flexibility to manage networks in a cloud-friendly way. Additionally, automation can be deployed to ensure compliance of device configurations that span both on-premises network devices, as well as those connected to cloud-based infrastructures. For example, with automation it’s possible to quickly perform a configuration back-up, check for compliance and execute “intelligent remediation”. This translates to a network device or group of devices that can be backed up and the current configuration compared against the existing golden configuration standard. Changes can be automated to ensure the network is adhering to the current compliance standard. Further, automation is changing the way that IT teams approach daily operational challenges.

    Evolving Value in Network Teams

    Network engineers play a unique role in organizations by performing tasks that require years of training, and an understanding of the complex ins and outs of their internal systems. Although the performance of these manual tasks might be assumed to be the value-driver for engineers – the adoption of new technologies has pushed the boundaries of what network professionals are familiar with. In turn, this has evolved expectations for what constitutes true success and impact. Organizations are looking for engineers to harness the power of these new technologies and execute on a modern strategy – utilizing automation to support this new mindset. 

    Streamline the Adoption of Integrated Multi-cloud Environments

    Breaking down the silos between technologies and teams is critical in order to understand how to get the most out of their investments. For network teams to fully embrace multi-cloud networking, they need to practice deeper management, segmentation, security and control of cloud networks. As with segmentation – automation can help network teams lean away from using overlays, and instead use the native software tools in AWS, Azure, etc. Additionally, many network teams might be under the false misconception that automation requires them to learn to program and write code – when in many new tools, network elements can be managed and orchestrated directly from within the code of an application. This will make network programmability part of the cloud software fabric, and streamline the adoption of integrated multi-cloud environments. Network teams can implement both compliance and automation to standardize both on-prem or new cloud programs, simultaneously building their automation skills without the need to write a single line of code.

    Aligning Operational Efficiency

    When investing in new IT infrastructures across organizations, IT leaders typically build up their programs “vertically” within each department. However, this creates a gap between teams, as each is operating in separate models and functionalities – driving up unnecessary costs and inefficient business practices. To successfully align multi-cloud initiatives for increased operational efficiency in 2022, IT leaders will be required to invest more “horizontally” across their organizations – and in doing so, incorporate automation tools to reduce time and stress. 

    Implementing NaaS

    Achieving operational efficiency can reduce the time and stress experienced by IT teams – this is where the adoption of networking-as-a-service (NaaS) tools can play a beneficial role. IT leaders can invest in networking services directly from the cloud rather than building a new network. Over the next year, as cloud infrastructure expands, NaaS implementations will in tandem grow in importance – enterprises and other organizations (including service providers) will have opportunities to leverage cloud infrastructure without building new networks themselves. Automation tools can help accelerate the time-to-complete and automate the highest percentage of tasks in the activity, eliminating as much idle time as possible.

    Moving Models and Making Improvements

    When considering the investment in these types of tools, it is important to keep in mind how they impact the entire process versus individual tasks. By automating an entire process, not just individual tasks, the operator gains the flexibility to do more in much less time with fewer resources — making innovation possible. With increased flexibility and more time available, engineering and operations teams can focus their attention on strategic activities of greater value instead of performing routine, time-intensive activities. Operations are improved when IT leaders can move from a “human-centric” paradigm to an “automation-centric” model. For example, for maintenance checks, the team can let systems run an increasing number of pre-checks in seconds – enabling the process to execute more efficiently and safely. The key is adopting a model that automates the entire process versus individual tasks.

    Moving Forward

    In the next year, as more workplaces operate in hybrid models, IT leaders will need to evolve their processes to not only unify operations/approaches for remote and in-person employees – but move forward with this new wave of cloud modernization. In doing so, automation can help mitigate and manage the challenges that come with multi-cloud networking,  bolstering skill and efficiency for long-term business impact.

  • CIS Benchmarks: DevOps Guide to Hardening the Cloud

    CIS Benchmarks: DevOps Guide to Hardening the Cloud

    DevOps and cloud computing have become inseparable. But while the cloud started as primarily a dev/test environment — without stringent security and availability requirements — it has evolved into a mature platform for running production workloads. Moreover, devastating supply chain attacks like SolarWinds and Kaseya taught us all that development environments must also be secure. 

    Today, to practice DevOps, you require the cloud, and to avoid catastrophe you must ensure its security. The Center for Internet Security (CIS) is a research body that developed a series of “benchmarks,” essentially guidebooks to secure the configuration of computing systems. There are CIS benchmarks for all major public clouds. 

    Every DevOps professional must be familiar with these benchmarks, and ensure they are applying at least their basic recommendations across dev, test and production environments.

    What are CIS Benchmarks?

    CIS Benchmarks include best practices that can help secure system configuration. CIS Benchmarks are created using a unique consensus-based process that includes cybersecurity professionals and subject matter experts from locations worldwide. 

    Created by a diverse pool of volunteer stakeholders, they include experts from academia and government, private community members, various businesses and relevant industries. 

    How does the process work?

    • The initial benchmark development process defines the scope of the benchmark and leads to a discussion. 
    • Next, volunteers create and test the process of working drafts. 
    • The CIS WorkBench community website lets contributors establish discussion threads to continue the dialogue, until a consensus on the proposed recommendations and the working drafts is achieved. 
    • Once all collaborators reach a consensus, they publish the final benchmark and release it online.

    There are currently over 100 CIS benchmarks for more than 25 vendor product families. You can download these benchmarks for free in PDF format.

    Each CIS benchmark contains configuration recommendations divided into two levels:

    • Level 1 covers basic configurations that are easier to implement and have the least impact on business functions. 
    • Level 2 is intended for a high-security environment. Recommendations at this level require more coordination and planning to implement with minimal disruption to the business.

    CIS benchmark categories most applicable to cloud environments

    • Operating system hardening—cover security configurations of core operating systems such as Microsoft Windows, Linux, and Apple OS X. This includes best practice guidelines for restricting local and remote access, user profiles, driver installation protocols and configuring Internet browsers.
    • Server software—covers the security configurations of popular server software such as Microsoft Windows Server, SQL Server, VMware, Docker and Kubernetes. These benchmarks include recommendations for configuring Kubernetes PKI certificates, API server settings, server management controls, vNetwork policies and storage limits.
    • Cloud provider security—supports secure configurations of Amazon Web Services (AWS), Microsoft Azure, Google, IBM and other public clouds. It includes guidance on configuring identity and access (IAM), system logging protocols, network configuration, compliance management, securing auto-scaling and more.
    • Mobile devices—covers mobile operating systems such as iOS and Android, and focuses on developer options and settings, operating system privacy configuration, browser settings, application permissions and more.

    Hardening cloud security with CIS Benchmarks

    Cloud service providers (CSPs) have changed the way organizations of all sizes design and deploy their IT environments. However, the use of cloud technology also introduces new risks. The CIS Benchmarks provide guidance for organizations to establish policies, plan and manage secure cloud environments.

    CIS has released Foundation Benchmarks for all major public cloud environments, including AWS, Azure, Google Cloud Platform, Oracle Cloud Infrastructure, IBM Cloud and Alibaba Cloud. 

    Users include systems and application administrators, security professionals, auditors, help desks, and DevOps personnel who want to develop, deploy, evaluate, or secure cloud solutions or platforms.

    CIS Foundations benchmarks are tailored to specific CSPs, but the content of the documents all have common features. At a minimum, each benchmark provides prescriptive guidance regarding identity and access management (IAM), logging, monitoring and networking.

    Obtaining the CIS benchmarks

    You can download the AWS CIS Benchmark free by clicking here. The CIS website provides easy access to all other benchmarks, which you can download in PDF format.

    Universal recommendations from all cloud CIS benchmarks

    • Create secure cloud workloads that comply with industry best practices, save your tested, compliant images and monitor them to avoid tampering.
    • Enable cloud control plane logging through tools, such as AWS CloudTrail or Google Cloud Operations Suite. Keep track of all API calls made in your cloud service account. 
    • Configure and enable cloud-native monitoring and alerting tools for your workloads.
    • Enable strong authentication for all cloud management interfaces, including web portals and the command line. 
    • Implement a least-privileged identity strategy for various cloud operations roles.
    • Enable encryption and other data protection measures for cloud storage services.
    • Secure cloud-native network access to minimize access, and ensure all network activity is monitored.

    Consider configuration drift

    CIS benchmarks are great. But, they are not enough. Trying to manually configure every item of a public cloud benchmark (which typically covers hundreds of pages) is infeasible for even the most seasoned DevOps professional. However, there are automated tools, some free and open-source, some part of commercial solutions, which can automatically configure your cloud according to the benchmarks.

    It is even more important to consider configuration drift. The cloud is a very dynamic environment, and what you configure today will be gone tomorrow. To ensure you stay secure, ensure you:

    • Gain control over all processes to create new cloud workloads and services, and ensure they enforce security standards.
    • Use cloud-native tools like infrastructure-as-code (IaC) to automate secure configurations — just as you do with everything else.
    • Put a configuration monitoring solution in place, such as cloud security posture management (CSPM), cloud workload protection platform (CWPP), or cloud security access broker (CASB), which can automatically scan and verify secure configurations.

    All of this information helps as you move one step closer towards hardening the DevOps cloud.

  • Theranos’s Holmes VC Reverb | 5G C-Band Marches On | Mozilla Jumps Shark

    Theranos’s Holmes VC Reverb | 5G C-Band Marches On | Mozilla Jumps Shark

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: The conviction of Theranos CEO Elizabeth Holmes leads to greater scrutiny of startups, higher-frequency 5G NR is creeping towards reality, and Mozilla gets criticized for promoting climate-harming scams.

    1. Holmes Case Causes Valley Rethink?

    First up this week: Elizabeth Holmes has been found guilty of defrauding Theranos investors. But how will the affair change Silicon Valley’s startup-and-funding culture?

    Analysis: Don’t fake it—just make it.

    This could be a seminal moment, causing investors to look more closely at startup founders and their outlandish promises. On the other hand, key Theranos investors—e.g., Murdoch, Cox, DeVoss—hardly fit the mold of Silicon Valley VCs.

    David Streitfeld: The Epic Rise and Fall

    F. Scott Fitzgerald’s creation … Jay Gatsby … was a bootlegger [and] sold fake bonds. Ms. Holmes chose Silicon Valley, the last and greatest of all human dreams. [She] was a natural salesperson, as good at bending reality as Steve Jobs himself.
    …
    She and her deputy and boyfriend, Ramesh Balwani … thought they could brazen it out in the Silicon Valley tradition until they had something that actually worked. [But] the verdict signaled the end of an era. In Silicon Valley, where the line between talk and achievement is often vague, there is finally a limit. … It is an epic rise and fall that will be chewed over in the coffee shops and juice bars of Palo Alto, Calif., until the tech industry departs [for] off-world colonies.
    …
    So where does this conviction leave … her investors and former fans? Ripe for the next huckster that comes along, probably. Some Silicon Valley promises are so sweet we just can’t get enough of them. Immortality. Crypto. Flying cars. Mars. Digital harmony. Wealth beyond compare.


    Think different, thinks DeanonymizedCoward:

    [There’s a] fine line between bombastic marketing spam, “fake it ’til you make it” pitches, and outright fraud. … The first is repugnant and sometimes unethical, but generally legal.
    …
    [But] If your product requires bull**** to get funded—even if it ultimately works—you’re a fraud. … Regulatory reforms … and a sort of corporate death penalty … can fix a lot of this by making it less financially practical to engage in ****ty behavior.


    Who else is to blame? Ask DS999:

    I am sure some of her investors didn’t really care whether it worked. They just wanted to get in early, ride the hype train up, and sell before actual results mattered.

    2. FAA and 5G Carriers Kiss and Make Up

    Higher-frequency 5G NR is creeping towards reality in the U.S., thanks to the FAA backing down. After the aviation regulator had vetoed C-band deployment—based on precious little evidence—it looks like as much as 280 MHz of extra spectrum is now ready to switch on.

    Analysis: Nomadic DevOps gets more bandwidth

    While band 77 is nowhere near the much-vaunted “FR2” extremely high frequency bands, this is a useful chunk of extra spectrum for mobile and nomadic apps. Next stop: ubiquitous Ka-band.

    Jon Brodkin: FAA agrees not to seek any more 5G delays

    The Federal Aviation Administration tentatively agreed not to seek any more 5G delays from AT&T and Verizon, potentially ending a battle over the aviation industry’s unproven claim that 5G … will interfere with airplane altimeters. [Their] C-Band spectrum licenses are for the frequencies from 3.7 GHz to 3.98 GHz.
    …
    The deal incorporates voluntary commitments that AT&T and Verizon previously made, including “C-Band radio exclusion zones” around airports for six months. [They] modeled the exclusion zones after those used in France, which are 910×2100 meters.
    …
    Assuming there are no further problems, AT&T and Verizon would be able to use their spectrum licenses without extra restrictions after July 5. … President Biden applauded the agreement … calling it “a significant step in the right direction.”


    In summary? Here’s Dieter Bohn:

    The agency in charge of airplanes is mad about wireless things. But the agency in charge of wireless things and the companies that make them lost a game of chicken.
    …
    GREAT JOB AMERICA. … I always said I wanted Internet Service Providers to be Dumb Pipes, but I never expected them to be this dumb.


    Has anyone read the FAA’s detailed report? bburdge has:

    I can see why the FAA is backing down here now, it only makes sense when your key report could be paraphrased as: “We got a couple grad students to run some basic model comparisons … using altimeter data from the aviation industry (with a proven track record of lying to us) and then went golfing for eight months before publishing … but didn’t bother … to actually test anything.”

    3. Mozilla Forgets its Values

    Firefox custodian, the Mozilla Foundation, has angered many by promoting a “grossly irresponsible” “Ponzi scheme” that harms the environment. What is this awful thing? I hear you ask. It’s cryptocurrency.

    Analysis: Imaginary money is bad—is this the last straw for Mozilla?

    Less than a year ago, Mozilla said it wants to be carbon-neutral, but it’s already reneged on that promise: Distributed proof-of-work systems require … well, work. And that work uses ridiculous amounts of energy per DeFi transaction. Electricity production is a zero-sum game, so cryptocurrencies and NFTs cause climate change by emitting ridiculous amounts of CO₂e.

    Liam Proven: Mozilla founder blasts browser maker

    A few days ago, Mozilla Foundation invited netizens on Twitter to send in cryptocurrency donations. … This move by the Firefox browser maker rapidly drew criticism.
    …
    As recently as September, Moz’s web-standards lead Tantek Çelik slammed cryptocurrencies as being unsustainable, stating: “[They] are harmful for sustainability. … Their energy requirements grow without any discernible upper bound, which is grossly irresponsible given the global environmental crisis.”
    …
    Mozilla has accepted crypto-coin donations for years, perhaps as part of its long-ongoing efforts to alienate its own users: It’s only the payment provider that changed.


    Chief among critics was Jamie “jwz” Zawinski:

    I founded Mozilla and I’m here to say **** you and **** this. Everyone involved in the project should be witheringly ashamed of this decision to partner with planet-incinerating Ponzi grifters.
    …
    Stop saying you were promised flying cars. Unless you were born in 1935, you weren’t promised flying cars, you were promised a cyberpunk corporate dystopia.


    It’s a shark-jump moment thinks Jeremy Keith:

    The most convincing argument I’ve heard yet for switching away from Firefox as my main browser comes from Mozilla. I wasn’t expecting that plot twist.

    The Moral of the Story: What is safety to one is not always safety to another.


    You have been reading The Long View by Richi Jennings. You can contact him at @RiCHi or tlv@richi.uk.

    Image: Benjamin Hayward (via Unsplash)

  • IoT Developers: Get Familiar With LoRaWAN for 2022

    IoT Developers: Get Familiar With LoRaWAN for 2022

    IoT Analytics forecast the global number of connected IoT devices would grow to 12.3 billion active endpoints in 2021. That number is expected to grow exponentially in the near future as more and more industries make use of long-range wireless capability. For example, president Biden’s infrastructure plan promised major investment in smart cities and smart municipalities across the United States. 2022 will also see IoT growth in the manufacturing and utility sectors as ‘brownfield industries’ look to update their existing machinery for Industry 4.0. Both of these factors will bring about a massive surge in demand for low power wide area network (LPWAN) solutions using the long range wide area network (LoRaWAN) standard next year.

    LoRaWAN is the standard protocol for LoRa wireless technology. LoRa was built specifically for long range use cases (it’s in the name). This means that technology using LoRaWAN requires significantly fewer repeaters and gateways to cover a large area, like a city, than would be required using traditional technologies. Additionally, LoRa is robust in how it responds to interference, and LoRaWAN sensors use less energy than other sensors, making them more efficient. In fact, ABI Research forecast that, by 2026, LoRa will be the leading non-cellular LPWAN technology.

    In the grand scheme of IoT, LPWAN technology is relatively new. LoRaWAN became an open standard just six years ago when the LoRa Alliance was formed in 2015. This means the main challenge for IoT developers in 2022 and beyond will be educating themselves on the technologies needed to put LoRa-enabled plans into action. There are two big reasons why you should begin that process now: The rising demand for smart cities and Industry 4.0.

    Building Cities Smarter

    When it comes to infrastructure, roads and bridges might come to mind first, but in reality, infrastructure is much more holistic. Utilities like electricity, gas and telecommunications should all be included in any infrastructure discussion. These industries have already come to rely on IoT technologies to collect data and function in the modern world. 

    The government IoT endpoint electronics and communications market is expected to reach $21.3 billion in spending in 2022, according to projections by Gartner. As governments continue to modernize and implement more wireless technology, I expect a good amount of this money to go toward the development of solutions using LoRaWAN to create flexible networks on a very large scale for smart cities. 

    In fact, this movement has already begun. In September, the city of San Jose, California, announced its partnership with a blockchain-based provider to extend the city’s broadband access. In exchange, the city is now hosting and expanding its peer-to-peer IoT network infrastructure.

    Updating Brownfield Industries for Industry 4.0

    2022 will also see IoT advancements in ‘brownfield’ industries. These are industries with legacy, stand-alone machines and processes, such as in the manufacturing and utilities sectors, that weren’t originally created with internet connectivity in mind. Players in brownfield industries already have large install bases of machines that have no way of reporting status or other pertinent data.

    These industries have long been looking at developing IoT solutions to solve this issue. Most are prototyping now with the goal of getting data to flow between large, legacy manufacturing machines with the end goal of improving manufacturing processes. However, unlike other industries where modern updates are often needed to improve efficiency, these manufacturers aren’t going to replace equipment that already gets the job done and has done so for decades. Instead, they need to find an alternate way to gather data and insights from the equipment they already have in place. 

    For many, LoRa-enabled sensors will be the answer. Often, upgrading to new technology requires equipment be substantially changed. That isn’t the case with LoRaWAN solutions, which allow manufacturers to add LoRa-enabled sensors to existing machines. LoRa-enabled sensors are durable, don’t require much maintenance and have low battery footprints. They also allow manufacturers to keep their data on-premises and on their own internal networks, a common preference for these types of industries. These characteristics make LoRa-enabled sensors ideal for manufacturing purposes. 

    In the new year, we will continue to see more pilot deployments go into production to help these industries gather the data they need to improve their processes and, in return, their bottom lines.

    LoRaWAN Resources for Developers

    The intention of the Biden administration’s high-tech infrastructure plans in the United States and the benefits of LPWAN (and LoRaWAN in particular) for private, long-range networks are converging to present a lot of great opportunities for this technology this year. That’s why 2022 will be the year IoT developers need to brush up on their knowledge of LoRaWAN.

    If you are interested in learning more about LoRa, check out the LoRa Alliance or LoRa Developer Portal communities to get started.

  • Only 30% of Orgs Fully Implement DevSecOps

    Only 30% of Orgs Fully Implement DevSecOps

    With the pressure to release more rapidly, security is shifting left within the continuous development pipeline at most organizations. This imperative is increasing with the rise of cyberattacks. Yet both a lack of training and poor visibility are stalling many DevSecOps rollouts, a recent CSA study found.

    DevSecOps is still a relatively new practice and has yet to reach maturity throughout most organizations. Though nearly all companies are on their way, only 30% of security professionals say they fully implement DevSecOps in practice today. That leaves most organizations in some state of DevSecOps ideation and planning.

    CSA recently released its Secure DevOps and Misconfigurations 2021 report which was commissioned by Trend Micro. The report found that misconfigurations commonly arise from default security settings. A lack of internal guidance and accessibility of security resources commonly hinder DevSecOps maturity, too.

    Below, I’ll review the other major takeaways from the report to see how they can inform organizations as they move to implement DevSecOps.

    State of DevSecOps Adoption

    DevSecOps is all about increasing the security around rapid deployment. It literally puts the security into DevOps by shifting security automation left and de-siloing the boundary between DevOps and IT security teams.

    While most engineers realize the benefits of DevSecOps, the state of each organization’s DevSecOps journey is very different. While an impressive 90% of organizations are in some phase of the journey toward DevSecOps, only 30% are implementing DevSecOps while 24% are in the planning phase, 18% are designing and 18% are still refining their DevSecOps strategy. Just over one in ten security professionals say their team has no plans to invest in DevSecOps at all.

    Looking to the future, 42% say they will implement full DevSecOps within the next 12 months. But due to its current nascent state, misconfigurations are still getting through. The primary reason cited for these misconfigurations was flawed or lacking internal guidance (33%).

    Many professionals say there is simply not enough training, support or internal knowledge around vulnerabilities and misconfigurations. Other top reasons for misconfigurations include insecure default settings (18%) and negligence (16%).

    Outside of misconfigurations, groups also report challenges with identity, authorization and access. Ensuring the correct privileges is vital to avoid escalation attacks, which are a prevalent issue. Between 2019 and 2020, 80% of companies experienced a data breach of some kind, many of which were due to misconfigured access controls. OWASP also reported that broken authorization is a top vulnerability for high-traffic web API endpoints.

    Common Threat Mitigation Practices

    To mitigate these threats, development and security teams must maintain best practices, yet certain issues prevent DevSecOps from emerging. For one, 60% of security professionals say their top challenge is insufficient visibility into security or compliance gaps—this is by far the most common challenge—and 11% also cite inconsistent cloud account onboarding. Finally, 10% say time-consuming, slow and/or insufficient architecture holds them back.

    One way to mitigate threats is to introduce routine security reviews more frequently. Yet it’s hard to set a definite benchmark here, as the frequency at which organizations review their cloud infrastructure for vulnerabilities or misconfigurations varies widely. Currently, 22% perform such security reviews daily, 22% monthly, 18% weekly and 23% quarterly, according to the survey. This rate will likely increase as DevSecOps becomes more commonplace and automated within the development life cycle.

    Staying up-to-date with modern security frameworks is another facet impacting DevSecOps adoption; and organizations tend to follow multiple frameworks to inform their security strategy. More than three-quarters (78%) follow the National Institute of Standards and Technology (NIST) guidelines, 67% follow the Center for Internet Security (CIS) benchmarks, 66% follow Cloud Security Alliance (CSA), 54% follow International Organization for Standardization (ISO) and 44% say they follow security recommendations from Amazon Web Services (AWS).

    For example, NIST, the government-operated standards-setting body, recently set cybersecurity guidelines that recommended the use of zero-trust and service mesh across departments. These security guidelines can be thought of as architectural benchmarks, especially for large, highly-regulated industries.

    DevSecOps Training Types

    Finally, investing in community resources and training is another way to increase DevSecOps awareness. Only half of survey respondents reported their DevSecOps best practices resources were moderately accessible—thus, the onus is on leaders to democratize such knowledge within their organization.

    The majority (81%) of respondents cited online articles and training as their primary form of learning about cloud security tools and vendors. Workshops, conferences and webinars follow closely. Organizations also adopt many internal knowledge-sharing methods in response to incidents. A full 85% said they conduct awareness training followed by table-top exercises (52%), attack simulations (45%) and protocol or response framework training (37%).

    Future DevSecOps In The Cloud

    It appears that most teams are still formulating their DevSecOps strategy. But looking to the future, 42% say they will implement full DevSecOps within the next 12 months. Simultaneously, more cloud traction is projected throughout the industry.

    Right now, 40% of organizations have between 41% to 99% of their workloads in the public cloud. And 55% of organizations will have between 41% to 99% of their workloads in the public cloud in the coming year. The type of workloads will also likely evolve in the coming year, as more organizations move to container platforms, Function-as-a-service and other serverless capabilities. To fully reap the benefits these new technologies promise, organizations must undoubtedly respond to a new class of cloud-native vulnerabilities.

    About The Report

    The Cloud Security Alliance (CSA) is a not-for-profit organization with a mission to widely promote best practices for ensuring cybersecurity in cloud computing and IT technologies. The Secure DevOps and Misconfigurations survey was conducted from July 2021 through September 2021 and collected over 900 responses from a global pool of IT security professionals working in various sectors and organizational sizes. For a full copy of the report, you can swap some personal information for a PDF download here.