devopsy.kinsta.cloud

Category: DevOps Practice

  • Using AI to Shift Production Wisdom Left

    Using AI to Shift Production Wisdom Left

    In my recent blog, Revolutionizing the Nine Pillars of SRE with AI-Engineered Tools, I indicated that AI could assist in shifting the wisdom of production to the left. In this blog, I’ll explain in more detail how AI-engineered tools can be used to improve the pillar that I call SRE culture.

    AI Use Cases for Shifting SRE Culture Left

    Shifting the “wisdom of production” to the left is all about bringing production considerations into the development process as early as possible. Here are some use cases where AI can help facilitate this shift, along with specific challenges and AI tools that can assist.

    Predicting System Behavior: Predicting system behavior under various conditions can be difficult, especially as systems grow more complex. AI can help by analyzing historical data and predicting system behavior. Tools like Splunk can use machine learning to provide these predictions and facilitate earlier decision-making.

    Automated Code Reviews: Manually reviewing code for potential production issues can be time-consuming and error-prone. AI can automate this process, identifying potential issues more quickly and accurately. Tools like DeepCode or Codota use AI to analyze code and identify potential issues.

    Security Vulnerability Detection: Identifying security vulnerabilities early in the development process can prevent costly and damaging breaches in production. AI can analyze code to identify potential vulnerabilities that might be missed by human reviewers. Tools like Snyk or WhiteSource can help with this.

    Performance Optimization: Predicting how code changes will impact performance can be challenging. AI can analyze changes and predict their impact on system performance. Tools like Akamas leverage AI to automate the performance optimization process.

    Dependency Analysis: Identifying how changes in one part of a system will impact other parts can be difficult. AI can analyze system dependencies and predict the impact of changes. Tools like FOSSA can help in automating dependency analysis and identifying potential issues.

    Resource Allocation: Predicting resource needs for new features or changes can help prevent resource shortages in production. AI can analyze resource usage patterns and predict future needs. Tools like Turbonomic or Densify use AI to optimize resource allocation.

    User Experience Optimization: Predicting how changes will impact the user experience can help prevent negative impacts in production. AI can analyze user behavior and predict the impact of changes on user experience. Tools like FullStory or Crazy Egg can provide AI-driven insights into user behavior.

    RoadMap to SRE Wisdom

    A practical implementation roadmap for introducing AI tools to help shift wisdom to the left may include the following steps.

    Identify Needs and Goals: Start by identifying the areas where shifting wisdom to the left could have the most impact. This might include areas where issues are frequently discovered late in the development process or where manual processes are time-consuming or error-prone. Define clear goals for what you hope to achieve by introducing AI in these areas.

    Research Tools: Once you’ve identified your needs and goals, research the AI tools available that could help meet those needs. Consider factors like the tool’s capabilities, integration with your existing systems, cost and support options.

    Evaluate Tools: Based on your research, select a few tools to evaluate more thoroughly. This could involve setting up trials or demos, speaking with the tool’s developers or other users and assessing how well the tool meets your needs.

    Pilot Implementation: Once you’ve selected a tool, start with a pilot implementation on a small scale. This will allow you to learn how to use the tool, identify any potential issues or obstacles and understand the tool’s impact before rolling it out more broadly.

    Training: Provide training for your team on the new tool. This could include formal training sessions as well as ongoing support as they start using the tool.

    Monitor and Adjust: After the tool has been implemented, monitor its use and impact. This could involve tracking metrics related to your initial goals, as well as soliciting feedback from your team. Use this information to make any necessary adjustments to your use of the tool.

    Expand Use: Once you’re satisfied with the results of your pilot implementation, expand the use of the tool to other areas of your organization. Continue to monitor its use and impact and make any necessary adjustments.

    Repeat: Technology is constantly evolving, and there may be new tools or features that could further improve your ability to shift wisdom to the left. Periodically revisit your needs and goals, and repeat this process to continuously improve your processes.

    Summary

    Shifting the wisdom of production to the left is an essential strategy for modern IT organizations, but it’s a journey that requires thoughtful planning, the right tools, and a commitment to continuous learning and improvement. As we’ve explored, there are several compelling use cases for leveraging AI in this transformative process. Whether it’s predicting system behavior, automating code reviews, detecting security vulnerabilities, optimizing performance, analyzing dependencies, managing resources or enhancing the user experience, AI tools are helping organizations tackle these challenges more efficiently and effectively.

    While embarking on this journey may seem daunting, a well-crafted implementation roadmap can help make the process manageable and rewarding. By identifying specific needs and goals, researching and evaluating the right tools, piloting their implementation, providing comprehensive training and consistently monitoring and adjusting their usage, organizations can successfully adopt AI tools to shift the wisdom of production to the left. With continued effort and commitment, this transformation can lead to more informed decision-making, more efficient processes and, ultimately, better outcomes in production.

  • Digital.ai Embraces Multiple AI Classes to Advance DevSecOps

    Digital.ai Embraces Multiple AI Classes to Advance DevSecOps

    Digital.ai has committed to adding generative artificial intelligence (AI) and additional machine learning capabilities to its namesake platform for managing DevSecOps workflows.

    The company plans to make available in alpha a generative AI tool to create test cases and user stories via large language model (LLMs) access via a natural language interface. In addition, generative AI will also be used to identify high-risk changes to code and improve the overall governance of DevSecOps workflows.

    At the same time, Digital.ai has extended the machine learning algorithms it already provides to provide predictions and scoring. Additional capabilities include flow acceleration recommendations, change risk predictions and service management process optimizations.

    Digital.ai CEO Derek Holt said as AI continues to evolve, the company will use a mix of public and private LLM platforms to ingest AI into DevSecOps workflows. In effect, the future of AI will almost be multimodal as different classes of AI technologies are used to automate workflows, he added.

    The goal is to safely break down the silos of data that today make it difficult to cost-effectively build and deploy secure software without compromising the rate at which it is developed, noted Holt.

    It’s still early days as far as the infusion of AI in workflows is concerned, but it’s apparent that many of the manual tasks that prevent organizations from fully embracing best DevSecOps practices will be automated.

    At the same time, increased reliance on digital processes, coupled with more stringent pending regulations, are reducing the overall tolerance organizations have for insecure software. The only way to address that rising sense of application security urgency—at a time when more complex cloud-native applications are being built and deployed—is to rely more on automation. In fact, the race is now on to secure software supply chains before regulations that will have stiff penalties for security lapses go into effect.

    Most of the AI advances in software development that have been made thus far benefit developers. However, many of those same core AI advances will soon be applied to software engineering. Many of the DevSecOps bottlenecks that exist today will start to fade away as various classes of algorithms are able to both identify and make recommendations to eliminate them. As those capabilities evolve, it should also serve to help reduce the long-standing cultural divide between application development teams and cybersecurity professionals that is at the root of the software supply chain issues that organizations are still struggling to resolve.

    In fact, many organizations would be well-advised to review their current workflows with an eye toward determining which processes can be automated. The days when AI was sparingly used are now giving way to a new era of software development that promises to dramatically accelerate the rate at which applications can be built, deployed and updated. The challenge, as always, is finding a way to incorporate these advances into workflows that were not created with AI in mind.

  • The DevOps Pendulum: Agility Vs. Control

    The DevOps Pendulum: Agility Vs. Control

    Managing changes to cloud assets is a universal pain felt by many engineering leaders today, despite all of the advancements in tooling and practices like GitOps. This is because, in reality, it is simply impossible to always have everything completely locked down—we don’t live in a utopia with zero incidents. If your engineering organization prevents any changes from being made through the cloud console or to your infrastructure-as-code (IaC) without complying with strict GitOps practices or change management processes via CI/CD, then it’s likely you have very frustrated developers—developers who can’t troubleshoot or debug in real-time and who have little control in a real-world incident.

    Engineering, like everything else in life, is all about balance.

    The Pendulum Swings

    The pandemic created a whole new mindset and practice for managing distributed and high velocity engineering and operations. Overnight, companies that were not built for remote ways of working had to continue their operations in a global, distributed and asynchronous way that they weren’t completely familiar with. This required a new way to think about software delivery—and it accelerated the DevOps practices that support that delivery. Self-service infrastructure removed barriers for developers to ensure continued performance and velocity.

    At the same time, your cloud cannot be the wild west with everyone creating bespoke infrastructure. It becomes impossible to manage, and misconfigurations can be risky. Guardrails and policy automation have become a hot topic. Today, with tech markets depressed and cloud costs escalating, there seems to be a growing trend toward locking things down again, even at the risk of frustrating developers.

    This begs the question: How can you achieve unencumbered infrastructure for your developers while simultaneously following policies and best practices for compliance, risk and cost? There is a way to find balance.

    Like many aspects of security, we’ve learned that when constraints and barriers are too high, users ultimately find ways to bypass them. This is true for operations, as well. While sometimes it might seem easier to lock everything down than design a better and more balanced way to enable developers to move fast, eventually this approach backfires. This is the exact same evolution the application and cloud-native security industry are undergoing right now.  All the guardrails and controls applied have created too much friction in development processes and developers ultimately bypass them.

    Real-Time Insight is Key

    CloudOps can learn a lot from the disruption the security industry is going through today. In the same way that point-in-time security has been rendered completely useless, non-real-time alerting or eventual alerting to infrastructure drift just won’t cut it when managing an ephemeral cloud. What is really needed is the same kind of real-time and continuous scanning of cloud assets and IaC, similar to what we apply to our systems through monitoring and observability. These solutions became an essential backbone of our business to ensure continuous operations and availability of cloud services.

    As we embrace IaC and the benefits it brings, everything-as-code unlocks greater agility and visibility, enabling you to automatically remediate without locking everything down. As DevOps says, “fail forward and fail fast.” Rather than focusing on never making a mistake, focus on how to fix it immediately. 

    The Solution

    By providing a continuous comparison of actual cloud assets with their desired state through IaC and GitOps, it’s possible to surface configuration drift and policy violations immediately, much like any other kind of breach or major system failure. Failures and incidents are inevitable. It’s unrealistic, and even dangerous, to build systems with an inherent underlying design that prevents you from changing something at the cloud console at 2:00 A.M. during an outage.

    With a locked-down approach, a developer would need to wait for the change management approval during a high-pressure production incident, oftentimes at 3:00 A.M. (because the incident gods of always make them happen in the middle of the night) or on a weekend. We don’t need to look much further than the catastrophic 40-minute and $440 million Knight Capital incident to understand that sometimes time is not on our side and that a delay can have severe consequences.

    Cloud drift has become equally troubling as uptime or any other mission-critical aspect of continuous business operations, and that’s why we need to apply the same principles for monitoring drift in real-time as we do to our CPU and load. This will make it possible to be alerted when your cloud and your IaC are no longer aligned and even flag issues that can be prevented in real-time. You can automate ticket creation and escalation and also triage whether this is something that needs to be fixed in real-time with remediation suggestions provided or open a ticket to fix it later. The choice should be yours, not made by an administrator who has a lot less context about the systems and the ultimate business impact.

    It is Not ‘One and Done’

    Some vendors preach codifying your cloud into IaC and then locking it down so that you’ll never have to do it again. This feels like deja vu; we’ve definitely heard this before. It sounds a lot like the ‘write once, deploy anywhere’ JVM promise that never quite panned out. 

    By going down this path, you’re resigning yourself to never adding new cloud assets or changing your cloud configurations. If there’s one thing we’ve learned about the cloud, it’s that it’s a constantly moving target.  (Read what cloud asset management can learn from the world of finance—another industry in constant flux). If this didn’t work decades ago with the JVM, it certainly won’t work in a dynamic and constantly changing environment like the cloud. That’s a fool’s journey.

    Continuous Cloud Up to Code

    There are major downsides of locking down agility and velocity. This is hard-earned advice, witnessed firsthand from tools like legacy CMDB and startups who have forgotten that cloud is ephemeral—and possibly the reason why we all use it in the first place! So if our cloud is constantly changing and is a continuously moving target, then shouldn’t our tools be built in just the same way to keep up? Solutions built for the rapidly evolving cloud-native era must continuously look for new, unmanaged and changed assets and ensure their cloud infrastructure always follows policies and regulatory standards.  

    Once we are able to find the balance between agility and control, we’ll be able to tap into the benefits of speed and safety (as DORA research shows time and again) that are the benchmark of high-performing teams. Automating cloud asset management can provide governance, policies and control while still enabling the velocity and agility engineering organizations today require. 

    Agility Versus Control

    There’s a minority of people who claim they don’t worry about cloud asset configuration drift because they have everything completely locked down. Zero changes can be done at the cloud console or to IaC without going through GitOps for strict change management processes via CI/CD. I bet they have happy developers—not!

    Life is All About Balance

    Throughout the pandemic, organizations had to make developers happy for fear they would leave. So DevOps went full tilt aiming for self-serve infrastructure for developers to remove barriers to speed and velocity. Now, with tech markets depressed, maybe it’s easier to lock things down even if that risks losing engineers.

    As we embrace IaC and its benefits, you need not live in the stone age of locking everything down. How can you achieve unencumbered infrastructure for your developers while following policies and best practices for compliance, risk and cost? There is a way. 

    The solution? Real-time continuous scanning of your cloud assets and your IaC with continuous comparison can surface configuration drift and policy violations immediately. Emergencies are inevitable. It’s bold/stupid/foolish to think you’ll never need to change something at the cloud console during an emergency or that a developer will wait for change management when production is down at 3:00 A.M. on a weekend. It happens, and you must deal with it. 

  • 4 Things Engineering Leaders are Thinking About Right Now

    4 Things Engineering Leaders are Thinking About Right Now

    Spiderman and engineering leaders have something in common: They both have great power and great responsibility. Engineering leadership is more critical than ever, with more than 4.4 million software developers in the United States building our experiences daily.

    Leaders do more than just manage the day-to-day. They are called to influence, empower and motivate their teams. For engineering leaders, this means grappling with new challenges and opportunities as the technology landscape changes and evolves. This shift impacts how humans work, where we work, what our work looks like and how we need to be supported and seen in our roles across the board.

    Let’s dive into four challenges and opportunities that engineering leaders face and how they shape the future of software engineering.

    Communication in Remote & Hybrid Work

    It has been over three years since the way that we work shifted dramatically. Choosing the right fit between remote, hybrid and in-office is a challenge that companies across industries are still wrestling with. The hardest part? Communication.

    There’s no doubt that the flexibility of remote work is beneficial for workers’ mental health. The 2022 State of Remote Engineering Report found that developers reported better work-life balance (64%) and less stress (48%) from working remotely. However, they also reported that collaboration and inclusion took much more effort. Although flexibility is good for mental health, it may hinder spontaneous interactions. And although in-office work fosters face-to-face collaboration, it may limit geographical diversity. Striking a balance is top of mind.

    No matter what the office structure is, engineering leaders must establish clear communication channels, guidelines and regular check-ins with their teams. Engineering metrics are a great way to identify and address the wins, challenges, solutions and bottlenecks. They help leaders foster an environment that encourages collaboration, cross-functional teamwork, and knowledge sharing through regular team meetings, brainstorming sessions and collaborative projects to promote engagement and a sense of collective ownership no matter where teams and team members work.

    Generative AI

    Generative AI is top-of-mind for the whole world right now. It’s an exciting and potentially stressful time for engineering leaders to consider how generative AI may reshape the way we work. While there is a fear of AI replacing human roles, a more positive (and realistic) way to look at AI is by asking: What will this revolutionize, evolve, and enhance and what are the risks?

    Developers are thinking primarily about the emergence of large language models (LLMs) for code creation. Leaders should consider how AI can integrate into workflows to increase development speed, accuracy and efficiency. This is also an opportunity to enhance and leverage AI for tedious tasks so developers can focus on creative projects.

    Leaders must also consider the risks of generative AI. AI simply cannot replicate the complexity of the human experience, which will call for a layered approach to integrating AI into engineering teams. It also begs the question: What responsibilities do engineers have when working with AI? The benefits of streamlining, speed and accuracy may also alter what quality control and testing look like. It’s an exciting time for engineering leaders to embrace the future of work mindfully and strategically.

    Meaningful Metrics and Outcomes

    Engineering metrics are vital for measuring impact and outcomes to drive progress and inform decision-making. Engineering leaders must carefully evaluate and select metrics that align with their team’s objectives and adapt measurement practices accordingly. DevOps Research and Assessment (DORA) metrics are popular, serving as a jumping-off point for engineering leaders. When leaders carefully evaluate DORA metrics as applied to their team’s specific objectives and complement them with other relevant metrics, they can ensure that they capture the desired outcomes and provide a complete picture of engineering health to drive meaningful purpose.

    The added pressure to deliver results while upholding developer morale and efficiency underscores the significance of choosing appropriate evaluation methods that capture the desired outcomes. But most importantly, leaders need to consider what metric visibility means and how best to offer support.

    Fostering Engineering Team Health

    Besides technical aspects, engineering leaders are increasingly concerned about the health and well-being of their teams. Balancing meetings, focused work time and creating a positive work environment are vital factors that contribute to developer health and productivity. Engineering leaders should consider the individuals and team when encouraging breaks, time off and flexible working hours to prevent burnout and promote overall well-being. Some teams have implemented “No Meeting Wednesdays” and similar strategies to provide dedicated time for deep work and to minimize interruptions.

    Leaders should be focused on creating a culture that prioritizes psychological safety where team members feel comfortable expressing their ideas, concerns and feedback without fear of judgment or reprisal. In this fast-paced world, a leader must remember to be human first and encourage open communication, active listening and empathy within the team. Prioritizing collaboration, work-life balance and a healthy team dynamic is critical for engineering leaders aiming to foster long-term success.

    Engineering Leaders Have Great Responsibility

    Engineering leaders are at the forefront of shaping the future of software engineering. Balancing communication in remote and hybrid work environments, leveraging the potential of generative AI, choosing meaningful metrics and outcomes and fostering team health and well-being are critical areas they must address. By embracing these challenges and opportunities head-on, engineering leaders have the power to drive success and create thriving, innovative teams. So, let’s step up to the plate, embrace the evolving landscape of software engineering, and lead with purpose, empathy and strategic vision. Together, we have the power to shape a brighter future for the world of technology. With great responsibility comes great opportunity. Are you ready to don your leadership cape and web-sling your way to success?

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

    Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    SimplyHired.com

    NVIDIA
    Santa Clara, California
    Senior DevOps Engineer
    $144,000 to $270,250

    CareerBuilder.com

    Western Union
    Denver, Colorado
    Senior DevOps Engineer
    $140,000 to $160,000

    Indeed.com

    Visa
    Atlanta, Georgia
    Staff Software Engineer – DevOps
    $137,000 to $173,000

    LinkedIn

    Amazon Web Services (AWS)
    San Francisco, California
    Senior Solutions Architect
    $122,900 to $239,000

    Dice.com

    HCL America
    Irving, Texas
    SRE DevOps Engineer
    $100,000 to $110,000

  • Snyk Survey: AI Generating More Vulnerabilities in Code

    Snyk Survey: AI Generating More Vulnerabilities in Code

    A survey of 404 IT professionals conducted by Snyk found the use of artificial intelligence (AI) to write code is creating a security paradox. On one hand, just over three-quarters of respondents (77%) said AI tools improve code security. At the same time, however, 59% are concerned that AI tools trained using general-purpose large language models (LLMs) will introduce security vulnerabilities that first appeared in the code used to train them.

    The challenge with general-purpose LLMs is that they are trained using a combination of excellent, mediocre and flawed code. As a result, any recommendation surfaced has the potential to be a suboptimal security result.

    Randall Degges, head of developer relations for Snyk, said that as AI tools increase the velocity at which applications can be constructed, it’s probable that DevOps teams will discover more vulnerabilities in their code.

    In general, 61% of respondents also noted that automation has increased the number of false positives, with 62% of respondents reporting that at least one out of every four vulnerability alerts they received from automation tools were false positives. Well over a third (35%) said false positives represented over half of the vulnerability alerts.

    On the plus side, however, more organizations are paying closer attention to application security issues in the wake of several high-profile breaches of software supply chains and disclosures of vulnerabilities. A full 96% reported their organizations are addressing supply chain security problems on an ad hoc basis, yet only half have a formalized supply chain security strategy in place.

    The survey also finds 87% of respondents work for organizations impacted by a software supply chain security issue in the last year, with 61% having implemented new tools and processes as a result.

    A total of 62% of respondents work for organizations that have a software life cycle assurance process in place, but only 42% of organizations are using software bills of materials (SBOMs). In addition, only 40% have formal security ratings for the open source packages that developers employ, and 31% ignore risks that arise from indirect dependencies.

    However, only 40% of organizations have embedded security testing tools into their integrated development environments (IDEs), with 40% not using software composition analysis (SCA) or static application security testing (SAST) tools at all. In fact, even though 80% of respondents reported working for organizations that ship code daily, only 27% claim to continuously audit their code.

    As a result, many vulnerabilities remain unpatched, with Java (42%) and JavaScript (31%) topping the list in terms of code with the most ignored vulnerabilities.

    Finally, the survey also noted that vulnerabilities involving open source code are now being remediated faster than proprietary code. Maintainers of open source software are now paying more attention to cybersecurity issues thanks in part to the tools and best practices provided by the Open Source Security Foundation (OpenSSF), said Degges.

    There will, of course, come a day when AI is more widely used to analyze vulnerabilities in code. In effect, AI will be used to solve some of the security issues general-purpose LLMs create. In the meantime, however, DevSecOps teams would be well-advised to proceed with caution.

  • Extending the GitOps Pipeline: DevSecOps and Trusted Application Delivery

    Extending the GitOps Pipeline: DevSecOps and Trusted Application Delivery

    We live in a fast-paced world of rapid changes and uncertainty where every aspect of our daily lives changes often, including the way we work and communicate. Organizations must deliver value to their customers at a much faster pace than ever before to thrive in such an environment. However, the decentralized nature of cloud infrastructure expands the threat landscape and poses several security risks that enterprises should address in light of recent data breaches.

    Organizations must combat security threats and address challenges arising from cloud misconfigurations. Several recent tools, strategies, practices and technologies have emerged that can help you handle such security threats. This article discusses how the fusion of DevSecOps and trusted application delivery can extend the GitOps pipeline and add business value.

    What is GitOps?

    Coined by Weaveworks in 2017, GitOps thrives on a source code management system built on Git and adheres to the belief that Git is the single and definitive source of truth. Since all changes are stored in Git, anyone can see the audit trail if necessary. This enables you to use Git-based version control to manage your application’s code, environment and processes.

    Figure 1: CI/CD with Git-based Version Control

    GitOps leverages Git repositories as the one and only source of truth and embraces DevOps and infrastructure-as-code (IaC) best practices. Using GitOps, your developers can spend more time developing applications than configuring or maintaining Kubernetes clusters.

    GitOps strategies are gaining traction with enterprises for various reasons, including improved productivity, increased deployment frequency and improved security. While it’s true that GitOps continues to be a transformative trend, the increased speed and automation can also lead to misconfigurations that compromise application stability and security.

    Figure 2: CI/CD using GitOps

    Often, these security vulnerabilities delay development as developers spend significant time and effort investigating them. Since this poses a hindrance to progress, the question that arises is how enterprises can maintain the frequency and speed of deployment while remaining secure and reliable. This is where trusted delivery comes in.

    An Extension of DevOps

    DevOps is a software engineering practice and culture that blends development and operations to provide a shared and collaborative approach to developing and maintaining software. This can boost productivity, lower costs and increase customer value through increased collaboration.

    GitOps extends DevOps to bring the deployment workflow closer to developers. GitOps integrates code and configuration management for cloud-native application deployment and administration, while DevOps fosters shared ownership, transparency, and rapid feedback.

    GitOps uses DevOps-proven practices like version control, code review and CI/CD pipelines with any Git-based repository, including GitHub, GitLab or BitBucket. It builds on DevOps and applies DevOps best practices for infrastructure automation.

    What is Policy-as-Code?

    When deploying and managing cloud-native infrastructures, adhering to security best practices and regulatory standards is critical without hindering development. Policy-as-code is an approach to infrastructure security in which rules are codified and enforced, thereby reducing or eliminating human errors. You can use it to write applications using a high-level language to control, manage and automate policies. With policy-as-code in place, developers may create applications to manage security, compliance and other regulations seamlessly.

    Here are the types of policies that you can codify:

    • Security Policies: By adhering to these policies, you can protect your software from data breaches caused by misconfigurations.
    • Resilience Policies: The use of these policies in your Kubernetes clusters will help you create highly available, fault-tolerant systems as well as maintain business continuity.
    • Coding Standards Policies: These policies can enforce coding consistency, i.e., any code that violates these policies will be rejected automatically by the system.

    What is Trusted Application Delivery?

    Trusted delivery entails codifying security policies within your software delivery pipeline for security and compliance and introducing guardrails at every stage. By ensuring the security, integrity and reliability of your applications deployed in production environments, unauthorized access, tampering or malware introduction is minimized. It establishes and maintains trust in application source code, artifacts and deployment pipelines throughout the SDLC process.

    The key objectives of trusted application delivery are:

    • Security: It protects the application from security threats and vulnerabilities
    • Integrity: It verifies the authenticity and integrity of the source code of your application, together with the dependencies, and any artifacts
    • Reliability: It ensures that the applications deployed to the production are stable and are devoid of any security loopholes so that they can perform as desired

    Trusted application delivery helps development teams release applications early and secures them with automated protections or guardrails. It extends the GitOps pipeline by integrating security, governance and verification with policy-as-code. These security measures are implemented with policy-as-code. The policy-as-code approach encompasses the entire SDLC, including the design, development, testing and deployment stages.

    According to your organization’s security and compliance policies, compliance and security rules are codified and integrated into the system. Throughout the life cycle of your application, you can manage its security, compliance and other regulations using policy-as-code. These code-defined policies prohibit the provisioning of non-compliant resources. You should implement trusted application delivery practices to secure your organization’s application delivery process and reduce the likelihood of unauthorized access.

    Here are the key benefits of trusted delivery:

    • Faster and more frequent releases
    • Enhanced security
    • Protect against misconfigurations
    • Avoid compliance violations
    • Improved collaboration

    What is DevSecOps?

    DevSecOps is a software development methodology that blends development (Dev), security (Sec) and operations (Ops) at all phases of the SDLC by incorporating mandatory security checks. An organization of any size can benefit by creating a culture of shared responsibility and collaboration by bridging the gap between development, security and operations teams.

    A DevSecOps pipeline adds practices such as scanning, policy enforcement, static code analysis, threat intelligence and compliance validation to the SDLC process. Contrary to traditional software development processes that treat security as an afterthought leading to security vulnerabilities and breaches, DevSecOps is a paradigm shift that fosters a culture of proactive and continuous security approach to help address security concerns and vulnerabilities.

    DevSecOps and GitOps help organizations adapt quickly to changing emerging trends and requirements. DevSecOps is an offshoot of DevOps that focuses primarily on security throughout the development process. It helps detect and resolve security issues and vulnerabilities easily and quickly while fostering a culture of continuous improvement.

    Here are the benefits of DevSecOps at a glance:

    • At the outset, determine which points in the SDLC process are susceptible to security flaws and vulnerabilities in the SDLC process
    • Streamlined compliance
    • Secure supply chain
    • Reduced risk of the attack surface
    • Complete visibility of potential threats

    Why DevSecOps?

    DevSecOps is a proven way to secure your CI/CD pipelines, deliver secure, trusted, high-quality software and foster an environment where security is the responsibility of everyone in the organization. By shifting security left—i.e., introducing security into the CI/CD pipeline earlier—organizations can be much more productive and the teams can be more cooperative and collaborative.

    Given the threats to the security of the software supply chain, DevOps practices have given way to DevSecOps practices, where safety is paramount and a fundamental and ongoing component of software development. At the outset of the SDLC, you should ensure that software components and dependencies are secure to avoid potential software supply chain hazards.

    Additionally, it would help if you had built-in security gates in each step of the SDLC to ensure consistent, repeatable and automated processes from the software build phase to deployment. Remember, DevSecOps isn’t an option; instead, it is a necessity.

    Trusted Delivery With GitOps

    Automated software delivery pipelines are based on Git as the only source of truth. Policy-as-code is a great way to ensure that misconfigurations and errors are detected, alerted, and deployments halted automatically. Next, we’ll cover how a typical GitOps workflow determines where multiple checkpoints can be implemented for trusted delivery.

    In a typical workflow based on GitOps, a developer commits the source code to a Git repository. The CI tool then builds the container images. These container images are then tested and then uploaded to an image repository. At the end of this process, these container images will be deployed to a Kubernetes cluster. GitOps agents compare the current cluster state with the desired state on a continuous basis.

    Hence, you should implement security guardrails at the following points:

    • Git repository
    • CI stage
    • Configuration repository
    • Kubernetes cluster

    Creating a Trusted Software Supply Chain With DevSecOps

    You can build a trusted software supply chain by incorporating security practices throughout the SDLC to ensure the integrity and security of the software delivered by DevSecOps. Here is a step-by-step guide to building a trusted software supply chain by leveraging DevSecOps principles:

    • Security by Design: You should integrate security right from the outset of the SDLC and identify the key threats to the security of the pipeline.
    • Application Dependency Scanning: When building applications, we often use third-party dependencies to accelerate the development process. You should monitor security vulnerabilities and patches as they become available for these dependencies. You can leverage OWASP Dependency Check, Firewall from Sonatype, etc.
    • Secure Coding Practices: You should adhere to and enforce these practices among your development teams. You can integrate static code analysis tools into your DevSecOps pipeline, conduct regular code reviews and identify and fix security issues.
    • Container Security: You should scan container images regularly for security vulnerabilities, implement strategies to secure your containers and use container registries with access controls.
    • Continuous Compliance: You should ensure the software supply chain adheres to the relevant standards and guidelines for compliance requirements. In this regard, you should conduct audits regularly to check if compliance requirements have been satisfied.
    • Collaboration and Communication: You should be able to foster a culture in your organization that facilitates collaboration and communication across the development, operations and security teams.

    DevOps, DevSecOps and GitOps: The Future

    As organizations strive to optimize the efficiency of their software supply chain, DevOps, DevSecOps and GitOps are approaches that can improve collaboration, efficiency and security, to help software developers and IT operations succeed. These practices would become more critical and widely used in the future. GitOps provides teams with better tools for managing configurations so they can focus on more strategic activities.

    While GitOps is an approach that advocates Git-based version control systems as the single source of truth, DevOps is concerned about a cross-functional team that can work together. DevSecOps goes a step further by blending security into all stages of the SDLC process.

    The future of DevOps, DevSecOps and GitOps will see increased automation, tighter security integration and a sustained emphasis on efficiency and collaboration. Your organization should adopt these approaches to provide reliable software and services to its customers.

    Conclusion

    Trusted application delivery is essential for securing applications, protecting user data, meeting compliance requirements and preserving market credibility and trust. It helps enterprises and end consumers by ensuring that software is distributed securely and reliably. Organizations can ship high-quality applications with guaranteed security and performance by adopting trusted delivery practices.

  • Overture Maps’ Challenge to Google ¦ Frontier Model Forum’s AI Safety Shtick

    Overture Maps’ Challenge to Google ¦ Frontier Model Forum’s AI Safety Shtick

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: A big-tech consortium goes toe-to-toe with Google Maps, and a big-tech consortium tries to fool AI regulators. (more…)

  • Breaking Boundaries: Integrating Generative AI for Developers

    Breaking Boundaries: Integrating Generative AI for Developers

    Many organizations are experiencing deficits in technical skills and gaps in productivity that ultimately harm their bottom line. To overcome those obstacles and drive growth, businesses can use generative AI tools like ChatGPT and Bard to handle large volumes of data and increase the speed and output of basic tasks without draining valuable human capital. Already, businesses are finding that saving time is one of the most valuable benefits generative AI can deliver. However, there must be oversight of deployments to avoid recurring pitfalls, as the technology contains just as much risk as it does opportunity.

    Generative AI provides developers with helpful task automation while simultaneously creating new challenges. Security, bias and IP questions have DevOps teams scratching their heads at how to best ethically and operationally implement generative AI. Developers must embrace these challenges to remain competitive in an increasingly automated and technologically-driven world.

    Maintaining Confidentiality of Company Code

    Generative AI’s ability to understand and solve code-related issues makes it an ideal tool to help software developers optimize code for faster feature development and quicker releases. By identifying where it can contribute to tasks, like legacy code conversion or automation of processes, companies can free up valuable developer time for building the tools that can grow the business or drive new initiatives. An added benefit is that development teams can automate the coding of new applications or systems by updating old code or re-using existing examples.

    ChatGPT, for example, can also turbocharge development time by scouring swathes of information on GitHub and other forums to find examples of whatever a coder is trying to build. A 2022 study published in the Proceedings of the Association for Computing Machinery on Programming Languages (PACMPL) found that developers could code faster and work more efficiently thanks to generative AI. Tedious searches in tech forums and manual copy-and-paste procedures are replaced by simply asking the right questions (via prompts).

    However, generative AI tools are not closed systems. As users enter data into ChatGPT, it is saved and aggregated to continuously train the language model, opening the door for potential leaks of sensitive company information. There is a serious, potential risk of employees using AI tools as sensitive data already makes up 11% of what employees paste into ChatGPT.

    As a third-party system, AI tools absorb every query, comment and question without any privacy guardrails for users. If an AI bot’s security is compromised, businesses can unintentionally hand over data to bad actors. Even without a hacker’s involvement, sharing confidential customer or partner information may violate contractual agreements and create long legal battles. Developer teams must remain conscious of AI’s security risks.

    Avoiding Bias Creeping Into Results

    It is of utmost importance that businesses make reliable, fair and traceable decisions based on the latest facts. Currently, ChatGPT-4 hasn’t reached the maturity level necessary to be trusted by most companies without significant verification measures. Already, testers have persuaded ChatGPT to make statements that are either inaccurate, biased or both.

    One key concern in generative AI is the ingrained and accidental bias in answers due to the human-generated content used to train large language models. ChatGPT works by searching for textual content relating to the question and recombining it for a distillation. In an almost democratic way, the majority opinion will dominate. For instance, if most people believe that the Swedish are hard drinkers, ChatGPT will say so. While the technology provides remarkably accurate responses in an alarmingly convincing way, it’s important to remember that it’s not always the most reliable or balanced source that wins.

    Furthermore, OpenAI, the creator of ChatGPT, has explicitly stated that its goal is to create a system where queries can be pre-processed before they are fed to the neural net. Answers can then be post-processed before being shown to users. But this safeguard lacks clarity around its objectives and opens the door for ideological or political manipulation.

    Companies considering implementing AI tools must carefully examine their potential applications to ensure they avoid scenarios where bias can result in insights and output that could end up harming the company and its reputation.

    Minimizing Developer Function

    Enterprises are looking for tools to integrate generative AI into existing business processes to enhance numerous functions and deliver greater value to their customers. While the technology still isn’t capable of replacing human developers responsible for updating and maintaining largescale software, updates to generative AI tools and integrations are occurring at a rapid pace, leaving businesses to determine which programs are most viable for developer function.

    As the economy continues to tumble closer to a recession, companies seek ways to minimize costs. And those looking to use generative AI to work with the source code and technical documentation the company uses to run its own operations—rather than the open source code tools like ChatGPT provide—face budgetary decisions. Implementing generative AI programs into the business model can be extremely costly if done wrong, leaving executives to weigh the benefits of adopting the tech versus the cost of trying to hire a full team of developers.

    Connecting the Enterprise to Avoid AI Pitfalls

    For businesses looking to build the connected experiences their employees, partners and customers desire, generative AI is a great resource to accomplish this. However, it’s just one piece of the puzzle that is a modern enterprise. These tools can only deliver smart answers if they get smart questions and businesses connect their internal processes and applications to enable machine learning on accurate and holistic datasets.

    Although AI poses many benefits for developers, such as increased efficiency, accuracy and the ability to handle large amounts of data, they must be wary of the potential security, ethical and budgetary concerns that impact employees, customers and the enterprise as a whole.

    However, once the concerns are overcome or managed, the power of large language models will be leveraged in all kinds of technology and business use cases. Certainly a truly transformational shift and a step change towards a world where technology and software play an unprecedented role in business and society.

  • Upgrade SRE Performance Management With AI

    Upgrade SRE Performance Management With AI

    In my recent blog, Revolutionizing the Nine Pillars of SRE with AI-Engineered Tools, I indicated that AI could analyze application and infrastructure performance data to identify optimization opportunities and predict capacity requirements. In this blog, I explain in more detail how AI-engineered tools can be used to improve the pillar that I call performance management of apps and infrastructure.

    AI Use Cases for Performance Management

    Performance management in the SRE context generally refers to monitoring, analyzing and optimizing the performance of IT systems to ensure they are functioning efficiently and effectively to meet the needs of users and the business.

    Performance Monitoring and Analysis: With the complexity and scale of modern IT systems, manually sifting through performance data to find issues can be like finding a needle in a haystack. AI can help identify patterns and anomalies that might indicate a performance problem. Tools like Dynatrace and Datadog use AI to analyze performance data and automatically alert you to potential issues.

    Capacity Planning: Predicting future capacity needs is often more of an art than a science, but AI can help make these predictions more accurate. Machine learning algorithms can analyze historical usage data and predict future capacity needs based on patterns and trends in this data. A tool like Amazon Forecast can generate accurate capacity forecasts based on time-series data.

    Load Testing and Stress Testing: AI can enhance these testing techniques by dynamically generating realistic load and stress scenarios based on real-world usage patterns. AI can also analyze the results of these tests to identify potential bottlenecks. Tools like BlazeMeter with Taurus provide capabilities for AI-enhanced load and stress testing.

    Performance Optimization: AI can identify optimization opportunities that humans might miss. Machine learning algorithms can analyze performance data to identify inefficient operations or configurations that are impacting performance. Tools like Akamas leverage AI to automate the performance optimization process.

    Performance Modeling: Traditional performance modeling techniques can struggle to accurately model the behavior of complex, distributed systems. AI can analyze historical performance data to create more accurate models of system behavior. Tools like BMC’s TrueSight Capacity Optimization employ AI to enhance performance modeling capabilities.

    Overcoming Challenges

    Implementing AI in any area brings its own set of challenges, and performance management is no exception. Here are some potential challenges and ways to overcome them:

    Data Quality and Management: AI relies heavily on data to provide accurate predictions and optimizations. If the data is inaccurate, incomplete or not representative of the system’s behavior, the AI’s effectiveness will be limited. To overcome this, it’s important to implement robust data management and governance practices. Regularly review and clean your data to ensure its accurate and relevant.

    Skills Gap: Implementing AI often requires a specific set of skills in data science, machine learning and AI, which may not be present in existing SRE teams. Investing in training and upskilling for existing team members, as well as considering hiring or partnering with AI experts, can help fill this gap.

    Resistance to Change: As with any major change, there can be resistance from team members who are comfortable with existing practices. Open communication about the benefits of AI and how it can make their jobs easier and providing the necessary training can help overcome this resistance.

    Integration with Existing Systems: AI tools need to be able to integrate with existing systems to access necessary data and take actions based on its analysis. Choosing AI tools with robust integration capabilities and planning for potential integration challenges can help overcome this issue.

    Cost: Implementing AI can require significant investment in tools, infrastructure and skills. Careful planning and budgeting as well as calculating potential ROI from the improved performance management can help justify these costs.

    Security and Privacy: AI tools need access to a lot of data, which can raise security and privacy concerns. It’s important to choose AI tools that follow best practices for data security and privacy and to conduct regular security audits.

    Summary

    Performance management is a critical part of site reliability engineering, ensuring that systems function at their optimal efficiency and efficacy. With the integration of AI, this facet of SRE is getting an unprecedented boost. From using AI in performance monitoring to identify patterns and anomalies to employing machine learning for accurate capacity predictions, AI is redefining how SRE practices are carried out. Tools like Dynatrace, Amazon Forecast and Akamas, among others, are leading the charge in AI-fueled performance management, streamlining processes and delivering superior results.

    Yet, as promising as the future of AI in performance management appears, organizations must navigate challenges to fully harness its potential. From managing data quality to bridging the skills gap, countering resistance to change, integrating with existing systems, managing costs and ensuring security and privacy, the transformation involves overcoming significant hurdles.

    However, with robust data governance, investment in upskilling, open communication, careful planning and strict adherence to security best practices, organizations can fully leverage AI to revolutionize their performance management practices and elevate their SRE capabilities. This not only ensures optimal system performance but also positions the organization well for future growth and innovation.