devopsy.kinsta.cloud

Category: Blogs

Ensuring Application Security from Design to Operation with DevSecOps

Safe development is critical for any company that creates software, whether for its own use or for others. DevSecOps principles focus on automating information security processes and introducing security measures early in software development. DevSecOps is extremely important these days as, according to recent surveys, more than 99% of tech professionals report that, on average, applications in production contain more than four vulnerabilities.

A study conducted by the Ponemon Institute and Rezilion reveals that 78% of those surveyed take over three weeks to address high-risk vulnerabilities in their systems. Furthermore, 30% say managing these vulnerabilities effectively takes more than five weeks.

Application vulnerabilities have become a primary channel for attacks driven by economic and political motives. But where do these vulnerabilities originate from? Firstly, they often arise from development practices, such as using unsafe programming structures or third-party components, frequently open-source frameworks and libraries. Developers might also insert shortcuts to accelerate the development process. Secondly, time constraints can lead to cursory code reviews that focus more on functionality than on thorough, safety-inclusive quality analysis. Lastly, the widespread use of outdated (legacy) software, known for its vulnerabilities and often difficult or impossible to update, contributes to this issue.

Main Stages of Secure Software Development

Using DevSecOps helps ensure the right level of security throughout both the development phase and the entire lifespan of the software. This method also concentrates on identifying and managing risks. By implementing safe development processes, there is typically an 80% reduction in vulnerabilities. Let’s explore the most important stages of this process, illustrated through the security development lifecycle (SDL) approach, widely adopted by many large corporations globally.

• Training
Everyone involved in software development, including all employees, contractors and other relevant personnel, receive training in cybersecurity basics and undergo regular instruction in secure development practices.
• Requirements
The development of each software product starts with clearly defining its security and privacy requirements. These requirements are shaped by factors such as the type of data the product will process, known security threats, established best practices, regulatory and industry standards and lessons learned from past incidents. Since software development is an ongoing process, the security and privacy requirements evolve throughout the product’s lifecycle, adapting to changes in functionality and the ever-shifting threat landscape.
• Design
At this stage, threat models are developed to help identify and categorize threats based on existing and potential risks. This process begins by outlining the different components of a product and how they interact in different functional scenarios, such as authentication. Data flow diagrams visually represent the interactions of data flows, data types, protocols, etc. It is important to keep threat models up to date throughout the product’s lifecycle, adapting them as the software evolves.
• Implementation
Implementation starts with developers coding according to the plan established in earlier phases. It is good to equip developers with secure development tools to incorporate all privacy, security and functionality requirements into their software. Such tools may include secure development environments, compilers and integrated security checks.
• Verification
Before the code is released, it undergoes thorough checks and approvals. Manual reviews are done by individuals separate from the code developers, ensuring a vital separation of duties to prevent any single person from both writing and releasing code. The step also includes a series of automated checks within the commit pipeline, covering aspects such as static and dynamic code analysis, binary analysis, credential and secret scanning, encryption scanning, fuzz testing, configuration validation and open-source software compliance.
• Release
Before launching software into products, a thorough review is conducted to verify if the security features implemented align with the initial specifications set during the design phase. Additionally, a contingency plan is developed to address potential security system breaches. Rather than deploying builds to all users simultaneously, they are incrementally rolled out to progressively larger groups.
• Response
Following their release, all software and services undergo comprehensive logging and monitoring to pinpoint potential security issues.

Main DevSecOps Tools

Let’s explore the tools essential for DevSecOps, integrating security principles into every stage of the software development process.

• Static Application Security Testing (SAST)
Static analysis is performed in a “white box” setting, enabling the detection of vulnerabilities without the need to run the actual code. This approach is most effective in the early phases of development, as it scrutinizes the source code directly, offering the chance to integrate the analyzer into the development pipeline for incremental scanning. However, it has drawbacks, such as a high rate of false positives.

Implementing a static code analyzer aligns well with the shift left concept, which emphasizes introducing checks as early as possible in the product development lifecycle rather than toward the end. This early integration significantly impacts the cost of fixing detected defects. For example, while fixing vulnerabilities identified during the development phase might cost X dollars, addressing these issues at the project release stage could escalate to 10 X dollars, and fixing them once the system is fully operational could soar to 100 X dollars.

• Dynamic Application Security Testing (DAST)
Dynamic code analysis operates in a “black box” scenario, where the tool does not have access to the source code and conducts tests while the program is running. DAST can mimic external attacks using common methods to find vulnerabilities in the application. DAST tools are not limited by programming languages and typically result in fewer false positives. However, their drawbacks include the potential to overlook vulnerabilities and miss certain functionalities because DAST does not fully cover the analyzed code.

• Interactive Application Security Testing (IAST)
IAST combines elements of both SAST and DAST to offer a more integrated and interactive way of detecting vulnerabilities.

Both IAST and DAST analyze live applications to find vulnerabilities. DAST tests the application’s interfaces like an attacker (from an external viewpoint), identifying vulnerabilities through response analysis. However, IAST also operates from within, blending insights from the application’s internal code and data flows with observations of its dynamic behavior during execution. This unique position allows IAST to uncover a wider array of issues, merging the depth of code analysis (similar to SAST) with the practical examination of running applications (similar to DAST). Consequently, IAST achieves greater accuracy and fewer false positives, pinpointing vulnerabilities that emerge only through the application’s operational context.

• Software Composition Analysis (SCA)
SCA scrutinizes open-source components and libraries within a software project. SCA identifies known vulnerabilities, licensing issues and outdated dependencies by examining the codebase against comprehensive databases of known security threats and compliance data. By integrating SCA into the DevSecOps pipeline, teams ensure that proprietary and open-source code adheres to security standards and compliance requirements.

Other Tools and Technologies

The tools mentioned above constitute the minimum set required to ensure the release of secure apps. To maximize your security efforts, it is also good to use additional technologies and tools that can support and enhance the secure development process. Here are some of them:

• Infrastructure-as-Code (IaC) Scanning
With the rise of cloud computing and infrastructure-as-code, scanning these configurations for compliance and security issues becomes critical during development.

• Container Security Scanning
Analyzing container images for vulnerabilities and configuration issues.

• Secret Management
Ensuring that secrets, such as passwords, tokens and keys, are securely managed and accessed is vital to protect access to applications, databases and services during development.

• Access and Identity Management (IAM)
Though not exclusive to the development phase, setting up proper IAM controls ensures that only authorized individuals can access development environments and resources. It can be supplemented with privileged access management (PAM) solutions.

There are many more strategies for ensuring the release of safe apps. For example, using a web application firewall (WAF) helps protect web applications by filtering and monitoring traffic between the web application and the internet.

Network detection and response (NDR) tools can detect and respond to network threats, while virtual private networks (VPNs) create secure internet connections. It is impossible to list all the options in this brief article. Choosing the right security measures depends on your available resources, including budget, expertise and technical capabilities.

Tool Integration and Workflow Optimization

One of the main goals of DevSecOps is to make security a seamless part of the development process, ensuring that security measures do not hinder but enhance development efficiency. Here are some expert tips for achieving this:

• Culture and Training
DevSecOps is as much about cultural transformation as it is about tools and processes. Before diving into technical integrations, ensure your team’s mindset aligns with DevSecOps principles. Underestimating the cultural aspects, such as resistance to change, fear of increased workload or misunderstanding the value of security, can impede adoption. You can address these challenges by highlighting the benefits of DevSecOps, celebrating successes and promoting a culture of learning and continuous improvement.

Developers should be familiar with the nuances of the security tools in use and how to interpret their outputs. Regular training and resources should be provided, empowering developers with the knowledge to address security issues, thereby fostering a proactive security culture.

DevSecOps hinges on breaking down silos between development, operations and security teams. Encourage regular meetings, joint projects and shared goals to build cohesive teams focused on secure development practices.

• Tools Used
Choose security tools that align with your needs and integrate smoothly with existing development and operations infrastructure. Favor those offering robust APIs, CLI support and compatibility with your CI/CD pipeline, as these features are crucial for seamless integration.

While the array of available security tools is vast, avoid deploying them simultaneously. This approach can lead to an overwhelming number of alerts and many false positives, cluttering your workflow. Instead, start with a strategic selection of high-impact tools and adjust settings to minimize unnecessary noise.

Prioritize automation in your security strategy: automate the execution of security scans, such as SAST, DAST and IAST, within your CI/CD pipeline. This automation ensures consistent security checks at every code development and deployment stage, significantly reducing manual intervention and accelerating the development cycle.

Continuous DevSecOps Improvement

DevSecOps is a journey, not a destination. Regularly review the effectiveness of your tool integrations and workflows. Gather feedback from all stakeholders and define metrics to measure the effectiveness of your DevSecOps practices, such as the number of vulnerabilities identified and remediated, the time taken to fix critical issues and the frequency of zero-day attacks and other security incidents. Use these metrics to demonstrate the value of DevSecOps and be prepared to adjust tools, processes and training for improvement.

Conclusion

The statistics are alarming: most applications have vulnerabilities, and fixing them can take weeks or even months, clearly showing that traditional methods are inadequate. Facing the ever-changing threat landscape, implementing DevSecOps practices is essential, not just recommended. Adopting the right mix of tools, practices and a shift-left mindset can significantly lower vulnerability risks.

June 28, 2024
Enhancing Your Company’s DevEx With CI/CD Strategies

In today’s tech landscape, developers’ productivity has become crucial for companies. This has led to the developer experience (DevEx) concept — encompassing how developers perceive and engage with their work environment. Companies deploy various strategies, from offering free food to company-sponsored pet sitting. But the question is, are these working?

Recently, Microsoft enlisted DevEx expert Dr. Nicole Forsgren, a key contributor to the DORA metrics, to conduct a study on this topic. Based on the insights from the study, this article explores how companies can improve their developer experience including my experience as the founder of an internal developer platform company.

What is Developer Experience?

DevEx is how developers feel about their work and their value for it. It is not just about writing code but about doing it in an environment that is just right. All this depends on the right tools, practices, processes and social setup. The Microsoft study looked at three dimensions that are known to impact developer experience:
● Flow state
● Feedback loops
● Cognitive loads

CI/CD pipelines are key to an engineering organization’s efficiency, used by up to 75% of software companies with developers interacting with them daily. However, these CI/CD pipelines are often far from being the ideal tool to work with. A recent survey found that only 14% of practitioners go from code to production in less than a day when high-performing teams should be able to deploy multiple times a day.

Further, I will share strategies for enhancing DevEx by refining the continuous integration and deployment process. These strategies focus on optimizing flow state, cognitive load and feedback loops.

Rethinking the CI/CD Experience for Developers

Before changing anything with your CI/CD tools and process, measure what you want to improve and set goals. These can be based on current business priorities or past pain points. For example, DORA metrics like deployment frequency, lead time for changes or change failure rate. The more the better; you can set up metrics such as how much every step within the build, test and deploy process takes.

Avoid High Cognitive Load Tasks

Cognitive load is the amount of mental processing necessary for a developer to complete a task.

Companies generally have one programming language that they use for everything. Their entire toolchain and talent pool is geared toward it for maximum productivity. On the other hand, CI/CD tools often have their own DSL. So, when developers want to alter the CI/CD configurations, they must get into this new rarely-used language. This becomes a time sink as well as causes a high cognitive load.

One of the ways to avoid giving developers high cognitive load tasks without reason is to pick CI/CD tools that use a well-known language. For example, the data serialization language YAML — not always the most loved — is an industry standard that developers would know how to use. Even better, modern CI/CD platforms, such as open-source Dagger, offer SDK that allows developers to interact in the language of their choice, avoiding high cognitive load.

Keep the Flow State Intact

Flow state — known by many developers as “being in the zone” — is a mental state where a software engineer is fully immersed in work and can achieve maximum productivity.

Merging, building, deploying and running are all classic steps of a CI/CD pipeline, often handled by multiple tools. Some organizations have SREs that handle these functions, but not all developers are that lucky! In that case, if a developer wants to push code where a pipeline isn’t set up — which can be quite recurring with the rise of microservices — they must assemble those rarely-used tools. However, this will disturb the flow state you wish your developers to remain in.

One way to prevent that is to pick a CI/CD tool that provides a simplified deployment workflow for developers. Modern tools such as Mogenius and Qovery (which I am the founder of) are good examples. These tools streamline the deployment process by simply requiring the application source control repository link, thus automating the remaining steps seamlessly. Another tip is to conduct training sessions for developers on utilizing the CI/CD solution. Despite assumptions that software engineers inherently know best practices, this is only sometimes the case. By providing targeted training, companies equip developers with the knowledge to navigate the CI/CD tools effectively. Doing so reduces the risk of cognitive overload during the code deployment process and cultivates a culture of learning within the organization.

Instant Feedback Loops

In software engineering, feedback loops can be measured by how quickly questions are answered.

Troubleshooting issues within a CI/CD pipeline can be challenging for developers due to the need for more visibility and information. These processes often operate as black boxes, running on servers that developers may not have direct access to with software that is foreign to developers. Consequently, developers frequently rely on DevOps engineers — often understaffed — to diagnose problems, leading to slow feedback loops.

Ideally, developers should have complete visibility over the entire process and fix errors by themselves. Solutions like Datadog and Komodor go above and beyond to provide full transparency over CI/CD pipelines. They make accessible the logs and reports on why the build, test or deployment failed. Software delivery pipeline failures tend to be recurring; building an internal knowledge base of the most recurrent errors is also a good practice to speed up the debugging process from the engineering team. Integrating an LLM-based bot in your CI/CD dashboard is an even more modern approach to help developers navigate errors. The LLM should be trained with external and internal data (knowledge base).

Conclusion

These are just a few examples of how a company can improve its developer experience by tweaking its CI/CD process. Once you have decided on a strategy, look at your metrics and set goals for every quarter. Changing tools and getting your team comfortable with them can be time- and energy-consuming but is worth it. The study found that developers using intuitive tools and processes report feeling 50% more innovative than those struggling with unclear systems. And teams with tight feedback loops report 50% less technical debt than the ones with slow response times.

June 28, 2024
Infinidat Revolutionizes Enterprise Cyber Storage Protection to Reduce Ransomware and Malware Threat Windows
Waltham, Massachusetts, June 27th, 2024, CyberNewsWire

Infinidat, a leading provider of enterprise storage solutions, has introduced a new automated cyber resiliency and recovery solution that will revolutionize how enterprises can minimize the impact of ransomware and malware attacks. Infinidat’s InfiniSafe® Automated Cyber Protection (ACP) is a first-of-its-kind cybersecurity integration solution that is designed to reduce the threat window of cyberattacks, such as ransomware. Sophisticated cyberattacks, including new sinister forms of AI-driven attacks, are increasingly targeting the data storage infrastructure of enterprises.

Infinidat’s InfiniSafe ACP enables enterprises to easily integrate with their Security Operations Centers (SOC), Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR) cybersecurity software applications, and simple syslog functions for less complex environments. A security-related incident or event triggers immediate automated immutable snapshots of data, providing the ability to protect InfiniBox® and InfiniBox™ SSA block-based volumes and/or file systems and ensure near instantaneous cyber recovery.

“The merging of cybersecurity and data infrastructure has been compelling CIOs, CISOs and IT team leaders to rethink how to secure enterprise storage across hybrid multi-cloud deployments in light of increasing cyberattacks. Enterprises need proactive strategies, seamless integration across IT domains, and the most advanced, automated technologies to stay ahead of cyber threats,” said Eric Herzog, CMO at Infinidat. Recognized as a cyber secure storage expert, Herzog is coming off participation in a string of cybersecurity panel discussions, roundtables and conference events.

“Infinidat has carved out a very unique leadership position as the only storage vendor to offer an automated enterprise storage cyber protection solution that seamlessly integrates with cyber security software applications,” said Chris Evans, Principal Analyst at Architecting IT. “Infinidat’s newly launched InfiniSafe Automated Cyber Protection that easily meshes with the SIEM, SOAR or Security Operations Centers is exactly what enterprises need to include enterprise storage as a comprehensive approach to combat cyber threats.”

Infinidat’s new InfiniSafe ACP capability orchestrates the automatic taking of immutable snapshots of data, at the speed of compute, to stay ahead of cyberattacks by decisively cutting off the proliferation of data corruption.

Evans added, “This proactive cyber protection technique is extremely valuable, as it enables taking immediate immutable snapshots of data at the first sign of a potential cyberattack. This provides a significant advancement to ensure enterprise cyber storage resilience and recovery are integral to an enterprise’s cybersecurity strategy. ACP enhances an enterprise’s overall cyber resilience by reducing the threat window and minimizing the impact of cyberattacks on enterprise storage environments.”

The InfiniSafe Automated Cyber Protection is one of the biggest innovations of the year in cybersecurity because it unlocks the full potential of an enterprise’s security posture and maximizes the investments that an enterprise has made in protecting the business. By plugging into existing security mechanisms and continuous monitoring, InfiniSafe ACP bridges the gaps between enterprise storage and cybersecurity strategies that can transform the way CIOs and CISOs think about enterprise data infrastructures.

Information technology leaders have identified this ability to automate data snapshot commands and data pathways as critical to early detection and worry-free cyber recovery that minimizes the effects of even the most vicious and deceptive cyberattacks of malicious actors. An enterprise’s security team can put all its information from security operations through an enterprise storage intelligence grid to create the most sensitive triggers that often get missed by existing technologies and techniques.

Paul Rapier, VP of Information Technology at the Detroit Pistons, stated, “Infinidat’s efforts in enhancing cyber resilience for enterprises, particularly through the new InfiniSafe Automated Cyber Protection, are noteworthy for data security.”

Allen Shahdadi, Vice President of Global Sales at Sycomp, said, “Infinidat has become synonymous with guaranteed cyber resilient storage. Infinidat continues to deliver powerful solutions that solve critical cyber issues for enterprises and service providers around the globe. The InfiniSafe Automated Cyber Protection solution brings much needed capabilities to fight more effectively against cyberattacks. The automatic capture of immutable snapshots of primary data could be the difference between your data being held ransom and the rapid recovery of your data. Before international cybercriminals, hackers and fraudsters can gain an advantage, Infinidat’s InfiniSafe reduces the threat window decisively.”

The InfiniSafe Automated Cyber Protection solution is the latest in a string of cybersecurity capabilities that Infinidat has brought forward to strengthen enterprise storage in the face of constant threats of a tsunami of cyberattacks. Infinidat has also unveiled the following extensions of its state-of-the-art cyber resilient capabilities:
- InfiniSafe Cyber Detection for VMware – Access to InfiniSafe cyber resilience capabilities to combat cyberattacks has been expanded into VMware environments. The impact of a cyberattack can be readily determined through this cyber detection capability, with highly granular insights by leveraging AI and machine learning whether or not a VMware datastore and the VM’s they encompass have been compromised.
- InfiniSafe Cyber Detection for InfiniGuard® – Cyber detection will be extended onto the InfiniGuard purpose-built backup appliance to help enterprises resist and quickly recover from cyberattacks. This proven capability provides highly intelligent scanning and indexing to identify signs of cyber threats in backup environments, helping ensure that data has integrity. The enhanced version will be available in 2H 2024.
As a leader in cyber resilient storage, Infinidat first unveiled its InfiniSafe software-based platform two years ago with a set of cybersecurity functions. This solution has won numerous awards and has been proven by large global enterprises. The comprehensive cyber resilience capabilities of InfiniSafe technology improve the ability of an enterprise to combat and protect against ever-increasing cyberattacks and data breaches by uniquely combining immutable snapshots, logical air gapping, fenced/isolated networks, and virtually instantaneous data recovery into a single, high-performance platform.

The InfiniSafe ACP is the latest example of Infinidat’s broadening innovation. It was introduced alongside the launch of the InfiniBox G4 family of next-generation storage arrays for all-flash and hybrid configurations. The G4 series is a completely new storage array family built from the ground up that substantially extends Infinidat’s cyber storage resilience and delivers up to 2.5x improvement in performance. The InfiniBox G4 series introduces a new set of foundational elements, powered by InfuzeOS, which is Infinidat’s software defined storage operating system.

Webinar On Demand

To watch Infinidat’s end-user webinar about the new solutions − “The Future of Enterprise Storage, Cyber Security and Hybrid Multi-Cloud” – users can click here.

About Infinidat

Infinidat provides enterprises and service providers with a platform-native primary and secondary storage architecture that delivers comprehensive data services based on InfiniVerse®. This unique platform delivers outstanding IT operating benefits, support for modern workloads across on-premises and hybrid multi-cloud environments. Infinidat’s cyber resilient-by-design infrastructure, consumption-based performance, 100% availability, and cyber security guaranteed SLAs align with enterprise IT and business priorities. Infinidat’s award-winning platform-native data services and acclaimed white glove service are continuously recommended by customers, as recognized by Gartner® Peer Insights reviews. For more information: www.infinidat.com.

Connect with Infinidat

About Infinidat | Blog | Twitter | LinkedIn | Facebook | YouTube | Be our partner

Contact

Director of Global Communications
Sapna Capoor
Infinidat
scapoor@infinidat.com
+44 (0) 7789684159
June 27, 2024
Datadog Extends Scope and Reach of Observability Platform

Datadog at its DASH 2024 conference added a bevy of tools and capabilities to streamline DevSecOps workflows, including integration with open-source OpenTelemetry agent software developed under the auspices of the Cloud Native Computing Foundation (CNCF) and the Datadog On-Call tool to optimize incident management workflows in a way that maintains context with observability data already collected.

In addition, support for agentless scanning along with tools for discovering vulnerabilities and sensitive data have been added along with a Log Workspaces collaboration tool that enables analysts and engineers to employ natural language interfaces to invoke a generative artificial intelligence (AI) agent to more easily associate logs and other datasets to specific applications, and a Live Debugger tool that enables developers to use live production data to better troubleshoot applications.

Finally, the company added a Kubernetes Autoscaling capability to provide IT teams with more control over how cloud-native applications dynamically scale up and down.

Hugo Kaczmarek, director of product for Datadog, said as observability continues to evolve it will become easier for IT teams to triangulate the root cause of issues down to specific lines of code. It may never be possible to prevent every error but the meantime to remediation will continue to rapidly decline as further advances in artificial intelligence (AI) are made by, for example, using visualization tools to replay the execution flow of code. IT teams will also be able to leverage generative AI to reproduce issues using production data.

Overall, Datadog is continuing to expand the reach of its observability platform in a way that promises to enable organizations to reduce the number of tools they would otherwise need to acquire, manage and integrate.
At the same time, integrations of with open source tools such as OpenTelemetry will simultaneously make it less expensive to instrument IT environments. Datadog is also making it simpler to centrally manage all the instances of OpenTelemetry that might ultimately be deployed.

The extensions to the Datadog platform, mostly available in beta, are being made at a time when many organizations are starting to embrace platform engineering as a methodology for managing DevOps workflows at scale. The challenge many of them will initially face is determining exactly how many platforms may be required to unify the management of those workflows.

It’s too early to say how platform engineering will evolve but with the rise of AI tools to generate code, observability is going to increasingly become a requirement. The issue is many DevOps teams don’t always know what queries to launch to surface issues. However, with the aid of AI agents the platform itself will not only suggest queries but also run them automatically as needed. The goal is to augment existing DevOps engineering teams to enable them to manage applications at much higher levels of scale without necessarily increasing headcount.

In the meantime, however, it’s also apparent that many DevOps teams are already struggling to manage the workloads already deployed. In that regard AI tools that promise to reduce existing toil can’t arrive too soon.

June 26, 2024
Logging Out

June 26, 2024
Cloud-First, Cloud-Smart to Cloud-Minimalism – A Strategic Shift

Before we discuss the strategic shift in cloud computing adoption and various connected developments, let’s revisit the basics of cloud computing.

According to NIST, the essential characteristics of cloud computing are:

On-demand, with self-service capability: The consumer can provision the capacity without human intervention when required.

Board network access: The capability is available over the network and can be accessed easily through a standard mechanism.

The consumer benefits from resource pooling: The resources are dynamically assigned and reassigned. Capabilities are scalable as per consumer needs. The service should be measurable.

According to a report by Forrester, The State Of Cloud In The U.S., 2022, most U.S. enterprise infrastructure decision-makers are using at least one type of cloud deployment. Forrester released similar reports for Asia, covering Australia and New Zealand, China, India, Japan, Malaysia and Indonesia. Asia is witnessing targeted growth for cloud-based deployment for applications and infrastructure portfolios.

With more and more companies realizing the benefits of cloud adoption, it is fast becoming a battleground, where companies aggressively pursue their plans to quickly onboard cloud at a near-to-limitless scale. These massive plans come with the “cloud-first” strategy.

Cloud-First Strategy — An Overview

Many organizations have attempted to define and refine the “cloud-first” strategy. Let’s highlight some common principles that can be the baseline for further analysis. Cloud-first strategy is often described by the following:

1. Using cloud services as the default, considering the five characteristics of cloud computing.
2. Designing for the cloud, architect cloud-native and limit customization.
3. Adopting cloud service functionality, automation practices, cloud-based security and other features.
4. Monitoring and measuring cloud services in real-time.

Prioritizing cloud services has led to short-term gains, providing the edge on agility and scalability. However, it also poses some challenges, and cloud-first is not a “one size fits all solution.” To top that, many companies have indicated cost sprawl and overrun, security & compliance concerns. Recognizing these challenges in the “Report to the President on Federal IT Modernization,” released in 2017 by Executive Order 13800,1 the Office of Management and Budget (OMB) pledged to update the Government’s legacy Federal Cloud Computing Strategy (“Cloud First”).

Cloud-First to Cloud-Smart Strategy

Cloud smart seems like the next step in the adoption of cloud computing. Gartner estimates that 60% of organizations that have adopted a cloud-first approach will switch to a cloud-smart approach by 2023.

Cloud smart addresses the practical implementation challenges. It shares a more comprehensive outlook, providing critical guidance toward security, procurement and workforce alignment.

Finally, it provides more mid-term gains for organizations, rather than focusing on “the here and now” problems.

The CIO Council created a list of actions as concrete steps to be cloud-smart. It outlines several topics, including developing methods of optimizing cloud usage, security architecture enhancement and implementation of security control at scale and collaborative processes to develop innovative models, considering sustainability, vendor lock-in and workforce development. To maximize the value of cloud computing, the cloud-smart approach enables organizations to assess, plan and execute the right mix of private, public, edge and on-premises needs without sprawling into the cloud providers. The top considerations are:

1. Setting realistic goals aligned with the key business outcome.
2. A selective investment strategy toward cloud computing, tools and services.
3. A roadmap toward cloud optimization keeping sustainability goals in mind.
4. Tight control of security and compliance.
5. Cloud exit strategy.

But how does cloud adoption maturity exploit cloud computing? One of the possible ways is to transition into more cloud-minimalism, which is decluttering, refining the value dimension of cloud computing to a more meaningful level of adoption keeping sustainability in mind.

Cloud Smart to Cloud Minimalism

Cloud waste rose at an average of 30% of cloud budgets in 2021. In 2022, it was 32%, according to Flexera. Stormforge reported that 75% of organizations suspected cloud waste. According to a report by PWC, about 53% of enterprises were yet to see “substantial value” from their investment.

Organizations must look at decluttering and refining the value dimension of the cloud. There is a significant focus on security and data protection. Mixing clouds with on-premises cloud computing capabilities is on the cards.

Organizations are also willing to take the next steps toward sustainability. Cloud minimalism focuses on a few optimized activities rather than a big-bang approach toward onboarding. One of the main drivers to investigate the next-generation cloud computing strategy is due to competing visions, goals and future scenarios triggered by complex cloud-based supply-chain models, a substantial shift in security and privacy, regulations and adoption of machine learning and data-driven models.

Cloud minimalism does not mean rejecting or following a specific big-bang way but consciously selecting and intentionally moving workloads to the cloud effortlessly.

Some factors influencing the choice for long-term strategic evolution are:

1. Sustainability Goals Take Center Stage: Sustainability is not a checkbox item. For example, Amazon targets to power 100% of its data centers with renewable energy by 2025. Microsoft aims to be “carbon negative” by 2030. However, operationalizing sustainability is more than just looking at these CSP targets, it is about sustainable engineering practices, controlling and managing waste and underutilization.

2. Security and Privacy Reimagined: Mega cloud security to micro cloud security, the future is about everything. Specifically regulatory and compliance-related guidelines will refine geographical boundaries for hosting applications, and categorization of sensitive information will lead to new security controls, and in some cases, limitations around cloud onboarding. Moreover, the explosion of data-centric applications will need additional controls seen as overheads for cloud providers to host such applications.

3. From Cloud-Native to Edge-Native: With the development, we will seek on-premises, cloud and edge hosting models as a mix for cloud-native to edge-native applications. Architectural evolution and modernization will help to optimally define boundaries.

4. AI Goes Mainstream: The AI era demands more systematic handling of data resources. It is critically important to define ownership, rights and governance posture. In the context of the cloud, it becomes more important to be selective and pragmatic: Where who and how the data is handled. Cloud and data minimalism are disruptive ideas to start but can reap long-term benefits. Developing and evolving AI applications toward processing clean, optimized and precise data with a mix of cloud and on-premise capabilities.

Applied Cloud Minimalism

Recently, we have experienced an explosion of tools and services in the cloud. Cloud computing strategy requires careful due diligence, moving forward. It is time to think “lightweight cloud playbook”. Applied cloud minimalism focuses on the existing workload, decluttering and simplifying the architectural posture, meter usage and optimizing the footprint. Applied minimalism will guide redundant workloads, lift and shift-based workloads and outdated or legacy tools and services.

Applying cloud minimization principles is not a “one size fits all solution”. However, mindful onboarding can bring new opportunities to cloud technology, for example, cloud management tools, responsible sharing and data optimization algorithms, etc.

Conclusion

It is important to look at the strategic goals and outline the short-to-long-term needs of the organization for cloud adoption. It might seem lucrative to embrace the cloud in its entirety in the short term, but it can bring some bottlenecks in the mid-to-long term. Short-term benefits around wholesale cloud onboarding can quickly vanish if there is limited pragmatic thinking and planning. Selectivity in investing in the cloud can bring more benefits in the mid-term to long term. With a more visionary approach toward selecting use cases and determining architectural choices, measuring and metering the impact to further optimize the footprint can be one option.

This article presents a disruptive approach to clouds. We do not know if cloud minimalism is the only answer to cloud complexity and clutter, but it provides some more pathways to meaningfully onboard and explore cloud computing.

June 26, 2024
FireTail Unveils Free Access for All to Cutting-Edge API Security Platform
McLean, United States of America, June 26th, 2024, CyberNewsWire
- FireTail announces a free version of its enterprise-level API security tools, making them accessible to developers and organizations of all sizes.
- FireTail’s unique combination of open-source code libraries, inline API call evaluation, security posture management, and centralized audit trails helps eliminate vulnerabilities and protect APIs in real-time.
- The free plan covers up to 5 APIs, includes 1M API call logs per month, offers 7 days of data retention, and provides clear developer support.
FireTail, a disruptor in API security, unveils free access for all to its cutting-edge API security platform. This initiative opens the door for developers and organizations of any size to access enterprise-level API security tools.

Today, over 80% of all internet traffic is computer-to-computer communication via APIs. Every mobile app, IoT device, and most modern software applications use APIs, creating a broad attack surface for potential threats. FireTail’s hybrid approach to API security blends open-source code libraries with a feature-packed cloud platform and equips businesses with a unique suite of tools to eliminate API vulnerabilities and provide robust runtime API protection.

“API security is essential for modern applications, and every developer and tech team should have access to effective security tools,” said Jeremy Snyder, CEO and Co-Founder of FireTail. “Security through obscurity is no longer a viable approach. We’re on a mission to secure all of the world’s APIs and our new free plan ensures ongoing access to an API security platform that delivers genuine insight into the most pressing attack vectors – design flaws in APIs. It’s perfect for smaller organizations striving for stronger API protection, and a great way for individuals or teams within larger organizations to get started.”

Riley Priddle, Co-Founder and CTO at FireTail, added, “We’re excited to help organizations of all sizes to better protect their APIs. We want FireTail to become the de facto standard when it comes to API security. Just because you have a small number of APIs, it doesn’t mean they aren’t critical. We want everyone to have access to the best, enterprise-level API security tools. That’s why we offer both this free tier, as well as our open source libraries.”

For developers and small to medium-sized organizations needing to secure up to 5 APIs, FireTail’s free tier includes comprehensive API security features such as discovery, inventory, assessment, detection and response, and inline runtime protection. Key features include:
- Protection for up to 5 APIs
- 1M API calls per month
- 7 days of logging retention
Thomas Martin, Founder at NephoSec, shared “We’ve been working with FireTail from the outset as both a customer and a distribution partner. Having proven that the platform works for even the largest enterprises with the most complex API security requirements, it’s great to see the team opening that technology up to everyone. This will enable us to solve API security challenges for organizations of all shapes and sizes.”

To access the FireTail API security platform, users can visit https://www.firetail.app or join the team on Tuesday, July 2nd for an in-depth look at what FireTail’s free tier can do.

About FireTail

FireTail allows customers to solve all the most critical problems facing APIs today with a hybrid approach, bringing together cloud, application and code with full blocking capabilities to solve the root causes of API data breaches – flaws at the application and business logic layer in authentication, authorization and data handling. Headquartered in McLean, VA, with offices in Dublin, Ireland, and Helsinki, Finland, FireTail is backed by leading investors, including Paladin Capital, Zscaler, General Advance, and SecureOctane. Users can learn more at https://www.firetail.io.

Contact

Marketing Director
Alan Fagan
FireTail
media@firetail.io
June 26, 2024
Fostering an AI-Focused Engineering Team That Accelerates DevOps Maturity

Businesses can accelerate DevOps maturity by harnessing the power of artificial intelligence (AI), specifically automation. However, for a company to truly reap the rewards of AI, it must move beyond tools such as Copilot and utilize more advanced solutions including TuringBots or AI agents. These will allow for stronger adherence to pipeline standards and greater productivity for engineering teams.

AI Agents: The Tool Empowering Tomorrow’s Engineering Teams

An AI agent is a series of prompts that leverage AI to carry out a role within the engineering team, such as the business owner or tester. AI agents act as assistants to help ensure the code adheres to all requisite security, quality and coding standards before merging with the main line and different environments, saving the developer precious time.

For example, if an engineer needs to verify their code, they can have an AI agent interpret, validate and make suggestions. Based on those suggestions, and with human approval, the AI agent can then build, rewrite or refactor whatever is missing, whether tests or quality gates. The faster feedback and reduced workloads possible with AI agents enable engineering teams to become proficient at churning out code, getting it tested, and moving it into different environments.

Likewise, as these AI agents ensure the code is high quality earlier, there will be fewer defects later in the software development lifecycle (SDLC), meaning less rework. This will, therefore, massively improve the productivity of the engineering teams, translating into faster time to market. Ultimately, this AI-assisted DevOps environment will empower teams to achieve a higher level of DevOps maturity at an unprecedented pace.

How Businesses Can Reorganize Teams in Light of AI

Building an AI-first engineering team will require legacy teams to undergo top-to-bottom change. Five years ago, a head of DevOps ran all the tooling to support how code moves, testing, etc. There is now an ongoing trend in the DevOps space for this position/title to transform into one focused on platform engineering.

These new platform engineering leaders are accountable for enabling a variety of AI-related objectives in their organizations. They own all the platforms that engineers use daily. These leaders must also account for AI enablement, whether overseeing all AI models the business has integrated with or managing the costs of these models through insights into token usage (tokens are how the different LLMs charge their clients).

Like the responsibilities of the platform engineering leader, a dedicated team must be accountable for caring for and feeding the platforms and tools used for DevOps. This team must own and support the AI agents because as applications mature, the AI agents need to change. Likewise, they will be responsible for encouraging AI adoption across engineering teams.

Even the simplest tools like Copilot, which has a low entry bar, require significant change management activity. Nevertheless, teaching senior engineers new ways of working can be difficult. Businesses should lean into education and reward mechanisms, such as organization chain management initiatives, to help reskill existing teams. Despite these best efforts, getting engineers to adopt new AI tools won’t happen overnight, it could take three months or longer.

Furthermore, companies must prepare for the inevitable restructuring of their engineering teams. Businesses will likely need to reduce headcount once AI agents begin automating and streamlining more processes in the SDLC. Currently, most engineering teams consist of a product owner, a scrum master, a businessperson, several developers and a few testers. Soon, these teams will only need a product owner, one engineer (such as an engineering lead or architect), a tester, and a business person. At the same time, enterprises do not need highly skilled engineers adept at building anything, rather their priority is someone with more domain expertise and understanding of the business.

Intentionally Implementing AI

Despite the undeniable productivity and cost-efficiency benefits of AI, many companies are still hesitant and even fearful of this technology and the implications it may have on their engineering teams. While AI will cause disruption, this is not uncharacteristic of all technological innovations at some point or another. Still, organizations must not immediately jump in feet first. They must find ways to incorporate AI by experimenting and testing. Moreover, businesses can enlist the help of experienced partners to craft incremental technology and business strategies.

June 26, 2024
Testing Agents: More than a Copilot

Much has been said about the adoption of coding copilots for developers. What is lesser known is that copilots can also write test scripts and translate tests from one script language to another. Copilots boost productivity for both use cases but are generally passive tools that must be fed precise requirements to get the desired results.

A new level of assistant is emerging — which takes this capability to a more active state — as AI technology is embedded directly into development and testing tools.

A QA manager from a leading tech firm put it best, “The ability of AI to not just run tests, but to learn from them and adapt, is transforming how we approach quality assurance. It’s like having an ever-evolving team member who ensures our releases are robust and reliable.”

These testing agents are beginning to appear in the wild and are bound to evolve rapidly over the next few months and years. They will address some of the major challenges enterprises face in business application development.

Crafting a Test Plan

The first challenge is that the people who understand what the app is supposed to do are generally not skilled in developing tests. The new testing agents will address this challenge by working with subject matter experts (SMEs) to craft a test plan based on the SMEs’ exploration of new features.

The second challenge is the fact that tests are not one-and-done. The first version of a test will only last so long before it will require updating. To paraphrase von Moltke the Elder, ‘Functional test plans will not survive first contact with a platform upgrade’, especially for enterprise SaaS. For traditional test development teams that means there is a constant backlog of rework. But testing agents can regenerate a new version of the test as easily as they wrote the first one.
The third challenge is running the right tests at the right time. The best companies create regression suites that can test most of the important features of their business applications before releasing them.

Everything is well and good until you realize 90% of those tests could not possibly fail based on the scope of changes that were made. This overkill costs both time and money. Wouldn’t it be great if your testing system was smart enough to know which tests should be run and which could be skipped? Testing agents that are properly integrated into the CI/CD system would be able to make that judgment.

Minimizing the Risks

By addressing these challenges, testing agents effectively alter the ROI calculation for test automation. Tests created by the agents are less expensive to maintain, thus reducing investment. They only run when needed, further reducing cost. Since the SME is involved in the creation process, tests are more likely to catch the most critical problems, thereby minimizing the risk of app downtime. Win, win and win.

All this sounds great, but there must be a downside. What are the risks?

The short-term risk is in thinking that a testing agent is fully automatic. We may get there soon, but in the near term it is best to think of these agents as a “team member who ensures our releases are robust and reliable.” The humans in the loop have a responsibility to manage the process and ensure the right outcome. Even the best LLMs still hallucinate on occasion, so until these agents establish a track record, trust but verify.

June 26, 2024
Sapient.ai Automation Platform Leverages AI to Create Unit Tests

Sapient.ai today launched a testing automation platform that makes use of artificial intelligence (AI) and automatically creates unit tests as the applications are developed.

Company CEO Rishi Singh said Sapient Codeless makes use of large language models (LLMs) that have been specifically trained to create unit tests and then automatically run them as needed. It analyzes code and then automatically generates declarative tests based on the inputs and outputs of the methods used to build the application.

Additionally, Sapient Codeless automatically adapts to changes in the codebase, ensuring tests remain up to date in a way that eliminates the need for ongoing test maintenance.

The overall goal is to make it simpler to keep pace with the amount of code that needs to be tested as more organizations make use of AI assistants to write code, noted Singh.

That approach provides the added benefit of significantly reducing the amount of testing code that DevOps teams would otherwise need to manage alongside all the other code they already manage, he added. In some organizations, there is as much as five times more boilerplate testing code that DevOps teams need to manage than there is actual code that ultimately finds its way into an application, said Singh.

As the pace at which applications are developed continues to accelerate, it’s clear existing manual approaches to creating unit tests will not scale. It’s expected many organizations thanks to the rise of AI will build and deploy more applications in the next two years than they might have in the past decade.

However, if most of those applications are not tested more thoroughly before they are deployed most DevOps teams will find themselves trying to debug and troubleshoot more applications than ever long after they have already been deployed in a production environment, noted Singh.

AI-Infused Automation Platforms Make Things Easier

It’s not clear to what degree organizations may need to run more tests versus focusing more on running the right test at the right time. Much time is wasted running tests in a sequence that doesn’t surface a failure until late in the process. In theory, automation platforms infused with AI should make it easier to identify code that is likely to fail a specific test sooner. In effect, DevOps teams should be able to more easily run the right test at the right time.

In the meantime, the debate over who should run what type of test at any given time continues unabated. Many developers are happy to run tests that surface issues as they write code but are not nearly as engaged when tests are run, long after they have moved on to another project. In many cases, they would rather see a DevOps team manage a significant portion of the testing process on their behalf.

Regardless of approach, the one thing that is clear is the overall quality of the applications being deployed needs to improve. The issue now is finding a way to achieve that goal without increasing the overall level of toil already being experienced.

June 25, 2024