devopsy.kinsta.cloud

Category: DevOps Practice

  • CodeSee Unveils Open Source Hub

    CodeSee Unveils Open Source Hub

    CodeSee today launched a free Open Source Hub (OSH) community through which developers can more easily analyze the codebase that makes up an open source software project.

    Shanea Leven, CodeSee CEO, said that capability is crucial because making it easier to explore open source codebases reduces the level of effort required for developers to understand where to make contributions.

    OSH is based on a namesake visualization tool that CodeSee created. The CodeSee tool makes it possible for developers to see how a codebase has been constructed using graph technologies that scan software repositories and identify components and their relationship to one another. Developers can also use CodeSee to better understand what impact changes to that codebase will have.

    In addition to making it easier for developers to discover open source software projects, OSH also enables maintainers and contributors to create personal profiles through which other members of the open source community can see how their efforts have impacted various projects.

    CodeSee, as part of OSH, is also providing integration with Discord, an online voice, video and text collaboration service, to make it simpler for maintainers and contributors of open source software projects to collaborate.

    Leven said it simply takes too long today for most developers to pore over a codebase to understand where they might contribute. The larger a codebase becomes, the less likely it is a developer will want to take the time required to begin making a meaningful contribution, she noted.

    OSH is arriving at a time when maintainers of open source projects are especially looking for help securing open source software. The core issue is that many of those projects are maintained by a small number of programmers that voluntarily contribute their time and effort to build components that others are free to use. Like any other developer, the amount of security expertise those individuals have is limited. Many of them simply don’t have the time to immediately provide a patch to an application when a zero-day vulnerability is discovered.

    Unfortunately, many IT vendors and large enterprise IT organizations benefit from open source code without contributing anything meaningful back to the project—whether in terms of financing or helping open source maintainers find and remediate vulnerabilities. Not every contribution has to be in the form of code, either. Many open source projects simply need help with documentation which, once provided, should free up other contributors to focus more of their time and effort on application security.

    It’s not clear to what degree business and IT leaders realize how dependent their organizations actually are on open source software. Even when they do, it’s not easy to onboard a developer to any software development project. It can take months before a developer is actually making meaningful contributions to a project.

    Application development, by definition, is now a group effort. The days when a lone developer cared for an entire application are long over. The issue is finding a way for teams of developers to more easily collaborate when most of them have never actually met in person.

  • Common RDS Misconfigurations DevSecOps Teams Should Know

    Common RDS Misconfigurations DevSecOps Teams Should Know

    Relational databases have become the option of choice for organizations wishing to streamline and scale the use, storage and retrieval of data. Many organizations choose AWS Relational Database Service (RDS) to forego the resource-intensive tasks related to database administration including management and continuous oversight. RDS is a fully managed service that simplifies and automates these processes, making it easy to set up, operate and manage relational databases in the cloud—including MySQL, PostgreSQL, MariaDB or Aurora—and their various time-consuming activities. Reducing costs and automating processes makes significant business sense and allows organizations to focus on performance, scalability and cost-effectiveness as data grows.

    That said, AWS is not the owner or the party responsible for securing your data—this duty remains in the hands of the organization. As the cloud provider, AWS does offer an impressive suite of security measures for protecting the infrastructure that runs its cloud services, including access controls, database snapshots and encryption. Their policies, however, clearly state that safeguarding data is within the responsibility of the organization and, as the moderator of your environment, you will be accountable for what occurs within it.

    The following are the six most common RDS misconfigurations related to security and compliance that DevSecOps teams should be aware of to secure their data stores and organizational assets.

    Broken Geo-Trust (aka Data Sovereignty): RDS provides the convenient option to distribute data across various AWS regions. There are various benefits to this data migration including minimizing latency, disaster recovery capabilities and scaling operations. However, the security and governance risks of cross-geo replication may significantly outweigh these benefits. A common misconfiguration includes migrating replicas or storing backups and snapshots in another location. When sensitive data travels and is stored in another geographic location, the organization may be at risk of violating international compliance requirements such as Schrems II (for EU-to-U.S. data transfer). Additionally, data traveling to various locations may not be visible to security teams or managed by DevOps teams—without a continuously updated inventory, data will spread unobstructed and ungoverned. 

    The screenshot below displays a copy-snapshot operation of a U.S.-based RDS datastore to an EU region.

     

    Inadequate Retention Periods: AWS allows organizations to retain database instances for a specific period of time as configured by the user. A common misconfiguration of this feature is the existence of unmonitored standalone snapshots, short-lived backups and a failure to permanently delete records. Organizations that retain records for a long period of time may be in breach of their GDPR obligations, whereas short-lived backups may jeopardize the organization’s ability to recover critical data in case of data loss or a ransomware attack. Clear guidelines and open communication between DevOps teams and compliance leads is the first step toward a healthy environment.

    The screenshot below presents a recommended and comprehensive backup retention period configuration from an RDS datastore creation process.

    Exposed Resources (Network Access): Publicly accessible database ports and RDS instances are a lucrative configuration loophole for malicious actors. Common misconfigurations may cause RDS database snapshots to be publicly accessible, thus providing unauthenticated users with privileges to access and abuse it through brute-force attacks, known CVEs and DDoS attacks—thereby exposing sensitive data. This risk will also impact the organization’s ability to comply with international regulatory requirements and should be a high-priority configuration when creating and maintaining such resources.

    The screenshot below presents recommended network (public) access and default port configuration from an RDS datastore creation process.

    Weak Encryption: Encryption of sensitive data—both at rest and in transit—is a necessary security baseline to ensure the integrity and confidentiality of organizational data and make it inaccessible to unauthorized users. Common encryption misconfigurations may include implementing inadequate encryption for communication channels such as TLSv1.2 (and higher), weak cipher suites or untrusted CA which may lead to a false sense of security. For data at rest, another common misstep is a lack of key rotation or exposure of the encryption key to unauthorized entities.

    The screenshot below presents the recommended basic encryption-at-rest configuration to be enforced when creating an RDS datastore.

    The screenshot below presents recommended basic encryption-in-transit configuration to be enforced when creating an RDS datastore.

    Improper Authentication & Authorization (RBAC): A cornerstone of adequate data security hygiene is ensuring that access is only associated with a unique account based on the principle of least-privilege, using strong identification methods with appropriate justification. With RDS, users may not use IAM accounts, provide over-privileged access and permissions to either the main instance or to backups and refrain from implementing a user-access quarterly review.

    The screenshot below presents the recommended authentication configuration to be enforced when creating an RDS datastore.

    Incomplete Audits: Visibility cannot be considered a point-in-time activity. Monitoring of access and use of sensitive data is an essential component of tracking organizational assets and will provide crucial information in case of an incident or potential data breach. Incomplete or misplaced audit records including login/logout events, short-lived audits or leakage of sensitive data from RDS to audit logs increases the risk. 

    The screenshot below presents the recommended audit and log configurations when creating an RDS datastore.

    Misconfigurations and single points of failure in cloud environments may be unavoidable for all organizations, especially those operating at scale, due to knowledge gaps, high velocity of data and changes and a lack of visibility as the amount of data increases. While the security baseline may be covered by RDS configurations, these are only the minimum required to protect your environment. DevSecOps teams are encouraged to work closely with their compliance leads to ensure that customer data is secured; leveraging RDS for its benefits is a complex and entirely more substantial responsibility. Organizations must view their data as an inherent part of their internal assets. As its owner, they should create appropriate ecosystems that allow continuous oversight and monitoring of the data, gaps that may arise and, most importantly, the controls in place to secure it. 

  • Quick! Define DevSecOps: Let’s Call it Development Security

    Quick! Define DevSecOps: Let’s Call it Development Security

    For a good long while, DevSecOps referred specifically to vendors like Veracode that did static application security scanning, dynamic application security scanning, software composition analysis and some form of runtime monitoring (usually interactive scanning). Then we realized that DevSecOps was potentially a lot more than that and, like DevOps, we drove the word to encompass all things that shift security left.

    That’s where we are now. But that leaves the DevSecOps market confusing to a lot of people. I propose we rename the tools that specifically focus on code quality to Development Security—even though that name is not perfect and all-encompassing. It’s a better fit than terms in other spaces, like Password Management, which includes two-factor authentication (2FA), multifactor authentication (MFA) and, increasingly, passwordless and secrets management, none of which actually use passwords for the focus of their functionality.

    This way, we can all understand that DevSecOps is the mindset and methodology and Development Security is one piece of implementing DevSecOps.

    There are probably people smarter than I am who have come to this (or alternate) conclusions, and I’m happy to run with their solutions, too—this is just an attempt to make it less confusing for those who don’t live and breathe the security and DevOps markets. If a new person says, “I think we need DevSecOps,” they are in for a journey to actually figure out what they meant and if what they need is actually DevSecOps. We should strive to clarify that so, at the beginning of their research, it is clear that DevSecOps is like DevOps—an overarching term for policies, procedures, mindset and products while the tools that can help with DevSecOps, like those that make up the overarching DevOps toolchain, belong to a market segment named X. In my case, I proposed Development Security because it’s a close fit. What we actually call it is irrelevant, as long as new people understand it is a subset of DevSecOps.

    While you continue to keep the systems spinning and the organization online, when you research these products, use phrases like, “I’m looking for Development Security tools that fit with a DevOps environment.” Markets are largely named by vendors and pundits but, in the end, all these people want to talk in terms their customer base recognizes. So, if enough of you ask for Development Security, that’s what they’ll all start calling it. Effective immediately, that’s what I’m calling it. It is a distinctive set of functionality that all orgs who do internal development need, so let’s give it a distinctive name. And yeah, drop me a line if you have a better name. I’m tied to making it easier, not to a specific term.

  • Dynatrace Adds Synthetic Tests to Validate App Experiences

    Dynatrace Adds Synthetic Tests to Validate App Experiences

    Dynatrace today extended the application release management capabilities it provides to include synthetic tests for validating and assuring user experiences.

    Saif Gunja, director of product marketing for Dynatrace, said the user experience validation and user experience assurance (UXA) capability spans everything from application availability and performance to actual engagement with specific features based on the service level objectives (SLOs) defined by a DevOps team.

    Dynatrace views application release management as an extension of its observability platform, said Gunja. While application release management has historically been viewed as an extension of a continuous delivery (CD) platform, Gunja said that observability platforms—such as the Dynatrace platform, which is infused with a Davis artificial intelligence (AI) engine—provide the visibility required to better automate the process.

    In fact, as DevOps continues to evolve, it’s apparent that CD and continuous integration (CI) are becoming more loosely coupled as DevOps processes mature, said Gunja. Most organizations have yet to implement CD simply because it’s been too difficult to achieve. Each platform that applications have been deployed is unique. Dynatrace provides the foundation for automating application release management via the agent software it makes available to instrument applications, said Gunja.

    It’s not clear whether DevOps teams are reevaluating their approach to application delivery, but Gunja noted that much of the interest in the Dynatrace approach is coming from organizations that have already installed the Jenkins CI/CD platform. The number of extensions that have been built and that need to be supported has created a level of technical debt that is unsustainable for many DevOps teams, he noted.

    Many IT leaders concluded they would rather allocate more resources to building applications than maintaining DevOps platforms, added Gunja.

    Most DevOps teams are committed to ruthlessly automating as many IT processes as possible. Observability has always been a core DevOps tenet in pursuit of that goal. Applications that are not instrumented can be programmatically managed. The issue is that providing observability isn’t enough—DevOps teams need to be able to take actions across the entire software development life cycle based on the data collected by the observability platform, said Gunja.

    Obviously, it’s still early days as far as observability is concerned. While application performance management (APM) platforms have been employed for decades, it’s only recently that observability platforms capable of correlating application and IT infrastructure data have emerged. Thanks to the rise of open source agent software, it’s also becoming less costly to instrument IT environments. The challenge, of course, is, as always, deploying and maintaining all that agent software.

    Regardless of the approach to observability and DevOps, it’s clear that IT teams will soon have a lot more visibility into their IT environments. The days when IT teams determined the root cause of an IT issue by process of elimination are finally coming to an end. Observability, however, is not an end in itself, but instead is the end of the beginning of a previous DevOps era.

  • Chip-to-Cloud IoT: A Step Toward Web3

    Chip-to-Cloud IoT: A Step Toward Web3

    During the first six months of 2021, IoT devices were breached 1.51 billion times, a significant increase from only 639 million breaches observed for the entirety of 2020. This problem can be attributed to the widespread adoption of the internet-of-things (IoT) and the Windows Server Message Block (SMB), and neither can be avoided in the age of remote work. 

    But while these technologies offer unprecedented levels of data mobility and oversight for many interconnected digital and physical systems in industrial settings, they also make it easier for malicious actors to penetrate the very fabric of our lives if left unsecured. 

    This makes it all the more important for DevOps teams and developers to prioritize cybersecurity while creating systems for the IoT. It is important to address the inherent flaws in security like easily-breakable usernames and passwords or saving data without protection on remote access servers. 

    There is a way developers and DevOps professionals can help curb the increasing instances of cybercrime, and it’s called chip-to-cloud IoT. Let’s explore how it is emerging as a viable way to construct a safer, more valuable and more decentralized system for everyone.

    IoT: Understanding the Inherent Security Challenges

    It’s best to investigate potential cybersecurity issues that may befall your organization before finding ways to secure your IoT platforms with solutions such as a shift left security approach (meaning security is embedded in the earliest phases of the application development process) or an IoT decentralization approach, as we’ll expand on below. 

    Some common security concerns include:

    Vulnerabilities in the Software and the Firmware

    It can be challenging to guarantee the safety of IoT systems because of the following security flaws:

    • Lack of computational capacity to provide adequate built-in security
    • Inefficient access control in IoT systems
    • Insufficient funds for adequately testing and further developing the firmware’s security
    • Lack of regular patching and upgrades as a result of IoT devices’ technical and budgetary restrictions
    • Unpatchable vulnerabilities because users don’t regularly update their gadgets
    • Older devices may not be compatible with newer software updates
    • Easy accessibility means attackers could insert corrupted chips or hack via radio waves

    Possibility of Cloud Breaches

    Hackers can gain access to the data processed by your IoT system by intercepting unencrypted messages. 

    Your device might contain sensitive information such as your location, bank account information and medical records. Attackers can access critical information in many other ways, including by exploiting weakly protected communications.

    Even if every piece of data is transported to cloud storage, intruders can potentially target cloud-hosted applications. Therefore, the risk of data leaks is not just from the devices themselves but also from the cloud environments to which they are connected. That is why DevOps pros, developers and software engineers must find ways to protect the technology from the start and prevent hackers from breaching the cloud.

    Risks of Malware

    A recent survey by Zscaler revealed that smart TVs, set-top boxes and smartwatches are most susceptible to malware attacks. 

    If attackers successfully infiltrate an IoT system or insert malware, they may be able to change its functionality, acquire personal data and carry out other malicious activities that can endanger device owners and users. 

    The trouble is that manufacturers struggle to maintain proper software security to keep their devices safe. Security often takes a backseat when these gadgets are built, leaving buyers to deal with the aftermath if they get infected with malware. 

    How Chip-to-Cloud IoT Minimizes Security Risk

    There are two ways for organizations to enhance their IoT security. 

    The first step is ensuring both device manufacturers and software developers adhere to sound security principles. If the value chain is exposed, the solution must be chip-to-cloud. 

    Second, they must take an in-depth approach to protecting key technology by layering security controls to create an iron-clad IoT infrastructure.

    The chip-to-cloud architecture enables the creation of secure, low-energy networks of IoT devices that can communicate directly with cloud hosting platforms. The collective effort to build a cloud-first technology stack has been costly, inefficient and unreliable.

    Traditionally, IT professionals have used non-machine-hosted security tools like firewalls to secure IoT devices. Chip-to-cloud architecture aims to fix this underlying flaw.

    Features of Chip-to-Cloud IoT

    Onboard security and computational power are two of the most significant shortcomings of IoT devices. In addition to being more powerful and safe than previous models, IoT devices built with chip-to-cloud security are also more energy-efficient.

    Here are the features that make the chip-to-cloud technology so effective:

    • An onboard cryptography engine
    • Generator of random numbers
    • Sufficient random-access memory (RAM)

    How It Works

    Reliable software design is essential for IoT devices and other internet-connected devices. It keeps hackers from stealing your identification or duplicating your device for their ulterior motives. Chip-to-cloud delivers on all fronts. 

    These chipset characteristics confer an extra security advantage. Each IoT node is cryptographically unique, making it nearly impossible for a hacker to impersonate it and access the more extensive corporate network to which it is connected. Chip-to-cloud speeds things up by eliminating the need for traffic delays between the logic program and the edge nodes that are ready to take action on the information.

    The chip-to-cloud architecture of the internet-of-things is secure by design. New tools are being developed to provide bespoke and older equipment with data mobility capabilities, just like the current IoT. 

    Nevertheless, chip-to-cloud chipsets are always connected to the cloud. As a result, the availability of assets and the speed of digital communication across nodes, departments and facilities will be significantly improved. Chip-to-cloud IoT is a significant step forward in the evolution of the IoT toward Web3. Experts predict IoT device customers and value producers will benefit more from these design principles than centralized providers.

    Chip-to-Cloud Enables IoT Decentralization

    The traditional approach to IoT is to cover an already-existing cloud of linked devices with third-party firewalls and other security measures. Its equivalent imagery would be a single umbrella covering a family of 12—or at least attempting to do so. The protocols that govern security must be central to decentralization.

    Chip-to-cloud IoT is a powerful, uniquely secured chipset that can be installed inside each device, giving it a far greater connection in the IoT chain than the average IoT gadget.

    The cloud manager or analytics application receives data from every node in real-time using the chip-to-cloud technology. The process does not add another layer of protection; instead, it reduces the latency and loss of data packets as they travel from one destination to another.

    The Future of IoT

    In the wake of recent global events, general cloud technology and chip-to-cloud architecture are receiving huge investments. IoT can supply the data that companies and organizations need to fuel their client engagement portals, machine maintenance platforms and enterprise planning tools.

    That said, the internet-of-things will not be entirely safe even with chip-to-cloud technology. Businesses must have a security-focused culture, standards for managing new IT investments and the expertise to pick the best technology partners.

    The Web3 transition will likely be coupled with future Web3 innovations such as blockchain to improve its utility and security. Seeing how the world’s genuine value-creators use these new solid tools will be intriguing.

    Conclusion

    Considering security at the very onset of any IoT project is critical. Maintaining comprehensive cybersecurity in IoT environments is challenging due to the rising frequency of cyberattacks and increasingly complicated system vulnerabilities. 

    The safety of IoT devices is essential to the operation of many businesses—and even entire economies. Engineers are under increasing pressure to ensure that the rapidly expanding number of interconnected devices is safe. This is why chip-to-cloud technology is poised to become the next big thing in this field. Are you ready to be the change?

  • Quality Is a Top Challenge for Data-Driven Projects

    Quality Is a Top Challenge for Data-Driven Projects

    Software systems continue to produce more and more data. And making use of it has proven benefits — so much so that many analysts have, over the years, referred to data as the new oil. As a result, the majority of organizations are expending effort into refining their data — in fact, a recent study found that 84% of organizations have either already deployed or have data-driven projects on their roadmaps.

    Corporations like Facebook and Google are the poster children for business models that harvest and monetize end-user data. However, this is only one aspect; valuable data is being produced by internal systems as well, which, if leveraged correctly, can provide insight into software observability and increase process automation for DevOps teams and developers. For example, time-stamped application logs are necessary for informing SLOs to maintain reliability standards. There is an ongoing parallel investment into AI/ML deployed with cloud-native tools to act upon production data to drive further business growth. As such, 63% of IT decision-makers say new revenue opportunities have emerged due to data and analytics.

    The 2022 Data & Analytics Study, conducted by Foundry (formerly IDG Communications), explored how data-driven initiatives continue to be an important investment area for executive leadership. Below, I’ll review the key results from the survey to consider how organizations can continue to make intelligent decisions now and into the near future.

    The State of Data-Driven Investments

    We undoubtedly live in a data-driven world, and investment in related projects continues to rise. More than half (55%) of IT decision-makers plan to increase their data-focused investments — the report found the average spend to be $12.3 million in the coming year. This figure rises to an average of $23 million for financial services, which makes sense given the nature of modern banking.

    Naturally, the use of analytics platforms is increasing in tandem with the amount of data generated. In terms of specific analytics tools, 50% of respondents said they used business intelligence platforms while 47% used relational databases and 19% planned to invest in them in the next one to two years.

    We’re also noticing an increasing use of cloud-based solutions. For example, 27% of an organization’s data analytics workloads now run in the cloud. The report also found an uptick in cloud-based enterprise-scale data warehouse technologies, an area that shows signs of increasing in the coming year.

    Common Objectives

    So, what are the most common driving factors behind these types of projects? Well, automating internal business processes is the top goal for data-driven projects—half of IT leaders described this as a primary objective. This is closely followed by other ambitions such as improving customer insights (46%), aiding customer support (43%) and automating IT operations (43%).

    In terms of type, transactional data tends to be the most useful—54% of companies are using transactional data in their data-driven projects. This includes consumer purchasing behaviors such as sales, returns and credits. The next-most-common type is machine-generated data, which includes information from logs, sensors, telemetry, networks, security systems and/or IoT devices. The third-most-common type is customer profile information.

    Data has a powerful impact in a business context as a means to refine existing digital products. Other respondents added that a data-driven approach to DevOps helps increase visibility and drives continuous improvement.

    Data Quality: Highest Ranked Challenge

    Undoubtedly, particular challenges remain. The greatest hurdle is retaining data quality—41% of organizations reported dealing with this issue. Quality may be poor because data is unstructured or incompatible with other sources. Other widespread challenges include governance issues and integrating data from multiple sources.

    For those undertaking data-driven projects, 44% said they lacked appropriate skillsets, such as analytics training, data management, security, business intelligence and integration expertise. Companies also often faced funding and talent-related quandaries when beginning data-driven projects. For example, 26% of small-to-medium-sized businesses lacked the necessary funding to take on data-driven projects, according to the research.

    Another challenging area (that I’ve covered previously) is optimizing how data is collected and stored. As cloud storage fees rise, organizations will likely want to refine retention and resolution to avoid creating unnecessarily large, expensive data lakes.

    Rising Deployment of AI/ML

    AI/ML is already well-established as a way to advance the use of data. More than half (54%) of companies used predictive analytics or planned to incorporate it into their systems in the next 12 months. Just under one-third (31%) also either used or planned to use anomaly detection in the future. These areas along with other functionalities (such as natural language processing and predictive analytics) can be used to aid applications such as process automation, decision support, customer analysis, virtual agents and others.

    The industry is at an exciting moment for leveraging data in DevOps. Data is becoming more and more accessible to enable DevOps with a full-stack picture of the application life cycle. To direct future engineering investment, data-driven decisions will rely on things like performances and usage habits. Thus, it’s an interesting time to consider how you might leverage data for greater process automation and software development fluidity.

    The 2022 Data & Analytics Report surveyed 872 IT decision-makers (ITDMs) from around the globe working in various industries. The respondents’ average company size was about 12,000 employees. To view the report for more insights, you can pick it up here.

  • Creating Career Opportunities in Quality Engineering

    Creating Career Opportunities in Quality Engineering

    Software testing is the thread that connects code to customers, ensuring that the code created by development teams works for users and supports customer loyalty. But as the demands of software development are transformed by DevOps and customer expectations rise, the career and role of the software tester is evolving rapidly. Customer expectations have made it imperative for applications to work seamlessly, necessitating evolution in QA and testing.

    As the QA and software testing sector progress—and “quality engineering” becomes the de facto term for creating agile, customer-centric software teams—QE is attracting a more diverse pool of leaders as the career skillset widens. The more quality engineering becomes the differentiator between elite software teams that thrive in a DevOps world and teams that struggle to adapt, the more important it becomes to elevate diverse leaders in the industry.

    Understanding this, mabl recently held a panel discussion with QA and software testing industry veterans who discussed the new era of quality and how these changes are transforming who enters the field.

    The Evolving Role of the Software Tester: Building Professional Confidence

    The constant evolution in software testing and quality engineering, though exciting, also presents a challenge to QA professionals: How to consistently build the necessary skills as well as the confidence to succeed. As quality engineering becomes a multidisciplinary career role that encompasses engineering, functional and non-functional quality management and the customer experience, the question for QE professionals becomes one of continuous learning and the confidence to broach, if not lead, challenging discussions.

    LaDeitra Lee, chief technology officer for Sparx Studio, understands how confidence can sometimes feel elusive—especially for younger pros just getting started. But her message is meant to encourage those just starting out to speak up: “QA knows the most about the product because we know the customer’s perspective, and we’re testing the full product from the front end that everybody sees all the way to the backend … the main thing: You want to make sure you have the confidence in your work,” Lee said.

    When quality engineers have confidence in their skills, they’re better able to collaborate with the rest of the software development team to improve testing strategy and triage defects. But building confidence can be challenging, especially as software testing has embraced coding skills to the point where software developers can specialize in quality as SDETs. However, that doesn’t mean that coding experience is the most essential skill in a quality engineering career. Since quality engineering is all about connecting code to user context, soft skills like empathy are just as critical for the next generation. So, even if QE professionals aren’t expert coders, they can build confidence in their skills by understanding their unique place in the software development process.

    Marjie Carmen, software engineering manager at Arch Insurance, agreed. “When I started out, it was commonly believed that software testers didn’t need programming skills or software engineering skills since the focus was on manual testing. But today, I see QA working hand-in-hand with and having almost the same skills as a software engineer; sometimes even more. I really see quality assurance as equal because they have to know the business side and the perspective of the users and where the industry is going. They have to make really good recommendations about how the product should be and need the confidence to go to the engineering side and say, ‘What’s the fastest way I can get this product tested and in the hands of the user?’”

    Creating Unconventional Career Paths in Software Development

    How has hiring for a tester today changed in the last decade? As quality engineering continues to grow as a profession, many in the field are creating new career paths by moving between different roles throughout the software industry. By supporting these unconventional candidates, Maaret Pyhäjärvi, principal test engineer and prominent QA speaker, said that software development organizations can grow internal talent and help quality engineering develop as a field.

    “We hope that there’s more of this openness for moving from one technical role to another,” said Pyhäjärvi. “There’s always the possibility of learning small slices of technicality. Some of my favorite architects these days are so good at software testing; so good at programming and can really bring the whole team together. So we need to allow that kind of movement where people get to try things and break away from stereotypes.”

    Susan Marie, president of the Triangle Software Quality Association (TSQA) said, “I love the capital-Q quality emphasis because it gives me leverage to do well—that’s just one area of quality. I hate the idea that the job title is the one thing that you’re allowed to do; you need to be giving guidance around what’s expected of you and what other people can expect from you.”

    While technology is always evolving, former Slack senior engineering manager Karine Sully said the main characteristics for the job have been consistent—even as far back as a decade ago. “I always look for people who are curious and who have good communication and organizational skills, especially coming in at entry-level or lower-level. All you need is to be able to think critically and organize your thoughts and be able to communicate what it is you’re doing. Then, you can push beyond that and grow.”

    Given the challenges inherent to working with multi-disciplinary teams, Lee said, “I think what helped me the most is having a sponsor. So my advice for anyone on my team, or anyone that’s looking to grow in their career, is making sure you have someone a few levels above you looking out for you.”

    Fostering Diversity in Software Testing Teams

    Growing responsibilities equal a growing number of requirements and skills for quality engineering careers. Navigating the hiring process is never easy, but succeeding in a rapidly changing field can feel like running a marathon at a full sprint, especially when trying to foster more diversity in software development and testing.

    “…Diversity and inclusion are definitely very dear to my heart, and I feel you have to go where people don’t look like you. So if you want to hire more Black or Hispanic engineers, you have to go to areas where you see more of them,” Lee said. “If it’s engineering that you’re looking for, do your research and find those schools that specialize in that particular area. I’m a part of the National Society of Black Engineers, so I tap into that network if I’m trying to help build a diverse team.”

    Carmen agreed that hiring managers need to look closely at areas where there may be holes to fill. “I got into management by looking at gaps and filling them—it was always my goal to find a gap and say, ‘Hey, I can take that off your hands and in the role.’ So it’s a natural evolution to get the different roles that I’ve had by saying yes to more and different responsibilities.”

    Conclusion

    Though the QA and software testing fields are in the midst of several transformations, the change is opening the door for more people to have successful careers in software quality. Though their role is to ultimately improve the product, that road to quality is usually filled with bugs and unpredictable challenges. When quality engineering professionals are confident in their work, it’s easier for them to lead constructive conversations on improving the product—and facing down the engineering teams, if necessary. Building a diverse and confident next generation for quality is essential to building delightful digital experiences for all.

    “I heard from a very famous pioneer in the engineering industry about QA that ‘We don’t have a magic wand; we can’t test quality into your product, but we can test your product.’” Pyhäjärvi said. “The whole concept of QA engineer, QA quality assurance, QE, I think gives people the illusion that we can do something impossible. We can only show light to the areas of the product that need work.”

  • What Is User Acceptance Testing and Why Is it so Important?

    What Is User Acceptance Testing and Why Is it so Important?

    Anyone involved in software development knows how important it is to ensure a positive end-user experience. One way to do that is through the use of user acceptance testing (UAT). 

    UAT is one of the types of testing that you can execute as part of your overall quality assurance process. 

    Source

    It’s essential in helping you determine if your product is market-ready and if it can perform effectively when used by real end-users. 

    UAT helps you avoid implementing software, iterations, upgrades, or customizations that are filled with pesky bugs that can destroy the user experience and render your software unusable (not to mention the damage done to your business’s reputation). 

    When the stakes are so high, it’s clear to see why businesses need a process such as this. In this article, we take a look at user acceptance testing, why it’s so important, and six ways brands can use it to their benefit.

    What is User Acceptance Testing (UAT)?

    User acceptance testing (sometimes known as end-user testing, user acceptability testing or beta testing) is the last step in the entire testing process of any software.

    In product management terminology, acceptance testing takes place as beta testing whereby a small group of early adopters test out the platform and provide user feedback to let you know if the solution meets user expectations and business requirements. 

    It’s done after the system, functionality and all other tests are completed and before the product is launched. 

    The image below shows some of the quality assurance (QA) tests that precede user acceptance testing. 

    Source 

    As you can see from the image, as development work moves forward, UAT progresses from unit testing to integration testing, then system testing and, finally, acceptance testing.

    This final stage is arguably the most crucial element of software development because it ensures a positive end-user experience. 

    As its name implies, it helps you determine if your platform will be accepted by end-users. 

    Testers (end users) work from a checklist of expected outcomes from the test platform and then record what happens when they attempt to execute the different tasks, such as:

    • Logging into the user’s account
    • Placing an item into a shopping cart
    • Checking out 
    • Buying multiple items that qualify for free shipping

    … and so on. 

    If the expected outcomes are achieved when each task is executed, then the software is approved for release. If not, it’s sent back to the developers. 

    This testing process requires collaboration between different stakeholders including project sponsors, business owners, analysts, QA teams and developers. 

    Why is UAT Important to Software Development?

    Although there are many ways projects can benefit from UAT (some of which we’ll look at below), this process is often overlooked by developers. 

    Many see it as a time-consuming and unnecessary process, which is unfortunate because acceptance testing can actually help improve software quality as well as the overall acceptance rate of any newly implemented software. 

    Think about it: You would never drive an untested car, would you? Similarly, businesses should not take risks by implementing software that has not been tested. 

    Considering the time and money you stand to save by ensuring that your software works in accordance with a predetermined test plan, it’s clear that this is something developers need to take more seriously. 

    In fact, far from being the time drain that many developers think it is, UAT can actually gain you a lot of time. How? By preventing unnecessary waste. 

    And far from being a one-off when you come to the end of the project, user acceptance testing extends beyond business application projects because of factors like additional phases, hotfixes, releases/further modifications or customizations and upgrades. 

    Take a look: 

    • Additional Phases: If you choose to roll out at this stage or upgrade an existing application in a phased approach, each phase can have different types of users, different companies (for parent companies, acquisitions, mergers, etc.), additional locations, etc., and you’ll need to plan and conduct separate additional acceptance tests for each individual phase.
    • Hot Fixes: Bug reporting or developer testing during regular day-to-day operations can lead to hotfixes. However, these bug fixes will have to be tested by end-users to make sure that they actually solve the problems originally reported.
    • Further Modifications: Software creators regularly release updates, including limited distribution releases (LTR) and general distribution releases (GDR). LTR releases usually fix issues in a specific problem area, whereas GDR releases are typically heavily tested before release. Both need to be tested to ensure that they fit users’ real-life scenarios so you can achieve your business objectives.
    • Upgrades: Everyone wants to offer their customers the best and most advanced experience. That’s why, for the most part, brands update software regularly to follow industry trends and keep up with the latest innovative technology. Regardless of the upgrade approach you take, whether it’s a little or a lot of customization, it’s crucial that your plan is completed according to business requirements. This will help ensure that the project’s end result is in line with the original business requirements.
    • Privacy Policy Updates: Many end-users may enjoy the overall functionality of the software, but they may desire increased integrations with other platforms or the ability to use a different payment method than that which is currently accepted. While these upgrades and modifications may be easily completed, you may need to alter the information you input into privacy policy generators to ensure that your users legally consent to any new use of their data or access to it by third parties.

    Now that you understand what UAT is and why it’s so important, let’s look at some of the benefits of user acceptance testing to give you a better idea of all the different ways you can leverage it in your own business. 

    Benefits of User Acceptance Testing

    At its core, user acceptance testing will be pivotal in the successful launch and/or maintenance of any type of online platform, whether it’s a simple mobile app or something more complex, such as an eCommerce website. 

    If the test object doesn’t work as desired, the faulty business functions are documented and the item is sent back to developers for repair. 

    Going through this final check ensures that your platform is well-built and performs as expected and that users accept the finished product. 

    Listed below is a summary of the top benefits of UAT: 

    • Benefit: The UAT process allows you to demonstrate that the software’s required functions are operating in a way that’s suited to real-world use and circumstances. As such, acceptance testing focuses on software performance and user behavior to ensure that interactions between the test software’s functionality and the end user’s thought process are aligned. 
    • Benefit: Furthermore, you’ll be getting a much better piece of software because it will be tested and verified by the same people who will be working with it every day. You’ll get optimal opportunities to quickly identify and repair any broken features. So, it’s easy to see how the time you invest in these beta testing cycles will lead to significant improvements in the quality of your software.
    • Benefit: Not only that, but the quality review provided by UAT is also a great way for stakeholders to secure a healthy return on investment (ROI) out of projects. Also, it keeps maintenance costs low and it’s cheaper and faster to fix usability/functionality issues early on.
    • Benefit: You’ll also be able to ensure that your software integrates with third-party platforms including various website builders, email marketing software, project management tools, communication apps and everything else you or your end-users might need to effectively use the software. If your software is supposed to allow for social media sharing, for example, you want to ensure that end-users are able to easily share without going through multiple steps that decrease an otherwise positive experience with the software.

    As you can see, user acceptance testing is vital to the successful deployment of new business applications and software enhancements, as well as to ensure organizational efficiency and success.

    The process helps you to mitigate risk and boost the ROI of your project. But most importantly, UAT ensures that your customers don’t end up being acceptance testers by default, which would have a negative impact effect on your business.

    6 Ways to Use UAT

    Here are six ways you can use this process to achieve better outcomes.

    1. Use user acceptance testing for internal development.
    2. Use the testing process to review new features.
    3. Invite users to take part in the tests to help them become more invested in the brand and become brand ambassadors.
    4. Use beta tests as a premium feature to convert subscribers to higher tier packages, increasing sales for the company.
    5. Share information about UAT and its results on social media platforms, email and other channels as part of your digital marketing campaigns.

    These are just a few of the different ways your organization can benefit from UAT far beyond the initial goal of the testing process. 

    And remember, it’s all about the users. 

    UAT isn’t just another testing technique. This test puts the user at the center of the discussion to answer questions such as:

    • Are users able to use the software without error(s)?
    • Does the solution meet promised specs? Does it behave in an expected way?
    • Does the software continue to work when users take unexpected actions?

    …and so on. 

    Whether the platform is constructed in-house or by a third-party company, all solutions must go through user acceptance testing because your users are the ultimate audience who will pay for your solutions. For this reason, it’s worth taking the time to ensure that your software solution meets both user expectations and business requirements.

    Planning and Managing the UAT Process

    The key to a successful UAT testing process is to understand the needs of your target users and their expected behavior. This way, you’ll be able to develop defined acceptance criteria so you can come up with efficient tests to complete the testing process fast. 

    Also, since the goal is to assess the market readiness of the product, it’s important to record all evidence and track progress with the dev team as well as report to stakeholders so everyone is on the same page. 

    With that said, here are five steps to help you plan and manage the user testing process: 

    Step One: Planning. The user acceptance testing strategy mainly includes a time frame outlined during the planning step.

    Step Two: Designing Test Cases. Test cases cover the core functional frameworks of the platform in real-world usage. When designing test cases, you need to do the following: 

    • Determine the needs of target users and stakeholders 
    • Design test cases according to the user journey and product specifications 
    • Summarize test runbook, acceptance criteria, etc. 
    • Prepare test data, e.g. registration, three days in use, one week in use, etc. 

    Step Three: Setting Up Your UAT Team. The acceptance testing team is comprised of real-world end-users or users who are not part of the development or testing phases to ensure objectivity. You should never use developers to test their own software as they may bring bias (albeit unintentionally) into the testing process. 

    Step Four: Executing and Documenting Test Cases. The UAT team executes the test cases, together with relevant random exploratory tests, after which all bugs are logged into the bug tracker along with steps to reproduce.

    Step Five: Bug Fixing. Once you’ve executed the test cases, you need to keep track of the tickets and user feedback. The development team can account for all the bugs found by the testers and start fixing bugs depending on severity. 

    Step Six: Confirm Fixes and Get Stakeholders to Sign Off. Once all UAT tests have been run and the results are in hand, the acceptance decision can be made. If all users are satisfied, then it’s a go. If not, it’s a no-go. 

    Last But Not Least

    UAT is the last stage in the software development life cycle. But, it’s also one of the most important things you can do to ensure the success of your software. Just keep in mind that for this process to be effective, it should be viewed as validation and not verification. Use your test procedures to validate functionality in both smaller scope (as a way to test functionality) and in a larger context (to simulate real-world processes) so you can get an end-user vision of your product which will ultimately help you increase the robustness and usability of your software.

    Are you ready to use UAT to get feedback on your software so you can increase end-user happiness? Share your thoughts below!

  • TechStrong Con: Open Source Software Community Needs Security Help

    TechStrong Con: Open Source Software Community Needs Security Help

    The only way to make significant improvements in the state of open source security is if more organizations that benefit from open source projects commit to making more resources available to achieve that goal.

    At the virtual TechStong Con event, executives on an Open Source and DevOps panel called for more contributions from enterprise IT organizations to ensure the integrity of open source software.

    Organizations of all sizes now benefit from open source software whether directly or indirectly. Those organizations have a responsibility to participate in the development of that software in any way they can, said Jeffrey Barnes, senior software engineer for Remote Operations, a provider of medical transcription services. “We need to give back to the community,” he said.

    Those efforts don’t necessarily have to involve contributing actual code, added Barnes. Many open source projects are in need of documentation and testing help because the number of actual maintainers of the project is relatively small, he noted.

    The challenge is that many enterprise IT organizations don’t understand how to participate in open source software development processes, noted Tom Sweet, CIO for Industrial Refrigeration Pros. An organization might download a piece of open source software and then extend it. Rather than continuing to maintain that branch on their own, organizations should contribute that code back to the project to reduce maintainers’ overall IT burden, Sweet said.

    “Many organizations are struggling to contribute back,” said Sweet. “It’s an evolution.”

    Organizations clearly need to make contributing code back to open source software projects a natural extension of their DevOps workflows. In the meantime, the Open Source Security Foundation (OpenSSF), an arm of the Linux Foundation, is focusing on 10 streams of investment that, in total, would require more than $150 million in funding to drive greater adoption of DevSecOps best practices among maintainers of open source software projects.

    The core issue is that many of those projects are maintained by a small number of programmers that voluntarily contribute their time and effort to build components that others are free to use. Like any other developer, the amount of security expertise those individuals have is limited. The onus for making sure the projects and software are secure is on the organizations that decide to deploy that software.

    Unfortunately, many IT vendors and large enterprise IT organizations reuse that code without contributing anything meaningful back to the project—whether that be in terms of financing or helping open source maintainers find and remediate vulnerabilities.

    It’s not clear to what degree business and IT leaders realize how dependent their organizations actually are on open source software. Many of them assume that open source projects are supported by IT vendors when, in reality, there are many projects that are dependent on the efforts of a small handful of developers volunteering their time and skills.

    Many organizations, of course, may soon decide not to employ open source software if it doesn’t have a critical mass of developers working on it. However, in an era where DevOps teams and developers routinely download software, enforcing those policies is going to be problematic. The best thing enterprise IT organizations can do is engage with the open source software community more rather than less.

  • Developer’s Guide to Web Application Security

    Developer’s Guide to Web Application Security

    When it comes to security, there are many vulnerabilities that can leave your website or web app open to attack. In this article, we’ll go over 15 common web application security vulnerabilities and how you can prevent them.

    1. Insufficient Cryptography

    Cryptography is a critical security measure that is used to protect data in transit and at rest. Yet, many web applications do not use cryptography properly, leading to a number of serious vulnerabilities including potentially devastating code theft. For example, data can be easily intercepted and read if it is not properly encrypted or encryption keys can be easily guessed or stolen if they are not properly protected.

    To properly protect data, it is important to use strong cryptography. This includes using proper encryption algorithms, encrypting data in transit and at rest, properly protecting encryption keys and more. It is also important to keep all software up-to-date, as new cryptography vulnerabilities are constantly being discovered.

    2. Broken Access Control

    Access control is a security measure that controls who has access to what data and functionality in a system. It is an important part of any web application but often is not implemented correctly. This can lead to serious vulnerabilities such as sensitive data being leaked or attackers gaining access to administrative features.

    There are a number of common mistakes that can lead to broken access control, such as failing to properly restrict access to data and functionality, using insecure methods for storing and transmitting user credentials and not properly protecting session tokens. In order to prevent these kinds of vulnerabilities, it is important to implement proper access control measures in your web application.

    3. Broken Authentication and Session Management

    Authentication and session management are two of the most important security measures in any web application. Yet, they are very often not implemented correctly, leading to a number of serious vulnerabilities. For example, session ID’s can be easily guessed or stolen, cookies can be tampered with and passwords can be brute-forced.

    In order to properly protect user data and prevent these kinds of vulnerabilities, it is important to implement strong authentication and session management mechanisms. This includes using strong passwords, two-factor authentication, proper session expiration and invalidation, and more. It also means properly protecting any session IDs and cookies that are used by the application.

    4. Cross-Site Scripting

    Cross-site scripting (XSS) is a type of vulnerability that allows an attacker to inject malicious code into a web page. This can be used to steal data, hijack sessions, redirect users to malicious sites and more. XSS is one of the most common web application vulnerabilities, especially in our era of remote work. Despite security awareness training, many employees remain vulnerable to social engineering and phishing tactics when these risks are not properly addressed.

    To protect against XSS attacks, it is important to sanitize all user input and output. This includes properly escaping special characters, using a whitelist of allowed characters and more. It is also important to keep all software up-to-date as new XSS vulnerabilities are constantly being discovered.

    5. Insecure Direct Object References

    Insecure direct object references (IDOR) are a type of vulnerability that allows an attacker to directly access data that they should not have access to. For instance, an attacker could guess or brute-force the URL of a sensitive file, such as a customer’s credit card information, and then download it. IDORs can also be used to bypass security measures such as access control checks.

    In order to prevent IDOR vulnerabilities, it is important to properly validate all user input and restrict access to data and functionality to only those who are supposed to have access to it. It is also important to keep all software up-to-date as new IDOR vulnerabilities are constantly being discovered.

    6. Insufficient Authorization and Authentication

    Insufficient authorization and authentication is a type of vulnerability that allows an attacker to gain access to data or functionality that they should not have access to. This can be due to a number of factors, such as weak passwords, improperly implemented role-based access control, deliberate over-permissioning and more.

    To properly protect data and prevent these kinds of vulnerabilities, it is important to implement strong authentication and authorization mechanisms. This includes using strong passwords, two-factor authentication (2FA), proper role-based access control and more. It is also important to keep all software up-to-date as new vulnerabilities are constantly being discovered.

    7. Failure to Restrict URL Access

    Another common web application security vulnerability is the failure to restrict URL access. This can allow attackers to gain access to sensitive data or functionality that they should not have.

    One of the most common problems developers face is forgetting to properly restrict access to directories and files. For example, they may forget to add an index.html file to a directory. This oversight would give anyone who accesses that full directory read and write access to all the files in it.

    Another common issue is that developers do not properly restrict access to certain URL parameters. For example, they may allow anyone to access the “id” parameter, which could be used to view or modify data that they should not have access to.

    To prevent these kinds of vulnerabilities, it is important to make sure that all directories and files are properly restricted and that all URL parameters are properly sanitized before being used.

    8. Remote File Inclusion

    Remote file inclusion (RFI) is a type of vulnerability that allows an attacker to include a remote file, usually through a script or other type of application, on a vulnerable web page. This can be used to inject malicious code into the page which can then be executed by anyone who views it.

    One of the most common problems with RFI is that developers do not properly sanitize user input, which allows attackers to inject their own files into the page. Another issue is that developers often use static include paths which makes it easy for attackers to guess the path and inject their own files.

    To limit these kinds of vulnerabilities, it is important to make sure that all user input is properly sanitized and that dynamic include paths are used.

    9. Insufficient Logging and Monitoring

    Logging and monitoring are critical security measures that are used to detect and respond to security incidents. Despite these critically important functions, many web applications do not properly log and monitor activity, leading to a number of serious vulnerabilities. For example, an attacker could easily cover their tracks or an incident could go undetected if there is not proper monitoring in place.

    In order to properly detect and respond to security incidents, it is important to properly log and monitor activity. This includes logging all activity, monitoring for suspicious activity and more. It is also important to keep all software up-to-date, as new logging and monitoring vulnerabilities are constantly being discovered.

    10. Security Misconfiguration

    Security misconfiguration is a type of vulnerability that arises when a web application is not properly configured. This can lead to a number of serious security issues such as exposing sensitive data, making it easier for attackers to gain access to systems, and more.

    To mitigate risk when it comes to these kinds of vulnerabilities, it is important to properly configure all software and systems. This includes setting strong passwords, disabling unnecessary accounts and services, properly configuring firewalls and more. It is also important to keep all software up-to-date as new security misconfiguration vulnerabilities are constantly being discovered.

    11. Tampering with Data

    Data tampering occurs when an attacker tries to modify data without permission. This can end up having a number of serious consequences, such as corruption of data, loss of data integrity and more.

    To prevent data tampering, it is important to properly protect data through data handling and storage best practices. This includes using proper authentication and authorization mechanisms, encrypting data in transit and at rest, properly protecting encryption keys and more. It is also important to keep all software up-to-date as new data tampering vulnerabilities are constantly being discovered.

    12. Cross-Site Request Forgery (CSRF)

    Cross-site request forgery (CSRF) is a type of vulnerability that allows an attacker to trick a user into submitting a malicious request. The goal is to be granted requests to do things without the user’s knowledge or consent, such as changing their password, transferring funds and more.

    To prevent CSRF attacks, it is important to properly validate all requests. This includes using proper request validation mechanisms, such as checking for a valid CSRF token, 2FA and more.

    Be Aware of Vulnerabilities

    We use and rely on a large number of web apps in our daily and commercial lives. While most of these apps are relatively safe and secure, there are still a number of common security vulnerabilities that can leave them open to attack.

    To keep your web apps safe and secure, it is important to be aware of these vulnerabilities and know how to prevent them. This includes keeping all software up-to-date, using proper authentication and authorization mechanisms, encrypting data in transit and at rest and training users to identify social engineering and phishing attempts, among others. By following these best practices, you can help to ensure that your web apps are as safe and secure as possible.