devopsy.kinsta.cloud

Category: Cloud Management

  • Alleviating Developer Workflow Headaches by Moving to the Cloud

    Alleviating Developer Workflow Headaches by Moving to the Cloud

    Leaders in tech make one common mistake when it comes to serverless and cloud computing: They want to migrate their current environment exactly as it is to the cloud. That’s about as limiting as planning a flight path along the road network and deciding the route based on street-level traffic. You can do it, but everyone’s going to look at you like you’re crazy.

    Keeping that ‘lift and shift’ mindset prevents developers from seeing the real ROI of cloud computing and serverless technology. Instead, we have to challenge our traditional ways of thinking.

    Redefining How we Think About Software Development

    The traditional definition of software is anything that makes the hardware do what we want it to. We use operating systems to control internal functions as well as peripherals. We use application software to direct our computers to execute commands. So we tend to think of software as programmatic, needing specialized programming languages to develop. But the most popular functional programming language isn’t Erlang or Haskell or Lisp. It’s Microsoft Excel, if you can believe it, with over 750 million users.

    Every Excel spreadsheet represents someone’s software; it makes their hardware process data in a way that’s valuable to them. In a similar way, the “systems” we build on the information technology side are just more software. And cloud computing gives us a new range of powerful tools so we can build bigger systems faster than before.

    What are Cloud Computing and Serverless Computing?

    Cloud computing largely references data centers and data storage. Serverless computing is one piece of cloud computing. It lets developers create software without managing infrastructure. In the end, it increases productivity, speeds up product delivery, optimizes resources and keeps developers focused on the end product rather than infrastructure maintenance.

    Once deployed, serverless apps respond to demand, scaling up or down as needed. So when a serverless function sits idle, it costs nothing.

    Key Benefits of Cloud Computing and Serverless Computing

    There are many benefits of cloud computing and serverless frameworks. By far, the one leaders are most excited about is cost control and increased ROI. It’s also one that leaders most often miss.

    Increase ROI With Cloud Computing and Serverless

    The number-one way to increase ROI with serverless frameworks and cloud computing is to avoid building anything from scratch. Invest in open-minded research. Sometimes you need to build something yourself, but often there’s a way to shift some of the burden away from your team. 

    An easy example is functions. The first thing most developers think of when they hear “serverless” is functions. But the functions running code are just a tiny piece of the puzzle. Serverless technology allows development teams to hand off as much work as they can to cloud platforms like Azure, Amazon Web Services (AWS) and Google Cloud Platform (GCP). 

    Just like someone wouldn’t buy a field, till it, plant wheat, water it, thresh the wheat into flour, bake bread and toast it to make a piece of toast, developers shouldn’t write their own code when the building blocks already exist in their cloud platform. Take, for example, Azure’s Durable Functions feature. This feature manages stateful workflows so teams don’t need to explicitly create, store and retrieve the progress through your data’s workflow in some other place. This process is so common to the systems that teams build that the cloud providers made it available without needing us to write lines of code. It’s like instant toast delivered to your door!

    The more a team can leverage already-made code, the more time they get back on their schedules and the more money goes back into the team’s budget, something we can all appreciate!

  • Aligning Cloud Spend Management With Cloud Transformation

    Aligning Cloud Spend Management With Cloud Transformation

    The cloud transformation movement is well underway, with more than half of enterprise organizations moving to a cloud-native approach this year, according to Forrester Research. Spending on cloud infrastructure is rising accordingly – more than $21 billion in Q4 2021, up 13.5% from Q4 2020, according to IDC. The cloud offers economies of scale and connectivity that companies can leverage to optimize operations, make better use of their data and identify opportunities. However, if a company’s cloud infrastructure investment isn’t well planned, they can end up spending more than expected due to unplanned access costs, applications consuming more resources than expected and underperformance caused by inefficient architecture or lack of maintenance.

    Spending governance–creating and managing a budget that supports the company’s cloud goals–also helps to maintain cloud security by ensuring that there are adequate solutions in place to prevent phishing, ransomware and other attacks that can disrupt or disable an organization’s cloud operations. Financial monitoring allows organizations to accurately evaluate the cost-efficiency of the apps in their cloud ecosystem. This can help control costs and avoid situations where different groups add their own apps without first leveraging what’s already available or correctly gauging associated cloud spend. Unchecked app proliferation in the cloud can create a cycle that includes overconsumption of resources and security issues. 

    Cloud governance can address sustainability concerns, too, as executives increasingly focus on reducing their organizations’ carbon footprint. It’s important to benchmark the organization’s on-premises servers’ carbon impact, so you can quantify how moving workloads from on-premises to the cloud impacts sustainability progress. As with spending, cloud sustainability measurement requires adequate planning, execution, organization-wide visibility, effective monitoring, and efficient use of cloud resources. 

    Planning for Effective Cloud Spend Governance

    Spending management processes have always been crucial for business, but governance of cloud initiatives is playing catch-up to technology advances and an accelerated digital transformation. We see many organizations that are relying more heavily on cloud infrastructure because of the speed it offers to deliver new products and experiences through innovation. But without financial controls, there can be an element of inefficiency that affects cloud spending decisions—something that we’ve seen as an increasing issue for companies over the past decade. 

    Whether an organization is preparing for the transition to the cloud or seeking to make existing cloud spending more visible and accountable, the financial governance aspect requires readiness. Assessing this readiness starts with cataloging the tools and expertise available in the organization to build a cloud budget, put monitoring tools in place, setting threshold levels that trigger notifications when spending exceeds certain levels and providing organizational controls to remedy any spending excesses. 

    It’s also helpful to define the goals and potential benefits of implementing better spending controls. First, no one wants to deal with unplanned costs that create budgetary problems and have a negative impact on the business. Second, spending accountability allows you to identify the internal groups that are knowledgeable enough about both cloud operations and spending management to take ownership of their role in the move to the cloud. At the same time, you can also identify the groups that need more training, guidance, and resources to get the most value and beset employee experience from their cloud transformation. Third, proper cloud governance can help companies avoid scenarios where cloud-related issues such as security, budget or over-proliferation of apps in the cloud ecosystem lead to customer experience problems. 

    All these planning requirements are more complex for organizations with an existing or planned multi-cloud environment. Because each cloud provider has its own processes and features, the organization will need to understand–and financially manage–a diverse set of tools and resources to analyze what happens across their cloud network. For example, it’s relatively simple to pull two similar reports from a single-cloud environment and synthesize them to create a summary report. When the reports are coming from two different cloud platforms, there can be format differences that make synthesis more challenging, time-consuming and costly to aggregate that data and present it in a dashboard for leaders. 

    Platform differences also mean that simply comparing previous on-premises spending to proposed cloud spending may not be a good model for accurate cost planning for multi-cloud environments. For all of these reasons as well as technical ones, multi-cloud governance often requires creating a team or task force to collaborate and share knowledge for effective technology and budgetary decision-making. 

    Cloud Spend Governance in Practice

    Like cloud technology and applications, cloud spend governance is a continually evolving practice, not a one-and-done task. That’s because proper financial visibility and management require monitoring to identify any emerging issues in terms of capacity, cost and security. For example, a manufacturer might analyze their cloud usage data and find they’re underutilizing some resources, which enables them to turn those resources off to save costs. 

    Financial governance also allows companies to find opportunities for optimization–something that can be as simple as identifying potential configuration changes that make cloud operations more efficient and secure. In the end, the promise and potential of the cloud for companies depend on smart, properly planned use of cloud resources and spending governance is a critical part of that smart planning. 

  • Exploring the Emerging Role of FinOps

    Exploring the Emerging Role of FinOps

    Cloud overspending is becoming a top-of-mind budget item for the modern CFO. To direct resource utilization in the cloud, some organizations are turning to increased automation and more diligent cloud procurement processes. As part of this momentum, new roles are emerging to oversee cloud financial operations.

    Amid rising cloud costs, FinOps is emerging as a helpful discipline. It is not always a specific role but more often a culture that blends engineers, finance and business areas to participate in dynamic cloud cost management. But getting all these players on the same page isn’t always easy — new findings say influencing developers to actually make optimizations is a top challenge.

    The FinOps Foundation recently released The State of FinOps 2022 report, a deep exploration into the role and the state of FinOps adoption across 1,000 companies worldwide. Below, I’ll highlight the key insights from the report to understand current trends and consider how organizations might implement similar tactics to better operationalize their cloud impact.

    Who Is Practicing FinOps?

    What type of person is involved in FinOps? Well, folks come from diverse backgrounds, spanning cloud financial management, IT or DevOps or consultants. Many are also new to the practice in general—the average career tenure is roughly three years. FinOps tends to be a well-paying field—45% of practitioners report salaries of over $100,000 annually.

    FinOps also tends to be associated with larger enterprises—45% of respondents came from organizations with 10,000 or more employees. In terms of industry, it is most common in financial services and IT companies, although studies show the practice is proliferating in many other sectors too. Geographically, FinOps is most adopted in primarily adopted in North America and Europe.

    Team Dynamics

    The average team size is five people, although many feel they’re a “one-person show.” Interestingly, more mature adoption tends to involve a larger team, upwards of 20+ members for established teams. There’s also a notable increase in FinOps within organizations managing between $50 million and $500 million of cloud costs.

    FinOps must interface with many levels of the company, sharing projections with both development and executive leadership. Most FinOps teams report directly to the CTO or other C-suite members. This makes sense, as an executive directive was found to be the most common way to promote a FinOps culture, followed by organic and grassroots adoption.

    Technology and Tools

    In general, FinOps tends to be achieved through cloud awareness and dedicated tooling. The most mature practitioners are “all-in on cloud.” The largest subgroup (24%) runs 1,000 to 5,000 computing instances in the public cloud, hosting technology like virtual machines, containers and serverless functions. Simply put, the average FinOps practitioner has a lot on their plate.

    In terms of tooling, there’s not one cloud cost management suite to rule them all. Teams use an average of 3.7 tools. A variance of tooling here is likely due to rising hybrid multi-cloud architectures and the need to manage costs separately within each cloud environment.

    As such, FinOps tooling includes a mixture of native cloud provider tools and other middleware. Surprisingly, after AWS Cost Explorer, the second most common tool is a homegrown tool. After that, Cloudablity, CloudHealth and Azure Cost Management rank as popular primary tools.

    Top Challenge: Collaboration

    The top barrier has to do with interdepartmental collaboration. Getting engineers to take action on cost optimization was the biggest challenge, cited by 30% of respondents. Other common challenges included accurately forecasting cloud spending (29%), convincing the organization to adopt FinOps (22%), enabling automation (20%) and reducing waste or unused resources (19%).

    Developers in the flow likely don’t want to be burdened by new cost optimization rules, so FinOps may encounter an uphill battle trying to affect low-level change. It will probably take a combination of shift-left IDE-based cost projection tooling and a decree from upper management to jumpstart this change.

    Besides getting everyone on board, FinOps is often tasked with chargeback models—48% of respondents report using chargeback to report cloud costs, the report found. Yet, correlating cloud costs to a single department or team is challenging with so much shared infrastructure. As such, shared costs remain a challenge; so much so that many practitioners don’t even split them up.

    There is also the need to resolve unexpected anomalies and increases in cloud costs, and it can be hard to distinguish between the two. As a result, 53% of respondents said it takes days for their FinOps teams to respond to unexpected cost increases. In the future, finding ways to shorten this timeframe will help save the company money.

    Next Goal: Getting Engineers to Take Action

    The vast majority (94%) of organizations are wasting money in the cloud, according to the 2022 HashiCorp State of Cloud Strategy Survey. Idle or overprovisioned resources can unnecessarily increase the cloud budget, making the need for FinOps evident. Investing in cloud optimization is also another tactic to meet sustainability pledges.

    FinOps is an emerging role that can help forecast spending and reduce waste. But the practice does require time and resources to reach an ROI. For example, a mature team only has a 5% deviation comparing forecasted spend and actual spend, whereas a less mature team can have as high as a 20% deviation. To improve, teams will require automation for evaluating and communicating cloud projections and more established anomaly management best practices.

    But above all, organizations must grapple with the number-one problem: Getting engineers to take action. Perhaps this is due to the fact that most respondents share cost data with technical teams monthly. Instead, more frequent cost transparency would match the pace of agile development and might empower more engineers.

    The State of FinOps 2022 surveyed 1,056 respondents on their FinOps roles. The yearly study is conducted by The FinOps Foundation, a Linux Foundation program. For more details, you can read the entire report here.

  • How to Go Multi-Cloud: A Simple Three-Step Approach

    How to Go Multi-Cloud: A Simple Three-Step Approach

    Odds are your business already uses cloud technology for automation, cybersecurity, IT infrastructure updates and other purposes. But you don’t have to stick to a single cloud server or provider. In fact, you can take advantage of multi-cloud strategies for your organization and reap the benefits for years to come.

    That said, multi-cloud adoption and optimization can be tricky, especially if you don’t have a plan in mind from the get-go. Today, let’s break down a simplistic yet effective three-step approach to go multi-cloud without running into major problems.

    Step One: Map Your Cloud Zoning Policy

    Your first major step should be to map out your cloud zoning policy and plan. In a nutshell, the cloud zoning choices you make can impact your commitments, costs, and even the eventual functionality of the multi-cloud setup.

    By mapping out your clouds, you also map out which processes and applications will run on each individual cloud server or provider. In essence, you decide what gets locked into one cloud, what data has to be ported between clouds and what applications must run on multiple clouds simultaneously.

    Need an example? A cloud zoning policy might cover whether you keep your web surfing or data analytics on separate cloud providers or on the same cloud servers. 

    You should map your cloud zoning policy regardless of whether you do the setup or hire a service. In the latter case, offering a read-to-go zoning map will make the service’s job easier and minimize the possibility of mistakes and/or hiccups.

    How to Determine Optimal Cloud Zoning

    Naturally, figuring out how to optimize cloud zoning can be difficult. The best way to do this is to determine your special focus areas. Alternatively, consider how you want your multi-cloud strategy to best benefit your organization.

    Say that you want to guarantee 100% uptime for your customers or visitors, even if your service goes down or if you experience a data breach. In this case, you can set up your cloud zoning strategy to balance the data load across multiple clouds at the same time.

    Or say that you want to make sure your users have global availability 24/7/365. In that case, you can set your cloud zoning policies to ensure that users can access your data or websites from anywhere around the globe at any point.

    Essentially, figure out what matters most to your organization–and what you want the most from multi-cloud optimization–and zone your cloud applications and policies accordingly.

    Step Two: Architect the Multi-Cloud Environment

    The next major step is to architect your multi-cloud environment. This involves looking at the high-level design of the environment and creating a rock-solid foundation for multi-cloud servers.

    At this stage, you should have at least some idea of how your business will grow and how the multi-cloud environment will assist with its scalability and resource needs. You need to know:

    • Where your data science and machine learning applications need to be
    • Where your product application serves from
    • Where your data warehousing takes place
    • Where cloud security is run from
    • How each of those functions grows alongside the others

    In the architecture phase of a multi-cloud setup, you need to figure out which projects and apps are so-called “cloud agnostic.” Cloud agnostic projects and applications don’t have to be portable; because of this, they can lean on managed services or proprietary IT infrastructure from your organization.

    How to Set Up an Ideal Multi-Cloud Environment

    To reap the most benefits out of a multi-cloud environment, you should adopt a containerized and flexible approach. Not only is this cost advantageous, it also allows you to set up your multi-cloud environment with as much versatility as possible.

    If you architect or plan your multi-cloud environment so it is containerized and flexible, you can work with practically any infrastructure-as-a-service (IaaS) provider. Therefore, you can transition to different cloud hosts or service providers whenever necessary according to your budget or other factors.

    To do this, be sure to perform heavy forecasting. You need to know how much data storage your computing will require, the database utilization your organization will need, the number of computer nodes you’ll likely require and so on.

    As a side bonus, containerization in your multi-cloud setup means that if one server or process goes down, the others are less likely to fail from a cascade effect as well.

    Step Three: Prep for Contracts and Forecast Costs

    The last step in going multi-cloud for your organization is handling the financial aspect of the process. You need to prepare for contracts and commitments alongside forecasting costs.

    Forecasting is critical in this phase because you’ll prepare for contracts and select different cloud services. Because of this, you need to understand how flexible your budget is relative to your infrastructure requirements.

    Specifically, you’ll need to match the costs to every multi-cloud forecast and build your overall resource and money consumption budget. Basically, you need to know:

    • How much you’ll likely spend on multi-cloud processing and services
    • Whether you need certain features, such as website monitoring tools like Visualping
    • Whether your budget can take that forecasted strain

    If the answer to the third question is “no,” you may need to go with a more affordable service or adjust your multi-cloud environment architecture and zoning policies. By forecasting costs ahead of time, you won’t run into a disaster scenario where you already have your multi-caught environment up and running but can’t pay for it, forcing you to scramble as a result.

    Minimize Commitment Risk

    Luckily, there are ways to minimize commitment risk and avoid budgetary disasters. For example, you can use commitment buy-back guarantees, or you can use flexible commitment options like that from AWS. These include computing savings plans, which consume cloud resources in any region and which result in very low savings rates.

    Of course, you can and should also practice very careful budgeting and accounting. Once you ensure that your commitment costs and savings are attributed to the right services, server resources, applications, etc., you’ll have a better idea of how much money and other resources you really need and avoid over-committing to a provider that is too expensive.

    Then you can further avoid commitment risk when planning your migrations of applications between different vendors carefully. Budgetary costs can skyrocket if migrating applications and data between vendors take longer or result in unexpected complications. Therefore, you should make sure that your migrations go quickly and easily or that a cloud service provider offers assistance during this phase (possibly as part of a deal to get you to sign with them in the first place).

    Wrapping Up

    As you can see, you can transition your organization to multi-cloud in a matter of months. But even if you follow the above steps perfectly, remember that you won’t optimize your commitments, performance and costs up to 100%. Still, you can prep your organization for long-term success and multi-cloud benefits with the right preparation and planning.

    With the right cloud services provider, you’ll gain additional assistance and support throughout this process and be able to take advantage of the extra resources from a multi-cloud setup quickly and easily. 

  • 90% Of Orgs Say Multi-Cloud Helps Achieve Business Goals

    90% Of Orgs Say Multi-Cloud Helps Achieve Business Goals

    Multi-cloud is the new normal. And thankfully, this new normal isn’t just happenstance—it’s driving positive outcomes.

    New findings show that most organizations benefit from using multiple cloud providers. Multi-cloud adoptions are helping achieve business goals, such as improving reliability and scalability and increasing overall security and governance. However, nearly all organizations (94%) admitted that they have some avoidable cloud spending and skills shortages continue to hold back a fully-realized multiple-cloud success.

    HaschiCorp recently released the 2022 State of Cloud Strategy Survey: Making Multi-Cloud Work. In addition to showcasing the positive outcomes of multi-cloud adoption, the report found a trend toward automation frameworks that help operationalize multi-cloud. Below, I’ll explore the report’s key takeaways to see what CloudOps and platform teams can garner from current multi-cloud trends.

    Multi-Cloud is Achieving Business Goals

    First off, the use of the public clouds is increasing dramatically—the majority of public cloud workloads will likely double in the next two years. To support this influx, more organizations are moving toward multi-cloud. According to the HashiCorp survey, 60% are already multi-cloud and 21% plan to use multiple clouds within the next year.

    The good news is that a multi-cloud strategy appears to be working. A full 90% of respondents said multi-cloud is helping their organizations achieve their business goals. This figure is an impressive jump from HashiCorp’s 2021 survey, in which only 53% of organizations said multi-cloud was helping them achieve their business goals.

    So, what exactly are companies extracting from multi-cloud adoption? Well, the topmost business goal driving multi-cloud is reliability, at 46%. This is followed by digital transformation (43%), scalability (42%), security and governance (41%) and cost reduction (39%). As we can see, multi-cloud equally benefits various areas.

    Centralized Automation Supports Multi-Cloud

    With the rise of multi-cloud, CloudOps is becoming its own discipline. As such, it’s common for an organization to build a dedicated Cloud Center of Excellence (CCoE) or strategy team to manage cloud operations—86% said they relied on a cloud platform team. Such a team is often in charge of standardizing cloud services, developing cloud best practices, creating operational policies and related duties.

    To aid cloud platform teams, cloud automation is becoming increasingly important. The survey found that 99% see automation as important for operationalizing multi-cloud infrastructure. Multi-cloud automation could help solve inconsistencies across varying cloud workflows. Respondents also found it can be applied to deliver more flexible infrastructure, improve security and governance and better utilize cloud resources. Improving security is especially important here, as 89% said security is a key driver of cloud success.

    So how are these automations built? Well, folks are rarely developing cloud automation tools from scratch—only 27% do so. It’s far more common to either use open source or commercial tools for cloud automation. It’s pretty equal across the board whether these tools are run ‘as-a-service’ or are self-hosted.

    Regardless of the tooling type, companies are experiencing a broad set of benefits from using middleware to manage their multi-cloud operation strategy. 49% rank scalability as a benefit. This is followed by infrastructure provisioning (42%), cost optimizations (40%) and more flexible deployment options (39%).

    (Nearly) Everyone is Overspending on Multi-Cloud

    Unsurprisingly to some, the study found that 94% of organizations are wasting money in the cloud. The following were the top cited areas that contribute to cloud overspending and waste: Idle or underused resources (66%), overprovisioning resources (59%), a lack of needed skills (47%) and manual containerization (37%).

    The cloud overspending dilemma necessitates forethought into optimizations and reduction of idle resources. As I’ve previously covered, some organizations are even tinkering with employing a cloud economist, or Cloud CFO, to keep escalating cloud fees in check. To help this mission, 43% say consistent and automated tooling has or would lead to better utilization of cloud resources.

    Although wasteful spending is pervasive, the majority of companies are forecasting their cloud spending correctly. More than half (57%) said that in 2021 their organization’s projected cloud spend aligned with their actual cloud spend.

    Getting the Most Out of Multi-Cloud

    Multi-cloud is becoming more common across all IT divisions—as is middleware to operationalize and standardize logic between multiple clouds. And, widespread business success with multi-cloud signals increased maturity in this area.

    Yet, multi-cloud doesn’t come without its challenges. Skill shortages rank as the highest factor impeding an organization’s ability to operationalize multi-cloud. Businesses must face other challenges, such as siloed teams, compliance and risk management and lack of training in order to fully realize multi-cloud. Standardized operating models, along with shared workflows and policies, are possible ways to combat these roadblocks.

    The HashiCorp study surveyed 1,000 technology practitioners and decision-makers from around the world. HashiCorp also partnered with Forrester to provide additional analysis of the findings. To read the results for yourself, check out the full report here.

  • VMware Embraces Graph Technology to Manage Multiple Clouds

    VMware Embraces Graph Technology to Manage Multiple Clouds

    At the VMware Explore 2022 conference today, VMware launched a portfolio of multi-cloud management tools, dubbed VMware Aria, based on a graph-based data store that captures the resources spanning multiple clouds and their relationship to one another.

    Accessed via a VMware Aria Hub platform previously known as Project Ensemble, VMware Aria Graph provides a common definition of applications, resources, roles and accounts in near-real-time across a multi-cloud environment that can consist of millions of nodes.

    VMware CEO Raghu Raghuram told conference attendees the Aria Graph is at the core of an effort to enable IT organizations to move beyond “cloud chaos” to embrace a next-generation “cloud smart” approach to managing distributed computing environments that span multiple platforms.

    Based on an event-driven platform, the VMware Aria Graph aggregates data pulled from public application programming interfaces (APIs) into a data store residing on that cloud. The data store is based on a federated model so there is no need to move data into a central repository. Instead, VMware is making use of GraphQL to launch queries across a federated data model. In addition, IT teams can discover dependencies and analyze historical configuration data to discover the root cause of any issue. All operational data is now aggregated in a way that creates a single source of truth.

    VMware has also provided a set of API services that can be used to integrate the Aria Graph data store with third-party platforms.
    In general, the company is committed to accelerating “the great replatforming” of IT environments spurred by digital business transformation initiatives, said Raghuram. The challenges IT organizations are encountering are roadblocks that involve everything from a lack of skills, the weight of existing enterprise applications and fragmented operations and cybersecurity models, he noted.

    The VMware Aria graph data store will enable the company to automate a wide range of management tasks, Raghuram said. That includes using the right cloud for the right application and governing and accessing them at the lowest cost possible, added Raghuram. The ultimate goal is to enable a unified developer experience that provides a frictionless multi-cloud experience across a consistent set of enterprise infrastructure, he said.

    VMware offerings that leverage the VMware Aria Graph include VMware Aria Guardrails for enforcing IT policies, a VMware Aria Migration tool for automating assessment, planning and execution using the VMware HCX platform and a VMware Aria Business Insights tool that surfaces business insights using machine learning algorithms. The rest of the VMware Aria portfolio is anchored around extensions to existing platforms in the form of VMware Aria Cost powered by CloudHealth, VMware Aria Operations and VMware Aria Automation.

    VMware also announced today that its existing VMware Cross-Cloud Service offering for deploying its stack of software across multiple clouds has been extended to add support for the Microsoft Azure cloud.

    Overall, VMware claims there are now five million developers in its ecosystem that collectively launch 350,000 projects every week. That equates to roughly 35 new applications a minute, according to Raghuram. All told, VMware claims there are 85 million workloads running globally on its platform.

    The bulk of those workloads today still run in on-premises IT environments. In fact, Raghuram noted that cloud platforms still only account for $413 billion in IT spending each year, which is only 10% of the total IT spending that reaches $4.4 trillion each year.

    VMware, which is expecting to complete its acquisition by Broadcom in the next few months, is betting that as more of those workloads move to the cloud, the need to centrally manage heterogenous IT environments will play to its strengths.

  • Overcoming Multi-Cloud Management Challenges

    Overcoming Multi-Cloud Management Challenges

    We’ve long talked about how the cloud is the future. But with the vast majority of corporate data now stored in the cloud, it’s clear that most businesses now realize this is a must-have in today’s increasingly demanding and agile business environment. 

    The cloud has been the backbone of the remote restructuring of the workplace over the last few years, enabling organizations to access data flows and critical workloads no matter where their employees are stationed. So much so that there’s been a dramatic rise in the number of enterprises deploying different service providers as part of a multi-cloud strategy. This enabled them to pursue greater agility and flexibility within a hybrid environment. 

    Recent research from Wanclouds found that most IT professionals use two or more cloud platforms today—and just under half (48%) said they used a mix of public and private clouds. However, the reality is that the more cloud environments your organization use, the more complex it becomes to both manage and secure them. Here are three multi-cloud management challenges impacting IT teams today and how they can overcome them.

    Maintaining Uptime in the Face of Rising Security Challenges

    Avoiding downtime has never been more important, nor has it been more challenging to achieve. Extreme weather events are becoming more frequent and increasing the risk of natural disasters or power outages, leading to data loss. In fact, 65% of U.S. and UK IT decision-makers said their organization experienced at least one data loss incident last year, while 21% admit they experienced two data loss incidents.

    But it is, perhaps, the security challenges that pose the biggest threat to IT departments and the developer teams they support. Since the onset of COVID-19, organizations have been targeted for cyberattacks far more often and have been infiltrated by cybercriminals much more quickly. According to McAfee, there were 3.1 million cloud-based cyberattacks in 2020 alone. Unsurprisingly, these attacks are fueling concern in IT circles. 88% of U.S. and UK decision-makers said they’re at least slightly worried—and 15% are apprehensive—about cloud workload security in 2022. 

    While multi-cloud environments enable developer flexibility, they also cause inherent configuration and visibility problems, and this is where cyberattackers can take advantage of weaknesses. The complexity of migrating data across different cloud platforms and operating systems can also lead to delays with patching. The key is often ensuring visibility across these platforms and maintaining interoperability. Security platforms for multi-cloud environments must be set up to share threat information across providers and platforms. If not, threats can easily be missed, or even if they are detected, the response across infrastructure will be too slow to minimize damage. 

    With businesses accelerating their goal of becoming 100% cloud-native in the next few years, a cloud-based disaster recovery strategy must also be embedded within their management plans. Without one, every business risks losing vital data and having their systems, operations or services shut down by natural and man-made disasters, security risks, hardware failures and power outages.

    Staying on Top of Hidden Charges

    Cloud spending has skyrocketed in the past two years, and all signs suggest that organizations will continue to allocate more of their IT budgets to the cloud over the years to come. But not every business has the same resources as, say, Apple, which reportedly spent over $30 million a month on Amazon’s cloud, according to a 2019 CNBC story. The reality for most IT teams is that they’re constantly battling hidden charges and unexpected cloud costs that threaten to blow up their entire IT budget. 

    In fact, in Flexera’s 2022 State of the Cloud report, respondents self-estimated that their organizations wasted just under a third (32%) of their cloud spend, up from 30% last year. Meanwhile, Wanclouds research found that 54% of British and American IT professionals say they have been hit with unexpected cloud costs in the past year.

    It’s a severe problem throwing IT teams for a loop from the migration stages of the multi-cloud plans right through to management and maintenance. Sure, cloud providers like Amazon provide basic tools for resource tracking and spend visibility. But truthfully, these features generally fall short of providing real-time and enterprise-wide insights on how to optimize costs.

    To eliminate the sticker shock of unanticipated cloud costs, organizations need to have a defined plan for cloud cost management. Again, company-wide visibility into their cloud platforms’ billing systems is imperative and a way to track spending across their multiple accounts. It’s vital for companies to properly tag the infrastructure for understanding costs and maintain up-to-date inventory of all the resources.

    Meeting Multi-Cloud Compliance Requirements

    Every cloud user must comply with specific regulatory standards following industry guidelines and local, national and international laws. Organizations in the health care space, for instance, must comply with HIPAA rules, which are essentially a set of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. Meanwhile, manufacturing IT teams must abide by stringent intellectual property security protocols and protocols for other sensitive data like PCI and PII. 

    Ensuring compliance across multiple cloud environments is necessary, but undoubtedly a challenge. This is especially true in today’s attack-filled security landscape, where internal threats can pose as much risk to data security as external attackers. (32% of the organizations surveyed by Varonis found incorrect access authorizations and privileges assigned to users). Not to mention compliance requirements are constantly changing, making it even more difficult for organizations to meet demands.  

    This is why every IT and security professional invested in the cloud needs a solution that lets them set up compliance policies against their cloud infrastructure, making it easy for them to ensure compliance requirements in the case of any unforeseen natural disasters or security incidents. We’ve seen the damage that just one data breach can have on a business—costing them millions of dollars in cleanup and leaving them with considerable damage to their reputation. It’s imperative that an organization’s entire multi-cloud strategy prioritizes compliance and the security of sensitive data. 

  • Learn Something New Every (Cloud-Native) Day

    Learn Something New Every (Cloud-Native) Day

    Being the new guy at Techstrong Group, the first couple of weeks was spent trying to find things. Like the bathroom when I’m at HQ in Boca Raton or the login to the SurveyMonkey account so I could check on the status of our various in-flight research projects. 

    I also realize I have to learn the vernacular, especially around DevOps and this cloud-native stuff. To be clear, I’ve been researching DevOps and how to integrate security into the process (yes, DevSecOps) for a while. But this cloud-native terminology is something I need to learn more about.

    You’re probably a bit confused about why I’m perplexed by the term ‘cloud-native.’ My work in cloud security for the past 10 years gave me some opinions about vernacular. When I say “cloud-native,” I’m typically referring to the native services you use in your cloud provider. Like AWS Fargate or Azure Container Registry. Those services are “native to the cloud (provider).” 

    But I’m realizing that native cloud services are only a portion of the larger cloud-native revolution. Like DevOps, cloud-native is a state of mind, not a service you buy from a cloud provider. It’s about openness. It’s about portability. It’s about agility. It’s also humbling as I realize I have a lot more to learn.

    That’s why I’m looking forward to our CloudNativeDay event on August 10, 2022. I get an opportunity to dig in and learn about some topics germane to my new coverage areas. For instance, the session on cloud-native challenges in traditional enterprises caught my eye. I’ve been involved in born-in-the-cloud companies, so we didn’t have any installed base to consider. But how would you embrace new and disruptive technology when your company has extensive legacy infrastructure? I can’t wait to hear about those more traditional enterprises’ opinions and experiences.

    Observability is also high on my list of things to learn more about. I’ve been working with customers on advanced security monitoring strategies for decades, but looking at the application layer and associated infrastructure is a different animal. I suspect there will be some technical similarities (collect data, analyze data, alert on data, etc.), but the use cases are fundamentally different. 

    I’m also excited for the last keynote of the day. However, I’m a little biased since it involves an excellent conversation Mitch Ashley and I had with Donald Lutz of Taos (an IBM company), where we dug into some of the enterprise migration challenges he’s seen in the field. 

    They say that when you’re young, you know everything. But as you get older, you realize you don’t know anything. I’m definitely in the latter camp, which is why I’m not going to squander a great opportunity to learn—and neither should you. Register and check out the event. I’ll see you there.

  • Orgs Struggle to Get App Modernization Right

    Orgs Struggle to Get App Modernization Right

    A survey published today found 93% of IT leader respondents admitted that application modernization efforts are either extremely or somewhat challenging.

    The survey, which polled 150 IT leaders at organizations with at least 1,000 employees, was conducted by Asperitas, an IT services provider. The survey found the primary issues respondents identified were identifying the right tools and technologies (30%) followed by finding staff with the right experience (20%), choosing the right external partner (18%), getting users trained on new systems (17%) and securing the support of management (11%).

    More than three-quarters of respondents (78%) said the top priority for organizations taking on application modernization should be “getting it right.”

    The definition of application modernization is, like many things, in the eye of the beholder. One-third of respondents defined modernization as the use of cloud-based infrastructure while 32% said it was moving legacy systems to the cloud. Another 22% defined it as using cloud-based tools.

    More than half of respondents (54%) said employing microservices meant that they were modernizing, while 59% said the use of any cloud-native services indicates as much.

    Scott Wheeler, practice lead at Asperitas, said that while there are a lot of definitions of application modernization, it’s clear that the lift-and-shift era of moving applications to the cloud is coming to an end. Organizations are instead preferring to build and deploy applications using a wide range of cloud-native platforms and platform-as-a-service (PaaS) environments they don’t have to manage.

    The challenge is many of these applications are being built and deployed on multiple clouds. More than a quarter (27%) said the biggest multi-cloud challenge was securing applications, followed closely by integration with on-premises systems and other cloud platforms (26%). Another 20% identified ensuring portability between platforms as the biggest challenge.

    A total of 80% also noted upskilling of internal staff and making improvements to antiquated processes were extremely important to application modernization. In fact, one of the major issues that organizations still need to address is the degree to which “bad DevOps” practices are being applied to modern application environments, said Wheeler. Much of that issue stems from the simple fact that many IT teams still don’t know how to effectively manage cloud computing platforms, he added.

    Well over a third (36%) said that a key application modernization best practice was giving yourself ample time to complete the project while an equal percentage identified avoiding shortcuts, distractions and/or partners that over-promise. Another 34% said the most important lesson was choosing the best tool for the job, while nearly a quarter (24%) identified waiting too long to modernize a system that’s clearly in need of modernization.

    A full 100% of respondents said application modernization was very or somewhat important to their business, with 45% reporting the applications they had chosen to modernize were critical. A little more than a quarter (28%) also noted modernization has enabled them to innovate faster and scale more rapidly, while 25% said it could improve end user productivity and 11% said it might make their company more attractive to employees and customers.

    Regardless of the motivation for modernizing applications, just about every organization is engaged in these efforts to varying degrees. The issue doesn’t seem to be the willingness to start these projects as much as it is making sure they are completed quickly enough to be relevant to the business.

  • Techstrong TV: The Future of Cloud Security

    Techstrong TV: The Future of Cloud Security

     

    Check Point Software has announced the acquisition of Spectral, an Israeli start up specialized in automated code security. This further reinforces Check Point’s commitment to cloud security. The video is above and a transcript of the conversation is below.

     

    Interviewer:                Hey everyone, welcome to another segment here on Techstrong TV. I’m really happy to have as our guest on this segment TJ Gonen, and hoping I pronounce that right, from Check Point. Hey TJ, welcome to Techstrong TV.

     

    Interviewee:                Yeah, and thank you very much for having us.

     

    Interviewer:                It’s a pleasure. Is that the right way to pronounce your name?

     

    Interviewee:                No, Gonen is the right way. Yeah. TJ is the name that they changed so no one butchers it.

     

    Interviewer:                Well I hear you. It happens sometimes. Hey I really, as I mentioned to you earlier I like the 49ers, especially in a week where they had a tough game. LA, the Rams are going to the Super Bowl in LA and still it’s close.

     

    Interviewee:                Yeah, they almost made it, almost made it.

     

    Interviewer:                It was close, a lot closer than my team, so who am I to say anything. But yeah I know, good for them. Anyway we didn’t bring you on to talk football unfortunately.

     

    Interviewee:                Of course.

     

    Interviewer:                We’re going to talk security, and maybe that’s better off anyway. TJ, why don’t we start though. Why don’t you kind of give our audience a little bit of who you are, a little introduction. What you do at Check Point, stuff like t hat.

     

    Interviewee:                Yeah, sure. So TJ, originally from Israel. That’s a little bit of the accent, now in the US. I am the Vice President for Call Security at Check Point. So I run the Call Security business for Check Point, and been with Check Point for two years. Actually exactly two years since my company was acquired by Check Point a couple of years ago in the cloud security space.

     

    Interviewer:                Yeah, what company was that?

     

    Interviewee:                So we need to talk about another acquisition so it’s an interesting time.

     

    Interviewer:                Well it’s the circle of life. Right?

     

    Interviewee:                Yeah.

     

    Interviewer:                What was the company that was acquired two years ago, your company?

     

    Interviewee:                Ortega Labs. We were in the servalice security space, yeah.

     

    Interviewer:                Absolutely, and of course servalice is a huge, huge kind of growth area right now. But that was two years ago, as you said TJ, and congratulations to you on that. But we have a new Check Point act, so it’s the way of the world. We have a new Check Point acquisition to announce or talk about today. Why don’t you share with our audience a little bit?

     

    Interviewee:                Yeah, so we just a few days ago we announced the acquisition of a company called Spectral in the code security space, and it’s really our move into the developer first security world, and we’ve been very busy in the code security space for the last four years, Check Point through a series of acquisitions.

     

    Actually to call security business at Check Point started with one acquisition, a company called o9 ______ _____ ______ [crosstalk].

     

    Interviewer:                Sure. I know that 09, who was the founder of o9? Not _______.

     

    Interviewee:                Zor.

     

    Interviewer:                Zor. Yeah, I knew him when he started o9.

     

    Interviewee:                There you go, yeah. So awesome company. So that sort of started the journey, then a few acquisitions later including my company and now Spectral, that’s the fifth acquisition we’re actually doing in the code security space.

     

    So I think one of the things that we found out relatively early is that cloud security is almost trying to reinvent all of security. Reinvent it for the cloud and trying to do 30 years of security in 4 years, and it’s very hard to move without acquisitions.

     

    Interviewer:                Yes it is, and look, quite frankly my background is security, so I’ve been in security 25 plus years.

     

    Interviewee:                Yeah.  

     

    Interviewer:                It’s the reason I started devopsy.kinsta.cloud. It’s the reason I got so attracted to the whole DevOps thing, which was I really felt like it was a fresh chance for us to kind of right some past wrongs. Right?

     

    Interviewee:                Right. Yeah.

     

    Interviewer:                A new beginning, if you will. Now it’s funny, I remember in 2005 or from the first time I heard the term cloud security. The Cloud Security Alliance and Chris Hoff and a bunch of folks at RSI were doing a meeting. And back then we found that cloud security is very sort of one dimensional. Right.

     

    Interviewee:                Mm-mmm.

     

    Interviewer:                And but what we see now is it’s infinite in its variety. There is so many different aspects to securing cloud.

     

    Interviewee:                Very much.

     

    Interviewer:                And it’s important. You know, I was on with I think it was the Palo Alto folks yesterday with their latest cloud, Native Survey. For the first time their respondents, and keep in mind when you’re a hammer everything looks like a nail, TJ. Right? So their respondents are probably people in Cloud Native, because it was a Cloud Native survey.

     

    Interviewee:                Right. Right.

     

    Interviewer:                But they said 50 percent of their infrastructure – at least 50 percent was in the cloud.

     

    Interviewee:                Yeah.

     

    Interviewer:                That’s a big threshold.

     

    Interviewee:                It is a big, yeah.

     

    Interviewer:                Right. When you say okay, half of organizations’ infrastructure is in the cloud today, well cloud security really damn important then.

     

    Interviewee:                Yeah, it is very important. Yeah.

     

    Interviewer:                Yeah, and so it’s part, you know, there is reasons for it to be complicated. This acquisition is a little different than o9 or yours.

     

    Interviewee:                Yeah, it is.

     

    Interviewer:                Why is it different?

     

    Interviewee:                Yeah, so the biggest difference I say is the user, and one of the things that we found out over the last two, three years is there is a few trends that are coming down together. One of them is the shift left turn, which is very clear. That shift left is more of a security initiative. Right.

     

    A security initiative that says hey, if I can fix something, prevent vulnerabilities before they hit the ______ department I should do that. Okay. So now if you want to shift left then you are living – your tools are living inside the pipeline, the development pipeline, and they’re supposed to be suddenly used not by security people, but by developers or DevOps people.

     

    Interviewer:                Yeah, yeah, yeah.

     

    Interviewee:                So these suddenly developed tools that are supposed to be used by people first, not to insure that security is their first priority. That’s number one. Actually it’s probably not their first priority. Even if they care it’s not their first priority. Then number two they just are totally used to different environments.

     

    And you find out that the security company definitely like Check Point that’s been doing security for 30 years and yourself and myself who are older than 10 years old as you can see, at least on my side, is that we know how to develop products for security people.

     

    And to develop  products – security products for developers and DevOps people is just a different genetics. It’s a different DNA.

     

    Interviewer:                No, that it’s a different animal, man.

     

    Interviewee:                It’s a different animal. So we were looking at that and said okay, so one, we think that developer first cloud security is a real thing. I mean it’s very important and it’s going to be a very big part exactly to your point there, of the future of cloud security.

     

    So there is always going to be cloud security – security for security people, which is their own time environment, checking out their actual cloud infrastructure. Making sure that the facts are being blocked and all that good stuff. But when you are talking about developer first cloud security you’re going to have a different type of user. You’re going to need to integrate into different types of tool sets. You need to have different types of genetics.

     

    So that’s what you wanted to sell to Spectral is exactly that. So these guys, you know, I met them first time and I said literally I had a, you know, probably a moment where I said okay, that’s it. These guys just get it. They’ve built a product that developers love. They built a product that developers understand how to use.

     

    Just like the one of their customers told me. They said, you know, I ask him why do you like Spectral compared to the other alternatives like Sneak and maybe a couple of others? And he literally said with Spectral the first time I take the connect to this thing first it took me five minutes.

     

    The second thing, I started to use it, everything was exactly where I expected it to be. And he actually used the metaphor in iPhone, and I totally related to that. Where with IOS everything is you don’t know why, but everything is exactly where you want it to be. You don’t need to think.

     

    So they nailed down the developer experience, and it’s not just the user experience and they integrate with tens of tools right out of the gate. They integrate into the IT environment. It’s also one of the things that we as security people who develop products for security people take for granted that you cannot take for granted in developer world.

     

    I’ll give you just a very simple example. Because we assume we’re selling to security people we assume that they’re going to be okay with us screwing up once in a while. For example, false positives. Something will take a bit more time. It’s okay, because they’re security. That’s their job. I mean they don’t have anything else to do except waiting for you to do your job.

     

    When you are talking with developers and you are going to scan code for example, which is what Spectral does. They started the first was scanning for secrets, hard coded secrets inside code, whether it’s in the I keys and W S keys, fast ______, huge problem. I mean developers who aren’t really fast, they forget keys and secrets inside code. They find an attacker that’s easiest way in.

     

    So now you have tens of repos, hundreds of repos. _______ repositories, S stream buckets, so secrets can be everywhere. If I’m a developer and I’m pushing code and I’m waiting for you to scan, and it’s going to take two minutes I’m going crazy over it. Two minutes I’m going crazy. Five minutes I’m killing someone. Ten minutes I’m out of this.

     

    Interviewer:                I’m not doing it.

     

    Interviewee:                And finding a way to go around this.

     

    Interviewer:                Yeah, yeah, I’m not doing it no more. Yeah.

     

    Interviewer:                So this Spectral technology, that was really their core tech, which is really interesting. So they, it’s like keeping it really, really simple. They have the ability to scan huge amounts of code for problems. Now a problem can be secrets. A problem can be mis-configurations in infrastructure as code templates like _______ can be a bunch of missed spaces, but they can do that really fast.

     

    Literally we scan, when we do the due diligence we scan their entire – our entire repo, the checkpoint repo in seven seconds.

     

    Interviewer:                Wow.

     

    Interviewee:                The entire repo, 30 years worth of repo.

     

    Interviewer:                Oh shit. Oh.

     

    Interviewee:                Seven seconds.

     

    Interviewer:                Holy mackerel.

     

    Interviewee:                I know it’s an oh shit. I had an oh shit moment also. It’s so, and it’s not like that. And they were saying okay, something here is happening. Now and it was also super accurate and they found very interesting things.

     

    So once they nail down the user experience or the developer experience you understand how they work and integrated the tools. Then you solve a real, real problem, because that is a real problem and you solve it really fast. That’s why we totally like them.

     

    So we really looking at them and just to make it even more interesting to the point that we started with how different of a DNA it is. Because it’s such a different DNA we’re acting inside my unit, inside the cloud security unit we are leaving them independent. We are not touching them.

     

    I don’t want them to start talking security to security people. You guys get the developers. You understand how they work. You go,  you do you. Just keep on doing that thing. I don’t want to dirty them.

     

    Interviewer:                I got to tell you, I’m sitting here, you know the word kvelling? Have you ever heard that word in your life?

     

    Interviewee:                Yeah, I – yea.

     

    Interviewer:                Because so I started devopsy.kinsta.cloud in 2013. Right. And RSA I think 20, maybe it was 2015 RSA. I started what we call the DevSecOps Event within RSA. It was Monday of RSA week. Right.

     

    Interviewee:                Right.

     

    Interviewer:                And the idea behind it was to bring the security, the cyber whatever you want to call it, the security community together with the DevOps try with the developers. And I got to tell you the aggravation I had, you know, eight years ago. Security people, they don’t care about security, they’ll never care about security.

     

    Interviewee:                Exactly. Yeah.

     

    Interviewer:                They’re stupid. They’re this.

     

    Interviewee:                They’re the enemy. Yeah.

     

    Interviewer:                Right. And you know what the developers are. All they do is say no, they slow us down. They are a pain in the ass.

     

    Interviewee:                Exactly. Totally.

     

    Interviewer:                It was like this. It took me seven years of build, because I believed – I believed that no, security may never be their number one priority, but no developer I ever met raises their hand and says I want to develop in secure code.

     

    Interviewee:                They don’t care, no. Right. No.

     

    Interviewer:                I like crappy quality. I’m a crappy quality developer. You know what I mean? No one says that.

     

    Interviewee:                Right. Right.

     

    Interviewer:                They all, they have pride in what they do.

     

    Interviewee:                Yes, exactly.

     

    Interviewer:                The problem was, is we weren’t giving them tools that they could use.

     

    Interviewee:                Yeah.

     

    Interviewer:                They’re not CISSPs. They’re not ______ or scanning _______.

     

    Interviewee:                No, no, there were security incidents and try to do for _______.

     

    Interviewer:                No, they’re not compliance experts.

     

    Interviewee:                Yeah, exactly. You found the problem, tell me how to fix it. Be very specific. Don’t tell me how to fix it –

     

    Interviewer:                Don’t fix it because I want the quality. I want the quality. Yeah.

     

    Interviewee:                Exactly. And I think you are touching now on a very interesting point, because when you start to bundle these things or unwrap it actually let’s say, one is you’re right, it’s a new user so we talk about it. I actually think that security people today, and I can tell you now product group, that’s exactly how we think.

     

    We think about the developer and the DevOps guy and the ______ guy as a new type of user. He is a user to the security side. I need to think, I need to cater to his needs. Now what does he need? To your point earlier, he is not going to read forensic reports. He is not going to read the tax batchers. That is not his job.

     

    His job is to write quality code that is not vulnerable as much as possible. Now if you find the problem in what he does tell him how to fix it and tell him in his language. In his language. His language is not a dashboard with a search. It is not his language. It is not just a piece of code telling that piece of code is problematic. If you replace it with that piece of code you are good to go.

     

    Interviewer:                Done.

     

    Interviewee:                It’s such a different mindset. It’s like you all are security people. You’ve been around, I’ve been around. We immediately show dashboards and must moves. Who cares? The Spectral ops guys where they showed us a demo and it’s like your heart attack for any normal security person, because what do they show? A CLI.

     

    Interviewer:                Yeah.

     

    Interviewee:                They open the CLI. It’s like everything black screen CLI. Anyone from a security will say I don’t understand what they are doing, but their customers, that’s exactly what they appreciate. To integrate immediately. You are talking with the ex, that everything is API first.

     

    Yeah, there is a report somewhere that you can see in the background if you need, but everything works inside the development environment.

     

    Interviewer:                But this also goes TJ, and we’re probably over time. I apologize.

     

    Interviewee:                That is okay.

     

    Interviewer:                But this also goes that we need to redefine the relationship between the security team and the DevOps developers and the people who use this kind of tool, because what happens is look, it’s going to be the developer. Maybe the DevOps or the SRE, but it’s going to be those people who are instituting the changes to close down a vulnerability or fix something.

     

    Interviewee:                Right.

     

    Interviewer:                That doesn’t absolve the security team of responsibility. No one is saying hey security team, you’re out of a job. Or hey security team, you don’t got to worry about it anymore.

     

    Interviewee:                ______ no.

     

    Interviewer:                The security team still needs that report.

     

    Interviewee:                Exactly.

     

    Interviewer:                That forensics trail if you will, to say hey, yes this was found, this was fixed and this is how it was fixed. And that again is yet another kind of special talent to make a tool that’s easy enough or is in the DNA of the developer, but still gives the security team, the compliance team what they need to sleep well at night.

     

    Interviewee:                That’s why one of the best sentences I like and we used it also when we announced the acquisition is would invent it, people use it before, it’s security tools that developers love and security people trust. That’s the theme. Right. That is so true.

     

    Interviewer:                I may steal that from you.

     

    Interviewee:                Steal it, _______ it. It’s like ten cents a use, and I know it’s in the –

     

    Interviewer:                Okay. We’ll put you down. We’ll put you down. No, but it’s true.

     

    Interviewee:                That’s what you want. Right. That’s really where you want, because and you just described the part that what does it mean for me as a security person to trust the tool that you’re using, and to trust the work that you are doing with it. And I think it’s a very different – it’s very interesting.

     

    I’m thinking the future by the Allan, and I think you are sitting with devopsy.kinsta.cloud, just right on the money. Because the future of security looks like this. You’re going to have security people. They are going to more and more, that’s where it’s going to go. It’s not tomorrow, but that’s where it’s going to go.

     

    The traditional security people I call it the sandwich model. The traditional security people is going to be at the beginning in defining what is secure, or what does it mean to be? Is going to be at the end validating that security actually happened. The sandwich in the middle is going to be more than ever what in the future, more than today by far developers. It’s going to be cool.

     

    Security is code. Computer security people are going to define what’s needed. They are going to make sure that they are going to validate that it happened. These people in the middle are going to be more and more code people.

     

    Interviewer:                People who make it happen.

     

    Interviewee:                Code people. That’s the new security engineer. The new security engineer knows how to code. And that’s why we acquired Spectral and that’s why we are going to let them lead our developer first spot security initiatives, and we’re super excited about it.

     

    Interviewer:                I’m excited for you, and I’m glad to see Check Point coming out with this. It’s great. Hey, for people who want to get information on Spectral where do they go?

     

    Interviewer:                ______.com website. You are going to find immediately on the homepage a link to the information around the acquisition and you can also go and check out spectralops.io, the website of the company.

     

    Interviewer:                I love it. TJ, man thanks for coming on and talking with us.

     

    Interviewee:                You are welcome.

     

    Interviewer:                It was a great acquisition. We’re going to be watching others go. I think a smart move by Check Point. Hey, we’re going to take a break here on Techstrong TV. We’ll be right back with some more interviews and news and information. TJ, thanks very much.

     

    Interviewee:                Thank you very much. Thanks.

     

    [End of Audio]