devopsy.kinsta.cloud

Category: DevOps Practice

  • Preparing for Machine Learning Readiness to Unlock its Full Potential

    Preparing for Machine Learning Readiness to Unlock its Full Potential

    With the rapid advancement of artificial intelligence (AI) and machine learning (ML), companies need to understand and evaluate their readiness to adopt these technologies and drive material business outcomes.

    To assess a company’s machine learning readiness, we must consider several key factors, including:

    ● Vision/strategy
    ● Data availability
    ● Expertise, infrastructure and resources
    ● MLOps and governance

    In this article, I will review these three key factors in assessing ML readiness and how they can help your organization prepare.

    1. Vision/Strategy

    A company’s vision for its AI/ML strategy is essential to consider when assessing its machine learning readiness. This includes ensuring that the expected AI transformation aligns with the company’s strategic goals and that it will ultimately be meaningful for the business. To evaluate this, organizations should consider their overall strategy for AI adoption and determine how it fits into their broader business objectives. Additionally, companies should identify specific use cases and applications of AI that support their goals and how those can be implemented to drive business outcomes. A company that has already woven an AI/ML strategy into its business planning is in a far better position to assess its ML readiness.

    2. Data Availability

    I believe data availability is another crucial factor in assessing ML readiness. Machine learning algorithms require vast amounts of data for training and validation to offer real value. It would be challenging for a company to successfully implement machine learning without access to sufficient data, or they’d risk a model that cannot be trained effectively and that would, in turn, perform poorly. Companies must consider the quality and quantity of data at their disposal, as well as any potential future data sources when assessing their readiness for this important element of machine learning. I also think organizations should consider the feasibility of collecting and integrating data from various sources, whether internal or external, to have the most impactful machine learning initiative.

    3. Expertise, Infrastructure and Resources

    It’s no secret machine learning requires a diverse set of skills, including data science, programming and statistics, and every organization must be sure they have all the necessary talent and resources when building that function. These resources include data preprocessing, model development, model validation, deployment, monitoring, maintenance and the ability to train and onboard new employees to oversee AI/ML programs. Companies should also enable collaboration across these different units and roles. If a company chooses to outsource machine learning projects to third parties, the skills needed internally may need to shift toward project management and collaboration with external teams, as well as a nuanced and sophisticated understanding of the business problem, industry and technical capabilities of the vendors, to ensure proper execution.

    A company’s systems and technology stack are key to any operation. This includes selecting the right technologies and tools to enable the end-to-end creation and use of AI/ML-powered analytical applications. Before adopting ML, companies should evaluate their current stack to determine if it’s equipped to handle AI, including the availability of hardware, software and programming languages. Organizations should also consider the costs associated with selecting and implementing the right technology stack for AI/ML, including the costs of any necessary upgrades or new investments. Decision makers should also research and evaluate different technology vendors, their products and services, and find the one that best suits their needs in regards to cost, value and alignment with long-term goals.

    4. MLOps and Governance

    To be machine learning-ready, I find it important for companies to have machine learning ops (MLOps) in place. MLOps is a set of practices that allows companies to manage the end-to-end machine learning life cycle. It covers the entire machine learning process, from data preparation to model deployment and monitoring. Implementing MLOps includes continuous integration and delivery, model versioning and management and monitoring and alerting. Additionally, MLOps practices such as automated testing, model evaluation and deployment can help organizations improve the overall efficiency and effectiveness of their machine-learning efforts over time.

    A company’s governance structure for AI/ML adoption is another factor to consider when assessing machine learning readiness. Companies should evaluate their existing governance structures and determine if they are equipped to handle the implementation of AI, including data governance, compliance and risk management. We must also consider how we will manage the deployment and scaling of AI, including the development of policies and procedures to govern the use of AI and the identification of internal stakeholders and decision-makers who will be responsible for its implementation.

    Ultimately, I believe the key to machine learning readiness is to assess current capabilities, identify areas for improvement and develop strategies to address them. By taking the time to assess their machine learning readiness, companies can ensure they are in the best position to take full advantage of the benefits that machine learning can provide.

  • Continuous Testing: The Key to Quality Assurance in the DevOps Era

    Continuous Testing: The Key to Quality Assurance in the DevOps Era

    Continuous testing has emerged as a critical aspect of quality assurance in the DevOps era. In recent years, there has been a rapid transformation in software development methodologies. With the advent of DevOps, there has been a significant shift toward automation and continuous integration and delivery (CI/CD). The traditional approaches to quality assurance are no longer adequate to meet the needs of modern software development practices. Continuous testing is the key to ensuring that the software is delivered on time, with quality and reliability.

    Definition of Continuous Testing

    Continuous testing is a process of executing automated tests continuously throughout the software development life cycle to provide rapid feedback on the quality of the code. It is an essential component of DevOps that ensures that the software is always ready for release. Continuous testing allows for the detection of defects and errors at an early stage, which reduces the risk of production issues and enhances the overall quality of the software.

    Importance of Continuous Testing in DevOps

    To understand the importance of continuous testing in DevOps, it is essential to understand the evolution of quality assurance in software development.

    Traditional Waterfall Method

    The traditional waterfall model of software development had a sequential approach to quality assurance. Testing was only performed after the development phase was completed. This approach often led to delays and increased costs due to detecting defects later.

    Agile Methodology

    The Agile methodology introduced an innovative approach to quality assurance. Testing became an integral part of the software development lifecycle, and the focus was on continuous feedback and improvement. However, even with Agile, testing was still done in batches, and there was a significant amount of manual testing involved, which could be time-consuming and prone to errors.

    DevOps Model

    The DevOps model took the concept of continuous feedback and improvement to a new level. With DevOps, testing became automated, and continuous integration and delivery became the norm. This approach significantly reduced the time to market, increased collaboration between development and operations teams, and enhanced the overall quality of the software.

    The Role of Continuous Testing in DevOps

    Definition of DevOps

    DevOps is a software development methodology that emphasizes collaboration and communication between development and operations teams to deliver software products rapidly and reliably. It involves the integration of development, testing and operations into a continuous process, with automation as a key enabler.

    Importance of Continuous Testing in DevOps

    Continuous testing is a critical component of DevOps. It enables the testing of software continuously throughout the development lifecycle, which helps to identify defects and issues early on.
    This early detection of issues is essential in reducing the risk of production issues, and it allows for timely feedback, which facilitates faster decision-making.

    Benefits of Continuous Testing in DevOps

    There are several benefits of continuous testing in DevOps, including:

    · Faster time to market: Continuous testing enables the rapid release of software, reducing the time to market significantly.
    · Improved collaboration: DevOps emphasizes collaboration between development and operations teams, and continuous testing facilitates this collaboration by providing continuous feedback on the quality of the code.
    · Enhanced quality: Continuous testing enables the early detection of defects and issues, which reduces the risk of production issues and enhances the overall quality of the software.
    · Reduced costs: Continuous testing can help to reduce costs by identifying defects and issues early on, which reduces the cost of fixing issues later in the development cycle.

    Implementing Continuous Testing in DevOps

    Choosing the Right Test Automation Tools

    The selection of the right test automation tools is critical to the success of continuous testing in DevOps. Some of the popular test automation tools for DevOps include Selenium, Appium, Cucumber and JUnit.

    It is essential to choose a tool that is easy to use, integrates well with other DevOps tools, and has strong community support.

    Building an Effective Test Automation Framework

    An effective test automation framework is essential to implementing continuous testing in DevOps. A test automation framework is a set of guidelines and standards that help in the creation and execution of automated tests.

    A good framework should be modular, flexible, and scalable. It should also be easy to maintain and extend as the project grows.

    Integrating Continuous Testing Into the DevOps Pipeline

    To implement continuous testing in DevOps, testing should be integrated into the DevOps pipeline. The DevOps pipeline is a series of steps that automate the software development process, from code commit to production release.

    Continuous testing should be integrated into every stage of the pipeline, from unit testing to acceptance testing.

    Best Practices for Continuous Testing in DevOps

    To achieve the full benefits of continuous testing in DevOps, it is important to follow best practices. Some of the best practices for continuous testing in DevOps include:
    · Test early and often: Testing should begin early in the development cycle and continue throughout the development process.
    · Automate everything: Automation is essential for continuous testing in DevOps. All tests should be automated, including unit tests, integration tests and acceptance tests.
    · Integrate testing into the DevOps pipeline: Testing should be integrated into every stage of the DevOps pipeline, from code commit to production release.
    · Use the right test data: Test data should be relevant and representative of real-world scenarios.
    · Collaborate across teams: Collaboration between development, testing and operations teams is essential for the success of continuous testing in DevOps.

    Challenges and Solutions for Continuous Testing in DevOps

    There are several challenges to implementing continuous testing in DevOps, including:
    · Test data management: It can be challenging to manage and maintain relevant test data that accurately represent real-world scenarios.
    · Test environment management: Ensuring that the test environment is consistent and reliable can be a challenge, especially in complex applications.
    · Test automation maintenance: Test automation scripts can become complex and challenging to maintain, especially as the application evolves.

    Strategies for Overcoming Continuous Testing Challenges

    There are several strategies for overcoming the challenges of continuous testing in DevOps, including:
    · Test data management: Creating synthetic test data can help ensure that the data is relevant and representative of real-world scenarios.
    · Test environment management: Using containerization technology such as Docker can help ensure a consistent and reliable test environment.
    · Test automation maintenance: Regular maintenance and refactoring of test automation scripts can help keep them up-to-date and relevant.

    Conclusion

    Continuous testing is the key to ensuring quality in the DevOps era. It enables the rapid release of software, reduces the risk of production issues and enhances the overall quality of the software. Implementing continuous testing in DevOps requires choosing the right test automation tools, building an effective test automation framework, integrating testing into the DevOps pipeline and following DevOps best practices. Although there are challenges to implementing continuous testing in DevOps, these challenges can be overcome with the right strategies and practices. By implementing continuous testing in DevOps, organizations can achieve faster time to market, improved collaboration, enhanced quality and reduced costs.

  • Atlassian Embeds Generative AI Across Cloud App Portfolio

    Atlassian Embeds Generative AI Across Cloud App Portfolio

    At its Team 23 conference today, Atlassian announced it is adding an artificial intelligence (AI) capability to the enterprise editions of its cloud portfolio to automate a wide range of routine tasks.

    Sherif Mansour, distinguished product manager for Atlassian, said Atlassian Intelligence uses natural language to drive a virtual agent that resolves routine help desk issues from within Slack or Microsoft Teams. Atlassian Intelligence can also identify incidents that have been previously resolved along with issues that are related to one another.

    In addition, IT teams can also leverage Atlassian Intelligence to create summaries for projects being tracked using the company’s Jira project management software, noted Mansour.

    The overall goal is to streamline incident management processes while also making it simpler for application stakeholders to collaboratively participate in software development, he added.

    Generative AI capabilities are likely to be infused into almost every imaginable application going forward, but Atlassian is clearly at the forefront of an effort to leverage AI to improve productivity. For example, instead of spending time handling routine issues that increase the amount of daily toil, IT teams should be able to spend more time resolving more complex issues, noted Mansour.

    The cumulative effect of AI should result in a significant decrease in the backlog of tasks that many IT teams would otherwise have to manually perform, he noted.

    It’s not clear just yet how much generative AI will impact the way software is developed and how IT is managed, but it’s already apparent that fundamental change is on the way. The Atlassian Intelligence approach is intended to augment the capabilities of IT teams so they can do more with the same number of or fewer personnel.

    The challenge IT teams will face is identifying tasks they couldn’t previously accomplish simply because there wasn’t enough time available.

    Fundamentally, generative AI changes the way humans interact with machines. Instead of requiring a developer to create a level of abstraction to communicate with a machine, it’s now possible for machines to understand the language humans use to communicate with each other. That makes it possible for anyone to make use of large language models used to create generative AI platforms to, for example, automate a routine task or, one day soon, create code.

    At this point, like it or not, the generative AI genie is out of the proverbial bottle. Just about every job function imaginable will be impacted to varying degrees. In the case of IT organizations, the ultimate impact should involve less drudgery as many of the tasks that make managing IT tedious are eliminated.

    Hopefully, as IT continues to evolve, there will still be plenty of demand for human expertise. For better or worse, the nature of the expertise required, however, will undoubtedly be at a much higher level than it has been for the past four decades or more.

  • Start Automating Now

    Start Automating Now

    A bit of feedback I received from last week’s post is that I didn’t provide any background, I just jumped right in with examples. So let’s take a step back and talk about the bigger picture.

    It is always a surprise to me when I talk to enterprise friends and associates and hear that automation has not taken over their DevOps processes. Yes, we still (and might always) want the ability to have a person review what is being done and make course corrections if the automation has something wrong, but most of the automation that is available for DevOps is no longer new and should be a no-brainer.

    The ability for a build to block based upon any given criteria and notify Jira or ServiceNow—or whatever issue tracking system you use—while alerting the people responsible for the build is simply obvious … and yet, some organizations aren’t even that far yet. The ability to stop a build, create a ticket, assign it to the appropriate person and give it a priority is built into most of these products. It should be looked at to see if it’s suitable to the organization.

    This goes on and on. We’re now to the point where everything in the toolchain can be automated. IaC and GitOps are tackling the broad operations end, and if the application is 100% public cloud-based, CloudOps simply solves the problem. Automation from check-in to production is possible, with very few places where intervention from humans is needed.

    Given that most of this technology is mature—even though some of it has not been around as long but has broad enough adoption that it can be considered mature (Flux and Argo come to mind here)—it is time for enterprises to start another round of automation. Just like AI won’t eliminate most development jobs this year, automation won’t eliminate jobs, either. But we’ve been so strapped for time for so long that this may be a surprise. Automation might reduce the need to scramble for new team members while asking current employees to give a bit more … over and over.

    So get started. The math that made DevOps appealing in the first place—streamlining to reduce time to market and free up IT hours—is the same math that applies to the current round of automation. The more that can be automated, the more time team members will have to perform more productive work.

    Having mentioned AI in passing, I’ll use that as a segue to include AI in the “automation” discussion. At this time, nearly all of the tools we call AI are simply advanced automation tools and should be considered in the process of increasing IT automation. The ability for an app to run, learn your systems and improve them (be that improvement in development, security or ops) is just advanced automation. In the places where it works well in a given environment, it should be adopted. It is highly unlikely that AI will get worse over time, so even marginally acceptable AI results make it worth implementing, counting on technology advancements and continued training to improve that benefit moving forward.

    So, start automating now. Free your time, take a holiday at the beach, do the same job in less time or, to quote a previous generation, “Work smarter, not harder.” You’re doing the job that keeps the servers humming and users coming, now do it with less effort. And keep rocking it.

  • AI Chatbots: Game Changers for DevOps Transformations

    AI Chatbots: Game Changers for DevOps Transformations

    In today’s fast-paced digital world, organizations are constantly looking for ways to accelerate their software development processes and ensure the seamless integration of their development and operations teams. DevOps has emerged as a popular methodology to achieve this goal, but even with its adoption, many companies still face challenges in their transformation journey. AI chatbots can revolutionize DevOps transformations, making them more efficient and effective than ever before.

    How AI ChatBots Improve DevOps Transformations

    Enhance collaboration by automating routine tasks and facilitating communication between teams: AI chatbots can handle repetitive tasks, freeing up team members to focus on more critical issues while also providing a centralized communication hub for both development and operations teams.
    Expedite incident management by providing real-time alerts and smart recommendations: AI chatbots can analyze logs and system metrics to quickly identify issues and suggest the most appropriate resolution steps, reducing downtime and improving overall system performance.
    Streamline deployment and monitoring processes using AI-driven automation: AI chatbots can intelligently manage deployment pipelines, ensuring that the right code gets deployed to the right environments while also monitoring system health and performance in real-time.
    Offer real-time analytics and insights into the development pipeline for informed decision-making: AI chatbots can gather and analyze data from various sources, providing valuable insights that help teams make better decisions related to code quality, release schedules and resource allocation.
    Identify skill gaps and recommend targeted training resources for continuous improvement: AI chatbots can analyze team performance and individual skill sets, helping organizations identify areas for improvement and providing personalized learning resources to close those gaps.

    Roadmap to Implement AI Chatbots in DevOps Transformations

    Evaluate your organization’s current DevOps maturity and identify areas for improvement: By assessing your existing processes and infrastructure, you can better understand the gaps where AI chatbots can make the most significant impact.
    Select an AI chatbot platform that aligns with your organization’s technology stack and goals: Choose a platform that complements your existing tools and supports your specific DevOps objectives to ensure seamless integration and adoption.
    Define and prioritize use cases for AI chatbot implementation in your DevOps processes: Identify the key areas where AI chatbots can provide the most value, such as incident management or deployment automation and prioritize their implementation accordingly.
    Develop a phased implementation plan that includes integration, testing and deployment of AI chatbots: Create a step-by-step plan to integrate AI chatbots into your existing DevOps processes, ensuring proper testing and validation at each stage to minimize potential disruptions.
    Train your teams on how to leverage AI chatbots effectively and continually refine their usage based on feedback and performance metrics: Provide education and training resources to help your team members understand how to use AI chatbots to their full potential and foster a culture of continuous improvement.

    Benefits of AI Chatbots in DevOps Transformations

    AI chatbots offer several benefits that can significantly improve DevOps transformations, including:

    Increased efficiency by automating manual tasks and streamlining processes: This leads to faster development cycles, quicker releases and a more agile response to changing business requirements.
    Enhanced collaboration and communication among development and operations teams: AI chatbots can break down silos between teams, fostering a more collaborative and unified approach to software development and delivery.
    Faster incident resolution and reduced downtime: With AI chatbots’ help, issues can be identified and resolved more quickly, minimizing the impact on end users and maintaining a high level of service quality.
    Real-time insights into the development pipeline for more informed decision-making: AI chatbots enable teams to make data-driven decisions by providing real-time analytics and insights into various aspects of the development process, such as code quality, resource allocation and release timelines.
    Continuous learning and improvement through AI-driven recommendations: By identifying skill gaps and suggesting targeted training resources, AI chatbots can help teams continuously improve their knowledge and expertise, ultimately leading to better performance and more successful DevOps transformations.

    Summary

    In conclusion, AI chatbots are poised to revolutionize DevOps transformations by addressing common challenges, enhancing efficiency and fostering a culture of continuous improvement. By automating routine tasks, facilitating communication and providing valuable insights into the development pipeline, they can significantly improve the effectiveness of DevOps processes. As organizations continue to adopt and refine their DevOps strategies, incorporating AI chatbots into their workflows will become increasingly essential to remain competitive in the ever-evolving digital landscape.

  • Mobb Launches Community Edition of Automated Remediation Tool

    Mobb Launches Community Edition of Automated Remediation Tool

    Mobb today made available a free community edition of a namesake tool that creates fixes to open source vulnerabilities. The fixes are based on the results of code scanning by a static application security testing (SAST) tool.

    Fresh from raising $5.4 million in seed funding, Mobb CEO Eitan Worcel said the company developed a tool that creates validated patches based on the scan results of third-party SAST tools from Checkmarx, GitHub and Snyk. Initially, the tool is aimed at Java vulnerabilities.

    Worcel said that most vulnerabilities can be traced back to eight types of mistakes that developers routinely make. The company created a pattern for those common mistakes, along with patterns to fix them, called Mobb rules. That ability enables Mobb to accurately produce a code fix that both remediates the vulnerability and adheres to the correctness of the language to eliminate code defects. Mobb then makes available a patch to address those issues in a way that can be readily downloaded and applied by developers. Mobb does not automatically apply those fixes because most developers prefer to review them first, noted Worcel.

    The Mobb approach eliminates the need for IT teams to sort through SAST scans themselves, which can result in the discovery of thousands of vulnerabilities that might theoretically need to be fixed. Each vulnerability, at minimum, is going to require 30 minutes to fix, so the Mobb platform provides a better return on investment and reduces patch backlogs, added Worcel.

    For decades, application development teams have been attempting to find a way to remediate vulnerabilities as quickly as possible. With increased focus on adopting DevSecOps best practices to address those vulnerabilities, more organizations are now reviewing which types of vulnerabilities should have a higher remediation priority.

    Historically, one of the reasons for the wide divide between application development teams and cybersecurity professionals is that many of the vulnerabilities being discovered don’t actually impact applications running in production environments. Development teams then find themselves wasting time investigating vulnerabilities and, when they do determine a vulnerability is an issue, spending time developing a patch. The Mobb tool addresses that later issue by automatically creating the necessary patch, said Worcel.

    Many organizations just allocate junior developers to the task of remediating vulnerabilities, which Worcel noted frees up more experienced developers to focus on writing additional business logic.

    There will, of course, be vulnerabilities that the Mobb tool will not be able to address simply because there may not be enough affected applications to warrant pre-building a patch. Even with the most robust set of rules, it is improbable that an automated tool can, with 100% certainty, safely fix every issue. However, given the number of routine vulnerabilities present in applications, such as SQL injections, there’s plenty of opportunity to improve developer productivity by relying on patches that have already been developed.

    One way or another, the process by which patches are prioritized, developed and then applied has long been a source of DevOps frustration. Anything that streamlines that process will go a long way toward improving the overall state of application security at a time when cybercriminals are becoming more adept at exploiting vulnerabilities wherever they may be found.

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

    Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    Monster.com

    Ace American Insurance Company (Chubb)
    Philadelphia, Pennsylvania
    DevOps Engineer
    $157,477 to $172,000

    LinkedIn

    DRISHTICON
    Mountain View, California
    Senior DevOps Engineer
    $120,000 to $150,000

    Dice.com

    Srivango Technologies
    Cary, North Carolina
    Java Developer with Azure and DevOps Expertise
    $120,000 to $140,000

    Indeed

    The Coca-Cola Company
    Atlanta, Georgia
    Cloud DevOps Engineer
    $102,00o to $109,000

    SimplyHired

    Moody’s
    Remote
    DevOps Engineer
    $90,000 to $159,300

  • Endor Labs Taps ChatGPT to Identify Secure Open Source Software

    Endor Labs Taps ChatGPT to Identify Secure Open Source Software

    Endor Labs has launched DroidGPT, an extension of its software for assessing risks in open source code. DroidGPT integrates the ChatGPT generative artificial intelligence (AI) platform to make it simpler to discover the most secure version of an open source package.

    That capability makes it possible for developers to launch a natural language query from within the Endor Labs platform that asks ChatGPT to identify, for example, the most secure logging modules of Java applications.

    Endor Labs CEO Varun Badhwar said the goal is to make it simpler to apply guardrails to application development processes that today rely heavily on reusing open source packages. Developers often wind up using an older version of those packages that are not as secure because a known vulnerability has not been remediated.

    Endor Labs’ Dependency Lifecycle Management platform applies graph analysis to identify the depth of dependencies that exist within an application. That capability makes it simpler to identify where vulnerable components have actually been employed within an application. DroidGPT extends that capability to identify the most secure versions of those components that developers should be using, said Badhwar.

    Having a full understanding of their dependency graph also lets customers generate and analyze accurate software bills of materials (SBOMs) as applications are dynamically updated, noted Badhwar.

    The level of dependency on open source software packages to create applications has risen sharply over the years. An analysis of nearly 2,000 software packages published by Endor Labs found 95% of all application vulnerabilities can be traced back to a transitive dependency created when a developer used an open source component. Functional dependencies are created whenever developers download a third-party component, so it is crucial to assess the risk levels created by those dependencies.

    Fortunately, in the wake of a series of high-profile breaches, there has been increased focus on securing software supply chains. The ongoing challenge is most developers don’t have a lot of cybersecurity expertise, so as contributions are made to open source projects it’s relatively easy for mistakes to be made. The simple truth is many applications deployed in production environments are riddled with known vulnerabilities that have yet to be addressed. DroidGPT is designed to make it simpler to begin the process of remediating software vulnerabilities in applications as they are built and after they are deployed.

    There is no doubt that it will take years before organizations are able to implement a set of truly mature DevSecOps best practices to teach developers how to build more secure applications. That journey, however, needs to begin with tools that enable them to address fundamental issues that dependencies inevitably create. After all, the best way to combat application vulnerabilities is to make sure they don’t manifest themselves in code in the first place. Making it easier to update applications using older versions of open source modules is nothing less than critical at a time when cybercriminals are getting more adept at exploiting them.

  • How Application Developer Turnover is Shaping Security

    How Application Developer Turnover is Shaping Security

    Observing the developer job market for the past two years reveals a surprising truth that has a profound impact on technology organizations. In the “new normal” of hybrid work, life moves fast and there’s no sign of slowing down. Since 2021, we’ve witnessed all-time record demand for software engineering developers. The emergence of privately held large and medium technology startups, fueled by a fear of missing out (FOMO) driven venture capital market, created vast growth opportunities for software engineer developers in particular. From developing and deploying new applications to scaling your business through multi-cloud environments, cloud and cloud-native companies are everywhere. Not only are cloud and cloud-native companies receiving enormous funding rounds, but worldwide spending on public cloud services is forecasted to grow 20.7% to a total of $591.8 billion in 2023.

    This dramatic cloud growth is primarily driven by the warp speed developers are operating. Thanks to developers, every company is now a digital company and every industry is reaping the benefits of a cloud presence. A retail organization can now build and deploy an application for the holiday shopping season within hours, and workforces can access applications from their kitchen, local coffee shop, or halfway across the world.

    However, as with any new, widely adopted technology, cybercriminals look to target and exploit organizations in their early cloud days as they begin to grasp and understand the technology.

    It was reported earlier this year that the recent exposure of roughly a terabyte of Pentagon emails was likely due to a cloud configuration error. Cloud attacks are on the rise, and there is a major disconnect about who is responsible for keeping the organization safe. Developers who are told to build with speed don’t want their applications slowed down or user experience to be altered by security protocols. Still, accelerating application velocity has security teams caught between remaining responsive to application teams and securing an increasingly complex cloud environment. A major problem is bubbling up, and if security and developers teams cannot come together, the result can leave organizations vulnerable.

    Developers and Turnover

    In a recent survey, 75% of respondents reported a higher-than-usual turnover rate in DevOps. Similar to the well-documented cybersecurity talent shortage, multiple workplace stressors appear to be taking a toll on developers. The same survey reported that 38% of enterprises deploy code to production or release to end users every day, with 17% deploying multiple times a day. To put this into perspective, just two decades ago, developers were shipping limited updates one to two times a year.

    Given the pressure to deliver new code every day, combined with security teams’ pressure to ensure that code is secure, it’s no surprise that we’re witnessing higher-than-normal developer attrition. Instead of pointing fingers at developers for unsecure code, security teams need to create tools and training that do not impede their number one priority: Shipping new code. We’re in a developer-friendly job market and organizations cannot afford to lose top talent because they are overburdening them with security tasks. Developers will find greener pastures.

    Shifting Left

    By now, everyone in the industry has heard of shifting security left—the practice of moving security to the earliest possible point in the development process to ensure code is secure and limit timely and costly remediation. In practice, this means bringing security to where the developers operate so vulnerabilities and misconfigurations are caught early when they are easy to fix.

    This approach has brought about a deeper level of engagement between application developers and security teams, especially in the design phase. However, while developers might now be embracing tools and processes that help them code secure applications, there’s still a limit to how much shift left responsibility they can and want to handle.

    Path Forward

    Shifting security left is certainly a recommended starting point, but simply equipping developers with DevSecOps tools isn’t a winning approach. Developers must be trained and have the desire to effectively use the tools. Like the old saying, give a man a fish, and you feed him for a day. Teach a man to fish, and you feed him for a lifetime. The same holds when shifting security left.

    To ensure developers and security teams understand their security responsibilities within the organization, consider implementing the following:

    1. Define a clear shift left strategy with developers and security teams
    2. Provision the necessary security tools that effectively protect the organization but don’t create roadblocks for developers. Additionally, more tools don’t necessarily mean more security, so be strategic.
    3. Train developers to be more mindful of cybersecurity issues. Most developers haven’t had formal cybersecurity training, so it’s up to organizations to make sure that particular skills gap is closed

    DevSecOps is as much about changing culture and approaches as it is about acquiring new tools. Developers will, unfortunately, come and go, but it should never be because security teams are overburdening them.

  • PagerDuty Bets on AIOps and Automation to Simplify IT Management

    PagerDuty Bets on AIOps and Automation to Simplify IT Management

    PagerDuty this week made generally available an artificial intelligence for IT operations (AIOps) platform that leverages the data model embedded in its incident management software to reduce the amount of time required for an AI platform to learn how an IT environment operates.

    Jonathan Rende, senior vice president and general manager for PagerDuty, said that approach enables the PagerDuty AIOps platform to begin surfacing valid recommendations sooner than other AIOps platforms. Other platforms first need to be integrated into IT environments by an expensive team of consultants and integrators, he added. The PagerDuty approach makes the benefits of AIOps immediately available to both IT operations teams and application development teams alike, he said.

    The arrival of PagerDuty AIOps comes on the heels of the launch of PagerDuty Process Automation, a platform for orchestrating automation across multiple platforms that is integrated within PagerDuty Operations Cloud. That capability makes it possible for organizations to centralize the management of islands of automation that have emerged across the enterprise without having to replace any framework that has already been deployed, said Rende. There are also more than 700 integrations between PagerDuty AIOps and the PagerDuty Operations Cloud platform.

    Like other platforms, PagerDuty AIOps relies on machine learning algorithms and an AI model created by PagerDuty to correlate events so that the platform can put them in context. Incident response recommendations are then made, which an IT team can accept and automatically implement or reject. The platform then uses those inputs to surface more accurate recommendations over time, said Rende.

    The platform will also automatically group apply defined rules coupled with its machine learning capabilities to aggregate alerts. That capability reduces the overall alert noise that might otherwise be generated, noted Rende.

    Organizations are looking to invest in AI and automation more heavily at a time when many of them are reducing the overall size of their IT staff, said Rende. The challenge with AI, however, is that it can take six months or more for a rival AIOps platform to learn enough about an IT environment to begin making recommendations. The PagerDuty approach takes advantage of the data within the PagerDuty incident management platform to train an AI model more quickly, in a way that reduces the time to generate valid recommendations to a matter of days, noted Rende.

    PagerDuty has been building that AI model for the last four and a half years with that specific goal in mind, he added.

    It’s not clear how quickly organizations are embracing AIOps, but as IT environments continue to evolve, many once-manual tasks are being automated. There is a natural fear of the impact those advances might have on specific roles within an IT organization, but as IT environments get more complex, there will always be a need for IT personnel that can focus on higher-order tasks, said Rende.

    Overall, the rate of IT staff turnover should also decline as much of the toil that contributes to burnout is also eliminated.

    It may be a while yet before AI becomes pervasively applied to manage IT, but the proverbial genie is not going back into the bottle. The challenge is determining precisely where the line between the man-machine interface with IT environments is today versus where it might be tomorrow.