devopsy.kinsta.cloud

Category: DevOps Practice

  • Dell Brings DevOps to Edge Computing Environments

    Dell Brings DevOps to Edge Computing Environments

    Dell Technologies today updated its edge computing platform this week to make it simpler to programmatically provision infrastructure using DevOps best practices.

    Phil Burt, senior director of project management for edge computing at Dell Technologies, said version 2.0 of Dell NativeEdge adds additional declarative blueprints based on YAML files and the Topology and Orchestration Specification for Cloud Applications (TOSCA) framework.

    Blueprints for Telit, Litmus and PTC for manufacturing use cases, Deep North for retail, Dell Streaming Data Platform for analytics and Rancher Labs K3s for Kubernetes environments are provided.

    Those blueprints make it simpler to either deploy applications on a lightweight operating system that Dell developed optimized for edge computing platforms or any other software stack an IT organization may prefer, he added.

    Dell is also adding support for the virtual Trusted Platform Module (vTPM) and UEFI Secure Boot capabilities to apply zero-trust IT principles to edge computing platforms using hardware-based cryptography and secure storage for encryption keys, certificates and passwords.

    Finally, Dell is also making available a three-year subscription plan for NativeEdge to lower the total cost of deploying edge computing platforms.

    Dell relies on virtual machines it developed for edge computing platforms to deliver software. IT teams can then opt to deploy monolithic applications or container-based applications running on an instance of Kubernetes deployed as an extension of the virtual machine provided by Dell. Those platforms can then also automatically connect to a network to provide the connectivity required.

    Regardless of approach, Dell is providing a method to programmatically orchestrate the management of highly distributed edge computing environments, noted Burt.

    In the longer term, Dell is also researching how to apply generative artificial intelligence (AI) to the management of edge computing environments using the data its monitoring tools provide, he added.

    While edge computing has been around in one form or another for decades, as more organizations start to process and analyze data at the point where it is created and consumed, the number of applications deployed at the network edge has increased substantially. As such, the number of applications that need to be built and deployed at the edge using DevOps best practices is growing exponentially. In fact, managing those workloads is only going to become that much more challenging as more AI models are deployed at the network edge.

    Of course, not every workload at the edge is managed by an IT team. For years, many organizations have relied on operational technology (OT) teams that have historically deployed applications at the network using manual processes. Organizations that embrace DevOps practices to automate the deployment of workloads at the edge will naturally have to navigate some cultural issues alongside the technical challenges encountered when programmatically deploying software.

    It’s not clear how much software will be running at the network edge in the years ahead, but as the capabilities of the IT infrastructure made available continue to increase, so will the complexity of the applications that will be deployed. The challenge, as always, is going to be finding the best way to manage all that distributed software at what will soon be an unprecedented level of scale.

  • Blueprints for a Secure, Future-Proof Hybrid Cloud

    Blueprints for a Secure, Future-Proof Hybrid Cloud

    For today’s organizations, hybrid environments are a given. Whether for legacy reasons, regulatory requirements, or other specific needs, some of an enterprise’s critical data is likely to reside on, or in some cases, revert to, on-premises. However, other equally crucial data might be more efficiently and cost-effectively suited for storing and accessing in the cloud. Hence, hybrid.

    Despite their logic and many benefits, hybrid environments bring new levels of complexity. And they bring greater vulnerability, with ever more devious cyber threats probing the multitude of network access points. More than 80% of breaches now involve data stored in hybrid environments, according to IBM’s Cost of a Data Breach 2023 Report.

    That’s why, to avoid data loss and maintain a comprehensive level of protection across the entire environment, organizations need a blueprint for adopting and evolving their hybrid systems. The right solution enables data protection across workloads, providing the hybrid enterprise with the flexibility to protect data wherever it is today — and wherever it might be in the future.

    A growing multitude of organizations in various industries have successfully implemented blueprints of this sort, built on the following foundational considerations:

    Cost-optimization: A solution that can span a hybrid environment — SaaS, software and on-premises — and reduce infrastructure to manage and save administrative time.

    Air-gapped security: Backup of the most critical data in cloud locations that can’t be accessed through whatever network or networks might be the focus of a cyberattack.

    Fast recovery: Flexible, performance-optimized storage combined with the ability to send an air-gapped copy to the cloud for ransomware protection.

    Broad coverage: An integrated set of software, appliance and SaaS offerings that span hybrid environments — and can evolve with the organization.

    Simple management: Single-pane-of-glass dashboards for monitoring the hybrid environment while reducing management overhead.

    Reliability for peace of mind: Leveraging industry-leading, trusted platform solutions rather than unproven point products.

    Now’s the time to see it in action.

    Ensuring an Insurer’s Data Backup

    In Israel, Harel Group is the country’s top insurance and financial services provider, managing a large volume of data and investments. As such, a critical priority for the company is to ensure all that data is 100% backed up and can be restored without any issues.

    Harel Group were using a secure solution to reliably protect more than 1.5PB of data in its on-premises environment. More recently, though, it has sought the flexibility and efficiencies of moving part of its infrastructure to the cloud. However, stringent industry regulatory requirements meant Harel could store sensitive data in the public cloud only if it could be backed up and stored as efficiently, securely and reliably as the on-premises data. What they needed was a SaaS solution.

    “A SaaS solution takes care of data availability, but not the backup operation of the data,” said David Ben-Eli, system IT infrastructure manager for Harel Group. “We knew from day one that in taking on Microsoft 365, we would need a SaaS solution with good restore functionality that satisfies our business model and strategy.”

    And so, Harel designed a blueprint based on a fully managed SaaS platform. The initial stage involved protecting approximately 1,000 of its employees’ mailboxes, which will soon cover more than 5,000 mailboxes.

    The SaaS solution also enabled Harel to move its on-premises storage securely to the cloud, which has the dual advantage of reducing infrastructure costs and air-gapping its backups to mitigate the risk of ransomware attacks. “We have peace of mind that our data is secure,” Ben-Eli said. And the entire cost of the SaaS solution “is less than the cost of hiring more people.”

    Backing up and protecting a company’s data in a hybrid environment is challenging enough. To be a vendor providing those capabilities to other companies comes with additional challenges.

    A Vendor Puts its Data in Order

    Evolutio, based in Madrid, is a leading enabler of cloud services that provides more than 5,600 kilometers of deployed networks with 6,100 virtual machines across three data centers. Its goal is to support customers’ digital transformations and foster their agility, flexibility and innovation capacity to optimize their business value.

    To meet Evolutio’s needs, Alain Rodriguez, head of services management office, had to find an easy-to-use solution that consumed minimal resources to manage backups and security for Microsoft 365. His blueprint aimed to protect critical data before anything could go wrong.

    So, Evolutio chose a single platform to back up and restore data for internal systems. By implementing a fully hosted SaaS-based solution, Evolutio no longer needs to worry about purchasing and maintaining equipment yearly. There is also no upfront investment required and no additional costs for support from the vendor. As a result, Evolutio’s business can grow on demand.

    Resolving a Global Data Sprawl

    Woodward, Inc. is an American designer, manufacturer and service provider of control systems and components for aircraft engines, industrial engines and power systems. The company has been growing significantly across dozens of global networking sites, with expansion that quadrupled the size of data and backed-up servers.

    Virtual machine sprawl ate into company resources while complicating backup operations requiring standardized procedures. Slow legacy servers and apps made it impossible to meet recovery point objective (RPO) and recovery time objective (RTO) targets. And the absence of a coherent, comprehensive disaster recovery plan worsened things.

    Topping this off was increased backup storage costs via disk and tape and a need for central management or cross-department visibility into data protection and backup policy compliance. There was no blueprint, in other words.

    After trying unsuccessfully to address its needs with various disparate solutions, Woodward decided to replace everything with a comprehensive cloud-based backup and recovery platform. The company switched all global sites to this solution. As a result, Woodward has reduced the overhead of managing their data protection, can consistently enforce backup, restore and retention policies and has unprecedented comprehensive visibility and reporting across the end-to-end environment.

    “I used to cringe when I received a restore request since backups would frequently fail,’’ said Loren Leveque, senior manager of IT and system networking. With the cloud-based platform, he said, “I am ready to support the backup, restore and archive needs of our company.”

    Supporting Dozens of Manufacturing Plants

    Linamar Corporation is a diversified global manufacturing company and world leader in designing, developing and producing highly engineered products. Because the Canadian company supports 61 plants globally, a cloud approach became necessary to streamline efficiency in backup and recovery.

    Linamar had recently shifted from Microsoft Exchange on-premises to cloud-based Microsoft 365 for its 7,000+ users worldwide, and the company’s tape-based backup system didn’t support it. The built-in Microsoft 365 data protection was a start, but it couldn’t handle the rapidly expanding demands imposed by Linamar’s global network.

    By moving to a cloud-based backup and recovery platform supporting Microsoft 365, Linamar saved the costs and administrative time previously needed for managing tapes. And backup is no longer a full-time job – it’s more like “when you need it, set it up,” said Kristian Smith, Linamar’s manager of technical services and support. Restores can now be handled 100% within the team and take hours to execute, not weeks.

    Bringing it All Together

    The examples might be as varied and numerous as enterprises worldwide with crucial data to protect. But these and any other success stories all have at least one thing in common: They took a blueprint approach to ensuring that their hybrid environment is secure and sufficiently future-proof.

  • Tabnine Extends Generative AI Testing Platform by Embracing RAG

    Tabnine Extends Generative AI Testing Platform by Embracing RAG

    Tabnine today revealed that its namesake generative artificial intelligence (AI) platform for creating test code can now surface more accurate and personalized recommendations based on specific code and engineering patterns.

    At the same time, Tabnine also announced that Tabnine Chat, a tool for interacting with the large language models (LLMs) at the core of the Tabine platform using a natural language interface, is now generally available.

    Data that resides in a codebase or an integrated developer environment (IDE) can now be used to extend the large language models (LLMs) on which the Tabnine platform is based using retrieval augmented generation (RAG) techniques. Previously, the Tabnine platform would only generate test code based on the data that Tabnine had exposed to its LLMs.

    Tabnine president Peter Guagenti said RAG makes it possible to provide additional contextual awareness for the test code generated along with documentation and explanations of the test code created. The overall goal is to leverage generative AI to make it easier to shift more responsibility for application testing further left toward developers, he noted.

    That approach enables developers to create and run more routine tests earlier in the software development life cycle, which should provide application testing teams with more time to run more complex tests before applications are deployed, added Guagenti. Rather than being a job killer, generative AI will eliminate rote tasks that most members of the DevOps team don’t really enjoy doing, he noted.

    Tabnine uses a mix of LLMs it developed with Google to apply generative AI to application testing. Unlike general-purpose LLMs, the ones used by Tabnine were trained using a narrower base of testing code that the company curated using tests made freely available on the internet.

    It’s now only a matter of time before generative AI is applied across the entire software development life cycle (SDLC). It’s not clear how automated testing will become in the age of AI, but the overall quality of applications should steadily improve as more tests are run. The goal is to make it possible to conduct more tests without slowing down the overall pace of application development.

    There continues to be as much irrational exuberance about AI as fear and loathing. Still, DevOps teams that committed early on to ruthless automation will naturally be at the forefront of adoption. The immediate challenge is assessing what functions will be automated and the impact those changes will have on the way DevOps teams are currently structured. Ultimately, the goal is to eliminate as many of the bottlenecks that conspire to slow application development and deployment while simultaneously improving the quality of the application experience.

    It may be a while before generative AI is pervasively applied across DevOps workflows, but one of the first places it will undoubtedly manifest is in test automation. The challenge and the opportunity now is determining how best to apply it in a way that augments DevOps teams that arguably have never had enough time to properly test code in the first place.

  • 3 Quick Fixes for Event-Driven Architecture (EDA) Complexity

    3 Quick Fixes for Event-Driven Architecture (EDA) Complexity

    Event-driven architecture (EDA) and the adoption of event streaming throughout enterprises are increasingly becoming essential architectural requirements for businesses across almost every industry. However, the more companies use it, the greater the complexity becomes. Event portals can play a pivotal role in not only gaining comprehensive insights into the intricate and expanding event-streaming ecosystem but also facilitating the auditing, management and governance of events.

    According to a recent IDC Infobrief, 93% of companies employing EDA across various applications reported that EDA either met or exceeded their expectations. Moreover, 82% of IT leaders intend to apply EDA to two to three new use cases within the next 24 months.

    Nonetheless, the number of event streaming use cases results in a surge of data volumes. This, in turn, entails the adoption of more brokers, projects and products for event streaming. For instance, an organization might use open source Kafka for one specific use case while turning to brokers like Confluent for another and Amazon MSK for yet another distinct purpose.

    While the real-time processing of data is certainly a positive development, numerous experienced EDA adopters have yet to maximize its potential. Frequently, the situation involves a one-to-one exchange, where a stream is consumed only once, or organizations, having advanced through various stages of maturity with multiple streaming use cases, find themselves entangled in a complex network of brokers, clusters, topics and overlapping schemas.

    Let’s explore three typical challenges that organizations encounter as they progress toward event-driven maturity.

    Success Needs Visibility – Make Sure Your Event Portal Can Provide It

    Application decoupling is great for runtime, but this lack of visibility on both the publish and subscribe side can cause issues when making changes to existing applications. Application producers don’t know who the consumers are and consumers don’t know who the publishers are.

    An event portal offers a single window into an event-steaming ecosystem. It provides a native discovery agent to scan, for instance, a Kafka cluster and its schema registry to produce a visual representation of every topic and its schema(s) across multiple versions–and, importantly, who its consumers are.

    If an organization were to decompose its monolithic applications into event-driven microservices that communicate with each other via, say, Apache Kafka, one of the biggest challenges is to understand and manage the infrastructure and information flows.

    Specifically, how to see the microservices affected by a given change before deploying a new feature or function to ensure it won’t bring that system down – even for as few as five seconds.

    By using an event portal, organizations can automatically scan their system and visualize a complete map of endpoints and event streams instead of manually diagraming event streams between microservices.

    Using Data at Its Best – in Real-Time

    Let’s extrapolate the poor visibility issue from one application across the entire enterprise.

    For instance, if you’ve been using Kafka for several years, especially with many departmental or specific application-type use cases, your Kafka cluster now is a treasure trove of real-time data. But data is most valuable at the moment it’s produced – as per Forrester: “Data is, without a doubt, valuable. But when stored in vaults and locked down, it is not.” Real-time data is the most valuable data that exists. But siloed event streaming data means other departments, decision-makers, customers and partners don’t know about it – therefore, it’s not getting shared or reused to its full potential.

    Typically, developers don’t have anywhere to go to find this data treasure trove. Some have resorted to building Confluence or Wiki pages that try to document that this data exists, using SharePoint or Word documents. Noble intentions, but without real-time data mining and updates, this information quickly gets stale and out of date.

    Again, this is where an event portal makes a difference, providing a perpetually up-to-date catalog of data detailing all topics, event streams, schemas and pub/sub interfaces for each application, along with owners and points of contact, as well as changes for each of the managed EDA entities. This helps expedite development by letting developers easily share, discover and re-use any existing Kafka or event streaming asset, both inside and outside the organization.

    For a real-world example of this in action, look at the Federal Aviation Administration and its SWIM (system-wide information management) infrastructure that distributes real-time information to FAA systems across the United States.

    Through secure gateways, external partners of the FAA can tap into the flow of events. Airlines and other industry partners that need the SWIM data get it in real-time, without perpetually requesting updates. Whether it’s the availability of gates at an airport, the position data of planes in the sky, or the weather for a region – external partners have the latest information without needing to ask.

    Don’t Forget to Govern Event Streams!

    The decentralized and dynamic nature of event-driven systems introduces unique security challenges. One of the common trade-offs with event streaming is that it does include access control rules, but developers can err on the side of being too permissive to ensure agility. If streams are not visible, properly cataloged, and data updated regularly, this presents problems with data security, governance and compliance.

    Using an event portal designed to give organizations visibility and control over their event streaming can turn security from reactive – to proactive. Users can organize systems into application domains, create and import payload schema definitions in a variety of formats, including AsyncAPI, define event interactions between applications and microservices, and create events and associated topic addresses using topic structure-proven practices. With the right visibility, administrators can ensure security, governance and compliance with internal policies and government regulations.

    EDA to the Rescue!

    A single, multi-broker event gateway technology offers a solution for organizations to uncover, regulate and oversee the life cycle of their real-time event streams throughout the enterprise. Its significance will continue to grow as more organizations adopt EDA as a fundamental platform.

  • What Does Build Quality Look Like in Software Design?

    What Does Build Quality Look Like in Software Design?

    With rapid developments in artificial intelligence (AI), mobile applications and modern software in the last year, the enterprise software market is expected to grow exponentially. Market revenue is projected to reach $292 billion in 2024, and developers are constantly implementing innovative measures into the software development life cycle (SDLC) to ensure a seamless, high-quality creation process. One of the best ways to achieve this is by leveraging modern build health tools to monitor a multi-faceted project’s overall quality and performance.

    Build health tools automate the creation of executable applications from source code and encompass several areas to ensure the stability and health of the software build process. From automated testing to security scanning, developers rely on these tools and processes when defining a modern approach to software development. Before diving into the intricacies of build health quality, it is necessary to grasp the complete significance of the SDLC when attaining the final product in a global marketplace.

    The Significance of the SDLC

    The SDLC is the process in which developers plan, write, modify and maintain software. This methodology applies to software developed for computers, mobile phone applications, video games and other systems. Adhering to this process allows developers to reach the optimal outcome for the final product. The life cycle includes everything from the planning and brainstorming stage to setting up maintenance and operations after the product has launched. It ensures success by providing a more structured approach to building and developing software. This becomes increasingly important as the software market’s value continues to rise.

    Since 2020, the demand for software engineers has doubled. Because it’s essential for business leaders and developers to keep up with the latest trends and innovations, the need for software knowledge will continue to grow exponentially. Currently, software is typically delivered in one of two ways:

    • On-premises. End users install and run the software themselves on the desired device. This serves as a more secure delivery method for highly-regulated industries.
    • Software-as-a-service (SaaS). This cloud-based method allows end users to access the software online rather than through a traditional download/upload. This enables providers to offer a subscription-based/pay-as-you-go structure for users. The provider is responsible for the hosting and maintenance.

    Developers rely heavily on build health tools to ensure a smoothly running life cycle. Build health tools play a huge role in determining a seamless development process.

    The Role of Build Health Tools in Modern Software Development

    Build health tools essentially fill the gaps in the development process and enhance the software build quality. These tools deliver automated testing methods by creating multiple testing scenarios to ensure full functionality. They help developers see the different data points necessary for garnering a 360-degree view of the software and its status.

    The tools also impact resource utilization and response times. Using key performance indicators (KPIs), they monitor the build quality while enhancing build production to ensure it is better than what was previously developed. In that way, it is constantly growing and improving to guarantee the project reaches a smooth and seamless completion for the developer. From there, the tools can create multiple datasets in less time, which significantly reduces overall software development time.

    Common Challenges of Build Health Tools in Software Design Projects

    There are several challenges with using build health tools. The most common obstacle is that automated tools and testing lack the human touch that comes from developers and their manual work. Although build health tools can perform simultaneous tasks quicker than a more manual approach, they overlook the full spectrum of available resources to improve the build. These tools are so focused on functionality that they fail to incorporate the prior research and available resources that often serve as key building blocks for a successful development project. For this reason, it is important to have developers working in conjunction with build health tools to provide a balance between manual and automated software testing.

    Developers can leverage build health tools to seek out the KPIs that determine the software’s quality at a given stage of the SDLC, from initial development and quality assurance (QA) to the final phases of staging and production. Some of these KPIs include:

    • Exceptions. Make sure there are no new exceptions from the previous build versus the production stage.
    • Test coverage. Ensure that adequate testing is performed on the current build by defining what application programming interfaces (APIs) need to be included for certification, along with the number of executions required.
    • Automated data validation. Make sure data is accurate and useful while remaining enforceable by the designated standards.
    • API testing. Test the overall interface for smooth performance with trustworthy data to advance the program/project. It is also important to compare performances during different SDLC stages to confirm the status of the API, dependency, database, and functionality.
    • Memory/CPU usage. Measure the overall usage of the central processing unit (CPU) and its memory to ensure stability and efficiency.
    • Requests per minute. Evaluate the rate at which the software can receive and execute certain requests delivered by the end user to ensure optimal efficiency.
    • SQL coding standards. Enforce standards and limitations for the overall coding within the interface by measuring quality, security, efficiency, and sustainability.

    While these are only a few of the KPIs detectable with the aid of build health tools, it is essential to note how these tools can benefit a successful software release. Developers can compare the differences between current and prior builds throughout the SDLC to fully gauge any changes, developments, improvements, or downgrades during production to a successful launch.

    Current Events and the Future of Build Health Quality for Developers

    There are many examples of current organizations effectively leveraging available build health tools for project success. Software developers will continue to adopt new and innovative methods using AI and automation capabilities to ensure more efficient testing and higher build quality.

    The future is bright for contemporary software engineering. As unexpected as the AI boom of 2023 was for the tech world, the future of modern software development may hold even more surprising developments. Build health tools are expanding and perfecting the creation process for enterprises and developers worldwide. As build quality improves on the back end, the customer experience for global industries will improve on the front end. The potential for software enhancements and innovations in this way is what makes the journey exciting.

  • Why DevOps is Key to Software Supply Chain Security

    Why DevOps is Key to Software Supply Chain Security

    DevOps is designed to increase business value and responsiveness through rapid, high-quality service delivery, made possible through fast-paced, iterative IT service delivery. The term DevSecOps emerged as a way to remind us that security was always intended to be part of the software delivery process. However, with the barrage of attacks on the software supply chain showing no signs of abating, the question now is whether even the tightest DevOps pipelines can maintain the pace-protection balance.

    It’s important to note that the term “software supply chain” has been used primarily to refer to the tools and processes used to build and deploy software applications. Now, however, with the rise of infrastructure-as-code (IaC), the term also refers to tools and processes used to build and deploy IT infrastructure.

    Meet Mandates, Reduce Risk

    Software supply chain attacks such as SUNBURST, HTTP/2 Rapid Reset or the breaches associated with the MOVEit vulnerability have fed news cycles for the last few years, and that likely won’t change anytime soon. Attacks on the software supply chain increased 742% since 2020. What we are seeing as a result are new concerns about supply chain security and DevOps requirements. This has led to confusion and often a mish-mash of tooling that may exacerbate rather than mitigate supply chain security issues.

    Arguably the most impactful salvo over the software supply chain security line was president Biden’s 2021 Executive Order 14028, which established new mandates, including the delivery of SBOMs, as minimum requirements for software used by the U.S. federal government. More recently, the FDA has mandated that “all medical devices running software must create and maintain” SBOMs. I expect to see government and industry requirements increase over time.

    These are just a couple of relatively recent examples. There are many more—and no doubt many more to come.

    So, if you’re moving at the speed of DevOps, how do you address these current and future mandates for software supply chain security, as well as the continually emerging vulnerabilities and attacks? I would venture to say that only by moving at the speed of DevOps—and within the parameters of the DevOps model—can organizations not only meet mandates but also effectively reduce risk for the business.

    Indeed, it’s not a matter of whether DevOps is viable within the current security climate but what requirements need to be added to support and enhance current DevOps work.

    New Guidelines, New Processes, New Tools and New Data

    In response to these new threats and regulations, the software community has been working on developing and updating guidelines to help organizations improve the security of their supply chains—for example, SLSA, NCSC UK supply chain security guidance and NIST cybersecurity supply chain risk management. However, these new guidelines can be complicated and require new processes and new tools.

    Before adding any new tooling or changing any processes, it’s critical to examine existing tools to determine whether and to what extent they satisfy supply chain security mandates. Organizations must also evaluate how well existing processes work to protect the business, then strategically add/subtract from there as needed.

    No matter what solutions are leveraged, more and different tools generate reams of more and different data. What’s important — and to whom? How do I manage the data? When can I trust it? Where do I store it? What problems does the new data help me solve? Organizations will need a way to effectively sift this information and deliver the right data to the right teams at the right time. To preserve the ability to quickly and continuously innovate, it will be important to focus on shifting security left as well as integrating automation whenever and wherever possible.

    As new security metadata becomes available, such as from SBOMs, new solutions for managing that metadata will be key. An open source initiative sponsored by Google, GUAC is designed to integrate software security information, including SBOMs, attestations and vulnerability data. Users can query the resulting GUAC graph to help answer key security concerns, including proactive, preventive and reactive concerns.

    Continue to Shift Security Left

    Another way that organizations can maintain their DevOps momentum while protecting the software supply chain is to continue to invest in shifting security left in the software supply chain. The software community has been talking about this for some time, but many organizations struggle to implement impactful changes. Security teams must work to understand how software is built and collaborate with development and DevOps teams to ensure that improvements are made to both application and infrastructure-as-code supply chains.

    We need to go beyond shift-left vulnerability analysis to ensure that we are evaluating the quality of configuration-as-code (for both applications and infrastructure), that we are taking advantage of new recommendations, and that we are leveraging new attestation solutions designed to work with pipelines such as sigstore and Tekton Chains. After all, the sooner an issue is discovered, the more quickly it can be addressed and the less disruptive and costly it is to fix it.

    No One-Size-Fits-All Solution

    While all of these solutions mentioned here are helpful, there is no single product or framework that will enable organizations to maintain the security-innovation balance. Success, rather, will require a focus on agility, flexibility and effective communication and collaboration—the very hallmarks of the DevOps model.

    Rather than being obviated by the demands of software supply chain security, DevOps provides the opportunity to integrate the kinds of protections that can prevent or mitigate supply chain vulnerabilities and breaches. DevOps also enables organizations to quickly and effectively respond to new threats and new requirements.

    With that said, there’s no doubt that organizations will need to think differently about how they manage software security, including the strategic evaluation and integration of tools that will meet current and future regulatory mandates and, more importantly, protect the business over time. Organizations may also need to think about weighing security over speed, at least until all of the pieces of the software supply chain protection puzzle are in place—but also when future circumstances warrant a fresh look at how to best balance the DevOps pace-protection balance.

  • Cycode Brings Generative AI to App Security Posture Management

    Cycode Brings Generative AI to App Security Posture Management

    Cycode today added generative artificial intelligence (AI) capabilities to its application security posture management (ASPM) platform to make it simpler for DevSecOps teams to identify the root cause of vulnerabilities in complex distributed computing environments.

    At the same time, Cycode is adding plugins for VS Code and JetBrains integrated development environments, a command line interface and pull request scanners to make it easier to identify security issues as early as possible during the software development life cycle (SDLC). Cycode also revealed today it now has more than 75 connectors to various security tools commonly used within DevSecOps workflows.

    Amir Kazemi, director of product marketing for Cycode, said the company is using OpenAI’s generative AI platform to provide a natural language interface for invoking the Risk Intelligence Graph that is at the core of the Cycode ASPM platform. As part of that effort, Cycode is now also making available an Executive Dashboard that, based on all the dependencies uncovered, provides summaries of risks that make it easier to discern what is occurring across an application environment.

    The platform, as a result, can now provide automated risk scoring for vulnerabilities based on actual severity and potential impact to the business, said Kazemi. The overall goal is to make it simpler to secure software supply chains by facilitating the proactive collaboration between application developers, DevOps engineers and cybersecurity professionals, he added.

    It’s not clear what impact generative AI is going to have on how DevSecOps workflows are constructed, but making it easier to identify the root cause of security issues in application environments made up of monolithic applications, microservices and event-driven frameworks is now essential. Application security has simply become too chaotic to effectively manage without help from AI, noted Kazemi. In its current state, application security is simply unmanageable, he added.

    The challenge is that just because a zero-day vulnerability has been discovered, it doesn’t always follow that application development teams know where every instance of it exists within their application environment. It’s not uncommon for DevSecOps teams to discover outdated versions of components that have known vulnerabilities to be running months after a patch in an updated version of that component has been made available.

    DevSecOps teams are, of course, always trying to strike a balance between the level of threat a vulnerability represents and the possibility that the patch that should be applied might break an application. However, given the risk to application environments, it’s becoming less risky to patch an application than it is to hope that cybercriminals don’t exploit a known vulnerability.

    While much DevSecOps progress has been made in recent years, it’s clear there is still much work to be done. Hopefully, generative AI will make it simpler for application development teams to address issues more rapidly than ever. In the meantime, however, DevSecOps teams should assume cybercriminals are looking to exploit the same AI capabilities to discover vulnerabilities they can exploit faster than ever.