devopsy.kinsta.cloud

Category: Features

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers. Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    ZipRecruiter

    Daikin
    Chatsworth, California
    Senior Developer Operations Engineer
    $130,000 to $150,000

    LinkedIn

    SciTech
    Boulder, Colorado
    Information Technology Infrastructure Lead
    $123,000 to $165,000

    SimplyHired

    OBMedia
    Remote
    Senior DevOps Engineer
    $120,000 to $170,000

    Indeed.com

    Brighthouse Financial
    Remote
    Principal DevOps Engineer
    $119,000 to $150,000

    Dice.com

    Hexaware Technologies
    Atlanta, Georgia
    DevOps Track Senior Engineer
    $100,000 to $120,000

  • Survey Sheds Light On Cloud, API Expertise Skills Gap

    Survey Sheds Light On Cloud, API Expertise Skills Gap

    Enterprise IT faces a three-pronged onslaught: Digital transformation, open APIs and security threats. First, most organizations are still navigating ongoing digital transformations and cloud migrations. Second, development teams continue to increase their use of open APIs, leading to sprawl concerns. And third, we’ve witnessed a slew of cybersecurity threats that appear to be growing in sophistication. Tech leaders are attempting to govern this influx of new tools and risks, yet it can be challenging to innovate quickly while ensuring that sensitive data is always protected.

    The Axway 2022 Open Everything Survey shed light on some of the above challenges and attitudes of those invested in API development and API-enabled managed file transfer (MFT). Most notably, the survey found that 86% of respondents feared an expertise gap in the coming years, in which their organization won’t have the skilled software and IT infrastructure talent they needed to innovate. Below, we’ll review other findings from the survey, focusing on the responses from those who indicated they’re invested in API development.

    Cloud Migrations Are Still Underway

    Digital transformations are still underway in the vast majority of organizations. Only 12% reported being wholly digital and leading innovation. The rest were either just beginning transformations, were midway through or were still largely brick-and-mortar. More than one-third (38%) also said their company’s digital makeup is a hybrid of old and new technology.

    The most-adopted computing environment is the public AWS cloud, at 47%. Yet other options trailed close behind, including hybrid (37%), managed cloud services (32%), Azure (28%), private (25%) and Google Cloud Platform (18%). Other reports substantiated how modern IT is becoming increasingly hybrid and multi-cloud. As digital journeys continue to shift and evolve, some organizations are embracing multiple fit-for-purpose clouds.

    Although multi-cloud offers unparalleled flexibility, the primary drawback is security. Just over half (55%) of respondents said that tracking and controlling the flow of personal data into and through the cloud is a key hurdle to a multi-cloud strategy. And 53% reported that dealing with different security requirements for regional instances of cloud infrastructure was a top challenge. This concern is warranted, as companies doing business internationally must carefully navigate many specific regional data regulations.

    Open Data Strategies Abound

    As the Open Everything name indicates, many different sectors are becoming more “open.” The report highlighted the adoption habits of APIs within supply chains, where they are most often used to configure applications, operate and monitor applications and integrate internal data sources. Popular use cases here included payment and tracking systems. APIs also have a significant role to play in the financial world—41% of those working in finance said open banking is an opportunity to discover new business models. But nowhere is the need for more open data more crucial than in health care, which was found to be the area most in need of digital transformation.

    We’d like to think of the API revolution as being driven by API-first startups and SaaS services. While these trends get attention, it’s not the most common use case for APIs. In fact, 44% of the time APIs are used to support IT consulting and system integration requirements. This is followed by providing cloud applications for customers (35%), developing a partner network (35%) and offering cloud services for customers or partners (34%). Although there are certainly business use cases for generating revenue through APIs, they are most often adopted to supplement existing platforms or to glue together internal services and data.

    Most Technology Leaders Fear API Sprawl

    Security is an encompassing concern for all walks of IT, but is especially top-of-mind when opening up data. Respondents said security is the most important concern when creating APIs (30%). This concern is warranted, as attacks on APIs have increased exponentially in recent years. Other top concerns are API adoption or consumption (15%), customer experience (14%), ease of API management (14%) and design and development (11%).

    As APIs and microservices become more abundant within an organization, it’s easier for sprawl to set in. Unbridled technology sprawl can have a deteriorating effect on design standards and lead to unknown shadow APIs that may pose a security vulnerability. As a result, over two-thirds of respondents said the prospect of API sprawl worries them.

    To mitigate sprawl and address other concerns, most companies are investing in tools to help manage the growing number of APIs. The majority (83%) said their budget for API management has either increased or stayed the same over the last two years. For 18%, this budget has risen by over 25%. Operationalizing API life cycle management capabilities can have benefits such as standardizing design style and increasing the discoverability of internal services.

    API Security Must Still Mature

    In a perfect world, we could share data without fear of misuse. But in reality, APIs are a common target for hackers. Publicly exposed endpoints with broken access control or missing object-level authorization can be easily abused for things like privilege escalation and data exfiltration. And although these risks persist, many APIs don’t adopt industry best practices regarding API security.

    Although most APIs use authentication and token schemes, under half (43%) implemented OAuth. Furthermore, only 30% implemented policies with an API gateway. OAuth 2.0 and gateways have become best practices in serving APIs, as there are too many vulnerabilities to rely solely on HTTP Basic Authentication and API keys. As such, we will likely see these adoption rates increase as API security matures.

    As with other cybersecurity endeavors, it’s really about taking a holistic perspective and applying defense-in-depth. Thankfully, most technology professionals understand this point—developing a more holistic approach to security was ranked as the top strategy for protecting personal data. Other strategies, like data encryption, advanced multifactor authentication, data loss prevention tools and highly-secured data transactions will also be necessary to protect cloud-native assets.

    Final Thoughts

    The Axway 2022 Open Everything Survey asked 1,000 IT leaders, architects and developers about their top concerns. Above, we focused on results from technology leaders engrossed in cloud and API development. For more insights and the findings from those using managed file transfer (MFT), readers can pick up a copy behind an email gate here.

  • Southwest Airlines: ‘Shameful’ Technical Debt Bites Back

    Southwest Airlines: ‘Shameful’ Technical Debt Bites Back

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    20 Years of Neglect Led to ‘Meltdown’

    Last month’s débâcle of canceled flights was caused by decades of technical debt. That’s the analysis of Columbia University professor Zeynep Tufekci. (more…)

  • Intel Expands Scope of oneAPI Initiative

    Intel Expands Scope of oneAPI Initiative

    Intel has expanded its effort to drive adoption of a set of open compilers, libraries, analysis and porting tools and frameworks for artificial intelligence (AI) applications, collectively made available via a oneAPI initiative, to include support for its latest generation of processors.

    The oneAPI initiative was launched more than three years ago to create a set of multi-architecture tools for building applications that could be deployed on any CPUs, graphical processor units (GPUs) and field programmable gate arrays (FPGAs). Processors that now support oneAPI include forthcoming 4th Gen Intel Xeon Scalable processors, Intel Xeon CPU Max Series and Intel Data Center GPUs.

    James Reinders, chief evangelist of Intel Software Products, said there is now a clear need for open tools and frameworks that provide equal access to multiple classes of processors. As part of that effort, the latest 2023 version of oneAPI, for example, adds support for plug-ins for Nvidia and AMD GPUs developed by Codeplay, a unit of Intel, to simplify writing SYCL code in a way that makes code portable across additional processor architectures.

    There is also a CUDA-to-SYCL code migration capability that supports more than 100 CUDA application programming interfaces (APIs) using the Intel DPC++ Compatibility Tool based on an open source SYCLomatic project. Intel is also providing tools to identify imbalances at scale using Intel VTune Profiler, and an Intel Advisor tool now provides automated roofline analysis for Intel Data Center GPU Max Series to identify root causes of memory, cache or compute bottlenecks along with insights for optimizing data transfer costs involving CPU-to-GPU offloading.

    As IT continues to evolve, it will become more routine for developers to invoke heterogeneous classes of processors within the same application, but it’s been challenging to convince providers of other types of processors to support the oneAPI initiative, noted Reinders. Processor providers have historically relied on compilers and libraries to lock developers into specific classes of processors.

    However, it’s becoming more common for developers to build applications that invoke multiple types of processors. The Intel oneAPI initiative is intended to simplify access to heterogeneous processors, also known as XPUs. That’s critical, because the pace of processor innovation has accelerated to the point where developers need to be able to invoke additional capabilities without waiting for specific compilers and libraries to be updated by multiple providers. Once oneAPI is more widely adopted, it then becomes possible to significantly lower the cost of application development and deployment, noted Reinders.

    It’s not clear whether the oneAPI initiative will become more widely adopted, either under the auspices of Intel or by some type of industry consortium that provides a neutral venue for building a common set of compilers and libraries. The one thing that is certain is that DevOps teams are vested in trying to standardize compilers and libraries across as many platforms as possible. The challenge, of course, is making sure developers only invoke compilers and libraries that can span multiple classes of processors versus ones that may have been optimized for a specific type of processor architecture.

  • Why SREs Are Critical to DevOps

    Why SREs Are Critical to DevOps

    Although a relatively new concept, site reliability engineers (SREs) have become crucial for DevOps teams, helping to solve an array of operational problems such as network availability and user experience. However, in previous years, some people have questioned the longevity of such a role. 

    This article will discuss several reasons why site reliability engineering roles are here to stay and why they have become critical to DevOps. 

    What Are Site Reliability Engineers (SREs)?

    A site reliability engineer helps connect development teams and IT operations by completing tasks previously assigned to operational roles. SREs use a range of automation tools for troubleshooting purposes, creating software systems that are both scalable and reliable.

    The role revolves around automation and standardization, as cloud systems become increasingly prevalent. SREs also play a vital role in ensuring the user experience of systems is of the highest standard.

    Why Site Reliability Engineering Roles Are Here to Stay

    Let’s take a look at two of the primary reasons SRE roles are here to stay. 

    User Expectations

    The key reason for the rise in popularity and the expected longevity of site reliability engineering roles is user experience. In the modern climate, user expectations are very high and more dedicated roles are required to help deliver a service that is not only acceptable but attempts to exceed user expectations.

    Even back in the 2010s, users were much more patient in terms of website load speeds and how quickly they could access information. Even crashes and load failures were tolerated without the user exiting a website.

    However, that has all changed due to the competitiveness of the market, as well as the growth of remote working, which has increased dependency on online resources. This means that if a service is unavailable for any period, users are unable to do their job. 

    An SRE’s role includes optimizing systems, ensuring they perform at the required level and that resources are always available to those that need them. This makes SREs critical to DevOps teams that may not have the capacity to focus on meeting user expectations sufficiently. 

    The Complexity of Software Architectures

    Another factor that has added a lot of value to the role of an SRE is their ability to provide much-needed support for software environments and architectures that continue to develop in terms of complexity. Kubernetes is one such architecture that requires dedicated attention. 

    Applications that are distributed across systems such as Kubernetes and other cloud-native platforms require specialized personnel that have the necessary knowledge and experience. Machine learning is also becoming more prevalent and requires special focus from a performance perspective. In 2020, just more than 22% of companies had machine learning models in production for one to two years.

    This level of complexity is only expected to grow further over the coming years as cloud-native systems become the norm. This is why new roles must be created that go beyond that of a normal IT engineer. 

    Challenges for SRE Roles

    Like any IT role, the role of a site reliability engineer always faces challenges that have led people to question whether SREs are a long-term solution or whether it is a niche specialization. 

    A Lack Of Opportunity Away From Hyperscale Companies

    The role of an SRE was created by hyperscale companies like Google that manage extremely large IT systems. For companies that do not have such a wide and varied IT infrastructure on a global scale, there are questions about whether such a role is necessary. 

    However, as previously mentioned, the growth of cloud-native technology shows no sign of slowing and, with this growth, opportunities for SREs at smaller organizations may arise. 

    The Role of an SRE is Considered Obscure

    The ambiguity of an SRE role can be considered a downfall in some cases, with many businesses unsure of what these professionals offer when compared to a traditional systems engineer. In many cases, SREs are deemed to be a hybrid of a software engineer and an IT operations role. 

    Fortunately, DevOps has realized the potential of SREs and their ability to provide an important bridge between developers and engineers, helping to achieve dedicated tasks to a high standard. 

    SREs Vs. DevOps

    Although both roles are connected and share some similarities, there are some clear differences.

    • Processes – DevOps has full visibility into the development environment which allows them to make changes from the initial development stages through to production. SREs, on the other hand, only have visibility into the production process, allowing them to make suggestions to ensure performance levels are maintained.
    • Implementation – The task of implementing new features on a system falls on the DevOps team. Meanwhile, SREs are tasked with ensuring the new features do not cause any system failures or impact performance during the production stage.
    • Key Focus – The primary focus of a site reliability engineer is to ensure the system’s reliability, availability and scalability. DevOps focuses on how quickly product development is completed, as well as its continuity.
    • Structure – The structure of an SRE team and a DevOps team have obvious differences. SRE teams are made up of individuals who have similar skill sets relating to development and operations. Whereas DevOps teams consist of professionals who have specific roles related to individual aspects of the project. These roles can include the team leader, product owner, cloud architect, software developer, QA engineer, system administrator, release manager and more.
    • Tools – DevOps teams often use tools such as integrated development environments (IDEs) when developing a product. These can include Jenkins (continuous integration and continuous development), JIRA (change management), Splunk (log monitoring) and GitHub (distributed version control). SREs commonly use tools such as Prometheus and Grafana (collection and visualization of metrics, such as CPU usage and available disk space), OP5 and PagerDuty (incident alerts), Ansible and Kubernetes (container orchestration) as well as a range of cloud platforms.
    • Bug Reporting – DevOps debug code whenever a bug is reported in the end product. SREs are not involved with debugging from a development perspective and are only required to perform such tasks if there is a production outage, there are infrastructure issues or perhaps if they are dealing with common AWS misconfigurations.
    • Measuring Performance – The typical metrics that DevOps uses to measure performance are deployment frequency and deployment failure rate. SREs measure service level objectives (SLOs), service level indicators (SLIs), service level agreements (SLAs) and error budgets.
    • Incident Handling – In the case of incident handling, DevOps teams work to mitigate an issue based on the feedback provided. SREs then analyze the issues post-incident, including the root cause of the issue. This is then documented and provided to the developers to fix. 

    Why SRE Roles Are Critical to DevOps – Conclusion

    As you can see, the two roles differ significantly but SREs can play a critical role in ensuring the DevOps team delivers a product that offers maximum performance. 

    The core benefits of employing professionals in a site reliability engineer capacity are high levels of product performance and reliability to meet user expectations while helping to manage complex IT architecture. 

    In the future, organizations that manage a large amount of cloud-based IT assets may struggle to deliver efficient products without such professionals. As such, demand for SRE roles is likely to grow. 

  • DevOps Must Embrace Automation in 2023

    DevOps Must Embrace Automation in 2023

    A survey of 500 engineering and software development professionals in the U.S. suggests more DevOps teams than ever need to resolve to embrace automation at a deeper level in the new year.

    The survey, sponsored by Chronosphere, a provider of an observability platform, found engineers spend, on average, more than 10 hours per week attempting to triage and understand incidents. That equates to a quarter of a 40-hour workweek.

    Overall, 96% of respondents said they spend most of their time resolving low-level issues, with 88% reporting that amount of time negatively impacts them and their careers because so much time is spent troubleshooting IT issues.

    Over a third (33%) said those issues disrupted their personal life with 39% of respondents admitting they are frequently stressed out. Just under a quarter (22%) said they want to quit.

    Chronosphere CEO Martin Mao said much of the stress DevOps teams encounter results from reliance on DevOps platforms that organizations built themselves. Platforms built and supported by a vendor today typically provide higher levels of automation that reduce overall stress levels, he added.

    The survey found that 40% of respondents frequently get alerts from their observability solution without enough context to triage the incident. A total of 59% said half of the incident alerts they receive from their current observability solution aren’t actually helpful or usable, with 49% reporting they struggled with inconsistent performance using their current approach to observability. Nearly half (45%) said their current observability solution requires a lot of manual time and labor.

    Overall, 42% of those using a vendor solution said they experienced high-severity incidents quarterly or more compared to 61% relying on a platform they built. Among organizations not using a vendor solution, the majority said they would consider doing so to enhance team productivity (61%) or improve reliability (54%).

    Stress levels are likely to increase as organizations deploy emerging cloud-native applications. A full 87% of respondents said cloud-native architectures had increased the complexity of discovering and troubleshooting incidents.

    During challenging economic times, it’s more critical for DevOps leaders to understand the total cost of building and maintaining platforms, said Mao. Many organizations decided to build their own platform at a time when there was no other viable option. The manual processes required to support those platforms result in a higher cost of labor that impedes the ability to scale workflows cost-effectively, he noted.

    It’s not clear how big an appetite for change any organization that has built their own DevOps platforms may have in 2023. The challenge is that the initial cost of swapping in a commercial platform may appear high given the fact that the legacy platform is already deployed. However, the cost of the acquisition of a new platform needs to be weighed against the total cost of ongoing operations. A lot of soft costs show up in, for example, higher turnover rates for DevOps professionals that are likely to find a more rewarding job elsewhere that is less tedious. One way or another, at the start of 2023, it’s apparent there are more hard DevOps questions than ever that need to be asked and answered.

  • Best of 2022: Agile/Scrum is a Failure – Here’s Why

    Best of 2022: Agile/Scrum is a Failure – Here’s Why

    As we close out 2022, we at DevOps.com wanted to highlight the most popular articles of the year. Following is the latest in our series of the Best of 2022.

    Welcome to The Long View—where we peruse the news and strip it to the essentials. Let’s work out what really matters.

    This week, something a bit different: I’m devoting my entire column to Agile and Scrum. They’re increasingly getting a bad reputation, being associated with the worst aspects of toxic workplace culture: Sexism, racism, burnout, micromanagement. (more…)

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers. Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    ZipRecruiter

    CapitalOne
    New York, New York
    Lead Software Engineer
    $190,950 to $225,278

    Monster.com

    UMD Energy Solutions
    Bonita Springs, Florida
    AWS Cloud Engineer
    $140,000 to $150,000

    Dice.com

    Cox Communications
    Atlanta, Georgia
    Lead DevOps Engineer
    $105,700 to $176,100

    Indeed.com

    Northrup Grumman
    Dulles, Virginia
    Senior/Principal DevOps Engineer
    $104,600 to $157,000

    SimplyHired

    Visa
    Miami, Florida
    DevOps Engineer
    $85,000 to $120,000

  • Best of 2022: We Must Kill ‘Dinosaur’ JavaScript | Microsoft Open Sources 3D Emoji

    Best of 2022: We Must Kill ‘Dinosaur’ JavaScript | Microsoft Open Sources 3D Emoji

    As we close out 2022, we at DevOps.com wanted to highlight the most popular articles of the year. Following is the latest in our series of the Best of 2022.

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: JavaScript is a bloated barrier to progress, and Microsoft’s emoji are on GitHub. (more…)

  • Best of 2022: Three Cloud Trends to Watch in 2022

    Best of 2022: Three Cloud Trends to Watch in 2022

    As we close out 2022, we at DevOps.com wanted to highlight the most popular articles of the year. Following is the latest in our series of the Best of 2022.

    Many developers and startups view cloud services as simply “compute”, “storage” and “networking.” The cloud has matured to the point where customers often don’t think about the underlying infrastructure, service levels or debate the merits of on-premises versus cloud&;mdash;instead, they are increasingly cloud-first. In fact, December of 2021 marked Amazon Web Services (AWS) marked its tenth AWS re:Invent conference—the company’s annual conference for customers and partners.

    While many startups don’t think twice about centering their IT strategy around the cloud and SaaS offerings, the enterprise has been slower to adopt cloud computing at scale. The conversation for these companies revolves around security, compliance, SLAs and the loss of control over their technology stack. In many ways, little has changed about the questions that enterprises are asking about the cloud.

    As the year starts, I’ve been reflecting on various conversations I’ve had with a variety of IT and business leaders, Digital CxOs and vendors. Below are three trends that I will be tracking this year.

    1. Alternative Vendors Gain Momentum

    The “big three” hyperscalers continue to dominate the market and garner the bulk of customer and partner attention. However, we are seeing increasing interest in the alternative cloud market. The alternative market includes vendors outside of the big names (AWS, Microsoft Azure, Google Cloud, Oracle, IBM and Salesforce). Developers and businesses are increasingly looking at alternative vendors and their offerings because they are easier to use than hyperscalers, less expensive and offer more predictable pricing models. In addition, with the tight labor market, hiring developers that are, for example, AWS certified can be extremely expensive. On the other hand, because alternative clouds are less complex, developers do not need to have the same certifications.

    You might ask: What about the global scalability, quantum computing and/or the thousands of APIs that the hyperscalers offer? The truth is that most small and midsize businesses don’t actually need any of those capabilities and don’t want to help subsidize the R&D that these technologies require. Companies to watch in the alternative cloud market include Linode, Digital Ocean, OVHcloud, UpCloud, Hetzner and Equinix Metal. In 2021, Techstrong Research published a report, DevOps and the Alternative Cloud, that dives deeper into these alternatives.

    2. Industry-Specific Cloud Ecosystems Expand

    Banking, insurance and companies in other highly-regulated industries have been slow to adopt cloud computing. However, the market is quickly evolving and businesses are rethinking their approach to the cloud. One of the reasons these regulated companies are starting to invest more heavily in the cloud is because customers have heightened expectations when it comes to how they engage with businesses. If customers are unhappy, it’s easier than ever to find alternatives. These highly-regulated companies and industries are being increasingly challenged by fintech, insurtech, healthtech and other industry-focused startups.

    Just as importantly, vendors are realizing that one size doesn’t fit all. Regulated industries need specific clouds that meet their regulatory and compliance needs. These industry-focused clouds aren’t being designed as an entire ecosystem where a variety of technology partners can offer their software to regulated industries. Instead, vendors have taken two different approaches to offering industry-specific offerings. Some providers are offering pre-built but customizable applications. Some notable announcements in the area of banking clouds include the following:

    • Goldman Sachs and AWS are working together to create data management and analytics solutions for financial services organizations (announced at re:Invent 2021). The result of this collaboration is the Goldman Sachs Financial Cloud for Data. It’s unclear if AWS will be offering a more general financial services ecosystem in the future.
    • IBM continues to grow its Cloud for Financial Services in terms of signature clients and partners. IBM built its cloud for financial services in collaboration with Bank of America, then hired the bank’s CTO, Howard Boville, to head up IBM’s hybrid cloud business.
    • Microsoft announced general availability of the Microsoft Cloud for Financial Services in November of 2021 (interestingly, it’s not named Azure for Financial Services). The company already has a large footprint in the financial services industry, and we’ll be tracking the adoption of Microsoft Cloud for Financial Services closely. In September 2021, Wells Fargo unveiled their digital infrastructure strategy that relies heavily on its partnership with Microsoft, but there is no mention of Wells Fargo using the Microsoft Cloud for Financial Services.

    I expect other industry-specific clouds to follow a similar pattern—with large vendors partnering with key industry incumbents to create cloud ecosystems that meet the performance, security and compliance requirements for that industry. For example, you can certainly imagine Oracle creating a Cloud for Health Care after the acquisition of Cerner closes.

    3. Software Supply Chain Becomes a Key Security Focus

    “Supply chain” was a key phrase across all industries and job functions in 2021. I’m particularly tracking the software supply chain—which, as you can imagine, is immense and complex. In essence, your software supply chain includes anything that might impact your software. That includes APIs, cloud services, containers, your DevOps pipeline and all of the open source components that you use. Software has many dependencies, and understanding the supply chain is critical to knowing your security and risk exposure. Take, for instance, the recent Apache Log4j vulnerability. Use of Log4j is pervasive, but how many companies were actually able to quickly identify what software is at risk? Check out Alan Shimel’s December blog post, Log4j: It’s All About the Supply Chain, Baby! to learn more about software supply chain security. In addition, API security is going to be a very hot topic in 2022.

    However, people remain the number-one cybersecurity threat. Although complex cyberattacks by ransomware gangs and state-sponsored actors get much of the attention, cloud misconfigurations and unpatched software are likely your biggest threats. Understanding your software supply chain will help uncover potential weak points and allow you to add automation, observability and/or other security tools to help spot potential problems.

    The Cloud Evolution

    Although the cloud isn’t new, the cloud market is continually evolving. While the developer community has been quick to adopt cloud computing, large enterprises have lagged—and regulated industries have been even slower. The alternative cloud market is offering different options for developers and businesses that don’t want the complexities of hyperscalers and don’t need their endless options and global footprint. At the same time, regulated industries are changing their cloud strategies thanks to cloud offerings that are uniquely focused on the challenges of their industry. Finally, you need to secure your software and data no matter where it resides. Focusing on your software supply chain will help ensure you can react to security vulnerabilities and update elements when needed.