Category: Enterprise DevOps

  • Cloud Confessions: Full Stack APM Is a Necessity

    Cloud Confessions: Full Stack APM Is a Necessity

    IT environments have become more dynamic and complex, which has created the need for robust monitoring tools. As a result, companies are increasingly adopting more than one platform, catapulting us into the multi-cloud era. Technology professionals are also embracing and acknowledging the need for comprehensive, full-stack application monitoring and management, bringing application performance management (APM) into the mainstream.

    The recent SolarWinds survey Cloud Confessions 2020 reveals even though APM has become mainstream (with a majority of tech pros using APM tools regularly), there’s still work to be done to move beyond troubleshooting. This finding is consistent with last year’s study, in which nearly half of the respondents said troubleshooting was a top-three task they managed daily.

    Tech pros have an opportunity to fully leverage the benefits of APM across the entire application stack, not just for troubleshooting. They should enable tech pros at any stage in their APM journey to realize the value and richness of end-to-end optimization with APM.

    In 2020, implementing solutions to achieve integrated application performance and availability management for any type of organization will become increasingly important.

    The Cloud Confessions survey showcases how application owners, developers and support teams currently use APM tools. It also shows areas where tech pros feel they need more education and support to confidently utilize APM solutions.

    Cloud Confessions Key Findings

    This survey explores how extensively technology professionals are using APM tools, whether on-premises or for SaaS-based application management and how they monitor these environments. It also showcases areas where tech pros feel confident in their APM tools and strategies, as well as challenges and avenues for building confidence.

    The key findings show:

    1. Tech pros are using APM tools, employing a nearly even mix of SaaS and on-premises to support the three architectures most often found in modern environments. Despite this, confusion around which tools are ideal for specific IT environments is consistent across application owners, developers and support team roles.

    • Nearly nine in 10 tech professionals are using APM tools in their environments.
      • 59% are using APM for monolithic (traditional on-prem) app development architectures.
      • 40% are using APM for N-tier service-oriented architectures.
      • 39% are using APM for microservices.
    • The top three most commonly deployed tools in support of APM strategies are:
      • Database monitoring (64%).
      • Application monitoring (63%).
      • Infrastructure monitoring (61%).
    • Two-fifths of tech pros face challenges due to lack of awareness of what APM solutions are currently offered and confusion over which currently offered APM solutions are best for their needs (respectively).

    2. Overall, tech pros are confident in their ability to manage and monitor applications on-prem, in hybrid environments and in the cloud; this confidence mostly sits within their ability to troubleshoot.

    • Over eight in 10 (84%) respondents are confident in their ability to successfully manage application and infrastructure performance.
    • Two-fifths (40%) of tech pros surveyed are most confident troubleshooting application issues and monitoring application availability and performance (respectively) given their existing skillset, followed by one-third (32%) of tech pros confident in collaborating with team members.
      • Troubleshooting and monitoring as the top two areas where tech pros have the most confidence is consistent with last year’s findings—in 2019, troubleshooting app issues was the number one activity tech pros spent their time on, with 48% of respondents choosing this as a top three task.

    3. The largest challenges tech pros face when monitoring and managing application and infrastructure performance relate to an existing knowledge and skills gap. As a result, tech pros have continued to deal with the troubles of troubleshooting, despite nearly all using some type of APM tool in the last 12 months.

    • When ranking the challenges, tech pros said:
      • Lack of training for personnel was the top challenge (57%), followed by lack of awareness of what APM solutions are currently offered (44%) and confusion over which currently-offered APM solutions are best for our needs (42%).
      • All other challenges were at, or under, the 30% rate.
    • Nearly eight in 10 (78%) tech pros report spending less than 10% of their time proactively optimizing their environments (vs. reactively maintaining).
      • In 2019, 77% of respondents reported spending the same amount of time on proactive optimization.

    4. Tech pros value the business insights delivered from APM tools, but greater skills development is needed in establishing KPIs and communicating IT performance to the business.

    • The top three business insights tech pros gain from APM tools include:
      • Ability to prevent applications outages (73%).
      • Ability to prevent app slowdown related to performance and/or capacity (63%).
      • Ability to improve user/customer experience (62%).
    • Tech pros are collecting these business metrics, but there’s a need to bridge the gap between business metrics collected and tech pros’ confidence in their ability to communicate performance to the business.
      • 34% of tech pros feel they need to improve their current skillset/ability to track impact across key business metrics to more confidently manage their organization’s IT environment, followed by 30% of tech pros who feel they need to improve their current skillset/ability to troubleshoot application issues, improve the performance of application code (29%) and manage/ensure/improve end-user performance (29%) (respectively).

    The key findings uncover the importance of knowing which combination of APM elements are right for your environment. Today’s environments are highly complex and distributed, involving microservices, N-tier, monolithic and commercial off-the-shelf (COTS) applications. This means the potential benefits of APM are even greater in modern contexts, as long as tech pros take time to educate themselves on the right tools for their environments.

    While APM tool usage is widespread, it’s not nearly as effective as it could be—an important distinction to business leaders in charge of digital transformation efforts. When we understand the APM world beyond troubleshooting, the possibilities for application performance optimization open up across the stack and across previously siloed teams.

    APM, when used to its potential, can be the great unifier of tech pro teams all working toward the goal of having highly available, well-performing applications and it can change the way modern businesses operate in the age of performance.

    — David Wagner

  • EP 1: A Brief History of Testing

    EP 1: A Brief History of Testing

    DevOps’ sister site Digital Anarchist has launched a bi-weekly video series and companion monthly roundtable on DevOps, Automation, CI/CD and testing. Featuring leaders in all of these areas, we explore the challenges and issues software delivery and IT teams face every day. How do we go faster, smarter with better quality? DevOps Unbound!

    The video is immediately below, followed by the transcript of our conversation. Enjoy!

    Transcript

    Alan Shimel: Hey everyone. Welcome to the very first episode of DevOps Unbound. I’m your host, Alan Shimel and joining us for this initial episode of DevOps Unbound, I’m proud and happy to introduce you to James Bach and Grigori Melnik. Grigori, James, welcome to DevOps Unbound.

    Grigori Melnik: Hey everyone.

    Shimel: Before we jump into things, let me give each of you an opportunity to kind of introduce yourselves, your backgrounds, your positions, etcetera, so that our audience kind of knows a little bit, if they don’t already, who you both are. So, Grigori, you’ve already been a guest in our show, so if you don’t mind, I’m going to ask James to go first. James? Introduce yourself. Go ahead.

    James Bach: My name is James Bach. I’m a consulting software tester. I started as a developer in my teen years after I dropped out of high school. I’m the proudest high school dropout you will ever meet. I later wrote a book about dropping out of high school and my particular self-education method, but my big opportunity came when Apple computer hired me to be a test manager, and at the time, I was the youngest manager in the R&D division of Apple computers.

    So that’s kind of something I’m proud of. And I fell in love with testing and I decided to devote my career to testing. I studied the epistemology of testing, the mathematics of testing, the sociology of testing. I am a bit obsessed with testing.

    Shimel: To say the least.

    Bach: And I have a book about that called “Lessons Learned in Software Testing” with a couple of coauthors. And now I teach and consult.

    Shimel: Excellent. And you know what, high school dropout or not, you’ve done pretty darn good, so congratulations and not saying it’s an example for our younger people in the audience to necessarily emulate. Of course, James grew up –

    Bach: My son did better than me. He never went to high school, so I’m –

    Shimel: Really?

    Bach: He’s already outdone me.

    Shimel: Absolutely. Very good. Grigori? Why don’t you tell them a little bit about yourself?

    testingMelnik: Sure. So I’m Grigori Melnik and I am the chief product officer of Tricentis, focusing on building the testing tooling of the future, testing tools of the future. Previously, I guess I spent almost two and a half decades focusing on the developer audience and building all kinds of platforms, Microsoft and Splunk and MongoDB and you know, always been kind of customer obsessed in the sense of developer obsessed quite a bit, making sure that whatever we were focusing on would help drive the productivity and alleviate some of the pains that developers in our target audience had.

    And while a few of those things that I’m particularly proud of, my team at Microsoft was actually the first one that built the very first auto-scaling for what was back known as Windows Azure, now Microsoft Azure, but also focused on common patterns and practices in implementing the crosscutting components that represent crosscutting concerns that later would make into the .NET framework.

    So again, a lot of work identifying those patterns, capturing them, externalizing them, testing them out and then helping drive their use. When it comes to testing, I first kind of discovered it in my days in academia when I was doing research and teaching at university, and it was quite interesting because testing was predominantly viewed through the lens of formal method groups. It wasn’t really viewed as an intellectual activity of discovery, as an intellectual activity of exploring or experiencing something.

    And those were actually the days when I’ve encountered the group of testers from the context driven school of testing, including James and then we kind of kept in touch ever since, even with me gravitating away from the testing more into the developer world and now doing like the full loop of coming back to testing and I have to tell you, I felt, when the opportunity came, I felt that the world of testing, at least from the perspective of how the discipline itself has advanced would be way further developed in the last decade than I found after kind of leaving it for a while.

    So I’m now on a mission of kind of reigniting that whole discipline and putting it more on a pedestal and giving it more view and empowerment and leveling up all around. So, yeah.

    Shimel: Excellent. So, thank you both, gentlemen. And I’m Alan Shimel, I’m the editor in chief, CEO for MediaOps, the folks behind DevOps.com, Container Journal, Security Boulevard, TechStrong TV, et cetera. And just quickly before we jump into today’s agenda, DevOps Unbound though, today’s focus is on testing. It’s not just about testing. It’s really about DevOps kind of unbound, setting us free, being able to leap tall buildings and bound into space, sort of freeing ourselves of gravity, whatever you want. It’s about speed. It’s about acceleration. Right? It’s about automation in a lot of ways.

    And each – we’re going got be doing these every other week and each episode will focus on particular aspects of this unbound nature, if you will. Today’s is testing. And then once a month, we’re also going to have a roundtable with about six or eight people of Grigori and James’ stature and we’ll open it up to the public for live audience questions and discussion. So I’m really looking forward to that. DevOps Unbound is sponsored by our friends at Tricentis and we thank them for it and with that out of the way, let’s jump into things.

    So, Grigori, I wanted to start off – obviously, you and James take very different paths to our – and both of you have been very successful in your lives and careers. So it just goes to show, there’s more than one way to skin the cat. Right?

    But, let’s take a look – look, I’m probably older than both of you, though not that much I’m sure, but let’s look at the history, the historical context of where you guys come from to be sitting here today and how that, you know, vis-à-vis kind of the whole testing industry, the whole testing, you want to call it a profession, the guild, the whatever you want to call it, right, how has this evolved over the years and let’s put some context in with timeframes. James, when you first went to Apple without saying you’re old, what kind of – what were the timeframes for that?

    Bach: Well, I am old.

    Shimel: So am I.

    Bach: But you’re older, which is nice. It’s nice to be a young guy in the room again.

    Shimel: Uh-huh. I can’t tell you how well that makes me feel, but go ahead.

    Bach: First, 1987, May 21, 1987 was the first day that I ever professionally tested something as a tester. Before that, I was doing videogame development and I had done informal testing, and I hated testing because testing just got in the way of me shipping my product. So, I didn’t like testing until it became my job and then I realized I’m perfect for testing ’cause I love complaining. And I’m much more interested in finding how things don’t work than to figure out how to make them work.

    Shimel: That’s interesting. You know, my background’s in cyber, back then we called it InfoSec, and in InfoSec, most of the people got into it ’cause they liked to break things. Right? Yeah. Same thing. Grigori, how does that timeframe-wise and everything else, how does that match up with your own experience?

    Melnik: So I like to actually build things. _____ you guys who are breaking things. And occasionally I break things and actually this also speaks about this overall I guess optimism of most developers who think that what they write is perfect and always underestimate the amount of buggy code that we put in there.

    But to me, if I think about my first day when I actually had my job as an engineer, actually, it was September, I think 5, 1990, so a few years after James and at that time, I was actually writing a C-library for a PC converting the data from mainframe into the visual format and I had to deal with all kinds of quirks of Fortran and the 80 characters limit and the asterisks for, you know, for bringing – the continuation of the line, all kinds of exciting stuff. But back to the beginning, to make sure that I don’t go too far on the tangent, we actually didn’t have, for a very, very long time – again, I’m giving you my angle into the testing, if you will.

    We actually didn’t have a dedicated thinking about testing as an activity, as a pursuit of excellence. It was just something that you kind of were doing and then at some point later, you’ve heard and learned that oh wait, look, there’s a QA department, apparently, right? And they’re the ones that were mostly viewed as gatekeepers or police of some sort. Right?

    And then again, if I think about again, once I got more into the research and academia and studying testing specifically because, you know, I’m probably one of the very few people who has testing in the title of my PhD dissertation. But, I remember looking back and thinking, “But where does this come from?” Right? Where did actually software engineering come from?” Right? And of course, this is where the history of the conference deck, you know, after the _____ _____ where all the stalwarts of at that time computer science and well, not even computer science, mathematics departments because that’s who were doing all the programming back then at the point the software engineer discipline and later on the association of debugging, right?

    It was the infamous story of how the moth was found in Harvard University’s scientific lab and the term bugging, you know, was coined. I almost think like the – in the early days, it was very much associated with this era of debugging. Right? Then later on, the era of the ability to demo, the fact that the software was matching the stack or the requirements, I think it almost feels like there were at least a decade when people were fixated and some would argue that it still continues.

    Shimel: What decade was that?

    Melnik: Hmm?

    Shimel: What decade are you referring to?

    Melnik: The debugging or the – the debugging I’d say –

    Shimel: Are you talking about the 70s? Are you talking about the 60s? Are you talking about the 50s?

    Melnik: I’m talking about 50s and 60s. I’m talking about the 50s and 60s as almost the era of debugging the way I viewed it. Then, after that, the era of more like 70s and 80s where you were focusing more on matching the spec and demo and that the software would actually approve it. And this is where this big, big, big focus was on formal methods and trying to even mathematically prove that a software worked according to the spec.

    And then after that, I feel like the next era was the era of breaking or, you know, something that probably is still continuing. And again, all these elements I feel are present in today’s profession of testing, but the later years, the last 20 years was everything that I was kind of studying, watching from the sidelines, getting myself into. I like to call it the era of enlightenment, if I may. I know that’s super pompous of me, but this is where I view more testing in the way how James and other members of the context drew in school of testing had formulated it which is, you know, lighting the way for the decision-maker, not for the developer necessarily, not for – again, it could be for the developer, but somebody who at the end of the day makes the decision whether what is being produced is acceptable or not, or if it’s good enough to ship. Is it, you know, what risks associated there and informing me as a decision maker about all these different factors and then leaving that decision up to me.

    So the testers are not the police. They’re not the quality gate. They’re not _____ anything. It’s really up to the stakeholder who is commissioning all this effort and who makes the ultimate decision about releasing something, putting something into production.

    Bach: I’d like to offer some historical notes on this.

    Melnik: Please.

    Bach: Okay, first, are you aware what the first book was on the subject of software testing, the first known book? A little quiz for your Grigori?

    Melnik: Is it the Myers book?

    Bach: It’s before that. It’s Program Test Methods from 1972 by Bill Hetzel. Now that book was a report on a conference a testing conference which was the Chapel Hill conference, which happened in ’72. That seems to have been a historical watershed event in testing. Before that, the first chapter on software testing that I’ve been able to find was written in 1961 by my teacher, Jerry Weinberg, who wrote it when he was 25 years old. It’s a brilliant chapter on testing.

    What’s fascinating to me is how differently Weinberg talks about testing in 1961 compared to how they talked about testing in 1972, although there is a reference in the 1972 book back to Weinberg, praising Weinberg’s attitude about testing. It’s fascinating to read that because the book in 1961, it’s Computer Programming Fundamentals and the chapter about testing was written by Jerry, he told, although it said it’s co-written, the book’s co-written with Herbert Leeds and Jerry Weinberg, but Jerry wrote the chapter on testing.

    And Jerry talked about testing as a matter of imagination, not automation, as a matter of being suspicious and critical, as a fundamentally unalgorithmic process. And he develops this beautiful story in his chapter about a programmer who’s sure that he’s found the last bug and then finds out that he’s wrong. And then he adds another check for that.

    And then he’s sure now he’s found the last bug and then he sees something else go wrong. And Jerry’s conclusion is look, this is just, we’re working on complex systems and this is always going to be like this. Now, Jerry was on the first project in 1958 that ever had a dedicated test team.

    Now, the reason why he knows that is that in 1961, IBM held a conference of all the computer programmers in the entire world of which there were 400, apparently, and Jerry said his team went to that conference. He was at IBM at the time, and he said everyone thought they were crazy ’cause they had a dedicated group of testers and no one else did.

    They all were just testing their own stuff. So it seemed like the idea of having a dedicated test team caught on and then in 1972, the way they talked about testing was all about test cases, automation, formality and that kicked off the era, I think, of the factory, the test factory. We can have technology and we can have procedures that make it so you don’t rely on human thinking.

    So this goes against what Jerry Weinberg was preaching, not only back in ’61, but all through his career, I became a student of Jerry’s in around 1989 and took all his classes in the mid-nineties and he became a mentor to me. That’s why I’m a real acolyte of Jerry Weinberg, because he always put the human in the center of everything. But, testing – when I joined testing, all the testing textbooks were about how you have to define test cases and if possible, automate them.

    And I felt like that was a fool’s idea. I think, well, the problem is is that there’s too many things to define and far from being unbound, we’ve become super bound by all of these documents and all of this code. And so if you want to be unbound, we have to find a way to temper that. We have to find a way to interact with our tools so that we’re not constrained too much by them. And that, in the nineties, the urge to unbind ourselves from that waterfall world and that heavy documentation world created agile, but it also created the context driven school of software testing, which is a humanist approach to software testing.

    And that was in the mid-nineties that we started creating that. And then DevOps and agile continued to sort of take over the world except that it seems to me that agile in a lot of places has lost it’s humanist foundation and it’s turned into tools, tools, tools. And so if we’re going to really talk about Unbound, DevOps Unbound, it seems to me that we have to be specific about what is it we’re unbinding. I hope what this means is it’s people being unbound, using DevOps as a tool rather than –

    Shimel: But not just a tool. I’m sorry. I didn’t mean to jump in. But not just – you know what, James, we don’t want to make the same mistake that Agile made. And you just said, one of the problems with Agile is we went from humanist to tools, right, too much of a reliance on tools. Let’s not make the same mistake in DevOps. I think that’s something I’ve advocate for for a while too is we can’t lose the human in DevOps.

    Bach: Actually, I want to hear you say more about that, Alan, if you’re willing to say a little more about that.

    Shimel: I’m not shy. I’ll give you my two cents. Look, I started DevOps.com. I cover this place. I cover this area pretty heavily and I have for seven or eight years now. And I think there’s been this – and I don’t want to say agile failed ’cause agile is far from a failure. But there has been a reliance on tools and maybe overly processed. When we think about things like ITIL and ITSM versus DevOps, let’s say, right, we get in – we tend to point fingers at ITIL. Excuse me and ITSM _____ too much process, too heavy, too much of that, that whole change management thing.

    But there are good things there. Nothing’s all bad and all good. The world’s not black and white. It’s grey. Right? And so there are things we take out of ITIL and things and ITSM that we put into DevOps. Btu DevOps, to me, anyway, and it’s just my humble opinion, is fundamentally about people and teams and culture, not the tools- there’s a lot of tools we could use and there’s overlap in tools and what’s the best tool for any given job.

    We could fight about it till the cows come home, but at it’s nitty-gritty, DevOps is making sure that devs and ops and tests and security and these people work with a higher degree of communication, right, with a higher degree of cooperation getting jobs done faster. And we do that by adding things like automation to the mix. But automation for automation’s sake alone is not enough. Right? And to do automation, yes, you’ve got to use tools sometimes to make that automation work. I get it. But if we lose the fundamental aspect that DevOps is, at its core, about humans, I think we all – we lose what DevOps is and I don’t hold myself out to be as accomplished as either one of you, but I –

    Bach: I still love you, Alan. I love what you just said. I think this is – if you can hold on to what the principle and the feeling behind what you just said, we can do anything with tools and we’ll be okay. We’ll be okay. If we’re talking to each other, if we’re caring about each other, I keep seeing people losing that and of course, any technology and any methodology, when it’s applied sociopathically, will become abuse. And so we just – those of us who can, shall do – should do whatever we can do keep it non-abusive and keep us talking. And then I think DevOps can be a wonderful thing.

    Shimel: Absolutely. I’m sorry to take us down that. Go ahead, Grigori.

    Melnik: No, it’s super encouraging to hear what you said, Alan and again, I’m a very big believer into the greatness of human mind, but it feels to me that in this kind of history of our industry, the pendulum keeps swinging back and forth, right? remember the whole infatuation with the case tools, you know, back in the eighties and nineties and then later on, there was this whole big movement of the software factories, like the term was actually software factors where the idea was that you can go and abstract away at some high level and then the loop, y, the tools will generate all the code and everything for you and make it all highly maintainable, all that, and of course that failed too.

    But I think out of this desire for some reason to do – to come up with the sort of boosters. So I don’t know, some kind of the way of equipping the humans to deal with the inherently complex problems where today there’s no better mechanism of dealing with them other than human brains. So this whole vision of, you know, computers writing computer code, I mean, that’s been promised in the first era of AI, not today, but I’m talking about the sixties, right, and seventies were all –

    Shimel: Yeah, yeah, I mean Spielberg does pictures.

    Melnik: Then it kind of died out. Right? Same thing again, you know, having the computers entirely come up with the test strategy, the thinking about testing automatically, entirely automatically, I think is – I think it’s utopical, at least if you think about what the tools are capable of doing today and for a very, very long time in the future. I think the human will remain to be at the center of this activity, while again, all the tooling is great because tooling gives you additional powers and additional ways of perhaps automating the most rudimentary, the most, you know, boring elements of the job and lets you actually free up time to think about new theories, new hypotheses, new models, new approaches –

    Bach: But you’ve got to consider different kinds of tools. Like, have you noticed the difference between let’s say a tool like a programmer’s IDE. When I use a programmer’s IDE, I don’t feel oppressed. I feel empowered. I feel like I’m riding a magic carpet and I have laser cannons mounted on it. I feel wonderful. But when I use most testing tools, I feel oppressed, like I have just a few possible things I can do and if I have any –

    Shimel: Like you’re castrated.

    Bach: that’s outside of what the test tool designer has thought that I might want to do for testing, then I’m not allowed to do that. This is what I feel like when I encounter something like Cucumber, which is very restricted and the Gherkin language, it’s very restricted. It’s stopping me from going on flights of imagination. And yet, when I use the tools that programmers have created for programmers, unsurprisingly, programmers have created for programmers tools that make them feel powerful and free and able to do all kinds of wonderful things. I would like to bring the same sense of freedom to testing that programmers already enjoy. That’s part of what we’re doing with the transformation work we’re doing at Tricentis.

    Shimel: Yeah. I love that.

    Melnik: In all fairness, not all of the programmer’s tools are that liberating. Some of them feel like you are operating in a straightjacket too, but in general, at least there are some examples, there are instances of tooling that are widely accepted, widely adopted today that are supporting and kind of accelerating your abilities to do your job without constraining you. That’s for sure.

    And you know, the piece that James was alluding to, this is actually the new initiative, that we are driving inside Tricentis, you know, about mentioning this whole new platform of the test tools for the future where we are building something akin to the IDE, we’re actually not calling it IDE, we’re talking ITE, integrated testing environment where actually it’s the human being, the human tester who is in the very, very center of the ITE, and all these other snippets and utilities and services and everything around the human tester, around the human that manages to support the individual in the way, wherever his line of thought, line of exploration, line of test execution may lead to. Okay?

    So yeah, we’re kind of envisioning this to be as a super configurable kind of morphing tool, almost like the chameleon style. We’re depending on the context and the environment, the different capabilities of the ITE, the integrated testing environment will represent themselves and then the human will actually pick whether this is actually something that they want to take advantage or not as opposed to again being forced into a specific kind of mold or one way of doing testing. And I don’t think – we don’t think actually anybody has attempted something of this caliber, specifically in the space of test tooling before. That’s why we’re so enthusiastic and so passionate about this project. Aren’t we, James?

    Bach: Yeah. I also don’t think that anyone is going to be able to copy is easily because the only way that they could actually compete with us is by hiring someone who loves testing, which test tool companies hate doing because testers are troublemakers. I still can’t really – it’s hard for me to fathom that Grigori really knows what he’s done by hiring me because I’m a constant gadfly.

    Melnik: [Laughs]

    Bach: I’m constantly complaining about the state of test tools in the world and at Tricentis, frankly, and I want things to be fundamentally better, but that means we have to fundamentally change how we think about what is a tester. Which might get us into the role of testing a bit, but the – to me a tester is a puzzle solver, a problem finder. I’m not a button pusher and I’m not a verifier. I don’t verify things. Tools can verify things. I’m not looking to prove that something works because I can’t prove that anything works. What I can do is collect evidence and then draws inferences from that evidence with a critical mindset.

    And of course, lots of tools are collecting facts about the products that I’m testing and those – that can be automated and so we’re pulling in these facts. And we can say, “We got this output and we expected to get this output, so apparently there’s no problem here as far as we can tell so far.” But then the tester layers onto that a critical mindset saying, “But how do we know and how can we be fooling ourselves?”

    And so I’m bringing that mentality into Tricentis and I’m really surprised so far they’ve been actually quite welcoming of me, but for years and years, I’ve tried to help other tool companies with this and basically, you know what reaction I get? They basically say, “Well, our customers just want to have automation that just pushes a bunch of buttons and we don’t really care about test design. We don’t really care about empowering testers. So that’s not going to help us make any money, James, so we’re really not interested in supporting the skilled testers that you keep talking about.” So Tricentis has a different kind of vision that I think is hard to match.

    Shimel: There’s also a little bit of you can’t make wine before it’s time. Right? And I think right, I think you need the right macro conditions, that things like DevOps have brought about and the whole progress -0 we’ve gone back here now to the fifties and sixties and all the way to the present time.

    Certainly the world we live in today may be a – I want to think so anyway, we’re a little bit more open to the idea of saying, “Look yeah, we can automate some stuff. We can have – we don’t need a human to just push buttons. Right? We have tools that can go push the buttons for us, but we need humans to do blank. We need humans to do some of this stuff and so we need to enable and empower them to do that within the context of let’s automate what should be automated, let’s say. But we still need those humans in there.

    You know, when I was growing up, much like you guys, right, the only animal in the world that used tools was humans. Isn’t that – that’s what I learned in school, right, that’s what separated us from animals, one of the things, right, was our ability to use tools. Well, then we found out chimpanzees use tools and other monkeys use tools and we still were okay with that ’cause they were primates. Now we found birds use tools, right, to crack nuts and stuff like this.

    So tool use in itself does not connotate one’s intelligence or higher being. We need to – so to me, that’s the ultimate case. Right? It’s not about what tools we use. It’s about how we use our brains. And I think that’s apropos to what we see in testing today. Yes, we could come up with tools, but it’s creating an environment for people to think in and use their brains in and apply it that I think will ultimately provide us the highest payback, if you will. Right?

    Bach: It’s interesting what you just said about you’re implying that the history of how we got to where we are now is important, that we have to have a certain set of – a certain historical context, technological context in order to take the next leap. And I think one thing in which that’s really true is we now have decades as an industry, decades and decades of experience trying to eliminate people from engineering and we can’t do it. I remember, maybe you do, there were these advertisements in Byte Magazine in the eighties about case tools and all your marketing people can just define your product and you don’t need developers anymore because it automatically generates all the code.

    And I remember sitting there at Apple Computer reviewing case tools, advertisements that had been sent to me, thinking, well, could I buy some of these tools and actually use them to help with the testing? And it turned out, no. You couldn’t. It was just all – it was all hype and nothing. And so I shrugged. And so a lot of – and even today, now we have AI, AI is the new case tool and the AI will do all this stuff for you. Then it turns out the AI is biased and racist and confused and if you put kitten ears on a whale, it says, “That’s a kitten.”

    Shimel: Yep. And it’s no more than ML, the machine learning anyway, but you know, yes, we’ve been – we have been, you know, chasing this white whale for most of my adult life and at the same time, if it was a nation, the fastest growing nation on earth are developers. There’s 40-something million is the estimate growing what, 20 percent a year or something like that. So I think it’s time we stop probably chasing that white whale and move on to empowering people.

    Bach: And one way to do that, I suggest a definition of programmer or perhaps developer. And the definition I use is a developer is someone who stands at the gateway between the world of the machines and the world of humans. And the developer’s purpose is to operate competently in the world of people and then operate competently in the world of machines.

    And if you don’t have that person standing at the gateway, then you don’t have a connection between the world of humans and the world of machines. You just have people kind of praying to the god of technology and hoping that good things happen. And so no matter how complicated technology gets, no matter how much AI we have, we still have the need to operate competently in the world of people and the developers will always live right at that threshold. And testers need to live there too and not get mowed under by automation.

    Melnik: Yep.

    Shimel: And you know what guys, we’re almost out of time, but this also brings up something that I thought we might be able to get to on this show, but we’re running out of time, and that is that this caste system, if you will, caste system of developers being a higher caste than the tester who’s higher than the, what we call today the SRE, the ops person or what have you. And this whole IT stack of humanity, I think we need to examine that too with the develop – when we’re asking the developer to do the security and the testing, is he any better than the tester? Is there a difference? But we’re going to save that one I think for another show, if you guys would like to come back on, and we can explore that a bit.

    Melnik: _____ back, but I categorically reject that whole hierarchy and I also do not like the whole, you know, notion when people say, “Hey, but the tools and everything that would really help with the low skilled tester.” That’s another notion that kind of gets _____ _____ –

    Bach: No, we reject that.

    Melnik: So annoying and, you know, whether it’s development or testing or any other, you know, data science modeling, the UX design, it’s the discipline, it’s something that requires dedicated effort of studying, perfecting, thinking about the way how people do that work and it requires intellect. That’s the most important thing. You know, using some very powerful tools doesn’t give you the license to turn off your brain and I’m happy to come back on the show and talk about the different career letters and progressions because again, it’s going to take us a longer –

    Shimel: That’s a whole other show.

    Bach: There’s a lot to –

    Shimel: _____ and vocal about that.

    Bach: say about that. But I just want to note that this whole issue has been studied in great depth in another field, in the field of the sociology of science. For instance, in physics, theorists are in the higher caste and experimentalists are in the lower caste. So if you’re an engineer, you’re in the lower caste and they’ve studied this. How do these people cooperate? How do they assign prestige to each other? It’s a well-known phenomenon in many fields of human endeavor.

    Melnik: And the same in math, right, the theoretical math versus applied math, the theoretical math seems to always think that they’re the gods and they’re the ones that are, you know, creating something that, you know, will take centuries for the world to truly appreciate and then you guys are in the applied math solving the problems of today.

    Shimel: Exactly. Guys, we’re out of time, but I’m going to hold this – I’m going to hold you both to it. We’re going to come back on – not in the next show because I think we have something scheduled, but in one of the ones coming up, we’ll have you both back on, or maybe this’ll serve as part of our first roundtable in about a month from now when we’ll open it up to the audience as well. But for now, Grigori, James, thank you. Yes

    Melnik: Thanks, Alan.

    Shimel: James, thank you.

    Gentlemen, it was a pleasure. This is Alan Shimel. You just watched the very first DevOps Unbound. We’ll be back in two weeks with a fresh panel, fresh topics, stay tuned. Thanks again to Tricentis for sponsoring and thank you for watching. Bye-bye.

  • SaltStack Updates Enterprise IT Automation Framework

    SaltStack Updates Enterprise IT Automation Framework

    SaltStack has partnered with Tenable.io to make it possible to pull vulnerability data into the enterprise edition of its namesake IT automation framework.

    In addition, version 6.2 of SaltStack Enterprise now integrates with the IT operations analytics platform from Splunk to make it possible to configure the Splunk Universal Forwarder to index and analyze events generated by the SaltStack framework.

    The SaltStack Comply compliance management module has also been updated to include content for Windows Server 2012 and Windows Server 2019 platforms that has been certified by the Center for Internet Security (CIS).

    Finally, SaltStack Enterprise 6.2 optimizes communications between the Salt Master and the SaltStack Enterprise Operations Framework by adding an intermediate SQLite database layer to queue events. SaltStack says IT organizations should see 20 times-plus improvement in event processing throughput. SaltStack has also added the ability to forward SaltStack events to any Salt Returner, such as a SQL database or local file, to improve performance and maintain high availability.

    Mehul Revankar, a senior product manager for SaltStack, said with this update to the enterprise edition of its open source framework the company is leveraging partnerships to enable IT systems to create closed-looped systems. For example, vulnerabilities identified by Tenable.io now can be automatically remediated using SaltStack Enterprise.

    Revankar said the goal is to make it easier for IT teams to create an IT process that can be automated at the push of a button. As IT environments become larger and more challenging to manage, IT organizations will need to automate more processes at scale, he said. To achieve that goal, SaltStack is simplifying the process to connect to a wider range of third-party platforms that house the type of data required to automate a closed-loop process.

    Naturally, organizations that have embraced DevOps principles are at the forefront of IT automation. Revankar said that as teams of IT professionals converge to drive DevOps and DevSecOps processes, the greater the willingness to employ IT automation frameworks becomes. The goal is to automate as many processes to inject a level of agility that serves to accelerate the rate at which applications are deployed and updated. The challenge organizations have always faced in IT automation is the time it takes to integrate an IT automation framework with relevant data sources.

    Revankar also noted resistance to IT automation among rank-and-file members of the IT operations team is declining as the number of applications that need to be managed increases. Most organizations can’t find or afford to retain enough IT personnel to manage IT operations at the level of scale now required. As such, the need to automate as many rote IT processes as possible has become apparent to all. That’s especially critical in the case of vulnerability management, where the amount of time it takes to patch an application directly correlates to a specific level of risk.

    There is, of course, no shortage of options these days when it comes to IT automation frameworks. In fact, the decision concerning which IT automation framework to employ now has as much to do with the number of sources that framework can pull relevant data from as much as it does the reliability of the automated processes that framework enables.

    — Mike Vizard

  • Automation Hacks for DevOps Teams

    Automation Hacks for DevOps Teams

    DevOps teams are expected to do more work in less time. They need to plan, test, build, secure and release applications at a fast-paced rate. Of course, the DevOps team needs to achieve all of this while maintaining high software quality. This is why automation is a crucial part of the DevOps workflow. The goal is to delegate repetitive tasks to the machine, and free up dev time for more complex jobs. 

    Below are some helpful automation hacks you can apply to boost the effectiveness of your DevOps practices.

    Automating Regulatory Compliance

    Properly managing regulatory compliance is vital for many organizations to avoid fines and operate legally. Although compliance standards vary by industry, most focus on ensuring privacy and confidentiality. To meet these standards, companies must secure data and prove they are taking the appropriate measures. This proof is commonly accomplished with the maintenance of a clear digital trail.

    You can use DevOps automation to log and store digital access trails for your protected data. You can also use automated testing and deployment to ensure that only code that passes compliance tests is deployed. This prevents compliance issues from being pushed to production and helps keep your data secure.

    Automating Development Environments

    DevOps workflows require frequent creation and elimination of environments, for testing, deployment and development. These environments can be created manually but it is more efficient to create environments automatically. This can be done using a golden image with your required configurations.

    Using standardized base images ensures that you are working with consistent environments and standardizes configurations and privileges. These images can be used for local or remote machines and can be initialized automatically.

    There are a variety of tools you can use to create and automate environment creation. Chef and Vagrant are two of the most popular. Both of these tools offer an accessible API and enable you to script automation using common languages and syntax.

    Automating Code Review

    Code review is an essential part of DevOps processes but it is also one of the lengthier and more tedious processes. Automation can help you perform this process more efficiently. Automatic code review works similarly to manual review except it is done using tools that integrate with development environments. These tools can check for styling, security, duplication, complexity and code coverage, and can auto-suggest corrections. Some popular tools for this automation include Codebeat, Code climate and Codacy.

    Automating File Synchronization and File Uploads

    Many DevOps and development teams use the public cloud for quickly spinning up development and test environments. However, what happens when the production environment, or other critical resources used in the dev/test process, are deployed on-premises? Having a fast, automated and reliable way to synchronize files between the on-premise data center and the cloud can save time and headaches.

    There are a few approaches to synchronize files:

    • Scripting file uploads and downloads. The most basic method is to use shell scripts and FTP or SFTP to upload and download files between local and cloud environments. However, this can be fragile, unreliable and difficult to scale.
    • Using APIs of cloud storage services. You can move data to and from the cloud using cloud storage APIs, such as the Amazon S3 API, the Box API or specialized hosting services such as Cloudinary.
    • Hybrid cloud. The ultimate solution is to create a hybrid cloud architecture where applications, developers and users view the local environment and the public cloud as one unit, and data is synchronized transparently in the background.

    Collaboration Tools for DevOps Teams

    There are a number of collaborative tools that teams can use to further boost gains from automation. These tools can help bridge gaps in automation and processes and ensure smooth workflows.

    Slack: a chat tool that DevOps teams can integrate with automation tooling. It includes features for segregating discussions by topic, team or purpose; uploading shared files and documents; and initiating or receiving alerts from automated processes via integrations.

    Jira: a tool that enables you to create and assign tasks. It includes features for scrum and kanban methodologies, unified reporting and backlog tracking. You can integrate it with many common DevOps tools, such as Jenkins.

    Trello: a cloud-based Kanban board tool. It enables you to create project boards that can be shared across teams to track project progress. Through integrations, you can automate the updating of cards or initiate processes when cards are manually moved.

    Asana: another cloud-based Kanban tool. Like Trello, it enables you to track and collaborate on projects across a team. Typically, when teams use tools such as Asana, they create multiple boards for different project aspects. These boards can then be viewed individually or from a central dashboard.

    Conclusion

    Hopefully, this article helped you figure out how to leverage automation for improved efficiency. There are many automation options for DevOps, including automated regulatory compliance, automated infrastructure, automated code review and automated file synchronization.

    For DevOps project management, you can use collaboration tools such as Slack, Jira, Trello and Asana. Remember to make sure that any tool you introduce can be simply and easily integrated into your current environment. The tools of your choice also need to fit the skillset of all collaborators. For ease of use, keep your tooling ecosystem simple and minimalistic.

    — Gilad David Maayan

  • Never Ignore the E-Factor

    Never Ignore the E-Factor

    When cloud burst upon the scene, we were treated to wild-eyed prognosticators telling us about the death of the traditional data center. This is a trend in IT that you would think we’d learn from, but we repeat every couple of years. 4GLs, no, XML, no…Were all going to end development, and yet here we are, with more lines of code and more programming languages in use. It just keeps happening.

    These all share two common failings. First, technology in use today may not be perfect, but it is getting the job done, so dumping it for the new silver bullet is an unlikely result either in the long or the short term. For example, we’re many iterations beyond the conception of the C programming language, and yet for some purposes it is still going strong–because it does the job.

    But that’s a little tangential to today’s discussion. Today, the other failing is where I’d like to focus. The E-Factor.

    Enterprises are a lot of things, but one of the things the successful ones are not is careless. Cloud use in the enterprise was always going to be both multi-cloud and hybrid. Why? Multi-cloud because sole supplier arrangements are riddled with possible issues, and hybrid because every enterprise has something they want to maintain sole control of or something that simply can’t be moved but they want to push toward newer environments.

    We were always going to have multiple choices, and successful enterprises were always going to use multiple of them. Containers facilitate this truth a lot. The ability to run containers pretty much anywhere makes them portable, as long as staff is familiar with the infrastructure of a given environment so they can support the container management system in that environment. But even without containers, a cloud portability solution was inevitable.

    There is a massive amount of automation going into IT right now, all for the good. Freeing up traditionally scarce IT hours to focus on more and better services is all to the positive. Inevitably, one or more of these automation tools will be hailed as “The End of X.” Ignore them, and keep rocking at your job. AIOps seems most likely to gather this type of following right now. It will offer a flood of new data and consolidated views of that data, but not much else in the near term. Even when decisions start to be automated, full-on automation based upon AIOps feedback still needs code to run against and infrastructure to run on, so no doom and gloom there.

    Apply the E-Factor to anything hailed as a silver bullet. If you’ve worked in the enterprise, you know there are so many variables in the datacenter that any silver bullet would have to be a splintering round, each splinter behaving in a completely different manner to address current IT needs. More options are always good, and I, for one, go after new tech because I’m non-stop curious. But it is indeed just more options for your IT needs. Use the ones that will help, ditch the ones that make things worse and ignore the cheering “This time we mean it!” crowd.

    — Don Macvittie

  • Enterprise Service Management with Jira Service Desk and Confluence

    Enterprise Service Management with Jira Service Desk and Confluence

    Companies are looking to reduce cost, create efficiency and improve productivity of all internal and external customer services. In many organizations, different departments are using individual tools to provide their customers with the services they need. They can work in silos, can provide inadequate quality of service and not to mention that the portfolio of different tools can be quite costly.

    Enterprise Services Management (ESM) is a popular approach to implementing services within the organization. Departments such as human resources (HR), operations and marketing are seeing the value of Information Technology Service Management (ITSM) processes, and companies are looking to repeat that same value across the business. ESM allows all departments in the organization the opportunity to standardize tools and processes across all of their services departments. This standardization of tools and processes can create transparency, can improve the customer experience and in the end can reduce overall cost.

    There are quite few tools that can be used to support the implementation of ESM. Two components of an effective ESM implementation include a shared service desk and a knowledge base. 

    The shared service desk encourages the standardization of tools, and even paves the way for the alignment of processes. Departments should find tools that can be scaled up from just ITSM to support requirements across different service departments. There are quite a few applications available to companies for a shared service desk.

    In order to promote adoption, organizations must consider the ease of usability for both customers and customer service providers. Atlassian has two applications, Jira Service Desk (JSD) and Confluence, that together provide companies their shared service desk and knowledge base components of their ESM solution.

    JSD can be used as the foundation of an organization’s ESM implementation. Having JSD as the standardized service desk provides customers with a single customizable portal for all requests across the business. Unlike Jira Software and Jira Core, JSD licensed users are called agents. Companies only pay for agent licenses and do not pay for their customers.

    Below are just some of the features that are available with JSD:

    • A portal that can organize request types for customers. This provides them one place to submit all of their requests across the business.
    • Customizable workflows that include features such as custom statuses, conditions and post-functions.
    • Queues that provide the ability for agents to monitor and manage requests.
    • Service Level Agreements (SLAs) that help set time frames for agents to complete a certain step such as responding to the customer and even resolving the request.
    • The ability to automate certain workflow steps.
    • A plethora of built-in reports, to include one that shows overall customer feedback satisfaction.

    The next component is a knowledge-base. Why is a knowledge base valuable to both customers and agents? Confluence is a wiki that helps teams organize and share information. A well configured knowledge base can empower the customer to answer the questions they have without submitting a request. This can reduce the time agents spend on common requests. 

    Confluence has the ability to create a knowledge base, and seamlessly integrate it with JSD. Confluence is organized by pages, which are structured in a series of parent-child relationships—in the end form it’s called a page tree. To add/edit articles in the knowledge base, the person will require a Confluence user license. However, any customer can read the articles in a knowledge base without a license.

    Below are just a few of the available features with a Confluence knowledge base:

    • Built-in templates for how-to and troubleshooting articles.
    • Page labels that help serve as keywords for customers and service desk agents when searching for knowledge base articles.

    Below is a process flow for customers submitting a request in a typical ESM implementation using JSD and Confluence:

    1. User launches portal in web browser.
    2. In the portal, if a knowledge base is configured, the user can start typing keywords to search for articles that answer their question.
    3. If the user does not find the answer to their question in the knowledge base, they can navigate within the portal to the request type they wish to submit. The request types can be grouped by department.
    4. User completes the request form. Fields can be custom or out of the box. They can also be required or optional.
    5. Form is submitted and it creates an issue in JSD. 
    6. The issue is added to one or more agent queues. Agents can also receive notifications in email, and third party applications such as Slack, Opsgenie or PagerDuty.
    7. Agent communicates with the customer via comments in the Jira issue, and the customer communicates with agents via the customer request interface.
    8. Agent works on request in until its resolution.

    In summary, ESM is continuing to improve value in organizations for many reasons. One part of a successful implementation of ESM is which tools are selected for customers and customer service providers.

    — Evan Golden

  • Is Agile Methodology Right for Your Project?

    Is Agile Methodology Right for Your Project?

    I’ve read a few articles of late that have declared the end of Agile development. They are interesting reads for the most part, and they make some interesting arguments, but I see none of them as compelling. I do, however hope that this is the beginning of applying “Right Tool for the Job” to how projects are handled in development/DevOps.

    Agile officially kicked off in 2001, but comes from 90s concepts such as Extreme Programming. That makes it old. But, age isn’t in and of itself a problem. Adaptability beats age every time, and there have been movements that update parts of Agile to keep up with the times/changing environment. My issue is that “We’re an Agile shop” becomes a mantra that implies “Everything is an Agile project” which is absolutely untrue. You can do any development you can consider in Agile. You can also ride your bike from Main to California. Doesn’t make either one the best option.

    As with any methodology, we’ve also had a couple decades for a burgeoning oversight function that interferes with the goals of Agile. The point was to rapidly iterate to get features out the door, low-hanging fruit first. But the weakness of any high-speed development effort is quality, and as fingers have gotten burned from too much change causing problems, oversight has been built in to temper the volume of change. That oversight inevitably becomes rigid and slowing.

    As others have repeatedly pointed out, Agile works best for small teams with shared focus and geographic proximity. That hasn’t changed much. The opposite problem—a project with large, geographically dispersed teams having divergent foci—are a terrible use case for Agile, no matter the flavor of Agile you are implementing. Incremental development is also not the best answer to all problems.

    Indeed, contrary to popular belief, large initial implementations do best if using traditional development methodologies with an Agile approach to feature inclusion. That is because what undermines large projects is growing the size of the project by throwing every requirement and the kitchen sink into Minimum Viable Product, or whatever you call the actual must-have features for your application. Using Agile mindset as a filtering tool, and development methodologies that get a base level of functionality up and running (rather than incrementally implemented) allows more time for testing complete features and limits the number of features dumped into the must-have bucket.

    I’m happy to see this conversation starting to happen more seriously. Agile is a powerful tool that is the silver bullet for some development efforts. But it is only a tool, not a lifestyle. Using the Agile tool does not preclude choosing other methodologies (even waterfall, though it is currently passe’ to suggest its use) when the project is best suited to it. Most large organizations do some amount of this already, but it should be standard practice to choose methodology based upon project and suitability to task. Hopefully this is the first step toward doing so.

    — Don Macvittie

  • Positioning Compliance as a Differentiator

    Positioning Compliance as a Differentiator

    As the threat landscape has become more perilous and complex, regulators have imposed a wide array of mandates designed to protect sensitive personal information. For most organizations, compliance is seen as the cost of doing business. However, if executed strategically it can not only improve a company’s overall security posture but shortens sales cycles and open the business to new markets.

    In order to turn compliance from a check-the-box line item into a valued business initiative, businesses need to identify all global, local and industry regulations that apply to their business and, also, strategically implement the processes and technologies that keep them compliant. Whether you’re targeting specific industry verticals or going after international customers, entering new markets requires continuous education about the latest in compliance and regulatory standards as they relate to data privacy and security.

    A good way to get started is to put together a roadmap for how you will get, and stay, compliant with the regulations relevant to your business. What follows is an outline of such roadmap.

    Start with the Basics

    When you’re building a house, a foundation is the key to a safe structure. This holds true for building a compliance roadmap for an IT infrastructure.

    The first step is to ensure the infrastructure is configured in accordance with Center for Internet Security (CIS) benchmarks. If operating in Amazon Web Services (AWS), ensure all AWS best practices are met. Setting this foundation will help meet basic security and compliance requirements and will simplify the compliance journey from the very start.

    Once the foundation has been set, it’s then time for the compliance, IT and security teams to determine which regulations apply to their business. This is the backbone of the compliance roadmap. The good news is that many of these regulations overlap so businesses can complete requirements for multiple regulations at the same time.

    First Stop: SOC 2

    As a component of the American Institute of CPAs Service Organization Control reporting platform, SOC 2’s goal is to ensure that internal IT systems are configured for maximum security, emphasizing the privacy of customer data. It’s specifically designed for service providers storing customer data in the cloud, and this means it’s becoming increasingly relevant as companies continue their cloud migrations. SOC 2 goes beyond a simple technical audit though, requiring businesses to establish and follow stringent security policies and procedures that encompass the security, availability, processing integrity and confidentiality of any data stored in the cloud.

    In order to achieve SOC 2 compliance, the organization first will need to establish an understanding of what normal looks like in their environment. It’s critical to baseline typical activity in order to be able to monitor for anomalies. This enables detailed audit trails that allow for deep, contextual insight into root cause, allowing organizations to remediate issues and thus keep up with SOC 2 requirements.

    The Roadmap Focal Point: GDPR

    The General Data Protection Regulation (GDPR) brought compliance into the mainstream. When GDPR passed, it established strict regulations for how organizations with European customers must handle customer data. The regulation is so broad, stringent and complicated that it has motivated many tech companies to create new job titles to ensure compliance.

    However, while there have been strict compliance regulations before, it’s the high financial stakes attached to GDPR that set it apart. A business can be fined up to 4% of its global revenue if it’s found to be non-compliant. Very few organizations can afford to take that kind of hit which is why so many make it the centerpiece to their compliance strategy.

    The privacy implications of GDPR are extensive but one of the most important and challenging requirements is the data breach notification. Organizations must notify authorities or specific data subjects within 72 hours of a breach. Most organizations are unable to locate sensitive consumer information within their environment, making this requirement near impossible. However, if the organization bakes data controls into its systems and enacts continuous monitoring and real-time intrusion detection, it not only becomes achievable but improves internal processes. 

    Go Broad with Certification Add-Ons

    Once you’ve done the basics, like SOC 2 and GDPR, organizations can then begin looking for compliance regulations that they can actually use as business differentiators. ISO/IEC 27001, for example, is a standard that SaaS organizations often use to demonstrate an aptitude for managing information security risks. The regulation formally specifies an Information Security Management System, a suite of activities concerning the management of information risks and lays out an overarching management framework to identify, analyze and address risks. Certification requires a host of documentation, including a clear information security policy, a risk assessment process and evidence of information security monitoring and measurement. The standard spans industry type, organization size and market, so it applies to just about any company.

    Compliance can be a powerful differentiator and business driver that inspires trust and confidence amongst prospects, customers and external partners. Although the above standards and regulations require extensive resources, non-compliance can result in fines and other punishment that can cripple a company. It’s important to remember that these compliance standards and regulations may have to be revisited, but once put into place and assigned to a dedicated compliance team, the once daunting task pays for itself.

    — Lindsey Hardy

  • Tight Demand Sets Some Tech Salaries Soaring

    Tight Demand Sets Some Tech Salaries Soaring

    Technology industry workers are enjoying historic low unemployment rates, and those workers with the right skills are commanding high salaries. According to the Dice 2020 Tech Salary Report, the annual average pay in the technology industry reached $94,000 in 2019, up 1.3% from 2018. And those workers in the right specialties, and in the right regions, have enjoyed significant increases in salary.

    However, as is often the case, the averages don’t accurately tell the story.

    For instance, in the St. Louis region, technology wages rose 13.6%. While in Columbus Ohio they rose 14.2% and Kansas City 8.1%. While other regions didn’t fare so well, and some actually witnessed their wages drop. For instance, in the Philadelphia region, they dropped 4.5% and in the Tampa metro a surprising 8.3%.

    As for the technologies with the most rapidly rising salaries, Dice found those to be Chef at a $132,136 average salary and growing at 19.50% a year. Also, the Spring Framework reach $127,286 and grew at 16%, while Jetty reached $128,751 and grew at 14.40%.

    A number of regions showed a really big salary increase while the number of job postings declined. Consider the St. Louis area, which enjoyed that 13.6% bump despite the number of job postings falling by 6%. Why the big spike? According to Dice, large enterprises such as Boeing, IBM, Wells Fargo and Enterprise Rent-A-Car all seek talent in large numbers.

    Then there’s the Dallas-Fort Worth metropolitan region, which saw salaries reaching roughly $95,000 in 2019, with technology jobs in the area increasing by 5%. Dice cited large employers such as Lockheed Martin, Southwest Airlines and American Airlines as driving demand.

    When it comes to specific positions, it’s not likely a surprise to anyone that security ranked high. According to Dice’s report, employers want security engineers who are adept at vulnerability analysis, threat modeling and can help prevent data loss.

    “As a result, salaries (on average) have risen from $110,716 in 2018 to $121,228 in 2019 (representing 9.5% year over year growth),” Dice wrote. Employers who seek security engineers should expect the search to take an average of 40 days.

    Dice found that engineers in high demand hold CompTIA Security+, Certified Information Systems Security Professional and GIAC Certified Incident Handler certifications.

    Another growing job is that of data scientist. Enterprises are collecting enormous amounts of data and it takes data scientists to make sense of it all. And those with the right set of data science skills and experience are getting paid. From 2018 through 2019, data scientist average salaries grew from $95,404 to $106,298–an 11% bump. The number of data science job postings grew 7% and the average time to fill them is 46 days.

    Because so many technology workers express being happy with their current job, Dice concluded that organizations are going to have to get creative with their total compensation packages, which could mean more remote working, increased training, a focus on healthy culture and work/life balance efforts.

    “With all that in mind, 2020 is the year for businesses to meet their recruiting goals by understanding and acting on the salaries and benefits that technologists value,” said Dice in a statement.

    What benefits are employees looking for? The Dice report found employees are interested in college tuition reimbursement (48%), wellness programs (45%), maternity/paternity leave (45%) and paid volunteer opportunities (35%).

    “In addition to more nuanced benefits, remote work remains a desire for more than half of technologists as 61% of survey respondents said that they wanted to work remotely at least half the time, but only 24% of them have the opportunity to do so,” the report said.

    Finally, the Dice report found that work-life balance was the top-rated motivator employers provided to technologists (40%) in 2019. Work-life balance beat job recognition (33%), health and retirement benefits (31%), as well as higher compensation or promotion (26%).

    “We’re excited to share that this year’s report brought to light a new tool for balancing the demands of technology work,” said Michelle Marian, chief marketing officer at DHI Group, Inc., Dice’s parent company. “With over a quarter of technologists seeking opportunities to be more creative in their jobs, employers can meet this need by offering special projects and empowering technologists to approach projects in distinct and creative ways, allowing room for continued innovation and in turn, increased satisfaction for technologists.”

    Dice.com administered the survey online between October 14, 2019, and December 17, 2019, with 12,837 employed U.S.-based technology professional respondents.

    — George V. Hulme

  • Multi-Cloud Adoption to Better Enable the Developer Workforce

    Multi-Cloud Adoption to Better Enable the Developer Workforce

    Over the past decade, we started to see a broader shift toward the use of multiple cloud providers by the enterprise. The need to reduce risk, optimize cloud usage, manage costs and the push to open source and cloud vendor-agnostic technologies are providing more options for developers, which will likely lead to an even steeper increase in multi-cloud usage.

    In 2019, we saw the acquisition of Red Hat by IBM, the largest software company acquisition in IT history, to support both cloud and open source software. This acquisition, and others such as Salesforce/Tableau and Google/Looker, suggest that the trend will continue moving forward. In addition to support from mergers and acquisitions, multi-cloud within companies and use by developers will continue to rise.

    Multi-Cloud to Better Enable the Developer Workforce to Keep Up with Competition

    Multi-cloud architecture allows companies to distribute, move and optimize workloads across multiple cloud environments, decreasing the risks and costs associated with running workloads on only a single cloud environment and allowing one to select the best mix of capabilities for the desired use cases. These benefits make the single cloud option far less popular, and results in more interest in multi-cloud deployments.

    This choice is important–to keep up with the competition, digital businesses across the globe need to make better decisions and deliver faster, smarter actions. They must capture and integrate data in real time from wherever it is located, govern these data assets and augment the intelligence of their business through deep analytical insights. These actions must support both the technical and business levels of the enterprise, and developers must be armed with the right tools to enable these capabilities. A multi-cloud strategy ensures that this is possible, and offers the greatest degree of flexibility and choice when it comes to building solutions.

    To further support this shift, it is important to provide developers with the flexibility to choose best-of-breed solutions in order to streamline their processes. Limiting developers to one cloud vendor can restrict them from using the best tool for the job and result in suboptimal cloud deployments. But with a multi-cloud approach, developers can create their own individualized arsenal. Executives, who expect the best from their developers, have to pursue a multi-cloud strategy in order to get the most reliable and fastest results for their business. 

    Industry Insights for Mature DevOps Teams 

    Last year, IBM released research that showed that 85% of the companies surveyed were already multi-cloud adopters. Approximately 39% of those companies have implemented DevOps processes, and 41% have a multi-cloud management strategy. Clearly, multi-cloud is important to the strategy of an organization. 

    As pointed out, in order to be successful with a multi-cloud strategy, one of the key issues for developers to tackle is the creation of strong, automated DevOps processes. These processes must bring structure to a multi-cloud computing ecosystem. According to 2019 research from GitLab, overall DevOps adoption is on the rise, and teams that have successfully implemented a mature DevOps program are seeing major improvements in their workflow. In addition to speed, mature DevOps teams are almost 1.5 times more likely to feel innovative and are three times more likely to discover security vulnerabilities earlier in the pipeline.

    Future of Multi-Cloud Adoption and Impact

    Moving forward, we will see more companies adopt multi-cloud strategies and developers will be among the groups that are most impacted by this approach. For developers, multi-cloud adoption involves matching the business case for certain problem sets to the appropriate cloud providers so the expected ROI can be achieved with the right technology blend. 

    Developers need the right tools to develop, test, support, manage and monitor the deployed solutions consistently across cloud providers. Over time, it may also be necessary to move the solutions from one vendor to another as the requirements, business landscape and cost justifications change. Thus, developers must work within the organization to evaluate and choose the relevant features from each vendor, augment as necessary with external tools and regularly monitor industry trends and capabilities to transition if needed. This is the flexibility that a multi-cloud approach brings, but it must be balanced with the strategy, business and financial needs of the organization.

    The cloud will continue to be a strong technology focus area for enterprises and developers across the globe. Cloud adoption strategies will continue to broaden and shift toward multi-cloud as needed, allowing developers to streamline their processes, select the best tool for the job and create more value for their company as a whole.

    — Nelson Petracek