devopsy.kinsta.cloud

Category: Features

  • Survey: More Cybersecurity Pros Embedded in DevOps Teams

    Survey: More Cybersecurity Pros Embedded in DevOps Teams

    A survey of 2,500 C-level executives published today by Palo Alto Networks found 81% of organizations have embedded cybersecurity professionals within their DevOps teams.

    Despite the presence of those cybersecurity professionals, however, the survey also suggested there is much work to do in terms of optimizing DevSecOps workflows. A full 90% of organizations cannot detect, contain and resolve cybersecurity threats within an hour, the survey found.

    Bob West, chief security officer for Palo Alto Networks, said most of the challenges associated with DevSecOps are directly related to persistent cloud security issues. More than three-quarters of organizations (78%) said they had distributed responsibility for cloud security, but almost half (47%) said a majority of their workforce still does not understand their security responsibilities.

    In many cases, developers with little to no cybersecurity expertise are responsible for provisioning cloud infrastructure. As a result, misconfigurations that create security issues are commonplace, noted West. That’s especially problematic because three-quarters of organizations (75%) are deploying new or updated code to production weekly, with almost 40% committing new code daily, the survey found. Given that developers far outnumber cybersecurity professionals in most organizations, it remains challenging to ensure application code is secure, noted West.

    In addition to improving the overall state of cloud security, organizations need to focus on fundamentals such as training developers to be more mindful of cybersecurity issues, he added. Most developers never had any formal cybersecurity training, so it’s up to organizations to make sure that particular skills gap is closed, he noted. In addition, organizations need to make sure they have a robust set of patch management processes in place alongside a capability to manage permissions and entitlements, added West.

    Overall, the survey found organizations are using more than 30 security tools, on average, including six to 10 dedicated to cloud security. More than three-quarters of respondents (76%) said relying on multiple security tools created blind spots that affected their ability to prioritize risk and prevent threats. A full 80% said they would benefit from a centralized security solution that sits across all of their cloud accounts and services.

    One way or another, a rising tide of regulations focused on improving the security of software supply chains will force organizations to improve cloud security, said West. The survey showed there is a strong commitment in terms of making cybersecurity professionals an integral part of a DevOps workflow. The issue is that there are still a raft of training and process issues that need to be addressed at a time when cybercriminals are becoming increasingly adept at compromising applications both as they are developed and after they are deployed.

    Of course, training and modifying processes take time. DevSecOps is as much about changing culture as it is about acquiring new tools. DevOps teams are still highly committed to building and deploying applications as quickly as possible. The challenge is finding a way to insert a set of cybersecurity gates within those workflows without slowing down the pace at which applications are developed.

  • AWS Delivers on Latest Graviton3 Price/Performance Promise

    AWS Delivers on Latest Graviton3 Price/Performance Promise

    Amazon Web Services (AWS) has expanded the number of virtual machines based on the latest generation of its Graviton processors to include instances that support DDR-5 memory.

    The latest Amazon EC2 instance types, dubbed M7g and R7g, that are now generally available are based on the AWS Graviton3 processors developed using an architecture created by Arm. Previously, these instances were only available as part of a technology preview program.

    Rahul Kulkarni, director of product management at AWS, said these latest offerings take advantage of DDR-5 memory to provide 25% better performance than the previous sixth generation of Graviton instances. DDR5 memory increases the amount of bandwidth available by 50%, he noted.

    Graviton processors now provide the lowest-priced instance of virtual machines in addition to the best performance and overall price/performance across the AWS portfolio, Kulkarni added.

    AWS is making a case for employing its AWS Graviton processors for general-purpose workloads as more IT teams are being tasked with reducing costs as the overall number of applications being deployed in the cloud continues to increase. In fact, all of the top Fortune 50 companies have already deployed workloads on Graviton processors, noted Kulkarni.

    While it’s not clear how many applications are being developed to run natively on Arm processors, the process of refactoring existing applications to run on Arm processors is not as intensive for most applications as it was when previously moving applications from one class of processors to another.

    In addition, Kulkarni noted AWS has committed to providing a full range of DevOps services, including a continuous integration/continuous delivery (CI/CD) platform, to help facilitate any transition to Graviton processors.

    There are, of course, multiple strategies for containing cloud costs that range from committing to consuming a specified amount of compute resources annually at discounted rates to relying more on spot instances that are available for limited amounts of time. Regardless of approach, the days when developers were allowed to invoke cloud resources at will appear to have come to an end as enterprise IT organizations become more aware of the total cost of IT. As a result, many of them are adopting financial operations (FinOps) best practices to maximize the utilization of cloud infrastructure resources.

    AWS, like most cloud service providers, gives organizations a wide range of processor options. However, it’s apparent that AWS views Arm processors in the form of Graviton to be the most efficient from both a price and performance perspective. It’s not clear how quickly organizations are embracing Graviton in the cloud given the dominance of x86-based platforms, but it’s apparent there is now a clear alternative for general-purpose workloads. If fact, the more data-intensive those workloads become, the greater the interest in more efficient processor architectures.

    Of course, x86 platforms are not going away anytime soon. But as more Arm-based processors find their way into the enterprise, DevOps workflows will only become more challenging to manage.

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers. Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it creates an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    Monster.com

    REPS & Co.
    Remote
    Senior Software Engineer
    $120,000

    Dice.com

    AIT Global
    Jersey City, New Jersey
    DevOps Engineer
    $120,000 to $130,000

    Indeed.com

    Southwest Airlines
    Dallas, Texas
    Cloud DevOps Engineer
    $118,600

    SimplyHired

    Portrait Displays
    Pleasanton, California
    DevOps Engineer
    $110,000 to $140,000

    LinkedIn

    Peraton
    Chantilly, Virginia
    DevOps Engineer
    $72,500 to $181,300

  • Report Identifies Top 10 Open Source Software Risks

    Report Identifies Top 10 Open Source Software Risks

    Endor Labs, a provider of a platform for managing open source software, published a report that classifies the top 10 open source software risks of 2023. The company published the list as part of an effort to better educate application development teams about issues that can lead to software supply chain compromises. That list includes:

    Known Vulnerabilities: A version of a software component may contain vulnerable code that is accidentally introduced by its developers. When vulnerability details are publicly disclosed, there may not be a patch readily available.

    Unmaintained Software: A software component may not be actively developed or maintained anymore, resulting in patches for functional and non-functional bugs not being provided in a timely manner—if they’re provided at all.

    Name Confusion Attacks: Attackers may create components whose name resembles the names of legitimate open source or system components. This is also known as typosquatting. Bad actors might also attempt to mimic trustworthy authors (brandjacking) or play with common naming patterns in different languages or ecosystems (combosquatting).

    Compromise of Legitimate Package: Attackers may compromise resources that are part of an existing, legitimate project or associated distribution infrastructure to inject malicious code into software components.

    Outdated Software: A project may use an old, outdated version of a software component even though a newer, more secure version exists.

    Untracked Dependencies: Developers may not be aware of a dependency on a component because it is part of another upstream module they employed.

    License Risks: A software component or project may not have a license at all, may have one that is incompatible with the component’s or project’s intended use or whose requirements are not or cannot be met.

    Immature Software: An open source project may not apply development best practices such as having a standard versioning scheme or lacking a regression test suite, review guidelines or documentation.

    Unapproved Changes: A software component may change without giving developers the chance to notice, review or approve such changes because the download link points to an unversioned resource, a versioned resource has been modified or tampered with or due to an insecure data transfer.

    Unknown Origin: Details about the source code, build process or the distribution process of a software component may be unknown or non-verifiable.

    Endor Labs CEO Varun Badhwar said organizations need more visibility in the potential operational risks that come with increased reliance on open source software. That doesn’t mean organizations should use less open source software, but there are issues that many development teams may not always appreciate. A recent analysis of nearly 2,000 software packages published by Endor Labs, for example, found 95% of all application vulnerabilities can be traced back to a transitive dependency created when a developer employed an open source component.

    Regardless of the root cause, responsibility for application security continues to be pushed left toward application developers. The challenge is it’s not possible to achieve that goal without first knowing what issues developers and the DevSecOps teams that support them need to be focused on. Perfect application security is, of course, unattainable, but any reduction in the number of vulnerabilities littering the software landscape will go a long way toward reducing the current level of stress developers and DevOps teams experience.

  • Checkly Adds Monitoring-as-Code to Testing Platform

    Checkly Adds Monitoring-as-Code to Testing Platform

    Checkly this week added a monitoring-as-code (MaC) workflow capability to its software-as-a-service (SaaS) platform that is used to create synthetic tests for applications.

    The Checkly platform spins up browsers to test and can now monitor how applications are performing at both the user interface and application programming interface (API) level. That capability, currently available in beta, is enabled via a command line interface (CLI) for accessing an instance of TypeScript to invoke MaC workflows.

    Checkly CEO Hannes Lenke said that integrated approach enables application development teams to observe applications in as little as 60 seconds without instrumenting them with agent software.

    As part of that effort, Checkly also made generally available Playwright Test, a testing platform for web applications that spins up modern browsers on demand in addition to updating its public dashboards and adding an analytics API.

    Finally, the Checkly SaaS platform has passed a SOC 2 Type II security audit.

    Lenke said the overall goal is to make it simpler for developers to discover and remediate issues as they assume more responsibility for the ongoing management of applications.

    It’s not clear whether developers are taking over responsibility for testing and monitoring applications, but as more responsibility for applications shifts left, organizations are looking to give developers the tools they will require to succeed. That doesn’t mean IT operations teams won’t need to continue to monitor IT environments, but developers do need integrated tools that give them enough meaningful context to address them as they write code. Synthetic testing tools also enable developers to address many routine issues long before they might be discovered by a dedicated testing team that should be focused on ensuring the overall quality of the user experience.

    Regardless of the approach to testing and monitoring, Lenke noted that the silos that make up the software development life cycle are becoming more tightly integrated in modern application development environments. The primary objective is to make it possible for organizations to accelerate application development without compromising quality, he added.

    Of course, the more testing that occurs early in the application development process, the fewer issues a DevOps team should encounter after an application has been deployed in a production environment. The issue is that, historically, much of that testing occurs late in the application development process. Each time a project falls behind schedule, there is naturally a greater temptation to reduce the amount of time spent on testing to ensure the on-time delivery of an application. Providing developers with tools for testing and monitoring applications as they are being built should ensure that the proper level of testing is occurring before an application is deployed.

    There will, however, never be a perfect application. Over time, DevOps teams will discover that every application is impacted by drift to varying degrees as updates are made and the underlying infrastructure is upgraded. The most critical issue is reducing the number of potential issues overworked DevOps teams may need to address later on by ensuring the code being deployed is of the highest quality possible.

  • Sysdig Launches Wireshark Foundation

    Sysdig Launches Wireshark Foundation

    Sysdig this week announced there is now a Wireshark Foundation that will oversee future development of the widely used open source traffic protocol analyzer.

    Gerald Combs, who is now director of open source projects at Sysdig, along with Loris Degioanni, CTO of Sysdig, launched Wireshark in 2006 to enable teams to monitor network traffic, learn protocols and packet basics and troubleshoot network problems. There are more than 2,000 contributors and Wireshark has been downloaded more than 60 million times in the last five years alone.

    The Wireshark Foundation will provide a framework for long-term stewardship and sustainability. The foundation will be led by Sheri Najafi as executive director, and Janice Spampinato, Hansang Bae, Najafi, Combs and Degioanni will serve on the board.
    Combs said rather than donating Wireshark to an existing foundation, it was decided to set one up to formalize many of the community processes that have evolved over the past two decades.

    Degioanni said the foundation will also ensure Wireshark remains relevant long after its creators eventually retire. Wireshark has a graphical user interface (GUI) that provides IT teams with an easy-to-understand traffic protocol analyzer. However, as applications become more distributed, additional types of IT professionals, including DevOps teams, are analyzing network traffic. Similarly, cybersecurity teams are using these tools to help track down the source of anomalous activity.

    It’s not clear whether network operations (NetOps) and DevOps workflows are merging, but the level of collaboration has increased. As networking increasingly becomes software-defined, it’s clear that developers will employ application programming interfaces (APIs) to manage networks as code in much the same way they do infrastructure in the public cloud. Most of those networking APIs are comparatively low-level, but with the rise of services meshes, it’s clear networking services are becoming more accessible.

    The biggest challenge is distinct cultures that have arisen around networking and application development. IT organizations will need to decide whether to provide development teams with the ability to programmatically invoke networking services on their own or through a self-service portal managed by a NetOps team. Regardless of who is responsible for managing the network going forward, the divide between DevOps and NetOps is already starting to narrow. The biggest challenge is simply finding a common language to express core concepts that eliminates any sense of fiefdom that might exist between them. After all, any conflict that arises can usually be attributed to a simple failure to communicate.

    In the meantime, in the age of edge computing, network latency issues are becoming even more challenging. An application based on microservices architecture is especially sensitive to network latency issues that are difficult to troubleshoot over an extended network. Tools that make those issues more obvious are crucial.

  • LinkedIn Job Scams: Out of Hand ¦ 4-Day Workweek: Let’s Get Serious

    LinkedIn Job Scams: Out of Hand ¦ 4-Day Workweek: Let’s Get Serious

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Don’t get scammed looking for a job, and momentum grows for the 32-hour working week. (more…)

  • Despite Tech Layoffs, Developer Shortage Continues

    Despite Tech Layoffs, Developer Shortage Continues

    Well over one-third (37%) of respondents to a recent industry survey reported that recruiting developers with the needed skills would continue to be a challenge through 2023. More than 2,000 developers and IT professionals participated in the Infragistics survey from December 2022 to January 2023.

    The survey also found developers and IT professionals are just as concerned (37%) when it comes to their organization’s ability to keep employees safe. The survey also found respondents believed they are working with limited resources (36%).

    “Over the past three years, workers have been faced with a series of unexpected challenges—the COVID-19 pandemic, an economic downturn and a volatile work environment–which is pushing employers to do more to assure workers are protected. Employers that take steps to protect their employees will be more likely to retain them, especially in light of the developer shortage,” the report said.

    The three technical jobs survey respondents said were the most difficult to recruit are DevOps engineers (16%), data analytics developers (16%) and IT security engineers (13%).

    The report found that while nearly all developers (89%) worked with a designer or design team, less than half of a developer’s time (43%) is spent on actual application coding. In most cases, low-code/no-code tools are filling in gaps left by vacant roles and helping organizations keep up with the necessary pace of development. “The lack of skilled developers challenge is being solved by the use of low-code/no-code tools in [more than] three-quarters (77%) of organizations,” the report said.

    Looking ahead, the survey found that software developers planned to improve project management (30%), improve designer/developer collaboration (30%), use software that will work for citizen developers (27%), use remote staff (25%) and incorporate a data catalog/analytics catalog (25%).

    “The biggest software development challenges in 2023 will be the inability to keep pace with innovation in developer tools (28%), difficulty with third-party integration (267%), struggle to manage workload (26%), security threats (26%), project management (26%) and client expectations that are too high (26%),” the report said.

    Despite the rough patch that rattled the industry throughout the second half of 2022, the survey results indicated developers are optimistic for the rest of this year. According to the survey, the software development industry plans to:

    • Adopt new technologies/applications (38%)
    • Expand into new markets (35%)
    • Take on new projects (32%)
    • Increase revenue (31%)
    • Increase requests for proposals (31%)

    Finally, the survey found business intelligence and embedded analytics are increasing in usage. More than 80% of developers currently incorporated these tools into their products, up 3% from the previous year’s survey.

    Embedded analytics in apps is also on the rise. Almost half, or “48% of developers were embedding analytics into client apps in 2022, compared to 31% in 2021. And 75% of software developers expected their organization’s focus on business intelligence to increase in 2023,” the report stated.

    The top three reasons software developers incorporate embedded analytics: Improving customer satisfaction (32%), gaining a competitive advantage (30%) and making data-driven decisions (25%).

    According to the report, customers included embedded analytics in their requirements in the hope they would improve productivity (42%), increase sales/revenue (39%), understand business problems (33%) and make better business decisions (32%).

  • Vercel Adds Observability Tools to Web Application Framework

    Vercel Adds Observability Tools to Web Application Framework

    Vercel today announced it has added a suite of observability tools to its platform for building web applications using Next.js, an instance of the open source React framework based on a JavaScript library.

    Vercel CTO Malte Ubl said the Vercel Monitoring tools make it simpler for developers to troubleshoot applications without relying on a DevOps team to surface data. Instead, developers can take advantage of Vercel Monitoring tools to access metrics that track user interface and application programming interface (API) issues, he added.

    That capability is not intended to replace the need for observability tools employed by DevOps teams. Instead, the goal is to provide metrics that are specific to issues that developers encounter as an application is being built or after it has been deployed so they can be addressed.

    Developers can select from pre-made queries provided by Vercel or create their own by defining what metrics they want the Vercel Monitoring tools to track, including bandwidth and web traffic spikes and requests by bots that are indicative of a cyberattack. In total, there are more than 500 potential errors that developers can track. Logs then make it possible to drill down into errors and issues once they are identified to pinpoint the root cause of an issue.

    As more responsibility for applications shifts left toward developers, there’s a clear need for tools that provide more visibility into the applications they develop. Many of the issues that DevOps teams encounter today could have been resolved if developers had been aware of them earlier.

    The Vercel platform employs caching, routing and a React framework to optimize application performance in a way that reduces the dependency on backend infrastructure to optimize application performance. That approach puts less strain on backend infrastructure as more requests are automatically processed using a framework that spans clients and servers. In effect, developers can take advantage of frameworks such as React to treat the underlying IT infrastructure as if it were serverless whenever possible with tools that have a familiar JavaScript construct. The overall goal is to increase developer productivity at a time when many organizations are much more focused on the issue.

    As a result, DevOps teams will need to make some adjustments as more applications capable of providing richer experiences are built and deployed without relying as much on backend infrastructure. That shift has implications for everything from the amount of network bandwidth consumed to the performance of web applications. Frameworks such as Next.js also tend to increase the overall rate at which web applications can be built and deployed.

    One way or another, it’s clear that the way web applications are being built is fundamentally changing. The only issue now is determining to whether DevOps teams are prepared to absorb that level of change across an ever-increasing portfolio of applications that still need to be deployed, secured, updated and optimized.

  • The Economic Downturn and DevOps Hiring Trends

    The Economic Downturn and DevOps Hiring Trends

    An analysis of more than 494,000 interview requests for software engineers coupled with a survey of more than 1,300 software engineers and 120 hiring professionals found a lot more employers prefer to hire DevOps professionals who work in the office—but resistance to working in an office (rather than working remotely) remains high.

    The survey also found that, despite the preference for hiring local software engineers, more than half of hiring professionals (52%) are filling positions on fully remote teams while another 40% are focusing on hybrid teams.

    The interview requests analysis conducted by Hired, a provider of a platform for vetting potential employees, found that nearly three-quarters of interview requests (72%) were for software engineers with more than six years of experience. Backend engineers received 59% of all interview requests.

    Hired CEO Josh Brenner said the survey makes it clear that organizations are less inclined to hire less experienced talent. In fact, there’s a decided shift toward DevOps professionals that have degrees versus individuals that are largely self-taught, he added.

    Hiring those individuals, however, remains challenging. More of them are willing to consider other employment options given the current state of the economy, but more than two-thirds of engineers (68%) said they are not worried about losing their jobs in the next six months.

    However, enterprise IT organizations are now finding it easier to hire DevOps engineers because competition from startup companies and technology vendors such as Google and Microsoft slackened in the wake of a series of ongoing layoffs, noted Brenner.

    Competition for software engineers is also impacted by geographic region, with the Los Angeles area seeing the largest negative impact on local salaries, decreasing by 6% to $152,000. Philadelphia had the greatest amount of growth, with local salaries increasing by 7% to $150,000. Despite demand for remote engineering talent, growth in salaries for these positions has flattened. The San Francisco Bay Area had the highest salaries for remote roles at $180,000, followed by Seattle ($175,000) and New York ($169,000). The percentage of active engineering positions “open to remote” fell to 69%, the survey found.

    The highest-paying markets for in-office jobs, in contrast, were San Francisco ($180,000), Seattle ($169,000) and New York ($162,000).

    Software engineers, as always, are motivated to work for organizations based on new challenges and continuous learning (69%), building products/solutions and problem-solving (66%) followed by earning potential and career stability (60%), the survey found. When learning a new skill, the survey found the biggest motivator remained the simple joy of learning new things (40%) followed by the fact that their current job required it (25%).

    Regardless of the state of the economy, it’s clear that demand for DevOps expertise continues to outstrip available supply. However, software engineers may be unable to command as high a salary as they did a short while ago. Of course, no one can be sure what lies ahead, but economies do eventually rebound. In the meantime, DevOps professionals would be well-advised to continue to invest in their own skills to maximize their earning potential, no matter which direction the economic pendulum swings.