Category: Blogs
-
Three Reasons DevOps Should Consider Rocky Linux 9.4
Anyone in the DevOps community seeking a rock-solid Red Hat Enterprise Linux (RHEL) clone may want to consider the Rocky Linux community’s latest release, Rocky Linux 9.4. This latest version brings improved security features, significant cloud image updates and updated developer tools. For DevOps pros, that means a useful addition to your Linux distro toolkit whether you work on local or cloud containers.
Rocky Linux has several security improvements, to start with For example, SELinux userspace release 3.6 has enhanced policy customization capabilities. Since SELinux is infamously difficult to customize and manage, this is all to the good.
The Keylime server, which enables users to monitor remote nodes using a hardware-based cryptographic root of trust components, now has enhanced Trusted Platform Module (TPM)-based security. This Cloud Native Computing Foundation (CNCF) project provides an end-to-end solution for bootstrapping hardware-rooted cryptographic trust for remote machines, the provisioning of encrypted payloads and run-time system integrity monitoring. In this latest version, Keylime’s verifier and registrar server components are now available as containers. That means it’s a lot easier to secure your containers.
That’s not the only security-related enhancement. The OpenSSL Transport Layer Security (TLS) toolkit now supports a drop-in directory for provider-specific configuration files. On a related note, the Rsyslog remote logging tool now has customizable TLS/SSL encryption settings. Finally, with stunnel 5.7.1, the TLS/SSL tunneling service now supports modern PostgreSQL clients. These features improve the process of securing your containers’ networking.
Improved Rocky Cloud images
Rocky Linux 9.4 now boasts a revamped image-building process for cloud and container images. Most of its images were rebuilt using the openSUSE KIWI image builder. For the Rocky Linux maintainers, that means it’s easier and faster to get new releases out as security patches are made. For you, it means getting safer updates up faster. As Gregory Kurtzer, Rocky Linux founder, explained, “The new KIWI-based workflow will enable us to provide more frequent updates across all major cloud providers.”
Rocky is now available for free on the Azure Community Gallery, making it easier to spin up Rocky instances on Microsoft’s cloud. Kurtzer explained, “Our Azure integration has been streamlined and simplified. Users can now access Rocky Linux with just a few clicks in the Community Gallery.”
Finally, there’s a bug fix for people who want to run Rocky on IPv6-only networks on AWS. Before this patch, running Rocky Linux on dedicated IPv6 was a pain.
Updates for the Developer in DevOps
DevOps whose role includes writing code will be glad to know that the new Rocky Linux version has updated several language runtimes and frameworks. This includes Python 3.12, Ruby 3.3, PHP 8.2, and nginx 1.24 as module streams. The Git version control system has been rebased to 2.43.0, while Git LFS jumps to 3.4.1.
Compiler toolchains have also seen significant upgrades, with LLVM rebased to 17.0, Rust to 1.75.0, and Go to 1.21.0. GCC has been updated to version 13, while Clang’s resource directory was relocated.
The new version makes setting up and maintaining Rocky Linux images easier. You can specify custom mount points and select from different partitioning modes such as auto-lvm, lvm, and raw.
In addition, you can use Podman modules to load a predetermined set of container configurations. The updated Container Tools RPM meta-package, which comes with the Podman, Buildah, Skopeo, crun, and runc tools, is also bundled in. Notably, with Podman 4.9, the SQLite database backend, previously available in a Technology Preview, is now fully supported. This provides better stability, performance, and consistency when working with container metadata. The BoltDB database backend is now deprecated.
Put it all together, and you get what appears to be an excellent business Linux. If you’re already a Centos user – and Centos is disappearing for good, real soon now—or an RHEL user who wants to try a clone, the latest Rocky Linux demands a look.
-
Advancing Sustainable Practices in Data Centers: Insights from Platform.sh
The environmental impact of data centers is becoming increasingly critical. These facilities, essential to our digital infrastructure, consume vast amounts of energy and contribute significantly to carbon emissions. Clearly, recognizing the urgency of this issue, Platform.sh is pioneering sustainable solutions to mitigate their environmental footprint. By incorporating renewable energy, cutting-edge cooling systems, and robust carbon offset programs, they are leading the way in creating greener data centers.
Insights from Leah Goldfarb
In a recent interview with Techstrong TV, Leah Goldfarb, Environmental Impact Officer at Platform.sh, shared valuable insights into the company’s sustainability efforts. Goldfarb discussed the integration of renewable energy sources, advanced cooling systems, and carbon offset programs, highlighting how Platform.sh is leading the way in green data center practices.
Green Data Centers Explained
Green data centers focus on energy efficiency and the use of renewable energy to reduce their environmental footprint. These centers aim to lower carbon emissions and optimize energy use, promoting long-term sustainability. Notably, according to industry reports, the global green data center market is projected to grow significantly. Check out this impressive projection: USD 198.3 billion by 2032 from USD 61.4 billion in 2023. This surge is driven by increasing demand for sustainable solutions and stringent environmental regulations
Innovative Sustainability Strategies at Platform.sh
Adopting Renewable Energy:
Platform.sh integrates renewable energy sources such as wind and solar power into their data centers. This move reduces reliance on fossil fuels and decreases carbon emissions, contributing to a cleaner energy future. For example, some of their data centers are powered entirely by renewable energy, significantly cutting their environmental impact.Designing Efficient Infrastructure:
The data centers at Platform.sh are designed with energy efficiency as a core principle. By investing in advanced technologies and optimizing their infrastructure, Platform.sh achieves lower power usage effectiveness (PUE). Markedly, this focus on innovation helps manage energy consumption more sustainably.Utilizing Advanced Cooling Technologies:
Implementing state-of-the-art cooling systems and optimizing server utilization are critical for minimizing energy consumption. Indeed, intelligent workload management and automation ensure resources are used efficiently, reducing unnecessary energy use. Key point: these technologies are crucial for reducing the overall environmental impact of data centers.Certifications and Compliance:
Notably, Platform.sh holds certifications like ISO 14001 for environmental management, demonstrating a commitment to maintaining high sustainability standards. Compliance with European Union regulations further ensures rigorous environmental practices. In essence, these certifications show that Platform.sh is dedicated to adhering to the best environmental standards in the industry.Participating in Carbon Offset Programs:
To address residual emissions, Platform.sh uses carbon offset programs. These initiatives support global environmental efforts such as reforestation and renewable energy projects. By participating in these outlets, Platform.sh helps mitigate the environmental impact of their operations.Benefits of Renewable Energy in Data Centers
Using renewable energy sources provides significant environmental and economic benefits. It helps reduce greenhouse gas emissions and conserves natural resources. Economically, it can lead to long-term cost savings by decreasing dependency on non-renewable energy sources and stabilizing energy costs. This dual benefit makes renewable energy a compelling choice for sustainable data center operations.
Emerging Trends in Sustainable Cloud Hosting for 2024
Sustainable cloud hosting’s latest trends span from automation to AI. However, green initiatives in digital transformation face challenges.
Automation and AI:
Automation and artificial intelligence enhance energy efficiency by enabling precise management of workloads and resources, thereby reducing energy waste. These technologies are becoming increasingly important in optimizing data center operations.Decentralized Energy Grids:
Utilizing decentralized energy grids allows data centers to effectively use local renewable energy sources, minimizing transmission losses and improving efficiency. This trend is helping data centers become more self-sufficient and environmentally friendly.
Circular Economy Principles:
Embracing circular economy principles involves reusing and recycling hardware components, reducing electronic waste, thus extending the lifespan of data center equipment. Consequently, this approach not only conserves resources but also reduces the environmental footprint of data centers.
Challenges in Implementing Green Initiatives
Implementing green initiatives in data centers can be challenging. Common obstacles include high initial costs, technological limitations, and the need for specialized expertise. However, prioritizing sustainability and leveraging innovative solutions can help overcome these challenges. For instance, despite the initial investments, the long-term benefits of green technologies often justify the costs.
🎤Tell Your Sustainable Solution Story
We invite industry Thought Leaders in tech and sustainability to share their innovative solutions and strategies. Boost your company’s profile and amplify your brand by contributing to our discussions on sustainable practices.
Contact Bonnie Schneider at bonnie@techstronggroup.com to participate.
-
No Country for No-Code: Are We Heading Towards a Wild West of Software Security?
Nearly everything we use is built on code, from cars to smart fridges to doorbells. In businesses, countless applications keep devices, workflows and operations running. So, when early no-code development platforms launched in 2010, promising more accessible application development for citizen developers, its success felt inevitable.
It’s hard to deny the success of no-code. These platforms flatten the learning curve for would-be developers, allowing organizations to innovate and automate with useful applications despite a developer skills shortage. Plus, the out-of-the-box applications offered by no-code platforms expedite the application development process in a world where speed-to-market is king. Last year, Forrester found that 87% of enterprise developers use low-code and no-code tools or platforms for at least some of their workload.
But functionality is not the only sign of success. Unintentionally, the same trends that pushed for application development to be democratized have led to a wild west of insecure applications and misconfigurations that expose a whole host of organizations to cyberthreats.
The Importance of Security
While these platforms democratize development, they must be used with caution. The OWASP Top 10 highlights factors such as misconfiguration and using vulnerable components as common security threats. Yet, a reliance on no-code development could introduce un-spotted vulnerabilities directly into an organization.
Forrester has long warned of the risk of no- and low-code, featuring the vulnerability in its predictions for the coming years. The spectrer of an untrained employee creating applications is especially alarming: These platforms empower employees with no application security knowledge to develop programs that security teams are often unaware of.
Organizations must gain real oversight into who is responsible for developing software, whether professional developers leveraging no-code platforms as tools, or citizen developers creating applications for smaller teams and projects. It is no secret that CVEs are rising sharply. They hit a record 28,092 last year and are projected to increase by 25% throughout 2024. Last December, Microsoft revealed a high-severity CVE that affected low-code and no-code users.
When businesses are facing a tide of new exploits each day, skills such as vulnerability detection and remediation are critical to any new software development project.
Software development needs to become more flexible in its roles, but never at the expense of security. By fostering a culture of “security by design” across the organization, security leaders can ensure that all roles in the software development lifecycle (SDLC) understand their responsibilities in their security posture — including citizen developers.
Empowering Human Intervention
Just one in five organizations are confident in their ability to detect a vulnerability before an application is released, according to Security Journey research, meaning that the security knowledge in most SLDCs is insufficient. Developers need to be trained to create secure software and to sniff out insecure code in the rest of the code base – responding and fixing it quickly – before it gets to production. Without this, application security and security teams are left with an unnecessary burden, which ultimately requires more time, expense, and potential for business risk. Securing vulnerabilities after the fact, through regular security scanning and patching, should not be the norm.
Instead, organizations have an opportunity to empower developers with security skills and knowledge throughout their careers. These skills allow them to deliver a higher quality of output and play a vital role in securing the organization itself. And yet, just one in three organizations (36%) train developers to write secure code, which ensures that software security starts at the end of the development process 64% of the time. The same goes for citizen developers, whose work often shows a passion for problem-solving and innovation that should be harnessed and supported with the right training.
A Problem for the Future
It would be reductive to suggest that software security risk is rising purely because of no-code and low-code platforms, or even that citizen developers are a majority contributor to CVEs. The very culture of software development has been forcing the industry down a path of speed and ease over security for almost two decades. The surge in AI-generated coding proves this more than anything.
So long as developers and the project managers above them are incentivized to move fast, each new solution will be valued based on its ability to create functional code quickly. This will be the case until security is made a priority by regulators and, importantly, by executives and the board.
The cultural disconnection at the heart of the software security crisis is human-made. No matter which tool is in the spotlight, building secure software will require human solutions. While large language models (LLMs) aren’t yet equipped to tackle the complex considerations that developers face daily, the biggest risk will come from complacency, overreliance and blind trust from their users. Human developers, equipped to perform rigorous code reviews and remediate any vulnerabilities they find, are central to the safe implementation of any of these technologies, whether no-code, low-code or AI-generated. Without this, the tools run the risk of introducing more vulnerabilities with less critical supervision.
No matter what tools arise, knowledgeable human users will always need to understand what the tool is providing and can act as a stopgap for quality and security.
-
Does More Money Improve Open Source Security?
It sounds simple: If you pay developers more money, they’ll improve the quality of their code, right? The evidence isn’t so clear.
There has been little direct evidence that paying open-source developers results in more secure code – until now. The Atlantic Council’s Digital Forensic Research Lab (DFRLab) recently showed a correlation between funding for maintainers and the security of open source code.
Specifically, the researchers found “prima facie evidence of a positive effect of general open source software funding on open source software security.” They looked at the 1,000 most downloaded Python Package Index (PyPl) and npm JavaScript packages. Using Open Source Security Foundation (OpenSSF) tools such as “funder-finder” and the “Security Scorecard” the researchers saw a connection between financial support and security enhancements.
That may sound like an obvious conclusion, but the evidence was not as clear as you might think. The researchers report with only “moderate confidence” that a meaningful connection exists “between more open source project funding and improved security posture. …[M]ore funding generally correlates with more dramatically differentiated security practices.”
This seems to go against common sense. As Dana Wang, OpenSSF’s Chief Architect, said, “Balancing the security, reliability, availability, performance, and cost of open-source software is not trivial. Maintainers sometimes have to choose between new features, bug fixes, and less critical security patches.” And, even after such open source project security fiascos as Log4J, as we all know, security all too often comes too low on developers’ priority list.
Still, other research, such as programming security company Tidelift‘s 2023 State of the Open Source Maintainer Report, showed that “paid maintainers were 25-30% more likely to have completed the [security] work or plan compared to unpaid maintainers. On every development practice surveyed, paid maintainers were significantly more likely to implement it than unpaid maintainers.”
Sometimes security fixes are needed and available, but corporations aren’t adopting them. In another study from Synopsys, the 2024 Open Source Security and Risk Analysis Report, not quite half of codebases contained open source components with no new development in the last two years; 91% contained components ten or more versions behind the latest version. This is a failure by open source users, not underpaid open source developers. Bad companies! Bad!
Returning to the DFRLab study, its researchers also found that diversity in funding sources appeared to be beneficial. That is, projects with multiple supporters apparently do better (with security at least) than those with a single backer. This suggests that investors should look at a variety of support mechanisms rather than solo-source funding.
One reason why the results are so fuzzy is that we don’t have enough data. As the DFRLab crew observed, the “OpenSSF Scorecard tool itself has several quirks… Scorecard does not necessarily capture all the security improvements that might occur during a project. For example, a security audit, paid for voluntarily by maintainers who received funding, might look for and remediate new vulnerabilities while likely not directly improving any Scorecard metric. Some practices may also meet OpenSSF criteria in principle but be missed by the automated scorecard check. For example, a project might include a strong security policy but with a different filename than what the scorecard search is looking for, and thus not pass the subcheck.”
As DFRLab states, we need more research to understand how funding affects security. No one can really doubt that more money helps, but the most effective way to fund projects, maintainers and developers – and how we should measure the results – remain unclear.
Given how critical open source security is to all of our technology, the sooner we figure it out, the better.
Photo credit: Jonathan Kemper on Unsplash
-
Logicalis enhances global security services with the launch of Intelligent Security
London, United Kingdom, May 13th, 2024, CyberNewsWire
Logicalis, the global technology service provider delivering next-generation digital managed services, has today announced the launch of Intelligent Security, a blueprint approach to its global security portfolio designed to deliver proactive advanced security for customers worldwide.
Intelligent Security has been designed by Logicalis’ worldwide team of security specialists to give customers the most comprehensive observability and protection available. It is based on tracking and analysing cyber threats and knowledge of the latest prevention methods deployed across its customer base.
Logicalis’ tenth annual CIO report surveyed 1,000 CIOs globally and found that of the 83% of CIOs who experienced cyber-attacks in the last 12 months, only 43% feel prepared for another breach. Designed to help CIOs manage these pressures, Intelligent Security will leverage Logicalis’s security capabilities as well as its relationships with global partners such as Cisco and Microsoft, where it has the highest levels of security accreditations.
Logicalis CTO Toby Alock said:
“Many organisations focus on one area of the security fabric; we recognise in today’s cyber security landscape there are no silos; organisations must look across the entire footprint, from secure connectivity, securing the cloud, securing the hybrid worker and weaving secure operations across the entire organisation”.
The Intelligent Security global portfolio delivers a concise and comprehensive proposition for customers, including:
● Advisory: Providing customers with a range of advisory services dedicated to helping them understand their security needs and identify the right solutions for their business.
● Secure workplace: Securing worker communications and devices as remote working continues to impact the workplace security landscape.
● Secure connectivity: Enforcing zero trust security from edge-to-edge, ensuring networks are robust enough to enable safe IoT, 5G and edge computing.
● Secure hybrid cloud: Safeguarding cloud environments to ensure data, applications, and IT resources are safe.
● Secure Operations: Providing 24/7/365 best practice proactive threat detection and incident response, across three global security regions, using AI and automation to identify and triage.
In addition to the Intelligent Security global portfolio, the company is announcing several key investments in cyber skills and capabilities to bolster its position as a global leader in security services.
- Expanding the Managed Security (SOC) team in Portugal, which currently serves customers across EMEA, including the UK, Ireland and Germany
- Partnering with Cisco to develop a Cyber Academy and a pipeline of qualified cybersecurity graduates into the EMEA Security team
- Partnering with local universities in Portugal to develop an Intern program, which helps develop cybersecurity skills to serve the EMEA region and beyond.
Logicalis continues to prove its robust security offer by achieving Microsoft-verified Managed Extended Detection and Response (MXDR) Partner Status, launching Cisco Powered Intelligent Connectivity, built on zero-trust security, and being one of only six partners globally working with Cisco to develop an XDR proposition and enhance its Cisco security capabilities.
Intelligent Security will be underpinned by Logicalis’ Digital Fabric Platform, providing CIOs with deeper-level insights and recommendations to enhance the performance of their entire digital ecosystem.
Toby Alock concludes, “We are at a pivotal point as security threats grow in scale and sophistication. CIOs and IT leaders are rethinking security in the era of AI and considering whether they have the in-house skills necessary to operate safely. Logicalis has seen a 300% surge in demand globally for Managed Security services in the past 12 months. Our customers are looking for a holistic, proactive approach to navigating security; we believe our simplified portfolio, our partnerships, and our investments in cyber talent for the next generation will deliver customers what they need: AI ready Managed Security with governance and SOC Protection wherever they are in the world”.
For more information please contact:
Logicalis Team at Another Word
Email: logicalis@anotherword.com
Tel: 020 3176 0014
About Logicalis
We are Architects of Change™. We help organisations succeed in a digital-first world. At Logicalis, we harness our collective technology expertise to help our clients build a blueprint for success, so they can deliver sustainable outcomes that matter.
Our lifecycle services across cloud, connectivity, collaboration and security are designed to help optimise operations, reduce risk and empower employees.
As a global technology service provider, we deliver next-generation digital managed services, to provide our clients with real-time visibility and actionable insights across the performance of their digital ecosystem including; availability, user experience, security, economic performance and sustainability.
Our 7000+ ‘Architects of Change’ are based in 30 territories around the globe, helping our 10,000+ clients across a range of industry sectors create sustainable outcomes through technology.
Logicalis has annualised revenues of $1.7 billion, from operations in Europe, North America, Latin America, Asia Pacific, and Africa.
It is a division of Datatec Limited, listed on the Johannesburg Stock Exchange, with revenues of over $5.1 billion.
Contact
Katie Fraser
ANOTHER WORD
katie.fraser@anotherword.com
07908229152 -
Criminal IP and Quad9 Collaborate to Exchange Domain and IP Threat Intelligence
Torrance, California, May 13th, 2024, CyberNewsWire
Criminal IP, a renowned Cyber Threat Intelligence (CTI) search engine developed by AI SPERA, has recently signed a technology partnership to exchange threat intelligence data based on domains and potentially on the IP address to protect users by blocking threats to end users.
Criminal IP underwent rigorous data evaluation to integrate with Quad9’s threat-blocking service, demonstrating high data uniqueness and accuracy. Particularly, test results revealed a remarkable outcome: 99.1% of malicious domains identified by Criminal IP’s threat intelligence were found to be non-duplicative with other TI data.
Through this integration, Quad9 leverages the most up-to-date threat intelligence lists, incorporating data from Criminal IP’s database of malicious domains to block harmful hostnames. This process not only safeguards computers, mobile devices, and IoT systems from a diverse array of threats like malware, phishing, spyware, and botnets, ensuring privacy, but also optimizes performance.
Quad9’s Threat Blocking Enhanced by Criminal IP’s Threat Intelligence
Quad9 is a free anycast DNS platform delivering robust security protections and privacy guarantees that comply with rigorous Swiss Data Protection and GDPR rules. Quad9 is operated as a non-profit by the Quad9 Foundation in Switzerland for the purpose of improving the privacy and cybersecurity of Internet users.
Operating on a high-performance global network, Quad9 partners with Criminal IP, which offers extensive cyber threat information, including malicious IPs, domains, and CVEs, derived from sophisticated IP and domain scoring algorithms and big data analysis on a worldwide scale, enhances this mission.
<Results of the blocking test for the Quad9 threat-blocking security service integrated with Criminal IP TI>The specially designed Criminal IP Malicious Domains Retrieval API is used to send the Domain Data Feed identified as malicious to Quad9 for integration. This feed is then utilized alongside other threat intelligence (TI) data sources integrated into the Quad9 platform, such as IBM, OpenPhish, F-Secure, RiskIQ, and Domain Tools, to create a comprehensive blocklist for user protection.
Criminal IP’s specialized Domain Threat Intelligence
In addition to these comprehensive threat-blocking results on Quad9, for those seeking more information about each component of domains, users can use Domain Search of Criminal IP. The vulnerability scanner tool meticulously analyzes a wide array of domain details including screenshots, WHOIS data, utilized technologies, page redirections, and certificates. It also identifies potentially malicious content and replicated phishing domains, providing an overall domain score and a Domain Generation Algorithm (DGA) score. This global threat intelligence is updated daily and can be accessed through flexible API integration enabling seamless incorporation of the data into existing security systems, such as SOAR and SIEM.
<Results of searching malicious domain in Criminal IP Domain Search>
“Our partnership with Quad9 is a recognition of the accuracy of Criminal IP’s data,” stated Byungtak Kang, CEO of AI SPERA. “It is expected that our collaboration will contribute to the protection of Quad9’s end-users, who have a global reach, while simultaneously enhancing the quality of Criminal IP’s data.”
End users interested in utilizing the integrated threat-blocking security service of Quad9, which is linked with Criminal IP threat intelligence, can automatically activate the service simply by using the Quad9 DNS server (9.9.9.9).
About AI SPERA
AI SPERA launched its global cybersecurity service, Criminal IP, on April 17, 2023, following a successful year-long beta phase. The company has established technical and business partnerships with acclaimed global security firms and educational institutions, including VirusTotal, Cisco, Tenable, and Sumo Logic.
Criminal IP offers personalized plan options, also suitable for company use. Users can check their own credit usage for specific features (Web, Vulnerability Scanner, Tags, etc.) and API on the dashboard, and upgrade the plan anytime according to their needs.
Criminal IP is available in five languages (English, French, Arabic, Korean, and Japanese), providing a powerful and accurate CTI search engine for users worldwide. AI SPERA has been delivering cybersecurity solutions worldwide through a range of products, including Criminal IP CTI Search Engine, Criminal IP ASM, and Criminal IP FDS.
Contact
Michael Sena
AI SPERA
support@aispera.com -
vFunction Adds Real-Time Observability and GenAI Tool to Modernization Platform
vFunction, the AI-driven architectural observability platform today added real-time observability and GenAI assistant.
vFunction today added an ability to observe IT architectures in real-time to a platform that automatically converts monolithic application code into a set of microservices.
In addition, vFunction has added a generative artificial intelligence (AI) assistant that identifies issues and surfaces recommendations as changes are based to application environments. Based on the ChatGPT-4 service created by OpenAI, the vFunction Assistant is designed to make it simpler to remediate and refactor applications.
Leveraging OpenTelemetry
vFunction CEO Moti Rafalin said these capabilities all leverage OpenTelemetry, open-source agent software being advanced under the auspices of the Cloud Native Computing Foundation (CNCF) to collect telemetry data.
It’s not clear how many applications are instrumented using OpenTelemetry, however, a survey of 1,000 software engineering professionals conducted by vFunction suggests that as organizations look to streamline the management of application environments there is a clear need for increased visibility. A full 80% said these capabilities are either extremely or very valuable, with nearly four in 10 (39%) acknowledging they lack visibility into their IT architecture. A total of 40% said they advocate for a “shift left” approach to proactively address resiliency concerns earlier in the development lifecycle.
A similar percentage (41%) also plans to leverage generative AI to improve application performance and scalability, the survey finds.
The survey also finds more than half (51%) of respondents work for organizations that dedicate more than a quarter of their annual IT and engineering budgets to remediating applications, including refactoring and re-architecting efforts. More than three-quarters (77%) have implemented enterprise-wide initiatives to address technical debt.
Among those respondents, 57% work for organizations allocating more than a quarter of their IT budget to technical debt remediation involving monolithic applications, compared to 49% for microservices architectures. More than half 53% also noted their organization delayed major technology migrations or platform upgrades due to productivity concerns involving microservices. The survey also finds that 44% noted monolithic application complexity that results in a lack of clear domain boundaries and decreasing modularity is a major challenge.
Most application environments will be made up of monolithic and microservices-based applications for the foreseeable future. The challenge that organizations encounter is that as changes are made to application environments the level of drift away from the original architecture starts to increase.
Apply AI to Reduce Drift
At the same time, organizations accumulate technical debt as issues that should be remediated are left to be addressed at some future date. Unfortunately, many of those issues are never resolved, simply because new application development projects require DevOps teams to divert limited resources. However, as more applications are instrumented it becomes feasible to apply AI to reduce both drift and technical debt.
Each organization must determine to what degree they wish to modernize existing applications versus replacing or retiring them altogether. However, there are plenty of instances where legacy applications are still far too critical to be replaced. The challenge then becomes to what degree to update these applications, in a way that makes them more resilient and flexible as business requirements continue to evolve.
-
Five Great DevOps Job Opportunities
DevOps.com is providing a weekly DevOps jobs report through which opportunities for DevOps professionals are highlighted as part of an effort to serve our audience. Our goal is to make it just that much easier for DevOps professionals to advance their careers.
Of course, the pool of available DevOps talent is still relatively constrained so when one DevOps professional takes on a new role it tends to create an opportunity for others.
These five job postings were selected based on the company looking to hire, the vertical industry segment, and, naturally, the pay scale being offered.
We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration.
Indeed.com
Callaway
Carlsbad, CA
Senior DevOps Engineer
$165,400Dice.com
Western Union
Denver
DevOps Staff Engineer
$152,069 to $179,688CareerBuilder.com
Coforge
Oaks, PA
Azure DevOps Engineer
$120,000 to $150,000SimplyHired
Michaels Stores
Irving, TX
Senior DevOps Engineer
$114,000 to $144,000LinkedIn
Paramount+
Lakeland, FL
DevOps Engineer
$74,400 to $140,000 -
Red Hat Plans to Add Policy-as-Code Tools to Ansible Platform
Red Hat is previewing a policy-as-code capability for the Ansible Automation Platform that promises to make it simpler to apply and enforce governance and compliance policies.
Demonstrated at the Red Hat Summit and AnsibleFest 2024 conference, Matthew Jones, chief architect for Red Hat Ansible Automation Platform, told conference attendees this capability would, for example, make it possible to enforce policies that prevent artificial intelligence (AI) models from initiating actions beyond the scope of a set of policies defined as code.
Scheduled to be added to the Red Hat Ansible Automation Platform in the coming months, Red Hat is in effect providing a declarative approach to implementing policy-as-code, in a way that eliminates the need to deploy and master a separate programming framework.
Alternative to GRC Platforms
Policy-as-code frameworks have evolved as an alternative to risk and compliance (GRC) management platforms deployed and managed by a dedicated team. Rather than acquiring and deploying those platforms, GRC requirements are met using code to programmatically enforce policies in the context of DevOps workflows before or after an application is deployed.
The challenge up until now is that policy-as-code frameworks required DevOps teams to deploy a separate framework that in some instances also required someone on that team to master a programming language specifically designed for that framework. Red Hat is now making a case for implementing policy-as-code using the same declarative Ansible platform many IT teams already use to automate workflows.
It’s not clear how many organizations have thus far embraced policy-as-code. However, Red Hat is betting that as organizations move to operationalize AI there will soon be a much greater requirement. The issue that remains to be resolved is to what degree that goal might be achieved using an automation platform such as Ansible or a DevSecOps platform based on a continuous integration/continuous delivery (CI/CD) platform that has been extended to enable DevOps teams to programmatically address compliance mandates.
Alternatively, organizations might in the longer term make use of the reasoning capabilities built into a large language model (LLM) to ensure compliance mandates are met as the ability of generative AI models to automate tasks becomes more robust. In theory, LLMs will be able to not only provide a summary of a compliance issue but also recommend how best to resolve it in a way that is automatically applied, either by it or an automation framework such as Ansible.
Red Hat, in the meantime, has yet to signal its intentions for incorporating the open-source Terraform infrastructure-as-code (IaC) tools that parent company IBM has gained with the acquisition of HashiCorp. In some cases, some subset of GRC requirements might be addressed via IaC tools used to programmatically provision IT infrastructure.
Regardless of approach, it’s apparent that more responsibility for compliance is shifting left toward application development teams in much the same way security did with the rise of DevSecOps workflows. That’s crucial when the fines and penalties imposed for violating mandates that are increasing in number are also becoming more costly. The challenge and the opportunity now is to programmatically ensure there isn’t a violation in the first place using policy-as-code tools that are slowly but surely becoming more accessible.