devopsy.kinsta.cloud

Category: DevOps Practice

WordPress Hacks: Best Ways to Protect WordPress from Hacking
When it comes to website security, even an iota of prevention is really worth a large pool of measures to restore a website from its affected state. WordPress websites are most vulnerable to security attacks from sophisticated hackers as well as the bots that are capable of exploiting security vulnerabilities. These security vulnerabilities range from weak passwords, outdated themes and plugins, and poor-quality web hosting.

But, there are several time-tested measures that can prevent such security compromises and risks and keep a website performing and secure.

Make Use of Strong Passwords

Weak passwords often cause security risks for websites. You can prevent such risks by using strong passwords and for this, you can use tracking tools such as 1Password that can track all the passwords and prevent you from using the same password on all your internet accounts. The tool also prevents you from using easy and easily rememberable passwords. Thanks to the tool you can only use unmemorable, long, difficult passwords.

Using this tool you can easily test the strength of the existing passwords and can create passwords that are long, complex and not easy to guess. The tool helps you maintain all your web accounts with strong passwords.

Updating WordPress Core, Themes and Plugins

Most updates of the WordPress core, or the themes and plugins, come to mitigate the security loopholes and risks. This is why making updates once a month is far from enough. Whenever a vulnerability will surface, your non-updated website can be the first victim of the security risk. This is why one must update as soon as there is an available update. For all the plugins that don’t come with important features and functions, one can use a Shield WordPress Security plugin to auto-update.

Insist on WordPress Hardening

There are several WordPress hardening methods that can easily prevent hacking from taking place. Let’s have a quick look at these hardening methods.
- Add extra allow/deny rules through your .htaccess file.
- Keep login URLs restricted to specific IP range(s).
- Safeguard your wp-config file.
- Prevent image hotlinking and mobile directory browsing.
- Do not use public WiFi or VPN to log in to the website.
- Remove unused WordPress plugins and files.
- Keep the server clean.
Prevent a WordPress Hack with a Website Firewall

A vast majority of WordPress websites are frequently hacked as they are more vulnerable to security risks than other CMS platforms. A common issue that security experts stumble upon often is that WordPress version update is often not possible, thanks to the incapabilities of plugins or themes. This is when a WordPress website can easily become vulnerable to hacks.

For such cases, enabling a WordPress firewall is strongly recommended to provide security patches for your website. A Web Application Firewall (WAF), when enabled, can take on such security risks. A WAF basically works like a pass for your website visitor traffic, and effectively filters out bad requests comprising hack attempts, exploits, DoS attacks and many more.

A WordPress firewall does the following things to strengthen WordPress security:
- Prevents all future hacking attempts by detecting and thwarting all hacking methods and behaviors, thus keeping your WordPress website protected against malicious attacks.
- The firewall provides a virtual security update for your WordPress website software, even when the website doesn’t have any new security updates.
- A WordPress firewall also blocks brute force attacks or any unwanted visitors from accessing the wp-admin or wp-login page and makes use of brute force automation to detect your password.
- It deals with Distributed Denial of Service (DDoS) attacks that basically try to overload a web server or the resources of an application with too many requests. By blocking DDoS attacks, a WAF ensures constant accessibility and performance of a WordPress website in all circumstances.
- A WordPress firewall helps boost WordPress performance by storing website caches and keeping bounce rate lower. This also ensures optimum website engagement, business conversions and steady search engine ranking.
- The cloud-based WordPress firewall solutions, besides preventing attacks, also boost WordPress website speed by using a Content Delivery Network (CDN).
Make Sure You Have an SSL Certificate Installed

This is a basic and very important security measure for most websites. It safeguards data by encrypting the data you and users use and transfer via a website. For example, when one submits a contact form or uses login in web pages, the data that is transferred remains encrypted. With SSL installed on a website, secure login can be ensured even while traveling. While some hosts and hosting plans provide this for free, with some you need to use a separate SSL plugin for the purpose.

Avail Better Web Hosting

Choosing good hosting companies can also be crucial for your WordPress security. Some hosting service providers such as WP Engine, Kinsta, Site Ground and a few others are great for WordPress security. These service providers take care of routine security scans and provide cleaning of hacked websites for free. Apart from performance, one should also consider security aspects for website hosting.

Taking Backup of Your Site

Though taking regular backups may not always be effective for preventing a WordPress hack, they can sometimes play a great role in disaster recovery. It is particularly useful in preventing a website database from damages due to malicious attacks.

Continuous Website Monitoring

Finally, continuous monitoring of websites can help greatly in tracking and mitigating security risks of all types. Setting Google Search Console alert is important concerning all issues on your website. Apart from that, you should monitor the error logs on your website through the cPanel File Manager or FTP (SFTP). You should also see the Raw Access Logs on the server to keep track of the users accessing website files on the site. You should also use a plugin called Shield WordPress Security plugin and use its Audit Trail feature to keep track of all the file changes and website accessibility issues.

Conclusion

All the above-mentioned ways are time tested as successful to prevent security attacks and keep security vulnerabilities at check. These measures, besides a meticulous choice of plugins and themes, can help a WordPress website perform well and remain secure.
May 6, 2020
TechStrong Con: 12 Hours Strong, June 4
In my previous article, I noted that as part of our COVID-19 response MediaOps has spun up TechStrong TV, a daily video stream. Additionally, we are hosting our biggest virtual event to date, TechStrong Con, for 12 hours strong on June 4. We want to make TechStrong Con our biggest, best virtual event to date. We want to show that while we may be working from home battling this terrible virus and dealing with economic upheaval, the tech industry is unbowed. We collaborate, we communicate. We develop, we deploy. We are strong, #techstrong.

I know what you are thinking: Hmm, another virtual event, joy. Just what we need. Yeah, I am with you—it does seem like everyone and their mother are putting on virtual events, or at least calling what they are doing virtual events. But really, this one is different. Here is why:
1. The speaker lineup is extraordinary. John Willis has handpicked the speakers in the main room auditorium. The lineup is not final yet but already includes an amazing mix:Seriously, this is a blockbuster lineup of speakers. In addition, there will be multiple auditoriums as well as the main stage, all with great speakers. One of the advantages of a virtual event is you don’t have to miss one speaker if two great talks are going on at the same time. The sessions will stream live at their given time and be available on-demand.
2. There will be chat rooms built into the event itself. Many of the speakers will be available live in the chat rooms after their sessions to answer questions or chat with attendees.
3. The event will be 12 hours chock full of all kinds of tech learning, networking opportunities and a chance to escape the bad news.
4. A job board will be available for companies looking to hire and those looking for work.
5. A portion of sponsor proceeds (it’s free to attend) will be donated to COVID-19-related charities.
The whole event will take place in our state-of-the-art virtual environment, which we have been steadily improving for the past 24 months. This really is one event you don’t want to miss. Also, if you are interested in sponsoring or speaking, write to me at editor@devops.com.

Stay healthy. Stay strong.
May 5, 2020
Enterprise Kanban Implementation: Where to Start and How to Scale Across an Organization
The Evolution of Kanban

At its core, Kanban is a management method designed to improve customer satisfaction by creating fast and reliable workflows capable of delivering products and services of superior quality.

Kanban originated in the automotive industry of Japan and was originally developed as a method for improving manufacturing efficiency at Toyota. However, at the beginning of the 21st Century, key players within the software industry realized that Kanban could be used to positively change the ways in which products and services were delivered.

The result is astonishing. In less than a decade, Kanban has become the most popular tool for software development and IT teams, surpassing the Scrum framework, which has been the de-facto standard until recently. According to the State of Scrum survey, 60% of Scrum teams utilize the Kanban method, which is a testament to the benefit it brings.

Kanban left the realm of the automotive industry and conquered the IT world, but now, with an increased focus on flow and by harnessing advances in computing technology, it is about to expand its reach to the entire business. Leaders all over the world have realized that Kanban has the most flexible architecture that allows it to scale across the enterprise in a natural and human-centric way. More and more companies are embracing the Kanban “start with what you do now” principle and are on their way to true business agility. But, how do you go about that exactly?

A Bit of Expectations Management

Managing an enterprise Kanban implementation starts with expectation management. Senior leaders that sign off on multi-million dollar budgets for agile transformations should be informed that business agility is a strategic choice and not a one-off project. No company in the world has ever managed to become agile overnight. There’s no shortcut to that, nor is there a recipe to follow.

Even if your company is doing well, unless you push hard to improve, sooner or later your competitors will catch up. So, in terms of expectations, people should know that there is no “we’re done” state. The constant, never-ending process called continuous improvement is what makes you resilient in the long run.

If there’s one area where Kanban really shines, it is continuous process improvement, which will almost always lead to qualitative and quantitative overall improvements. Applying Kanban to a process will typically drive up to 2000% improvement—and that’s not a typo. Scale that on a company level and let the numbers speak for themselves.

Start with What You Do Now

Once an organization has made the decision to implement Kanban, it can be tempting to jump quickly into building the system itself without conducting a thorough analysis of enterprise operations and processes. As a first step, it is vital that organizations assess their current situation to understand where concrete improvements can and need to be made. This includes aspects such as:
- Processes: Is production stable and predictable? Answering no to this question doesn’t mean you can’t properly create and scale Kanban in your organization, but it does mean that you need to put some extra buffer and flexibility into your planning.
- Involvement and Investment: This is where the notion of scale is important. A company-wide Kanban would be immensely more effective than local implementations, but it will require involvement from senior leadership and a significant budget. It is often a good idea to start small, learn fast and then go full speed.
Kanban’s flexibility allows it to be overlaid onto existing workflows, systems and processes without disrupting what is already successfully being done. It will, naturally, highlight issues that need to be addressed and help to assess and plan changes so their implementation is as non-disruptive as possible.

Kanban’s versatility allows it to be introduced incrementally, and sympathetically, to all types of organizations without fear of over-commitment or culture shock. This makes Kanban easy to implement in any type of organization as there is no need to make sweeping changes right from the start.

If you are starting on a smaller scale with a goal of growth, once the Kanban mentality is put in practice and successfully functioning, it is important to set goals for future scale—six months, one year and three years down the road. If you conduct a pilot where Kanban is embraced and productive, don’t lose time and momentum waiting to deploy it across the rest of your business or enterprise.

Training

Training is an aspect of Kanban implementation that is often overlooked. It is important for the team designing and implementing the system to consider every level of user across the organization. What seems logical, obvious and understandable in the context of a planning meeting may not prove to be so on the shop floor.

While a well-designed Kanban system may appear visual and obvious, end users who don’t understand the theory behind it, will not always trust it. This is especially true for mature employees who are accustomed to doing things a certain way based on learned habits. When introducing Kanban, put yourself in the shoes of someone who does not know anything about it and may not initially embrace the idea of change. As straightforward as Kanban should be, if the end-user is not on board, it won’t work.

Training resources such as Kanban University offer certified Kanban courses and a global network of resources for organizations to help onboard employees and users at every level, build awareness and assure quality in Kanban implementations. Upfront and ongoing investment in such training teaches organizations how to fully maximize the value of Kanban, and train them to understand and visualize systems of work to continually improve and deliver effective results.

Past the Team Kanban Phase

If you do Kanban right, many tough questions will have to be answered, including, “How do you connect the high-level strategy with the goals on a team level?” and “How do you bridge the gap between planning and execution?” The good news is that Kanban has an answer for these questions, too.

Kanban integrates naturally with strategy deployment frameworks such as Hoshin Kanri or OKR. All you have to do is use Kanban across every level of the organization. Practice shows that companies would typically use three flight levels. The lowest level is the team level, where work gets done. The second is the coordination level, and the third is the strategic level. All levels are connected to one-another, so that strategic initiatives (level 3) are broken down into projects (level 2), which are then broken into work items for the teams to work on (level 1).

When you “Kanbanize” all three levels and connect them into a single whole, then you get an extremely powerful management tool with the following benefits:
- All work is visible, starting from the very top to the very bottom.
- Impediments across all levels are explicit.
- There is bidirectional feedback loop between all flight levels.
- The senior leaders can quickly change the course of the whole company.
- Much more accurate and reliable status reports that are based on real data.
- Through the usage of proper Kanban tools, the data gathered on the team level can be used for forecasting on the project level. This helps leaders take informed decisions.
Driving Enterprise Agility with Kanban

The demands of businesses, customers and markets will always change. And in response, businesses must be able to quickly pivot and adapt to meet shifts in expectations and requirements. Successfully implementing Kanban across an enterprise requires a deep understanding of the theory that stands behind it and upfront investment to determine the best approach to make it work within the context of unique organizational challenges and objectives. When implemented and designed appropriately–with buy in and support at every level–Kanban enables enterprises to be agile amidst change, continually improve vital processes and the ability to scale to meet the demands that tomorrow can bring at a moment’s notice.
May 5, 2020
DevOps as a Service: Migrating Your Entire DevOps Stack to the Cloud
DevOps as a Service (DaaS) enables teams to centralize their tooling and workflow into one unified solution. This solution typically contains all necessary DevOps pipeline features, which replace legacy tooling. This article explains how DaaS works, including pros and cons, and an example showing how to migrate from Azure DevOps Server to Azure DevOps in the cloud.

What Is DaaS?

DaaS is a managed, cloud-based service that provides a unified DevOps toolchain. All or most of the tools necessary for a continuous integration/continuous delivery (CI/CD) pipeline are collected in a single platform. This platform is then provided to teams with the support of dedicated DevOps professionals.

The goal of DaaS is to enable organizations to focus on developing and delivering software without having to worry about managing or maintaining tools. It is designed to abstract away the intricacies of tool integration, deployment and maintenance. This enables teams to focus on higher-level tasks, and outsources significant manual effort.

DaaS can provide small to medium businesses with enterprise-level infrastructure and tooling without needing to hire more staff or build extensive expertise. Instead, these businesses can rely on the experience of DaaS providers to create, deploy and optimize a pipeline for them. These pipelines are created to be intuitive and to facilitate the smooth collaboration of all team members.

DaaS Pros and Cons

If you are looking to migrate your development processes to the cloud, there are several migration strategies you can use. One involves moving existing tools to cloud resources as microservices, which you must then integrate. The other may involve scraping existing tools and adopting a DaaS. Whichever the case, you need to understand the pros and cons of DaaS before you can make the right choice for your organization.

Pros of DaaS:
- Managed services provide access to dedicated DevOps engineers for support, expertise and optimization.
- Provider teams have experience across a range of organizations and industries, and can customize solutions for you based on that experience.
- DaaS teams can provide mentorship and guidance which helps your team improve their own skills. This enables teams to learn from the mistakes of others and prevents repeating mistakes.
Cons of DaaS:
- The importance of pipeline management and availability requires you to partner with a service provider that is reliable and can ensure zero to minimal interruptions.
- Outsourcing infrastructure demands and providing access to source code and other sensitive data and systems. This can create a security risk that you are not in control of.
- DevOps teams still need to understand the tools being implemented and the basics of how to manage and use those tools.
- Managed services often cost more than self-implemented pipelines and the costs may not be offset by an in-house reduction in IT responsibilities.
DevOps Cloud Migration Example: Migrating from Azure DevOps Server to Azure DevOps in the Cloud

Azure DevOps Server, formerly called Team Foundation Server (TFS), is a server hosted on-premises that enables you to build DevOps pipelines. While based on similar services to those offered in the Azure cloud, it requires you to manage and maintain your infrastructure and provides limited support for your configurations.

By migrating to the cloud, you can outsource many of your infrastructure responsibilities, focusing instead on producing quality software. Azure DevOps Services are an example of partially managed DaaS that you can use.

Below is a brief guide for how to transfer your data and projects from DevOps Server. This guide is adapted from the full DaaS guide provided by Microsoft.
1. Preparation: Planning your migration requires taking an inventory of how you are currently using your tools, what data you need to migrate and how migration will impact your productivity. You also need to determine if you need additional licenses. For this step and those to follow, there is a tool you can use to assist you in the process.
2. Configure Your Prerequisites: Before you can migrate your pipeline data you need to set-up a few prerequisites. You should synchronize your local Active Directory (AD) with Azure AD for authentication. You also need to set up security and compliance measures to ensure that your infrastructure remains secure.
3. Update and Validate Your Server: Check to make sure that your server is up-to-date with the latest version of Azure DevOps Server. If you are still using TFS, this may mean a series of updates. Once you’re fully updated, you can use the migrator tool to validate the collection databases of each of your projects. If any errors are found, you need to fix those issues during this phase.
4. Ready Your Cloud Resources: After all errors are eliminated, you can begin preparing your cloud resources for import. This requires assigning, activating and mapping your DevOps Services subscriptions. You also need to generate a template for your import settings through the migrator tool. These settings should be saved in your Import Specification file. Finally, you need to create a container instance in the data center you want to use your DevOps Services in.
5. Migrate Your Pipelines: After all of your preparatory and planning stages are done, you are ready to migrate your workloads. During this phase, you should first run a test import to ensure that all configurations are correct and that the import process goes smoothly with no data corruption. This helps ensure that you don’t create unnecessary downtime.
Provided your test run goes smoothly, you can then proceed to import your data. Once uploaded, you need to assign your organization name, set up billing and redirect your on-premises build servers to the new cloud resources. After you are done, you can resume operations and begin operating your pipelines directly from the cloud.

Conclusion

DaaS is typically not just a centralized platform, but also a managed service that comes with certain levels of support and optimization. If you are short on DevOps talent and tooling, DaaS can fill this gap or even help you and your team learn DevOps skills.

However, since you are giving the DaaS of your choice control over your pipeline, you need to investigate and research. You will be giving your DaaS access to source code and security. Before signing a contract, make sure this service is trustworthy and meets your standards.
May 5, 2020
5 Capabilities Network Infrastructure Must Have to Support DevOps

According to the Accelerate 2019 State of DevOps report, high-performing DevOps organizations achieve over 200 times more frequent deployments and over 2,600 times faster recovery times than low performers. These outcomes have been realized by both forward-leaning organizations such as Amazon, which deploys code every 11.6 seconds, and more traditional enterprises that have been in existence for a long time. For instance, Nordstrom, a well-known American retailer, increased the release frequency for its mobile app from twice per year to monthly.

Embracing DevOps results in significant advantages, including improved team collaboration, cooperation and productivity. Companies can get digital products, applications and services to market faster because of the higher deployment and release frequency. Because development and operations teams are not operating in silos, unaware of each other’s constraints, there are lower failure rates within production environments. Cooperation leads to faster recovery times when there are issues with deployment.

To achieve DevOps success, teams must engage in a new approach to network infrastructure, and the network infrastructure must have the following five attributes.

Automation

Automating repetitive tasks, such as configuring DNS or a firewall, saves a lot of time and effort. It eliminates manual errors by standardizing deployment and configuration of network infrastructure. Automation can be achieved by using Infrastructure as Code (IaC), which entails using an application programming interface (API) to create, modify and shut down infrastructure. This ensures that a repeatable, consistent configuration can be created. This code can be version-controlled, which serves as a form of documentation—it’s easy to detect what changes were made by whom in case there’s an issue—and rollback to a stable state is quick and easy.

Standardization puts an end to “It worked in my environment” or “It worked on my machine” as any issues can be easily reproduced, resulting in faster resolution times. Support for IaC tools, such as Terraform, is essential for network infrastructure to advance DevOps practices.

Continuous Integration/Continuous Delivery (CI/CD)

CI is a coding best practice wherein code is checked into version control repositories frequently. It provides a consistent and automated way to build, package and test applications. CD picks up where CI ends and deploys applications in an automated fashion in a variety of environments, including production, development, test and sandbox.

There are a variety of tools, such as Jenkins and Ansible, that DevOps teams use for CI/CD integration. It is imperative for network infrastructure to integrate with these tools to accelerate deployment velocity.

Elasticity

DevOps teams spin up and spin down test/development/sandbox environments routinely. Infrastructure may also be needed for short periods to account for seasonality or for handling sudden surges in traffic and demand. DevOps-friendly network infrastructure must be elastic to support these activities.

Appliance-based vendors who provide network services are not scalable as they impose artificial limits on their usage (such as queries per second or leases per second) and require organizations to anticipate their needs in advance. When there is a need, organizations have to spend time procuring these appliances, waiting to receive them and, finally, deploying and managing them—a very inefficient way to manage demand.

Support for Containers

Containers are the foundation for developing cloud-native applications. Containers allow developers to package up application code and all its dependencies, including libraries and other binaries, as well as configuration files needed for running the application. This enables applications to be executed quickly and reliably across a variety of environments.

Containers provide flexibility and portability of applications across public, private, hybrid cloud and even bare-metal environments. They are lightweight, as all containers share the underlying machine’s OS system kernel. They also lend themselves to greater modularity, which is essential for developing microservices-based applications.

Instead of a monolithic application consisting of a three-tiered architecture, a microservices-based application consists of several smaller services that perform one function and one function only. It’s easier to scale, easier to manage and faster to develop such applications. Because containers have a small footprint, they are most suited for microservices architecture.

In order to support containerized applications, network infrastructure must first be compatible with containers. Network infrastructure must be able to configure DNS, allocate IP addresses for containerized applications, route traffic intelligently between containers and balance loads for optimal performance. Network infrastructure must also support Kubernetes, the most widely deployed orchestration platform. To ensure that the needs of DevOps teams are met, it is important to inquire with network services vendors about compatibility with containers and Kubernetes, as many legacy, appliance-based solutions cannot support this technology.

Self-Service Access

To move quickly, development teams may need to configure network infrastructure for test/development/sandbox environments. Having to submit tickets to network operations teams that use legacy appliances for delivering network services significantly slows down application development and deployment. Providing self-service access to network infrastructure, such as firewalls, load balancers, DNS and DHCP for development teams, eliminates the reliance of these teams on network operations teams. Self-service with robust role-based access controls reduces the deployment time and increases efficiency while freeing up network teams for more strategic projects.

Conclusion

DevOps attempts to minimize friction in application deployment by providing autonomy to development teams so that they don’t have to rely on network administrators to provide the necessary infrastructure needed for development and testing. But, the move to DevOps requires more than a consolidation of teams.

Success requires best practices such as automation, CI/CD and self-service access to infrastructure, as well as support for containers and Kubernetes, which are key to building modern, cloud-native applications. Teams that incorporate these capabilities will see increased agility and speed that lead to shorter delivery time, higher-quality applications and improved communication and collaboration throughout a product’s lifecycle.

May 1, 2020
Communicating with Management About Technical Debt
We’re all familiar with the challenges of technical debt. While it’s often unavoidable–due to time constraints, resource considerations or simply a lack of good information–it still weighs on our minds and puts us on the defensive. It makes future changes that much more difficult. As it builds up, it generates that nagging sense of an unpaid bill that’s accumulated interest and is about to come due.

But, perhaps, the most challenging aspect of technical debt is simply this: getting senior business leaders to understand what it is and convincing them to do something about it.

There are many reasons we’re not getting through. Management is often under significant pressure to deliver results with little patience for discussing anything that doesn’t directly contribute to a specific outcome. Resources may be limited. It’s simply human nature to prefer short-term gratification–developing a new customer-facing app, for example–to the longer-term but behind-the-scenes benefit of paying down technical debt.

If we’re honest, we also bear some responsibility for our lack of progress. We need to do a better job of clearly defining and explaining why technical debt should matter to business leaders. But, how do we do this?

Here are five ways to explain and highlight the importance of addressing technical debt to key decision makers.

Drop the Tech Talk

When discussing technical debt, it’s easy to fall back on shop talk–i.e., explaining technical debt in IT terms. This is a battle that must be waged in business terms. Fortunately, there are many parallels between technical and financial debt that business leaders are familiar with.

All healthy businesses carry financial debt on their books, and leaders know that debt must be kept within certain limits in order to maintain a healthy balance sheet. Indeed, they are acutely aware of the consequences of carrying too much debt. Not only does it endanger the company’s credit rating–making future borrowing more expensive–but it also accumulates interest and may force companies to curtail certain actions, such as paying dividends or buying back stock, that are important to shareholders. That’s why, when debt levels rise to a certain point, most companies bite the bullet and make a concerted effort to pay down debt before embarking on another business-building cycle.

Outline the Potential Business Impact for Carrying too Much Technical Debt

Technical debt must be kept within certain limits to avoid hurting the business. Unpaid technical debt generates interest that increases over time and adds to the cost of fixing the problem. Carrying too much technical debt leads to negative business (versus IT) consequences, including:
- Lost sales and/or lower productivity due to system outages.
- A loss of competitive advantage due to a progressively poorer user experience.
- An inability to adapt to market changes.
- Fines due to security breaches.
- Poor decisions resulting from inconsistent or untimely data.
Find Creative and Visual Ways to Tell the Story

There are several different ways you can contextualize technical debt–from using everyday analogies, such as the importance of daily household upkeep, to the benefits of preventative maintenance, as in the classic Fram oil filter “pay me now or pay me later” commercials. You can also leverage compelling visuals like the one below to dramatize your arguments.

Source: Projectmanagement.com

Rinse and Repeat

In making your case to business leaders on the need to address technical debt, it’s important to adopt a campaign approach. Think like advertisers who measure their impact in terms of reach and frequency–how many people they reach and how many times those people are exposed to their message. While you’re not running an advertising campaign, you need to be prepared to make your case over time, and to reach both the decision makers and the people who influence the decision makers. One email, or one presentation to management, isn’t going to get your message across.

Creating a Healthy IT Balance Sheet

Technical debt is inevitable and, in some cases, makes sound business sense–i.e., when speed-to-market is critical, when resources are limited or information is incomplete. If technical debt reaches a certain level, it makes good business sense to forego immediate gratification projects (developing that shiny new app) in order to pay it down.

That’s why framing technical debt in a manner that business leaders understand (i.e, through the lens of financial debt) can make business leaders more inclined to realize the importance of managing it, as they do other risks facing the business.

Of course, responsible IT leaders not only surface issues that require management attention, they also offer potential solutions. For example, funding strategies to pay down technical debt, including ongoing efforts and small and large improvement projects.

By treating technical debt as a business rather than a technical issue, technology officers stand a better chance of breaking through with management, paying down those nagging old debts and finally getting their IT balance sheets in order.
May 1, 2020
How to Get Your Digital Data Game on with DataOps

As a new mindset, methodology and practice within data management, DataOps focuses on improving the communication, integration and automation of data flows to simply and successfully help developers, IT and the business create real-time data experiences and reduce the risk of project failure. DataOps enables developers and organizations to better adapt to fast changing business requirements to become data driven.

DataOps, like DevOps, aims to provide continuous delivery of new capabilities with higher quality, but it’s focus is on data rather than putting technology and application development first. A DataOps approach ensures data pipelines are deployed, SLAs are met and that data versioning, compliance and auditing are in place. It also helps improve visibility into the quality of data.

How Can Enterprises Maximize the Value of the Digital Data They’re Collecting?

Organizations need to move quickly, and the faster knowledge is in the hands of those with domain expertise, the higher the value.

Enterprises need to react quickly to events, both digital and physical, because the rate at which data value perishes increases with time. The key to understanding and interpreting this stream of data is to be able to share and disseminate the information to those with the business and domain expertise, without the typical time-consuming back and forths. If we take the current coronavirus outbreak, we can use technology to track and correlate but if we can’t share it with the medical professionals in a usable real-time form, we lose.

The way Babylon Health does this is a great example of bringing in DataOps practices that reduce the turnaround time in delivering healthcare data to medical professionals and patients.

They have adopted DataOps. All their data personas (engineers, analysts, etc.) have different needs but use the data integration platform in the same way. For them, DataOps is a big reason why they have been able to expand and offer so many great AI healthcare data products in many countries so quickly.

What’s the Best Way to Build an Effective Data Optimization Strategy?

Organizations need to provide developers with tools that bind data technologies, increase data literacy, promote and incentivize data sharing, while ensuring it comes with transparency to protect data ethics.

Data optimization comes from knowledge and adoption of DataOps practices. When companies deliver data to those with domain knowledge and cut out the complex IT and engineering processes—currently in between the data and that knowledge—data projects succeed.

This practice ensures that focus remains on the business and its needs, with technology as an enabler.

Organizations must also stop thinking that one data solution fits all. Instead, they should use a data mesh leveraging best-of-breed data technologies and look for a solution that makes those technologies accessible to anyone, not an elite few.

Increasing data literacy and working with a common language, such as SQL, is a key best practice. For example, Airbnb has been very successful increasing its line of business employee data literacy through its Data University courses. When business partners and developers leverage SQL to solve their problems it reduces barriers to optimizing data.

Organizations must also drive a mindset of data sharing by including measurement of teams and individual performance on how much data they share across their organization. When teams and people know data sharing is part of their performance evaluation they are more likely to take steps and adopt practices needed to be effective in their data sharing.

However, with increased democratization of data, and a higher data-sharing policy, comes the need for greater transparency to ensure data ethics are upheld. Look for tools that increase observability to uphold data ethics. Improved transparency into who is doing what with the data also enhances accountability.

What Are the Leading Data Optimization Challenges?

Organizations struggle to provide timely access to data with governance, with developer productivity and getting applications that process data to production.

A big contributor to this is that many data platforms have a number of open source technologies. The industry has not accounted for how these technologies can be easily integrated into an organization. Platform teams spend too much effort integrating these individual technologies—when solutions exist that allow them to instead focus on delivering products to market.

This wasted time and inefficient use of talent exacerbates the existing skills shortage.

A further challenge is changing mindsets. How can organizations ensure and encourage developers and engineers to select technologies that best support business initiatives and not technology for technology’s sake?

How Can IT Leaders Bring Their Staff Up to Speed on the Latest Data Optimization Technologies and Practices?

We are now in an era of commoditized technology. Previously complex and hard to manage open source projects are now offered as managed services by all major clouds, along with every incarnation of data store possible. Importantly, they also provide features an organization needs in order to be successful. For example, encryption and secret management, not to mention the compute resources to deal with the ever increasing data workloads.

Tech intensity is upon us. Let’s not recreate technology that has been commoditized, and focus instead on building data intensity with a real-time DataOps approach.

The question is not about upskilling developers and IT, but about enabling business partners to be more data literate so they can self serve.

Developers can help by working to build a culture focused on what the business needs and switching the mindset from the line of code to the daily, weekly, monthly outcome to deliver bottom line improvements to the business.

People perform better from a business perspective when they care about the product the business delivers versus what framework they use with solutions that are ill suited to business needs.

Developers should also measure their success. Having objectives and key results (OKRs) is a great framework to establish goals and a roadmap to achieve them, but they must be aligned with the OKRs of the business. Organizations should move away from 360 reviews because they are fraught with irrelevance to business goals and political intent.

A better approach is to educate developers on the goals of the business, then the department and the team. Make them feel part of the machinery, give them the chance to have a say and get involved to yield better outcomes.

May 1, 2020
Kong Brings Collaboration to Designing APIs

Kong has launched an open source tool for designing application programming interfaces (APIs) designed to make it easier for teams of developers to collaboratively edit an API specification that can be stored in a Git repository.

Based on the open source Insomnia API management platform the company gained last year by acquiring Floating Keyboard Software Inc., the Insomnia Designer tool for designing APIs integrates natively with the testing capabilities embedded in the Insomnia API management platform to make it easier to collaboratively design both REST and GraphQL services.

As part of that effort, Kong is also releasing plugins that enable teams to automatically embed Kong Gateway policies directly into their API specification files within a Git repository.

Greg Schier, technology tech lead for Insomnia at Kong, said the goal is to streamline the workflow for designing APIs by enabling teams to share updates to edits of API specifications using best GitOps processes.

For example, DevOps teams can now search for API designs to discover details such as Git Status and Git Branch. They also can automatically generate configurations for both Kubernetes and Kong for Kubernetes within the individual API spec file. Developers can also select Kong plugins that provide capabilities such as authentication or rate-limiting to govern their API’s behavior.

As organizations embrace microservices-based applications the need to be able to design, build, deploy and maintain APIs has become more critical. Each microservice within an application exposes its own APIs. Organizations that embrace microservices soon find they need to potentially build thousands of APIs. Rather than address each of those API as an isolated project, Kong is making the case for constructing a set of workflows that make it easier to design and construct APIs within the context of a larger DevOps process.

The goal should be to eventually make the testing of APIs a natural extension of the unit testing process embedded within a continuous integration/continuous delivery (CI/CD) platform, said Schier.

Within far too many organizations the designing and building of APIs is still an afterthought. There is naturally a lot of focus on building microservices, but once they are constructed not nearly as much attention is paid to the API. And yet, while microservices frequently are replaced, it is the API that remains constant. All the dependencies between the microservices that make up an application are only manageable because of the APIs employed to connect them all. Rather than constructing APIs after a microservice is built, Kong is making the case for consistently designing and building APIs in keeping with best DevOps practices.

In the wake of the COVID-19 pandemic, it’s hard to say at what rate organizations will be building and deploying new applications. What is for certain is the bulk of new applications will be based on cloud-native microservices to make them more flexible and resilient. That way when the next major crisis erupts, organizations will be able to respond more adroitly to rapidly changing business conditions because the enterprise architecture now revolves around APIs.

April 30, 2020
Software Development Management Drives Business Value

How much business value does your software group generate for your organization?

That’s the existential question an international corporation’s software leader poses, kicking off the 2017 book “The Business Value of Software.” It’s also a topic we’ve all likely wrestled with from time to time. It’s the essence of the value we personally bring to the business through our daily actions.

The problem is, value is hard to define and hard to measure. But, it’s easy to see how business value can seep away from software initiatives when software projects start to experience problems.

When production is delayed, and software releases don’t go out on time, sales will fall short of projections. When a release doesn’t satisfy customer needs in a specific market, negative user reviews will spike–and that could impact future sales. When market trends shift suddenly, and business unit leaders have no clear way to push the development team to add new features to the product, that’s a missed market opportunity.

With every misstep, you’ve lost a certain amount of business value.

Conceptually, every one of these situations is fixable. To an extent, some companies have adopted practices that can catch certain problems before they become unfixable. But, to a greater extent, the inability of software-driven companies to anticipate trends, flag problems, share information, iterate on solutions and learn from mistakes is costing them business.

In this blog series, we’ve discussed how software delivery management (SDM) presents a framework for organizations to change the way they think about software and streamline delivery processes. SDM seeks to connect all aspects of the software delivery process to not only become more efficient but also drive toward a common goal of delivering maximum business value.

The SDM model is built around four key pillars: ensuring everybody is working with common data; sharing insights and continuous learning across the organization; connecting processes to bring ideas to market; and enabling closer collaboration across software-related functions and teams to amplify value creation efforts. It emphasizes that software doesn’t have to go it alone–the whole organization is rallying around software and making it a top priority.

How does an interconnected, collaborative, information-driven software organization create business value using SDM? Here are a few ways.

Leaning on Analytics

Rather than just using discrete build-test-deploy processes, make sure management, developers, marketers and engineers are all incorporating key analytical measures in their iteration processes. These stakeholders shouldn’t go on hunches–they should base their decisions, at least in part, on data. The data includes downloads, adoption figures, conversions, support requests and customer experience performance ratings. Armed with information, the organization will do a better job delivering the software customers want and are willing to pay for.

Helping People Ask the Right Questions

Developers are a prideful bunch. They want to build great software that users love to run. Without insight into business needs and user preferences, they’ll do their best with features and functionality. With data sharing and communications channels in place, they can ask questions like “Where is this feature being deployed?” or “Why will customers want a whole new interface?” Consequently, ops pros can ask, “Who pushed this new release to production and when?” VPs can ask whether the latest round of releases will be ready for the big marketing push to launch it. If you’re asking the right questions early enough in the process, you’re going to make better decisions and be doing a better job delivering on business goals.

Being Nimble Enough to Change Quickly

Organizations pride themselves by their ability to act in an agile manner. But, are they really set up to move on a dime? Say a well-researched release flops unexpectedly. Sales and support rapidly gather feedback that European users hate the color and APAC users hate the navigation path. Because all the stakeholders are aligned and ready to move, developers tweak the features, ops leaders juggle the release schedule, management relaunches with regional marketing campaigns, sales follows up with targeted incentives and developers watch for more user feedback that can be incorporated into future releases.

Your company has worked hard to turn itself into a software-driven business. Using the principles of SDM, your business can drive business results to the next level. It can generate more sales. It can make unhappy customers happy. It can make happy customers even happier. It can improve its own responsiveness, up and down the organization. Most of all, it can use software to achieve its ultimate goal: to drive business value.

April 30, 2020
DevOps Trends for 2020 and Beyond

Since the ideation of DevOps, technologists have made great strides to benefit from it. Despite advancements and the success that teams have seen within pockets, many of its core challenges are still prevalent: scaling across the enterprise due to manual processes, poor visibility between dev and ops teams, and tool sprawl that hurts agility. Luckily, there’s light at the end of the tunnel for organizations hoping to get the most from DevOps.

In order to succeed in DevOps and foster agility in this next decade, the secret is pretty simple: Get the right work to the right team at the right time. Here are three ways development and operations teams will get closer to this formula over the coming years.

Change Automation Based on Policies, Data and Automation Will Take Hold

Despite large investments to double down on DevOps initiatives, the reality is most organizations have only made progress on development processes, while downstream gates and processes such as change management are still manual and time consuming. Too often are developers having to log in, create change requests and fill out forms manually–a frustrating, drawn out and overall unnecessary process. The reality is, manual processes in DevOps simply cannot continue in the next decade. They create unnecessary friction, disrupt the flow between dev and ops, and get in the way of other essential work.

However, the tide is starting to turn as organizations look to automate tasks like change management by leveraging dynamic controls through data and policy automation to achieve true CI/CD. As automation becomes more commonplace, developers will spend more time actually developing and will be able to deploy apps faster and with greater efficiency.

Organizations Will Rely on AI/ML and Analytics to Drive Efficiency and Greater Visibility

Despite all the advancements in DevOps over the past 10 years, one hurdle hasn’t been addressed: the limited visibility across all the pipelines from development, and the connection to how those deliverables run in the real world–i.e., knowing what changed, how it’s been tested, understanding the impact and assessing the risk, how something performs in production etc. The lack of visibility presents challenges of its own (distrust among teams, slower approvals, bottlenecks and inefficient processes).

Organizations are starting to recognize and address this challenge, realizing the gains from local optimization within departments along the way. As this continues, they will increasingly rely on analytics to drive efficiency and end-to-end visibility across processes. What’s more, analytical tools will draw planning, repository, test, deployment and performance data from across the DevOps lifecycle to provide insights into reducing cycle times, risk and improving project outcomes. AI and ML will play a role in leveraging that information to better direct work, to adjust stage gates and policies based on prior performance and more.

At its core, analytics enables IT teams to make changes at the pace of DevOps, while unprecedented visibility assisted by ML puts IT at the center of developers’ culture and mindset.

Tool Sprawl Will Continue to Be a Problem but DevOps Management Platforms Will Emerge

With continued adoption of cloud and microservices architectures, new tools will continue to emerge–different teams within an organization often use different tools for planning, version control, build automation, testing, deployment, etc. But, a new trend is emerging as the industry moves toward platforms that streamline management across various tools and teams to improve development speed and agility. Platforms also enable IT teams to quickly accommodate the rapid addition of features to software, while automating the approval process–making product development faster and more efficient, while also breaking down silos.

The Bottom Line

Despite advancements from the last 10 years, there are still many ways to deliver on the value of DevOps and grow adoption. The vast number of tools used by developers and IT makes it difficult for leaders to get a holistic view of how each team is performing. Lack of visibility paired with manual processes slows the behavioral and cultural change needed to succeed with DevOps.

But, as we enter the next 10 years of DevOps, the combination of automation, analytics and workflow platforms will arm teams for success.

April 30, 2020