devopsy.kinsta.cloud

Category: IT as Code

  • Datadog Updates Aim to Improve Logging, Testing Efficiency

    Datadog Updates Aim to Improve Logging, Testing Efficiency

    At its recent DASH 2023 conference, Datadog revealed Flex Logs and Intelligent Test Runner, two major new capabilities aimed at improving logging and testing efficiency for engineering teams.

    Omri Sass, director of product management at Datadog, said Flex Logs introduces a new middle tier of log storage between real-time querying and cold archives. As Sass explained, this provides a cheaper option for retaining logs beyond the typical two weeks for occasional analytics and investigations. By decoupling storage from compute for reading logs, teams can independently scale each based on their needs. This enables retaining rich log data for months or years to uncover long-term trends, he said.

    In addition, Sass noted that Flex Logs helps address common log analysis limitations around storage costs and rehydrating archives. The feature better aligns log pricing with specific use cases beyond just troubleshooting. According to Sass, this evolution in log storage tiers will likely shift more logs from legacy on-premises systems to its cloud platform.

    The second capability, Intelligent Test Runner, leverages observability signals to optimize CI test suites. As Sass explained, comprehensive test automation in CI pipelines often increases deployment times and flakes. Intelligent Test Runner inspects code changes to determine associated tests, ignoring irrelevant ones, which helps avoid long wait times for minor changes just to exercise unaffected areas.

    By tapping into existing telemetry around code commits, test health and runtimes, the feature adapts testing to each code modification. Sass explained that observability data has matured enough to enable real-time optimization like this. The end result is faster CI validation, so engineering teams can ship updates more rapidly.

    Sass highlighted how Flex Logs and Intelligent Test Runner are Datadog’s attempts to address real pain points developers face around managing log data life cycles and CI speed bumps. Sass said he believes this combination of depth in core disciplines like logs and application performance monitoring (APM), along with expanding into adjacent developer workflows, is key to solving these issues through innovation.

    Looking to the future, the observability space continues to evolve rapidly as emerging technologies and practices expand monitoring beyond traditional IT infrastructure. Companies handling modern workloads expect their observability platform to provide comprehensive visibility as development toolchains and architectures grow more complex, with the next generation of observability likely incorporating advanced analytics, automation and AI to help engineers tame systems at ever-increasing scale and speed. 

  • Data Management: Cloud Technology or Data Centers?

    Data Management: Cloud Technology or Data Centers?

    Traditionally, larger enterprises have relied on in-house server hardware equipment for their data management needs, optimized to run high-performing applications with a certain degree of assured security and reliability. 

    However, the high costs and technical expertise required to manage these solutions effectively often render them inaccessible to startups and emerging businesses. But, as the old saying goes, necessity is the mother of invention. 

    With the growing demand for cost-effective, efficient data management solutions, the tech industry has witnessed the advent of cloud technology and data center colocation rental services. These alternatives pave the way for startups and small businesses to handle large volumes of data without straining their budgets.

    This article will compare and contrast cloud technology and data center services to help business leaders make well-informed decisions about their data management needs and the solutions that can help them.

    Understanding Data Center Colocation Services

    Data center colocation services offer an enticing solution for companies that require robust data management capabilities without incurring high capital expenditure for securing storage hardware, along with storing and powering them. 

    Essentially, this solution is like renting a space for your data in a specialized facility. These data centers provide a secure environment with the necessary power, cooling, and physical security for your server, storage, and networking equipment.

    In opting for colocation services, companies can leverage state-of-the-art data center infrastructure without the burden of high upfront costs and ongoing maintenance responsibilities associated with owning a private data center. This also allows businesses to focus more on their core competencies rather than the intricacies of data center management.

    However, data centers come with their own set of unique challenges. For instance, they often require a certain degree of technical expertise on the part of the business to manage their servers. This means hiring or training staff to handle server management, increasing the overall cost of this solution.

    Additionally, data centers’ effectiveness can sometimes be influenced by physical proximity. The closer your operations are to the data center, the better the performance can be. This geographical factor can pose problems for businesses operating in multiple locations or managing data across different data centers.

    The Power of Cloud Technology

    In contrast to relying on data centers, cloud technology offers businesses of all kinds and sizes immense scalability and flexibility in terms of data management solutions. 

    As a service that delivers computing infrastructure, software, or storage as a service via a network connection, typically the Internet, cloud technology eliminates the need for physical proximity to servers. It is quickly scalable, both upwards and downwards, as per business needs, ensuring that you only pay for what you use.

    Moreover, the ability of cloud technology to integrate various services can simplify business operations and enhance customer engagement. For instance, many businesses are now offering cloud-based text-to-pay systems that allow customers to pay from any device, providing ease of transaction while simultaneously gathering customer data in the cloud.

    Cloud services can also provide robust disaster recovery and business continuity solutions. However, businesses often cite concerns about data security and privacy in the cloud. Although most cloud service providers implement best-in-class security protocols, the very nature of the cloud—being an off-premises solution—necessitates a high level of trust in the provider.

    AI and Data Management Solutions

    If your business relies heavily on AI applications, you must understand how your data management solution supports this need. AI requires high-quality, well-managed data to function effectively. Here, cloud technology often presents an edge over traditional data centers.

    Many cloud service providers offer built-in tools and services designed to better facilitate AI implementation, including pre-trained machine learning models and AI platforms as a service. These resources can dramatically reduce the time, costs, and complexity that come with implementing AI, particularly for small to mid-sized businesses without extensive in-house AI expertise.

    On the other hand, while data centers might not have these built-in tools, they offer robust performance capabilities for AI workloads and often provide more control over the data, which is vital for sensitive AI applications.

    Keep in mind you can turn to other server-based solutions for storing data as well. For example, if your application relies on a significant amount of PDF content to store data and function effectively, hosting those files on a server such as a server-side PDF SDK will allow you to process those documents on the server via an API. This will then allow you to autoamte your document processing and convert large volumes of your PDF files. 

    Web Hosting Requirements

    Your current web hosting requirements can also significantly impact the choice between data center services and cloud technology. Shared hosting services may be sufficient for businesses with low-traffic websites or applications, and if you don’t need to store a lot of data, but as your traffic increases and the website grows, so do your hosting requirements. 

    Cloud hosting solutions offer excellent scalability, allowing your website to grow with your business. As traffic surges, cloud servers can easily handle the increase, maintaining website performance and user experience.

    Conversely, with a dedicated data center, you’re generally limited to the capacity of the server you rent. To increase your capacity, you may need to physically upgrade the hardware, a process that can result in downtime and potential loss of revenue.

    Considering Cost Implications

    The overall cost of your chosen solution will be a key factor when deciding between data center colocation services and cloud technology. Each service has unique cost structures that can vary between providers, and understanding these can significantly impact your company’s financial health and resource allocation.

    With data center colocation services, the costs are generally more predictable. You pay a fixed amount based on your rented server space and the bandwidth you use. This stability can be advantageous for budgeting purposes, especially for businesses with steady data usage and processing needs. However, you may also incur additional expenses for any necessary hardware upgrades, maintenance, or increased bandwidth usage.

    What’s more, there’s the indirect cost of employing or training staff to manage the servers, plus the potential costs of transportation to and from the data center, particularly for businesses not located near their rented server space. These costs can add up and should be factored into the total cost of operating within a data center.

    Cloud services, conversely, operate on a pay-as-you-go model. This solution can be much more cost-effective for businesses with shifting data needs since you can readily scale up or down based on demand, ultimately only paying for the resources you actually use.

    Choosing the Right Path for Your Organization

    Unfortunately, there’s no one-size-fits-all solution for effective data management. Each business has unique needs, requirements, and considerations that necessitate a carefully tailored approach. When choosing between cloud technology and data center colocation services, business leaders must carefully consider several key factors to determine the right solution for them.

    If scalability, flexibility, and AI integration rank high in your data management strategy, cloud technology presents an excellent solution with its on-demand resources and array of built-in tools. On the other hand, data center colocation services provide robust performance capabilities, greater control over data, and predictable costs—features that may appeal to businesses with more consistent data management needs.

    Understanding your current web hosting requirements and the potential cost implications of each solution are also crucial elements to consider in your decision-making process. The demand for efficient, secure, and cost-effective data management solutions will only continue to grow as data storage needs expand rapidly.

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    devopsy.kinsta.cloud is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

    Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    Indeed.com

    Salesforce
    San Francisco, California
    DevOps Engineer
    $183,310 to $183,900

    SimplyHired.com

    Sony Electronics
    Culpeper, Virginia
    DevOps Engineer
    $130,000 to $155,000

    CareerBuilder.com

    The Navy-Marine Corp Relief Society
    Arlington, Virginia
    DevOps Network and Infrastructure Engineer for Azure
    $120,000 to $140,000

    LinkedIn

    KPMG
    Fort Lauderdale, Florida
    DevOps Cloud Engineer-Remote
    $113,000 to $242,000

    Dice.com

    Steam IT
    Austin, Texas
    DevOps Engineer
    $100,000 to $120,000

  • How New Tech Elevates Release Management’s Quality Standards

    How New Tech Elevates Release Management’s Quality Standards

    Release management is a critical discipline within software development and IT operations that focuses on the planning, scheduling, coordination and deployment of software releases. It includes the procedures, plans and methods employed to guarantee that software updates or items are sent to customers in a secure and effective way. Release management’s main objective is to make it possible for software releases to be delivered reliably and smoothly while causing as little disturbance as possible for the company and its users. This entails overseeing a release’s whole lifespan, from preliminary planning through testing, deployment and post-release support.

    Challenges in Traditional Release Management

    Traditional release management approaches often face several challenges that can hinder the efficient and effective delivery of software releases. These include manual and time-consuming processes, lack of visibility and traceability, complex and fragmented environments, limited collaboration and communication and a lack of effective communication channels and collaboration tools. Manual processes can be time-consuming, error-prone and lead to delays in release cycles. Lack of visibility and traceability can make it difficult to track the status of releases, identify bottlenecks and troubleshoot issues effectively. Fragmented environments can be complex and differ widely from one another, making managing and synchronizing these environments manually challenging and prone to errors.

    Limited collaboration and communication can lead to miscommunication, delays and misunderstandings. Traditional release management can lead to silos between development, operations and other stakeholders, hindering efficient coordination. Inconsistent release practices can lead to variations in processes, documentation and quality standards, making it difficult to establish a standardized and repeatable release process. Lack of automation and continuous integration can slow down the release process, increase the chances of human errors and inhibit the ability to deliver frequent, small and reliable releases. Limited scale and adaptability can be addressed by adopting new technology and modernizing release management practices. Automation, continuous integration, deployment pipelines, collaboration tools and standardized processes can help overcome these hurdles and enable more efficient, reliable and quality-driven release management.

    Benefits of New Technology in Release Management

    Advanced Testing Techniques for Improved Quality Assurance

    1. Enhanced speed and efficiency
    2. Improved interaction and collaboration
    3. Improved stability and quality of software
    4. Reduced risk and downtime

    Using New Technology: Implementation Techniques

    1. Organizational readiness assessment
    2. Choosing the correct technologies and tools
    3. Developing an all-inclusive release management strategy
    4. Embracing the DevOps and Agile principles

    The Impact of New Technology on Release Management Quality

    Automation: Accelerating Release Cycles and Ensuring Consistency

    Automation plays a pivotal role in release management by significantly accelerating release cycles. It reduces manual effort and expedites the delivery of software releases, leading to a faster time-to-market. Automated workflows enforce standardized practices, configurations and environments, resulting in more reliable and predictable releases. Automated testing frameworks and tools enable faster and more comprehensive testing, while continuous integration and automated build processes facilitate seamless integration of code changes. Automation also enables better visibility and traceability, allowing release management teams to track the progress of releases, identify bottlenecks and analyze performance metrics.

    Continuous Integration: Early Detection of Issues and Improved Collaboration

    Continuous integration has revolutionized software development practices by emphasizing early issue detection and enhanced collaboration. By regularly integrating their code, businesses can spot problems early and fix them, decreasing the possibility of significant issues later in the development cycle. Additionally, increased developer collaboration encourages better coordination, communication, and information sharing, which results in a more effective and unified development process.

    Organizations can profit from continuous integration by utilizing automated build processes, extensive test suites and a collaborative development environment. Early problem identification and enhanced teamwork not only lead to better software quality but also enable development teams to build applications more quickly and consistently. Organizations can achieve improved efficiency, productivity and success in the dynamic world of software development by adopting continuous integration as a core practice.

    The Role of Innovation in Breaking Barriers: Future Outlook and Trends

    Machine Learning and Artificial Intelligence in Release Management

    Release management is not an exception to the way that machine learning (ML) and artificial intelligence (AI) are transforming numerous sectors. Technologies based on machine learning and artificial intelligence (ML and AI) provide useful capabilities that can significantly improve release management procedures, increase effectiveness, and promote improved software quality. The function of ML and AI in release management is described in more detail below:

    Automated Testing and Quality Assurance:
    In release management, ML and AI may automate and enhance testing and quality assurance procedures. Intelligent algorithms can examine enormous amounts of data to find trends, anomalies and potential issues in brand-new software releases. To cut down on testing time and effort while maintaining high standards, ML models can be trained to anticipate and prioritize test cases. AI-driven testing solutions can also suggest the right test coverage and offer insights into the effects of code modifications.

    Predictive Analytics for Release Planning
    ML and AI approaches can be used to create prediction models for release planning using past release data, such as metrics, logs and performance statistics. These models are able to predict potential dangers, predict release dates, and allocate resources more efficiently. Release managers may prioritize important tasks, make data-driven decisions and improve the planning process for software releases by employing AI-driven insights.

    Anomaly Detection and Continuous Monitoring
    ML and AI algorithms can continuously monitor the production environment, analyzing real-time data to spot anomalies and potential problems. Release management teams can proactively identify and respond to performance bottlenecks, security breaches, and other key occurrences by putting in place sophisticated monitoring solutions. A faster and more reliable reaction to production issues can be achieved with the use of ML-powered anomaly detection, which can decrease the mean time to detect (MTTD) and mean time to resolve (MTTR).

    Impact Analysis and Risk Assessment for Releases
    ML and AI approaches can be used to evaluate the hazards that may be involved in a release. ML models can estimate the effect of a release on several areas like performance, stability and user experience by assessing historical data, code modifications, dependencies, and environmental factors. Release managers can prepare mitigation methods, make educated decisions, and reduce the likelihood of unforeseen problems throughout the release process thanks to these risk assessment skills.

    Intelligent Release Deployment and Rollback
    ML and AI technology can help with intelligently choosing when to deploy and roll back a release. In order to recommend deployment tactics, machine learning (ML) models can learn from previous deployment experiences, including success rates, user input and mistake patterns. In order to ensure a more dependable and error-resistant deployment process, AI algorithms can track the deployment process, evaluate the system’s health and initiate automated rollbacks if anomalies or severe concerns are discovered.

    In general, ML and AI provide valuable capabilities to release management, boosting testing and quality assurance, streamlining release planning, enabling continuous monitoring, analyzing release risks and simplifying wise deployment decisions. Utilizing these technologies enables businesses to improve software quality, streamline release management procedures, and deliver high-performing applications more effectively and reliably.

    Microservices Architecture and Cloud-Native Technologies
    With the advent of cloud-native technologies and the adoption of microservices architecture, release management has been transformed, enabling organizations to leverage the benefits of scalability, agility, and flexibility. Let’s explore how cloud-native technologies and microservices architecture enhance release management:

    Containerization and Orchestration
    Release management has a solid foundation thanks to cloud-native technologies like containerization (like Docker) and orchestration frameworks (like Kubernetes). Application components are encapsulated in containers, which makes them very portable and independent of the underlying infrastructure. Release management can use containerization to streamline application packaging and distribution while ensuring consistent application deployment across a variety of environments. Frameworks for orchestration allow for automated container deployment, scaling and administration, speeding up release management procedures.

    Scalability and Elasticity
    Applications can use cloud-native technologies’ inherent scalability and elasticity to dynamically modify resources in response to demand. The modular and independent services of the microservices architecture make granular scalability possible. Release management can use these features to scale individual services or components on their own, ensuring optimal resource usage and effective handling of increasing user loads. This adaptability reduces downtime and enhances the application’s general performance during releases.

    Fault Isolation and Resilience
    Failures in one service do not affect the entire system, thanks to the fault isolation and resilience that the microservices architecture fosters. Release management can use this resilience to lessen the impact of any potential issues during releases. It is possible to roll back or replace a specific service if it develops issues without affecting other services. Release management may efficiently manage errors, improve fault tolerance and maintain service availability during the release process by implementing cloud-native technologies and microservices.

    Observability and Monitoring
    The enhanced observability and monitoring capabilities made possible by cloud-native technology allow for release management. Platforms for container orchestration include integrated monitoring and logging capabilities that give information on the efficiency of an application’s use of resources and the state of the system overall. With the use of this information, release management teams can proactively monitor releases, spot abnormalities and quickly resolve problems. Observability and real-time monitoring support the release process by ensuring the dependability and stability of programs.

    Release management greatly benefits from cloud-native technologies and microservice architecture. Organizations can improve their dependability, achieve faster and more frequent releases, achieve scalability, fault isolation, and observability, and produce high-quality software applications by leveraging containerization, orchestration, CI/CD methods and many other technologies. Organizations are better equipped to manage complex release cycles and adjust to the changing needs of the software industry when they adopt these cutting-edge methods.

    Conclusion

    In this article, we have explored new technology’s role in raising the bar for release management quality standards. Organizations may increase communication, optimize processes, and more quickly produce high-quality software by adopting automation, continuous integration and DevOps approaches. The advantages and revolutionary potential of new technology in release management are apparent, notwithstanding the risks and difficulties that may arise. Organizations may promote continuous improvement, adjust to market demands and succeed in today’s changing business environment by tearing down barriers and embracing innovation.

  • The DevOps Pendulum: Agility Vs. Control

    The DevOps Pendulum: Agility Vs. Control

    Managing changes to cloud assets is a universal pain felt by many engineering leaders today, despite all of the advancements in tooling and practices like GitOps. This is because, in reality, it is simply impossible to always have everything completely locked down—we don’t live in a utopia with zero incidents. If your engineering organization prevents any changes from being made through the cloud console or to your infrastructure-as-code (IaC) without complying with strict GitOps practices or change management processes via CI/CD, then it’s likely you have very frustrated developers—developers who can’t troubleshoot or debug in real-time and who have little control in a real-world incident.

    Engineering, like everything else in life, is all about balance.

    The Pendulum Swings

    The pandemic created a whole new mindset and practice for managing distributed and high velocity engineering and operations. Overnight, companies that were not built for remote ways of working had to continue their operations in a global, distributed and asynchronous way that they weren’t completely familiar with. This required a new way to think about software delivery—and it accelerated the DevOps practices that support that delivery. Self-service infrastructure removed barriers for developers to ensure continued performance and velocity.

    At the same time, your cloud cannot be the wild west with everyone creating bespoke infrastructure. It becomes impossible to manage, and misconfigurations can be risky. Guardrails and policy automation have become a hot topic. Today, with tech markets depressed and cloud costs escalating, there seems to be a growing trend toward locking things down again, even at the risk of frustrating developers.

    This begs the question: How can you achieve unencumbered infrastructure for your developers while simultaneously following policies and best practices for compliance, risk and cost? There is a way to find balance.

    Like many aspects of security, we’ve learned that when constraints and barriers are too high, users ultimately find ways to bypass them. This is true for operations, as well. While sometimes it might seem easier to lock everything down than design a better and more balanced way to enable developers to move fast, eventually this approach backfires. This is the exact same evolution the application and cloud-native security industry are undergoing right now.  All the guardrails and controls applied have created too much friction in development processes and developers ultimately bypass them.

    Real-Time Insight is Key

    CloudOps can learn a lot from the disruption the security industry is going through today. In the same way that point-in-time security has been rendered completely useless, non-real-time alerting or eventual alerting to infrastructure drift just won’t cut it when managing an ephemeral cloud. What is really needed is the same kind of real-time and continuous scanning of cloud assets and IaC, similar to what we apply to our systems through monitoring and observability. These solutions became an essential backbone of our business to ensure continuous operations and availability of cloud services.

    As we embrace IaC and the benefits it brings, everything-as-code unlocks greater agility and visibility, enabling you to automatically remediate without locking everything down. As DevOps says, “fail forward and fail fast.” Rather than focusing on never making a mistake, focus on how to fix it immediately. 

    The Solution

    By providing a continuous comparison of actual cloud assets with their desired state through IaC and GitOps, it’s possible to surface configuration drift and policy violations immediately, much like any other kind of breach or major system failure. Failures and incidents are inevitable. It’s unrealistic, and even dangerous, to build systems with an inherent underlying design that prevents you from changing something at the cloud console at 2:00 A.M. during an outage.

    With a locked-down approach, a developer would need to wait for the change management approval during a high-pressure production incident, oftentimes at 3:00 A.M. (because the incident gods of always make them happen in the middle of the night) or on a weekend. We don’t need to look much further than the catastrophic 40-minute and $440 million Knight Capital incident to understand that sometimes time is not on our side and that a delay can have severe consequences.

    Cloud drift has become equally troubling as uptime or any other mission-critical aspect of continuous business operations, and that’s why we need to apply the same principles for monitoring drift in real-time as we do to our CPU and load. This will make it possible to be alerted when your cloud and your IaC are no longer aligned and even flag issues that can be prevented in real-time. You can automate ticket creation and escalation and also triage whether this is something that needs to be fixed in real-time with remediation suggestions provided or open a ticket to fix it later. The choice should be yours, not made by an administrator who has a lot less context about the systems and the ultimate business impact.

    It is Not ‘One and Done’

    Some vendors preach codifying your cloud into IaC and then locking it down so that you’ll never have to do it again. This feels like deja vu; we’ve definitely heard this before. It sounds a lot like the ‘write once, deploy anywhere’ JVM promise that never quite panned out. 

    By going down this path, you’re resigning yourself to never adding new cloud assets or changing your cloud configurations. If there’s one thing we’ve learned about the cloud, it’s that it’s a constantly moving target.  (Read what cloud asset management can learn from the world of finance—another industry in constant flux). If this didn’t work decades ago with the JVM, it certainly won’t work in a dynamic and constantly changing environment like the cloud. That’s a fool’s journey.

    Continuous Cloud Up to Code

    There are major downsides of locking down agility and velocity. This is hard-earned advice, witnessed firsthand from tools like legacy CMDB and startups who have forgotten that cloud is ephemeral—and possibly the reason why we all use it in the first place! So if our cloud is constantly changing and is a continuously moving target, then shouldn’t our tools be built in just the same way to keep up? Solutions built for the rapidly evolving cloud-native era must continuously look for new, unmanaged and changed assets and ensure their cloud infrastructure always follows policies and regulatory standards.  

    Once we are able to find the balance between agility and control, we’ll be able to tap into the benefits of speed and safety (as DORA research shows time and again) that are the benchmark of high-performing teams. Automating cloud asset management can provide governance, policies and control while still enabling the velocity and agility engineering organizations today require. 

    Agility Versus Control

    There’s a minority of people who claim they don’t worry about cloud asset configuration drift because they have everything completely locked down. Zero changes can be done at the cloud console or to IaC without going through GitOps for strict change management processes via CI/CD. I bet they have happy developers—not!

    Life is All About Balance

    Throughout the pandemic, organizations had to make developers happy for fear they would leave. So DevOps went full tilt aiming for self-serve infrastructure for developers to remove barriers to speed and velocity. Now, with tech markets depressed, maybe it’s easier to lock things down even if that risks losing engineers.

    As we embrace IaC and its benefits, you need not live in the stone age of locking everything down. How can you achieve unencumbered infrastructure for your developers while following policies and best practices for compliance, risk and cost? There is a way. 

    The solution? Real-time continuous scanning of your cloud assets and your IaC with continuous comparison can surface configuration drift and policy violations immediately. Emergencies are inevitable. It’s bold/stupid/foolish to think you’ll never need to change something at the cloud console during an emergency or that a developer will wait for change management when production is down at 3:00 A.M. on a weekend. It happens, and you must deal with it. 

  • Snyk Survey: AI Generating More Vulnerabilities in Code

    Snyk Survey: AI Generating More Vulnerabilities in Code

    A survey of 404 IT professionals conducted by Snyk found the use of artificial intelligence (AI) to write code is creating a security paradox. On one hand, just over three-quarters of respondents (77%) said AI tools improve code security. At the same time, however, 59% are concerned that AI tools trained using general-purpose large language models (LLMs) will introduce security vulnerabilities that first appeared in the code used to train them.

    The challenge with general-purpose LLMs is that they are trained using a combination of excellent, mediocre and flawed code. As a result, any recommendation surfaced has the potential to be a suboptimal security result.

    Randall Degges, head of developer relations for Snyk, said that as AI tools increase the velocity at which applications can be constructed, it’s probable that DevOps teams will discover more vulnerabilities in their code.

    In general, 61% of respondents also noted that automation has increased the number of false positives, with 62% of respondents reporting that at least one out of every four vulnerability alerts they received from automation tools were false positives. Well over a third (35%) said false positives represented over half of the vulnerability alerts.

    On the plus side, however, more organizations are paying closer attention to application security issues in the wake of several high-profile breaches of software supply chains and disclosures of vulnerabilities. A full 96% reported their organizations are addressing supply chain security problems on an ad hoc basis, yet only half have a formalized supply chain security strategy in place.

    The survey also finds 87% of respondents work for organizations impacted by a software supply chain security issue in the last year, with 61% having implemented new tools and processes as a result.

    A total of 62% of respondents work for organizations that have a software life cycle assurance process in place, but only 42% of organizations are using software bills of materials (SBOMs). In addition, only 40% have formal security ratings for the open source packages that developers employ, and 31% ignore risks that arise from indirect dependencies.

    However, only 40% of organizations have embedded security testing tools into their integrated development environments (IDEs), with 40% not using software composition analysis (SCA) or static application security testing (SAST) tools at all. In fact, even though 80% of respondents reported working for organizations that ship code daily, only 27% claim to continuously audit their code.

    As a result, many vulnerabilities remain unpatched, with Java (42%) and JavaScript (31%) topping the list in terms of code with the most ignored vulnerabilities.

    Finally, the survey also noted that vulnerabilities involving open source code are now being remediated faster than proprietary code. Maintainers of open source software are now paying more attention to cybersecurity issues thanks in part to the tools and best practices provided by the Open Source Security Foundation (OpenSSF), said Degges.

    There will, of course, come a day when AI is more widely used to analyze vulnerabilities in code. In effect, AI will be used to solve some of the security issues general-purpose LLMs create. In the meantime, however, DevSecOps teams would be well-advised to proceed with caution.

  • Extending the GitOps Pipeline: DevSecOps and Trusted Application Delivery

    Extending the GitOps Pipeline: DevSecOps and Trusted Application Delivery

    We live in a fast-paced world of rapid changes and uncertainty where every aspect of our daily lives changes often, including the way we work and communicate. Organizations must deliver value to their customers at a much faster pace than ever before to thrive in such an environment. However, the decentralized nature of cloud infrastructure expands the threat landscape and poses several security risks that enterprises should address in light of recent data breaches.

    Organizations must combat security threats and address challenges arising from cloud misconfigurations. Several recent tools, strategies, practices and technologies have emerged that can help you handle such security threats. This article discusses how the fusion of DevSecOps and trusted application delivery can extend the GitOps pipeline and add business value.

    What is GitOps?

    Coined by Weaveworks in 2017, GitOps thrives on a source code management system built on Git and adheres to the belief that Git is the single and definitive source of truth. Since all changes are stored in Git, anyone can see the audit trail if necessary. This enables you to use Git-based version control to manage your application’s code, environment and processes.

    Figure 1: CI/CD with Git-based Version Control

    GitOps leverages Git repositories as the one and only source of truth and embraces DevOps and infrastructure-as-code (IaC) best practices. Using GitOps, your developers can spend more time developing applications than configuring or maintaining Kubernetes clusters.

    GitOps strategies are gaining traction with enterprises for various reasons, including improved productivity, increased deployment frequency and improved security. While it’s true that GitOps continues to be a transformative trend, the increased speed and automation can also lead to misconfigurations that compromise application stability and security.

    Figure 2: CI/CD using GitOps

    Often, these security vulnerabilities delay development as developers spend significant time and effort investigating them. Since this poses a hindrance to progress, the question that arises is how enterprises can maintain the frequency and speed of deployment while remaining secure and reliable. This is where trusted delivery comes in.

    An Extension of DevOps

    DevOps is a software engineering practice and culture that blends development and operations to provide a shared and collaborative approach to developing and maintaining software. This can boost productivity, lower costs and increase customer value through increased collaboration.

    GitOps extends DevOps to bring the deployment workflow closer to developers. GitOps integrates code and configuration management for cloud-native application deployment and administration, while DevOps fosters shared ownership, transparency, and rapid feedback.

    GitOps uses DevOps-proven practices like version control, code review and CI/CD pipelines with any Git-based repository, including GitHub, GitLab or BitBucket. It builds on DevOps and applies DevOps best practices for infrastructure automation.

    What is Policy-as-Code?

    When deploying and managing cloud-native infrastructures, adhering to security best practices and regulatory standards is critical without hindering development. Policy-as-code is an approach to infrastructure security in which rules are codified and enforced, thereby reducing or eliminating human errors. You can use it to write applications using a high-level language to control, manage and automate policies. With policy-as-code in place, developers may create applications to manage security, compliance and other regulations seamlessly.

    Here are the types of policies that you can codify:

    • Security Policies: By adhering to these policies, you can protect your software from data breaches caused by misconfigurations.
    • Resilience Policies: The use of these policies in your Kubernetes clusters will help you create highly available, fault-tolerant systems as well as maintain business continuity.
    • Coding Standards Policies: These policies can enforce coding consistency, i.e., any code that violates these policies will be rejected automatically by the system.

    What is Trusted Application Delivery?

    Trusted delivery entails codifying security policies within your software delivery pipeline for security and compliance and introducing guardrails at every stage. By ensuring the security, integrity and reliability of your applications deployed in production environments, unauthorized access, tampering or malware introduction is minimized. It establishes and maintains trust in application source code, artifacts and deployment pipelines throughout the SDLC process.

    The key objectives of trusted application delivery are:

    • Security: It protects the application from security threats and vulnerabilities
    • Integrity: It verifies the authenticity and integrity of the source code of your application, together with the dependencies, and any artifacts
    • Reliability: It ensures that the applications deployed to the production are stable and are devoid of any security loopholes so that they can perform as desired

    Trusted application delivery helps development teams release applications early and secures them with automated protections or guardrails. It extends the GitOps pipeline by integrating security, governance and verification with policy-as-code. These security measures are implemented with policy-as-code. The policy-as-code approach encompasses the entire SDLC, including the design, development, testing and deployment stages.

    According to your organization’s security and compliance policies, compliance and security rules are codified and integrated into the system. Throughout the life cycle of your application, you can manage its security, compliance and other regulations using policy-as-code. These code-defined policies prohibit the provisioning of non-compliant resources. You should implement trusted application delivery practices to secure your organization’s application delivery process and reduce the likelihood of unauthorized access.

    Here are the key benefits of trusted delivery:

    • Faster and more frequent releases
    • Enhanced security
    • Protect against misconfigurations
    • Avoid compliance violations
    • Improved collaboration

    What is DevSecOps?

    DevSecOps is a software development methodology that blends development (Dev), security (Sec) and operations (Ops) at all phases of the SDLC by incorporating mandatory security checks. An organization of any size can benefit by creating a culture of shared responsibility and collaboration by bridging the gap between development, security and operations teams.

    A DevSecOps pipeline adds practices such as scanning, policy enforcement, static code analysis, threat intelligence and compliance validation to the SDLC process. Contrary to traditional software development processes that treat security as an afterthought leading to security vulnerabilities and breaches, DevSecOps is a paradigm shift that fosters a culture of proactive and continuous security approach to help address security concerns and vulnerabilities.

    DevSecOps and GitOps help organizations adapt quickly to changing emerging trends and requirements. DevSecOps is an offshoot of DevOps that focuses primarily on security throughout the development process. It helps detect and resolve security issues and vulnerabilities easily and quickly while fostering a culture of continuous improvement.

    Here are the benefits of DevSecOps at a glance:

    • At the outset, determine which points in the SDLC process are susceptible to security flaws and vulnerabilities in the SDLC process
    • Streamlined compliance
    • Secure supply chain
    • Reduced risk of the attack surface
    • Complete visibility of potential threats

    Why DevSecOps?

    DevSecOps is a proven way to secure your CI/CD pipelines, deliver secure, trusted, high-quality software and foster an environment where security is the responsibility of everyone in the organization. By shifting security left—i.e., introducing security into the CI/CD pipeline earlier—organizations can be much more productive and the teams can be more cooperative and collaborative.

    Given the threats to the security of the software supply chain, DevOps practices have given way to DevSecOps practices, where safety is paramount and a fundamental and ongoing component of software development. At the outset of the SDLC, you should ensure that software components and dependencies are secure to avoid potential software supply chain hazards.

    Additionally, it would help if you had built-in security gates in each step of the SDLC to ensure consistent, repeatable and automated processes from the software build phase to deployment. Remember, DevSecOps isn’t an option; instead, it is a necessity.

    Trusted Delivery With GitOps

    Automated software delivery pipelines are based on Git as the only source of truth. Policy-as-code is a great way to ensure that misconfigurations and errors are detected, alerted, and deployments halted automatically. Next, we’ll cover how a typical GitOps workflow determines where multiple checkpoints can be implemented for trusted delivery.

    In a typical workflow based on GitOps, a developer commits the source code to a Git repository. The CI tool then builds the container images. These container images are then tested and then uploaded to an image repository. At the end of this process, these container images will be deployed to a Kubernetes cluster. GitOps agents compare the current cluster state with the desired state on a continuous basis.

    Hence, you should implement security guardrails at the following points:

    • Git repository
    • CI stage
    • Configuration repository
    • Kubernetes cluster

    Creating a Trusted Software Supply Chain With DevSecOps

    You can build a trusted software supply chain by incorporating security practices throughout the SDLC to ensure the integrity and security of the software delivered by DevSecOps. Here is a step-by-step guide to building a trusted software supply chain by leveraging DevSecOps principles:

    • Security by Design: You should integrate security right from the outset of the SDLC and identify the key threats to the security of the pipeline.
    • Application Dependency Scanning: When building applications, we often use third-party dependencies to accelerate the development process. You should monitor security vulnerabilities and patches as they become available for these dependencies. You can leverage OWASP Dependency Check, Firewall from Sonatype, etc.
    • Secure Coding Practices: You should adhere to and enforce these practices among your development teams. You can integrate static code analysis tools into your DevSecOps pipeline, conduct regular code reviews and identify and fix security issues.
    • Container Security: You should scan container images regularly for security vulnerabilities, implement strategies to secure your containers and use container registries with access controls.
    • Continuous Compliance: You should ensure the software supply chain adheres to the relevant standards and guidelines for compliance requirements. In this regard, you should conduct audits regularly to check if compliance requirements have been satisfied.
    • Collaboration and Communication: You should be able to foster a culture in your organization that facilitates collaboration and communication across the development, operations and security teams.

    DevOps, DevSecOps and GitOps: The Future

    As organizations strive to optimize the efficiency of their software supply chain, DevOps, DevSecOps and GitOps are approaches that can improve collaboration, efficiency and security, to help software developers and IT operations succeed. These practices would become more critical and widely used in the future. GitOps provides teams with better tools for managing configurations so they can focus on more strategic activities.

    While GitOps is an approach that advocates Git-based version control systems as the single source of truth, DevOps is concerned about a cross-functional team that can work together. DevSecOps goes a step further by blending security into all stages of the SDLC process.

    The future of DevOps, DevSecOps and GitOps will see increased automation, tighter security integration and a sustained emphasis on efficiency and collaboration. Your organization should adopt these approaches to provide reliable software and services to its customers.

    Conclusion

    Trusted application delivery is essential for securing applications, protecting user data, meeting compliance requirements and preserving market credibility and trust. It helps enterprises and end consumers by ensuring that software is distributed securely and reliably. Organizations can ship high-quality applications with guaranteed security and performance by adopting trusted delivery practices.

  • Palo Alto Networks Extends CNAPP to CI/CD Platforms

    Palo Alto Networks Extends CNAPP to CI/CD Platforms

    Palo Alto Networks has extended the reach of its cloud-native application protection platform (CNAPP) to include the ability to secure continuous integration/continuous delivery (CI/CD) platforms.

    Daniel Krivelevich, CTO for application security for Prisma Cloud at Palo Alto Networks, said this extension of the Prisma Cloud platform would make it easier to better secure software supply chains as software builds are continuously updated by application development teams.

    Previously, Palo Alto Networks provided the ability to secure runtimes and secrets and scan code for vulnerabilities as it is being developed. This latest extension now adds the ability to secure the CI/CD platforms that drive DevOps workflows, he noted.

    While more organizations than ever are shifting application security responsibility further left toward developers, many of them overlook the need to secure the CI/CD platform itself. Most developers are not cybersecurity experts, so the chances they will miss something that can find its way into a software build are still high. Extending the reach of Prisma Cloud to the CI/CD platform will ensure the build that forms the foundation of the code is free of vulnerabilities when it finds its way into a production environment.

    That’s critical, because cybercriminals are becoming more adept at injecting malware into software supply chains in the hopes of being able to eventually compromise multiple downstream applications. In fact, this issue has prompted governments around the world to hold more organizations legally responsible for the security of the applications they build and deploy.

    There are, of course, multiple approaches to securing software supply chains, but Palo Alto Networks is making a case for an integrated platform that provides a comprehensive approach to securing the entire IT environment. Rather than integrating multiple point products, a CNAPP ultimately reduces the total cost of cybersecurity on an end-to-end basis, noted Krivelevich.

    It’s not clear how quickly organizations are transitioning to CNAPPs, but as that transition occurs, the overall state of application security should improve. One of the issues that has historically plagued application security is no one in an organization has been specifically tasked with ensuring it. Application development teams assumed cybersecurity professionals were allocating funds to it. Cybersecurity teams, however, tended to focus on areas they directly controlled, such as network firewalls. A CNAPP makes it simpler to deploy a cybersecurity framework in a more extensible way.

    Of course, there’s still much work to be done when it comes to prioritizing vulnerability remediation efforts. The truth is developers only have so much time to allocate to developing patches, so the focus needs to be on identifying the vulnerabilities that are the most severe in terms of the amount of damage that might be inflicted. At the very least, however, a CNAPP should provide the means by which the context required to identify those vulnerabilities could be more easily shared.

    One way or another, however, the number of vulnerabilities finding their way into production environments should steadily decline as more focus is put on securing software supply chains.

  • New Relic Adds App Security Testing Tool to Observability Platform

    New Relic Adds App Security Testing Tool to Observability Platform

    New Relic today made available a public preview of an application security testing tool that will be integrated into its observability platform.

    Esteban Gutierrez, CISO and vice president of information security for New Relic, said the New Relic Interactive Application Security Testing (IAST) will provide DevSecOps teams with the context needed to identify the root cause of a cybersecurity issue down to specific lines of code.

    DevSecOps teams will be able to take advantage of IAST to identify vulnerabilities both in code as it is written and after it has been deployed in a production environment without any false positives, he noted.

    New Relic achieves that goal using deterministic testing techniques that surface an actual proof-of-exploit using observability data collected from both applications and the underlying infrastructure upon which they depend, said Gutierrez. DevSecOps teams are then provided with guided remediation suggestions, guardrails and tracking tools to both remediate the issue at hand and prevent it from reoccurring, he noted.

    New Relic IAST takes advantage of the agent software New Relic provides to collect observability data, which reduces the total cost of DevSecOps by providing IT teams that have adopted the New Relic platform with an integrated set of application security testing tools that doesn’t require them to acquire and manage a separate additional platform, added Gutierrez.

    That approach also ensures that application security testing is integrated with the continuous integration/continuous delivery (CI/CD) platforms that New Relic already observes, he added.

    The reason most vulnerabilities are not remediated in a timely fashion is the DevOps teams responsible for creating and deploying the required patches lack any context. They often don’t know, for example, how many instances of a vulnerability there might be or the actual level of severity. Without those insights, it becomes exceedingly difficult to prioritize remediation efforts, noted Guttierrez.

    As application security requirements become more stringent in the wake of forthcoming legislation, it’s now more of a question of when than if organizations will be required to better secure their software supply chains. The issue DevOps teams face now is finding a way to integrate application security testing tools into existing DevOps workflows without slowing down the pace at which applications are being developed.

    Of course, not every vulnerability discovered requires the same level of attention. Depending on its severity and likelihood of being exploited, DevOps teams need to prioritize which vulnerabilities need to be remediated first. There simply are not enough resources available today to fix every vulnerability an application might have. For the foreseeable future, there will remain technical debt involving vulnerabilities that will need to be addressed after an application is deployed in a production environment.

    The issue, of course, is that cybercriminals are getting more adept at exploiting those vulnerabilities. The amount of time any DevOps team has to resolve issues before they result in a breach continues to dwindle.

  • Dynatrace Adds Generative AI Capabilities to Davis Engine

    Dynatrace Adds Generative AI Capabilities to Davis Engine

    Dynatrace today revealed it has added generative artificial intelligence (AI) capabilities to its Davis engine it uses to apply machine learning algorithms to its observability platform.

    Steve Tack, senior vice president for product management at Dynatrace, said that hypermodal approach to AI will allow DevOps teams to take advantage of probabilistic AI capabilities provided by Davis CoPilot that are enabled by large language models (LLMs) originally developed by OpenAI.

    The generative AI capabilities effectively provide DevOps teams with a tool that surfaces workflow recommendations via a natural language interface. The recommendations are based on historical data such as sales and customer experience trends, seasonality and cloud application health. It is also able to analyze dependencies across large sets of data while retaining context accessed via the Dynatrace Grail data lakehouse and the Dynatrace Smartscape application visualization and mapping framework.

    Dynatrace is now making a case for a multimodal AI platform that uses a common set of metrics, traces, logs, user behavior and topology to enable machine learning algorithms to predict anomalies and causal-AI dependencies to determine the root cause of an IT issue and then leverage generative AI to provide recommendations to resolve it. The company is forecasting IT teams will achieve 10% to 20% productivity improvements year-over-year as a result.

    It’s too early to determine the full extent to which a multimodal approach to AI will transform IT management, but it’s clear that as IT operation teams become more productive, more time will be freed up for innovation, noted Tack. Many of the manual tasks that IT teams still need to perform divert time away from building and deploying additional applications, he added.

    Naturally, there’s a lot of speculation concerning the impact AI will have on DevOps. Some contend it’s only a matter of time before the entire software engineering process is automated. As those advances are made, the cost of building applications will effectively drop to zero. Others argue that AI will augment DevOps teams in a way that makes it simpler to manage IT at scale using either the same number or possibly even fewer engineers.

    The one thing that is certain is that AI will soon be pervasive, which will drive the adoption of automation frameworks as organizations look to operationalize the insights surfaced by AI platforms. As rich as the insights any AI model surfaces might be, they only provide real value when integrated with an automation framework, noted Tack.

    Ultimately, most DevOps professionals will not want to work for organizations that don’t provide them with AI tools that make it more likely for them to be successful. Organizations that embrace AI may not have a sustainable competitive advantage when every other organization is doing the same, but those that don’t will soon be left behind. Those that succeed will benefit from managing application environments at a previously unprecedented level of scale at minimal additional cost. The challenge is determining which tasks will be automated with an eye toward planning how DevOps roles will need to evolve.