devopsy.kinsta.cloud

Category: DevOps Toolbox

Okta Makes No-Code Integration Tool for Identity Platform Available

Okta today made generally available an Actions Integration capability that makes it possible to integrate third-party tools without having to write any code.

Shiven Ramji, chief product officer for Okta, said this no-code integration capability for the Okta Customer Identity Cloud extends a simpler approach for managing secrets that is invoked via an application programming interface (API).

At a time when more responsibility for application security is being shifted left toward developers, the Okta Customer Identity Cloud is gaining traction as an alternative for managing secrets more securely, noted Ramji. Rather than developers attempting to manually verify the identity of end users, it becomes easier to manage identity flows within the context of a larger application development workflow using a cloud service, he added.

In addition to giving developers access to Actions Integration, Okta is also making third-party integrations developed by partners available via the Auth0 Marketplace. The goal is to encourage providers of application development tools to build integrations that development teams can simply download when needed, said Ramji.

It’s not clear how much influence developers are exerting over how identity is managed as more organizations embrace DevSecOps best practices for building and deploying applications. Regardless of approach, the overall state of application security should continue to improve as developers embrace new methods of managing identity within their applications. One of the issues that frequently creates a security breach is when developers forget to remove secrets created during the application development process before an application is deployed in a production environment. Cybercriminals today routinely scan for secrets that have been inadvertently stored as text within an application.

Lees clear is the degree to which developers may opt to update existing applications to take advantage of identity management services that can be invoked via an API or whether they will opt to switch to a cloud service for only new applications.

One way or another, organizations of all sizes will need to find a way to make it easier for developers to manage identities across multiple applications. There is often a tendency to ascribe responsibility for managing identities to development teams without always providing access to a set of tools to manage the process. In about half of the instances in which organizations adopt Okta Customer Identity Cloud, the decision is made by developers, said Ramji. Many of those developers discover the Okta service when they are building a proof-of-concept for their application, he added.

The other half of the time the decision is made by more senior leaders on behalf of an entire development team, said Ramji. In some of those cases, organizations are even going to far as to create a team of specialists for managing identities across a portfolio of applications, he noted.

The core issue, as always, is determining how much time and effort developers will want to spend on identity management versus writing business logic code. All things considered, most developers are going to find it a lot more convenient to invoke an API to access a cloud service versus setting up and maintaining a vault full of application secrets on their own.

January 17, 2023
FAA Ground Stop due to Technical Debt? | Don’t Do DIY Crypto!

Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

This week: The FAA’s NOTAM database gets corrupted, and Threema shows why DIY cryptography is bad. (more…)

January 12, 2023
Broadcom Survey Reveals Spike in VSM Adoption

Value stream management (VSM) is gaining traction as organizations look to find ways to engage customers more efficiently via digital business transformation initiatives.

A survey of 500 executives, IT and business leaders conducted by Dimensional Research on behalf of Broadcom published this week found 39% of respondents implemented a VSM platform with another 16% having some equivalent capability. Another 31% said their organizations is moving in the direction of adopting a VSM platform. A total of 60% of respondents indicated that they will be using VSM to deliver products in 2023, with 95% of organizations that have adopted VSM also engaged in digital transformation.

Laureen Knudsen, chief transformation officer for Broadcom, said the primary goal is to close the divide that has emerged over the years between software development teams and the rest of the business. More than two-thirds of respondents (68%) reported there are disconnects between the business and software development.

Overall, the Broadcom survey identified increasing customer value (58%), improving product quality (55%), reducing costs (51%), adding more customers (50%, increasing profits (49%) and increasing speed to market (45%) as the top strategic issues organizations face in 2023.

The top benefits derived from investing in VSM were increased transparency (42%), improved organizational alignment (39%), faster solutions to customers (38%), data-driven decision-making (37%) and improved access to data (36%).

VSM traces its lineage back to lean manufacturing methods, which called for each step of a manufacturing process to be continuously measured. As software development has evolved and organizations realize how dependent they are on software, there is a growing appreciation for the value of monitoring things such as the impact of missed software development deadlines on the business. At their core, VSM platforms aggregate DevOps metrics and then match them to a set of key performance indicators (KPIs) defined by business leaders. Once those metrics are gathered and correlated, organizations can apply advanced analytics. The goal is to apply algorithms and other forms of predictive analytics that will enable organizations to more easily identify the precise impact software development processes have on the business.

Knudsen said the survey makes it clear a lack of discipline when it comes to software engineering now needs to be addressed as organizations realize how dependent they are on applications to engage customers. Many organizations have, for example, adopted flawed approaches to agile development that wind up creating chaos across the software development life cycle, she noted.

Many organizations, for example, are unsure how much time development teams are spending on retiring the technical debt accrued within legacy applications versus actually working on developing new applications, Knudsen added.

Business conditions tend to change rapidly, so aligning software development with corporate goals is difficult. Nearly three-quarters (72%) of respondents said they are frustrated by the state of the business and constant changes to strategy. Digital business transformation initiatives, however, will require organizations to adopt a more structured approach to software engineering, said Knudsen.

The issue, of course, is the pace at which businesses are already being digitally transformed. The accelerated pace requires almost immediately re-engineering software development processes for them to succeed.

January 10, 2023
5 GraphQL Trends to Watch in 2023

The GraphQL query language had a big year in 2022. We witnessed its increase in production use cases, solving overfetching and underfetching concerns that plagued traditional API integrations. GraphQL can significantly improve usability, aggregate multiple services and optimize how data is ported from system to system.

Yet, GraphQL is also prone to new security concerns. And as attacks on APIs continue to increase and grow in sophistication, an increased security focus will undoubtedly be required to avoid vulnerabilities. The coming year will likely also see architects grappling with their GraphQL maturity as they consider how best to scale its use across an organization and its various stakeholders.

Below, we’ll consider where the tides are flowing for GraphQL in 2023. These forecasts are informed by my coverage in 2022 and reports from within the web development community.

1. Increased Production Use

A full 62.6% of developers reported relying on APIs more in 2022 than they did in 2021, according to RapidAPI’s State of APIs report. As the number of APIs in use expands, we will undoubtedly see more GraphQL examples. GraphQL is popular due to its usability and flexibility which outweighs traditional integration points. Studies showed it is primarily used for exposing internal data, although partner and public use cases are not uncommon.

Representational state transfer (REST) remains a dominant style for modern APIs. According to Postman’s 2022 State of the API report, 89% of developers use REST. GraphQL is in fourth place at 38%, superseded by webhooks (35%) and SOAP (34%). Although usage remains small in comparison, it’s steadily gaining traction and will continue to expand.

2. Unifying Disparate APIs

GraphQL helps expose fields in an easily consumable manner. But it’s also good for aggregating disparate microservices into a unified schema. As such, it is often used as a meta layer that combines multiple REST services, databases and even GraphQL schemas. For the time being, it appears that REST has staying power. And it’s unnecessary to migrate all REST services to GraphQL. Looking to the future, it is more likely to be adopted as a layer on top of existing REST APIs.

Combining multiple backend services under the hood and exposing them in a unified schema creates a more usable, localized interface that frontend developers can work from. In the future, GraphQL might become a meta layer for more organizations, increasing the discovery of internal services and helping teams reuse internal microservices.

3. Supergraphs and Subgraphs

As mentioned above, GraphQL is used not only to combine legacy REST services but also to combine multiple GraphQL schemas. Some call this a graph of graphs—or a supergraph. A supergraph that combines multiple GraphQL schemas would offer unparalleled developer experience in that engineers can access many services from the same endpoint.

However, there’s a downside to centralizing with a unified graph. Different internal teams or partners might only need access to a particular set of functions. Giving the entire schema to every person who walks through the door would be TMI, not to mention a potential security risk that breaks the rule of least privilege. So, the idea of a subgraph has gained traction. A subgraph is an Apollo concept, but the theory could certainly be applied in other implementations. In the future, we’ll likely witness more use cases that use subgraphs to help federate a supergraph across an organization, helping segment a graph to specific stakeholders’ needs.

4. Turning on GraphQL Security Controls

As of 2022, less than half (43.2%) of GraphQL implementations have disabled query introspection. Disabling field suggestions and introspection are means to reduce the risks of public GraphQL exposures. As GraphQL security best practices become more apparent, these numbers will likely become more commonplace. Other security controls, such as implementing query timeouts, query rate limiting and query cost analysis, can also help curb potential malicious behaviors.

As we’ve covered before, security by obscurity is not enough to protect GraphQL. Yet, many native GraphQL security and performance directives go unused. Besides turning on these advanced features, new tooling is coming to market that could harden GraphQL. Security vendors continue to add support for GraphQL, making its protection more accessible for non-security engineers.

5. Managing GraphQL at Scale

GraphQL has arisen in some large production use cases in recent years, helping developer usability at GitHub, boosting productivity at Netflix and aiding Shopify’s API strategy. These case studies proved its usefulness in large enterprises. But how do we effectively scale GraphQL across a massive organization?

The concepts of supergraphs and subgraphs are ways to help scale it across a company. But retaining high performance will also be vital to maintaining an effective, scalable footprint. As such, we will likely continue to see companies optimize how GraphQL is used as it matures. This includes optimizing queries and query depth and applying filtering and rate limiting to fit application demands. Taking measurements of GraphQL response times will be necessary to establish benchmarks to improve over time.

We’re Just Querying the Surface

Above, we’ve only scratched—or queried—the surface of the exciting developments on the horizon for GraphQL in the coming months. There is much more to be said regarding updates to the query language and improvements within the surrounding tooling landscape. Where do you think GraphQL will go in 2023? Let us know in the comments below!

January 10, 2023
Cloudflare Adds Digital Experience Monitoring to CDN Portfolio

At an online CIO Week event, Cloudflare today added a digital experience monitoring capability to a portfolio of services layered on top of its core content delivery network (CDN).

Corey Mahan, director of product management for Cloudflare, said the Cloudflare Digital Experience Monitoring service extends a Cloudflare Zero Trust platform based on agent software dubbed Cloudflare WARP. The solutions delivers a wide range of software-as-a-service (SaaS) offerings spanning everything from data loss prevention (DLP) to email security.

He added that the overall goal is to reduce the total cost of IT by delivering SaaS application services more efficiently using a single agent rather than having to deploy multiple agents for each service.

The Cloudflare Digital Experience Monitoring service, available as a private beta, will enable IT teams to leverage the Cloudflare CDN to measure and analyze controlled data flows to public or private resources by emulating traffic flows using synthetic data. Via integration with the Cloudflare Zero Trust platform, IT teams can also access real-time data visualizations highlighting anomalies in connectivity or performance that might, for example, be indicative of a security breach, noted Mahan.

While there’s no doubt IT organizations are looking to streamline the number of IT vendors they need to manage, it’s not clear what the center of gravity will be for achieving that goal. Cloudflare is making a case for using the same global CDN that many organizations already rely on for networking services.

The Cloudflare Digital Experience Monitoring service leverages the company’s CDN to make it simpler to understand, for example, why users in one geography experience sub-optimal application experiences compared to another, said Mahan. That’s especially critical when more organizations than ever have employees working from home across multiple geographies, he added.

In the longer term, more networking and security functions will be consumed as a service. The challenge then becomes integrating those services into the DevOps workflows that are employed to deploy applications across a highly distributed computing environment. In many cases, what might initially appear to be an application performance issue winds up being a network connectivity problem that is more easily solved.

One way or another, the management of IT services in the months and years ahead will continue to converge. Organizations of all sizes will need to determine whether it makes economic sense to acquire platforms they need to manage versus consuming a service that is managed on their behalf. Most of the time, a service will be easier to consume and free up resources that can be applied to other IT functions, such as application development.

Of course, organizations will also need to take care to avoid locking themselves into a specific services provider. Ultimately, however, the question is whether managing a specific IT function provides enough differentiated value to be worth the time and effort when there is so much more to do.

January 9, 2023
No-Code Automated Software Solves a Host of Problems

There’s a huge disconnect in corporate America, and it’s costing companies big time. The disconnect involves software testing, or, more precisely, the lack of it. More than nine out of 10 CEOs are confident that their company’s software is tested regularly, yet roughly eight out of 10 product testers reported that up to 40% of their software goes out the door with insufficient testing. This dichotomy came to light in the latest Leapwork survey of 500 CEOs and software testers.

The consequences of untested software are potentially dire and far from hypothetical. Flawed software that delayed the launch of new car models contributed to the dismissal of Volkswagen CEO Herbert Diess, while Facebook saw its market cap value plummet by billions in 2021 when a software glitch came to light.

It’s not as if anyone is unaware of such risks: A whopping 95% of CEOs surveyed admitted they’re concerned about losing their jobs if a software failure occurs, while 76% of testers shared that concern. Those feelings are certainly valid, as more than three out of four CEOs reported that software failures damaged their companies’ reputations during the past five years.

Despite these realizations, CEOs seem willing to gamble. A full 85% said they considered it acceptable to release software that wasn’t adequately tested, as long as it can be patched later. That attitude has made patching standard operating procedure. More than half the testers said their teams spend five to 10 days a year patching software.

Why are organizations willing to take unnecessary risks by releasing software that’s potentially not ready for prime time? There are several common reasons—and a solution that many are overlooking.

The Problem with Manual Testing

One of the major problems is the continued reliance on manual testing, which requires time and resources companies can’t afford. Only 43% of testers said they use automation to some extent in their testing, proving that the majority of testing is still a manual process.

That significantly slows product development, an issue for businesses anxious to get their products to market before the competition. Nearly 40% of CEOs said the time-consuming nature of manual testing is one of the primary reasons they release programs that haven’t been properly vetted. Testers clearly feel the crunch, with about one in three saying faster development cycles don’t allow enough time for testing.

Given the choice between rushing through testing or delaying a release, companies often roll the dice and opt for the former.

Two recent pandemic-related trends have made the situation even more difficult. More organizations are embracing digital platforms to cope with the effects of COVID-19 on their businesses, increasing the need for IT talent. At the same time, upheaval in the labor market has resulted in widespread resignations and job hopping, contributing to a serious shortage of skilled IT personnel.

The Coding Conundrum

Even in this chaotic business climate, experienced software developers remain a hot commodity, with many career options at their fingertips. The competition for talent has left many IT teams scrambling and understaffed, making it difficult to produce high-quality software at a breakneck pace.

Eliminating the need for manual testing could relieve the pressure to a great extent. By automating testing, organizations can reduce the burden on staff and minimize the risk of errors caused by deadline pressures. That would allow more testing of more software in less time, which would help move product out the door and into the hands of customers.

But automated testing isn’t without its challenges, as many organizations have discovered. Many solutions that are billed as “low code” still demand coding skills beyond the capability of typical business users and testers. That need for coding is an obstacle that can drag down the pace of testing and make it difficult for business users to participate in the process.

That challenge grows as the need for ongoing maintenance expands. The test engineers who came on board to set up an automation solution can find themselves bogged down in maintaining code. As a result, speed to market continues to suffer.

Democratizing the Test Process

There is a solution: true no-code test platforms. This type of solution allows both testers and business users to design, run and maintain tests without the need for coding. Business users who understand how the software deliverables are supposed to grow business can be intimately involved in testing, which enhances the quality and functionality of the product and the satisfaction of customers.

It also promotes speed. When testing is largely automated and more people are involved, it’s possible to test more software in less time. This eliminates bottlenecks and addresses the issue of scale. The use of automation on a no-code platform has been shown to speed time to market by a factor of 10—an improvement that largely eliminates the need to rush potentially flawed software to market without adequate testing.

Organizations can position themselves to meet the growing demand for digital solutions by revamping the way they test software. By eliminating manual testing and adopting an automated platform that doesn’t require coding skills, they can afford to test all their products thoroughly. The end result: They can minimize the risk of bugs that could undermine their success and threaten job security.

January 9, 2023
Best of 2022: Agile/Scrum is a Failure – Here’s Why

As we close out 2022, we at devopsy.kinsta.cloud wanted to highlight the most popular articles of the year. Following is the latest in our series of the Best of 2022.

Welcome to The Long View—where we peruse the news and strip it to the essentials. Let’s work out what really matters.

This week, something a bit different: I’m devoting my entire column to Agile and Scrum. They’re increasingly getting a bad reputation, being associated with the worst aspects of toxic workplace culture: Sexism, racism, burnout, micromanagement. (more…)

January 3, 2023
Best of 2022: Microsoft Adds Raft of Tools and Azure Cloud Extensions

As we close out 2022, we at devopsy.kinsta.cloud wanted to highlight the most popular articles of the year. Following is the latest in our series of the Best of 2022.

At its Build 2022 conference this week, Microsoft added a bevy of tools and platform updates as part of its effort to improve the productivity of developers and the DevOps teams that support them.

A Microsoft Dev Box offering, for example, provides access to a set of pre-configured environments on the Azure cloud that enables developers to be onboarded in seconds, while a previously announced GitHub Copilot tool that makes use of artificial intelligence to make writing code faster will be made generally available this summer.

Donovan Brown, a partner program manager in the Azure CTO Incubations team, told conference attendees the overarching goal was to enable developers to stay agile while they continue to work remotely in the wake of the COVID-19 pandemic.

For DevOps teams, a Smart Maps capability was added to the Application Insights module within Azure Monitor. Smart Maps leverages machine learning algorithms to surface performance bottlenecks or failure hotspots and is also available as a technical preview.

There is also a tool that discovers and groups dependent Hyper-V virtual machines (VMs) and physical servers to ensure all required components are identified and included during an Azure migration.

Other updates include an App Service Landing Zone Accelerator that provides a combination of artifacts and documentation to automate application deployment using the Azure App Service 3.0 and preview tools for migrating ASP.NET web applications to the platform. In addition, Microsoft is previewing support for Google Remote Procedure Call (gRPC) on the Microsoft Azure App Service. A .NET Multi-Platform App UI framework allows for building natively compiled applications for iOS, Android, macOS and Windows using C# and XAML in a single codebase.

Microsoft has also extended the reach of its cloud platform for managing application programming interfaces (APIs). The Azure API Management service now supports the Azure Private Link virtual private network (VPN) along with a capability that automatically renews certificates. In addition, Microsoft is previewing support for the GraphQL query language for APIs.

In addition, a GitHub OpenID Connect (OIDC) with Azure Active Directory (Azure AD) workload identity federation capability has also been added to eliminate the need to store and access secrets outside of the Azure cloud platform.

Microsoft, in partnership with VMware, is adding a managed Azure instance of the Spring framework for building Java applications and making previews of the Dynatrace observability platform and NGINX proxy software available as software-as-a-service (SaaS) applications on the Azure cloud.

Finally, Microsoft has added a raft of tools to make it simpler to build cloud-native applications on Kubernetes clusters.

It’s not clear how quickly developers are adopting these tools, but DevOps teams can expect to see the rate at which applications are developed on the Azure cloud increase in the months ahead. The challenge, of course, will be managing all those applications—both as they are being built and after they are deployed either in Azure or some other compatible IT environment.

December 26, 2022
AWS Saves Ukraine’s Data | WPF ‘is not Dead’ (yet) | Devs Quit for Cash

Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

This week: Amazon S3 is keeping Ukraine’s data safe, we ask if Windows Presentation Foundation is dead, and developers tell us why they switch jobs. (more…)

December 21, 2022
Rezilion Updates Open Source MI-X Tool to Better Secure App Development

Rezilion has updated its open source MI-X vulnerability discovery tool to include mitigation and remediation recommendations.

In addition, the tool can now produce machine-readable output in either a JSON or CSV format.

Finally, the company added Windows support for Heartbleed and SpookySSL vulnerabilities in Windows environments.

MI-X makes it possible to use a command line interface (CLI) tool to identify and establish the exploitability of more than 20 well-known common vulnerabilities and exposures (CVEs).

Yotam Perkal, director of vulnerability research for Rezilion, said Rezilion created the tool as part of its efforts to create a platform that enables organizations to better secure their software supply chains. The primary purpose of the platform is to prevent vulnerabilities from being introduced into applications in the first place by providing developers with the context required to understand the potential severity of a vulnerability, he added.

There’s no doubt that developers need tools that enable them to easily identify vulnerabilities while writing code. However, shifting responsibility for vulnerabilities entirely left toward developers is not a panacea for application security. DevOps teams need to embrace DevSecOps best practices to ensure that the build created by multiple developers is secure and that the runtime environment where applications run is also free of malware.

The challenge is that achieving that goal needs to go beyond adding additional tools to a DevOps workflow. The biggest challenge is narrowing the historic cultural divide between developers and cybersecurity teams tasked with discovering vulnerabilities. Most cybersecurity professionals don’t understand how applications are developed, so every instance of vulnerability found in an application looks the same to them—regardless of whether the actual code is externally accessible.

DevOps teams, meanwhile, are trying to strike a delicate balance between patching innumerable vulnerabilities and building and deploying additional applications. More than anything, those teams need to be able to prioritize their patching efforts based on the actual versus theoretical severity of a vulnerability, noted Perkal.

It may never be possible to address all the application security debt application environments have accrued over the years. However, as apps are built and application security issues are addressed more proactively, the state of cybersecurity should improve. The issue, of course, is that cybercriminals are now targeting software supply chains; inserting malware into a DevOps workflow creates a potential opportunity to compromise any number of downstream applications. Organizations are now racing against time to secure their software supply chains.

The good news is that no developer intentionally sets out to build an insecure application. It’s just that far too many of them have been conditioned to think of security as an obstacle they need to overcome rather than address. However, the more tools they are provided to remediate as many vulnerabilities as possible, the better off everyone concerned will be.

December 19, 2022