devopsy.kinsta.cloud

Category: Blogs

The Basics of Infrastructure as Code: A Primer for DevOps
Cloud computing and DevOps are reshaping how organizations design, build and manage their IT infrastructure and applications. Central to this transformation is the concept of infrastructure as code (IaC).

IaC changes the way IT operations and development teams collaborate to create, provision and manage infrastructure and applications. The practice treats infrastructure as software, enabling automated provisioning, configuration and management.

The process needed to change. Traditionally, managing IT infrastructure was a labor-intensive and error-prone process. System administrators manually configured and maintained servers, networks and storage systems, which led to inconsistency and operational bottlenecks. As organizations adopted cloud computing, they were motivated to address their needs for agility and automation.

At its core, IaC involves defining infrastructure and application components using code, which can then be version-controlled, tested and deployed in the same manner as software applications. IaC emphasizes the use of declarative or imperative code to define infrastructure, which allows for the automation of tasks that were once manual and time-consuming.

Among its benefits:
- Automation and Consistency: IaC allows organizations to automate the provisioning and management of infrastructure. The result is that configurations stay consistent across environments, reducing the risk of configuration drift and human errors.
- Version control: Just like software code, IaC scripts can be stored in version control systems. This enables tracking changes over time, rolling back to previous configurations and team member collaboration.
- Scalability: IaC makes it easier to scale infrastructure up or down based on demand. It’s easier to allocate and deallocate resources dynamically.
- Speed: The time required to provision and configure infrastructure is significantly reduced. This agility allows organizations to respond quickly to changing business requirements.
- Reusability: IaC encourages the creation of reusable templates and modules, which reduces duplication of effort.
- Testing and validation: Infrastructure code can be tested automatically, ensuring that configurations are correct and meet security and compliance standards before deployment.
IaC in Cloud Computing

Cloud computing platforms such as Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) have played a pivotal role in popularizing IaC. These platforms provide a wide range of services and APIs that can be orchestrated and managed through code.

For example, Netflix, the global streaming giant, relies heavily on cloud infrastructure to deliver content to millions of viewers worldwide. It embraced a microservices architecture and employs a tool called “Spinnaker” for continuous delivery. Spinnaker uses IaC to define and manage the infrastructure required to deploy and scale microservices. Netflix engineers write code to describe an application’s infrastructure, enabling them to create, modify and tear down resources on demand. This approach has allowed Netflix to achieve rapid deployment, reduce downtime, and maintain high availability while managing a complex and dynamic infrastructure.

As another example, Shopify, the e-commerce platform that powers thousands of online stores, uses IaC to manage its infrastructure across multiple cloud providers. Shopify uses Terraform, a popular IaC tool, to define and provision cloud resources. With Terraform, Shopify can define its infrastructure clearly and concisely, ensuring consistency and repeatability. Everything is defined in code, whether the Shopify staff aims to create a new instance, configure a load balancer, or scale an application. This approach has enabled Shopify to scale rapidly, maintain stability and adapt to changing customer demands seamlessly.

IaC in DevOps

DevOps aligns perfectly with IaC:
- Continuous Integration/Continuous Delivery (CI/CD): IaC is a cornerstone of CI/CD pipelines. In a DevOps environment, changes to infrastructure and applications are continuously integrated and tested. IaC scripts define the desired state of infrastructure, ensuring its consistency across all stages of development.
- Collaboration: Developers can define infrastructure requirements alongside application code, leading to a shared understanding of infrastructure needs and reducing the “it works on my machine” problem.
- Immutable Infrastructure: IaC promotes the concept of immutable infrastructure, where servers and resources are not modified in place but replaced with new instances when changes are needed. This approach ensures consistency and simplifies rollback procedures.
- Infrastructure Testing: Infrastructure as code can be subjected to automated testing, including security scanning and compliance checks. This approach helps identify and rectify issues before they reach production.
- Feedback Loop: Infrastructure issues or discrepancies are detected early in the development process, reducing the cost and effort required to address them.
As technology continues to evolve, the role of IaC in cloud computing and DevOps will only become more prominent. Organizations that adopt IaC stand to gain a competitive advantage by accelerating their development cycles, reducing operational overhead and improving infrastructure reliability.

The adoption of infrastructure as code is not just a trend but a necessity in the age of cloud and DevOps. It empowers organizations to build and manage infrastructure with the same rigor and discipline as software development, paving the way for a more agile and efficient future in IT operations.
May 10, 2024
Survey Credits Engineering Teams With Keeping Lid on Cloud Costs

A CloudZero survey credits engineering teams with keeping cloud costs under control, but there’s still some room for improvement.

A survey of 1,000 U.S. engineering and finance professionals working in organizations with 100 to 9,999 employees, that spent at least $500,000 annually on cloud services from Amazon Web Services (AWS), Google Cloud Platform (GCP), or Microsoft Azure, finds just over half (51%) believe costs are higher than they should be, with 14% of those respondents claiming their cloud costs were way too high.

Conducted by CloudZero, a provider of a platform for managing cloud computing costs, the survey further finds that 81% of respondents said their cloud costs are “about where they should be” when engineering has some level of ownership. The survey also noted that more than half (59%) said their organization now has at least one person dedicated to implementing best FinOp practices to control cloud costs.

In total, 87% said they are able to investigate cost discrepancies in a matter of hours, the survey finds.

Despite those efforts, however, a full 88% said they see significant variance (5–30%) in actual cloud spend versus forecast, but only 43% said cloud costs are a higher priority in 2024 than in the previous year. In fact, well over a third (37%) said cloud costs are less of a concern.

Lack of Cloud Cost Visibility

Nevertheless, a full 89% of respondents said a lack of cloud cost visibility has an impact on their ability to carry out their role, with 46% describing that impact as significant. Among the 500 engineers that participated in the survey, 66% report a lack of visibility into cloud costs causing some level of disruption to their work, with 22% reporting high levels of disruption.

Three-quarters (75%) of all respondents noted they fear losing their jobs if cloud costs abruptly surge by 50% or more, the survey finds.

Only approximately a third of respondents said they could accurately allocate cloud costs, with 42% only being able to estimate. More than three quarters (78%) have less than 75% of their cloud spend allocated.

The profit margins enjoyed by cloud service providers suggest there is plenty of room for improvement when it comes to optimizing consumption of cloud services.

Costs Can be Highly Variable

Bill Buckley, senior vice president of engineering, said the challenge is that in addition to all the types of cloud services being consumed, costs can be highly variable from one month to the next. Developers also have a natural tendency to over provision cloud resources to ensure applications are always available without appreciating total costs, he added.

The best way to control those costs is to ensure engineering teams armed with the right tools are managing the consumption of those resources, said Buckley.

There may, of course, come a day soon when artificial intelligence (AI) is more broadly applied to rein in cloud costs by, for example, taking more advantage of spot instances to run workloads.

In the meantime, DevOps teams would be well-advised to revisit application workloads running on various clouds to make sure resources are optimally being employed in an era where many organizations as much as possible are trying to maximize existing investments in IT. After all, even in the best of times, it’s only a matter of time before someone from the finance teams starts asking questions that DevOps teams should be able to answer in a matter of minutes.

May 10, 2024
Transforming DevOps With AI: Practical Strategies To Supercharge Your Workflows

As someone interested in DevOps, I wondered how all the AI advances could benefit my field. OpenAI used deep learning to release groundbreaking products like ChatGPT and Sora. Microsoft used similar technologies to revamp its products, notably enhancing GitHub with Copilot. Many startups have sprung up, and large tech companies have poured billions into AI research.

Ultimately, how can engineers use this technology to reduce toil, add value to the software development lifecycle (SDLC), and increase development velocity? There are a few interesting options.

Random Forest Classifier for Self-Healing Systems

Say you have a distributed systems environment with lots of pods serving different services. You also have some observability tooling, like Prometheus, to provide a stream of system metrics, such as CPU usage, memory usage, disk I/O, network statistics and even container logs.

Random Forests can help you build a self-healing system. With some creative feature engineering to get rolling averages, rates of change, and error log counts, the Random Forest Classifier can generate corrective actions. For example, it can roll back services if pods fail to start after a deployment or increase pods on a service if CPU and network queries per second (QPS) exceed a threshold.

Since a Random Forest Classifier is an ensemble of many decision trees, each trained on a subset of the features, it can effectively model non-linear data while minimizing overfitting by averaging multiple decision trees and providing multi-class outputs. That’s why I would prefer them over support vector machines (SVMs) and decision trees which don’t provide all those advantages.

LSTMs for Anomaly Detection Based Smart Alerting

Metrics such as CPU usage and network stats like QPS are continuously emitted by a service. You can naturally interpret them as time series and use a long short-term memory (LSTM) neural network to find anomalies. LSTMs are a type of recurrent neural network (RNN) that are good at “remembering” long-term events.

An LSTM trained on, say, CPU utilization data can ignore seasonal events such as nightly backups and unimportant events like minor rises during maintenance events such as host-to-host migrations. It also can alert on things like an unexplained rise during off-peak hours caused by a security breach.

For example, you could train the LSTM on historical data of overall traffic QPS. Once deployed, it references the current QPS and predicts future values that you can later compare to the real future values. If there’s too large of a difference, it sets off an alert. The detected anomalies can also be cataloged and used to fine-tune the model to increase performance over time.

Q-Learning for Autonomous System Configuration Updates

Getting a bit more advanced, Q-Learning is a type of reinforcement learning algorithm that can look at performance metrics, logs, and events such as restarts and deployments, and then update the system configuration. For example, if the metrics point to strained CPUs, the algorithm can decide whether to scale up the pods by adding additional CPUs or spin up additional pods. A reinforcement learning agent can learn from the action’s outcome and adjust its policy without human intervention.

To build this, you would have to define the states (various performance metrics), actions (scale up pods, etc.), and rewards (system performance) following an action. Then the model can be trained on historical data without much manual labeling, and it could be back-tested to ensure good performance.

LLMs for System Management With Natural Language

I bet you know by now what a large language model (LLM) is and how powerful LLMs can be. While LLM-based models can only be trained by well-resourced companies like OpenAI, the APIs for these models are available for public use, albeit at a steep price. But if you do have access to an LLM, you can build a bot that accepts natural language instructions, like “Set up a new service using X image in the development environment and write a deployment report,” after which a well-integrated LLM can carry out the actions.

If an LLM is not at hand, Bidirectional Encoder Representations from Transformer (BERT) is another model used for Sequence-to-Sequence (seq2seq) use cases. It can accomplish similar things, in a more limited but more controlled way. For example, “Restart the web server on node 5” would translate to {“action”: “restart”, “target”: “web server”, “node”: 5} which can be interpreted by a traditional program.

Looking Forward

AI is changing the face of product development and has become a common fixture of software and technology in general. While it’s exciting to use the cutting edge of AI, it’s also enlightening to learn how it can be used directly to reduce toil and improve business outcomes. Simple models can achieve this end by offering proven results for smaller investments, while larger models could revolutionize the SDLC at your company. The only wrong choice is not thinking about it at all and continuing with business as usual.

May 10, 2024
Kinesis PutRequestError Throttling: Don’t Panic, Debug Like A Pro!
Quiz #26 is in our series of quiz questions where we are investigating how to troubleshoot AWS CloudWatch Alarms. If this is of interest, also look at our recent quiz on AWS ELB Performance, Debugging Message Queue alert, Neptune Write IOPS Spiking, and Slow Redshift.

Quiz #26 is:

You are on-call and receive an alarm notification for your Amazon Kinesis stream. The alarm indicates “Increased PutRequestError Throttling”.

Which of the following is the MOST LIKELY initial troubleshooting step to identify the cause of this error?

Check the Kinesis shard health metrics for any degraded shards.
Increase the Kinesis stream’s write capacity units (WCUs).
Review the application logs for any exceptions related to Kinesis writes.
Restart the Kinesis stream to reset any internal throttling counters.
Investigate the application code responsible for writing data to Kinesis.

Correct Answer: 5. Investigate the application code responsible for writing data to Kinesis.
73 people answered this question and 7% got it right.

Hey there, fellow SREs! As veterans in the trenches of keeping our systems humming, we’ve all encountered our fair share of Amazon Kinesis surprises. One such head-scratcher is the dreaded “Increased PutRequestError Throttling” alarm. It can send chills down your spine, but fear not! In this blog, we’ll delve into why this throttling happens and why choice #5 is your best bet for conquering this Kinesis beast.

Understanding PutRequestError Throttling:

Imagine Kinesis as a busy highway. You (your application) are the trucks trying to deliver data (packages). To ensure smooth traffic flow, Kinesis enforces a speed limit – the allowed number of PutRequests per second. Exceed this limit, and you get flagged for throttling – essentially, Kinesis tells your trucks to slow down for a bit.

So, why do we care about PutRequestError Throttling? Because it indicates your application is pushing data faster than Kinesis can handle. This can lead to:
- Data loss: Throttled requests might be dropped.
- Increased latency: Your application waits for throttling to clear, slowing things down.
- Unnecessary costs: Scaling up Kinesis Write Capacity Units (WCUs) to compensate for inefficient writes is like adding more lanes to a highway with poorly optimized trucks!
Why Code Review is Your Debugging BFF (Not Other Options):

Now, let’s analyze the answer choices and see why choice #5 reigns supreme:
1. Shard health metrics: While keeping an eye on shard health is important, it won’t tell you why your application is making excessive PutRequests.
2. Increase WCUs: This might seem tempting, but it’s a reactive solution, not a proactive fix. Throwing more resources at the problem masks underlying inefficiencies in your code.
3. Review application logs: Absolutely! Logs are valuable for identifying errors, but for throttling, you need to dig deeper into the code responsible for Kinesis interactions.
4. Restart Kinesis stream: Restarting disrupts ongoing data flow and might not reset throttling counters. Plus, the root cause remains unaddressed.
5. Investigate application code: Bingo! This is where the magic happens. Here’s where you put on your detective hat and start examining your Kinesis interactions:
- - Are you batching writes efficiently? Sending data in smaller batches can significantly improve throughput.
  - How are you handling retries on throttling errors? Exponential backoff is a good strategy, but avoid bombarding Kinesis with retries immediately after throttling.
  - Are you using the Kinesis SDK optimally? The official SDKs offer functionalities to handle throttling gracefully. Make sure you’re leveraging them effectively.
Code Sample (Java with AWS SDK v2):

Java

import software.amazon.awssdk.services.kinesis.KinesisClient;

import software.amazon.awssdk.services.kinesis.model.PutRecordsRequest;

import software.amazon.awssdk.services.kinesis.model.PutRecordsRequestEntry;

public class EfficientKinesisWriter {

private final KinesisClient kinesisClient;

private final String streamName;

public EfficientKinesisWriter(KinesisClient kinesisClient, String streamName) {

this.kinesisClient = kinesisClient;

this.streamName = streamName;

}

public void putBatch(List records) throws ThrottlingException {

List requestEntries = new ArrayList<>();

for (Record record : records) {

requestEntries.add(PutRecordsRequestEntry.builder().data(record.getData()).partitionKey(record.getPartitionKey()).build());

}

PutRecordsRequest request = PutRecordsRequest.builder()

.streamName(streamName)

.records(requestEntries)

.build();

try {

kinesisClient.putRecords(request);

} catch (KinesisException e) {

// Implement proper backoff logic here

throw new ThrottlingException(“Throttling encountered”, e);

}

}

}

Remember: By meticulously reviewing your application code, you can identify and rectify the root cause of PutRequestError Throttling. This ensures smooth data flow, prevents data loss, and keeps your costs under control.

Call to Action (CTA):

Troubleshooting modern cloud environments is hard and expensive. There are too many alerts, too many changes, and too many components. That’s why Webb.ai uses AI to automate troubleshooting. See for yourself how you can become 10x more productive by letting AI conduct troubleshooting to find the root cause of the alert: Early Access Program.
May 9, 2024
Sumo Logic Previews GenAI Tool to Improve DevSecOps Observability

Sumo Logic this week at the RSA Conference previewed a copilot that leverages generative artificial intelligence (AI) to make it simpler for IT and cybersecurity professionals of varying levels of experience to derive benefits from its observability platform via a user interface (UI) the company is in the process of revamping.

In addition, Sumo Logic revealed the ability to streamline alerts using machine learning algorithms based on the AutoML framework is now generally available.

Sumo Logic is also adding a Cloud Infrastructure Overview dashboard to make it simpler to identify misconfigurations and vulnerabilities faster that can be remediated using playbooks infused with AI.

Finally, the company has added a MITRE ATT&CK Threat Coverage Explorer to its security information event management (SIEM) platform to make it simpler to apply rules based on the widely employed cybersecurity framework along with integrated threat detection feeds.

Chas Clawson, Field CTO for security at Sumo Logic, said the company is working toward providing an observability platform that normalizes DevOps and cybersecurity data in a way that makes it simpler to embrace best DevSecOps practices. Various types of AI models will then surface actionable insights via summarizations and recommended remediations that can be automatically applied in a way that significantly reduces the current level of toil that DevSecOps teams regularly encounter, he noted.

Over time, DevSecOps teams will have at their disposal multiple AI assistants that are optimized to asynchronously manage multiple tasks. As the underlying AI models that enable those capabilities improve, so too will the ability to use reasoning engines to enable AI assistants to automate more complex tasks.

It’s not clear to what degree AI will make application environments more secure, but the one thing that is certain is cybercriminals will be investing in AI to launch more sophisticated cyberattacks at scale because emerging technologies are always going to weaponized, noted Clawson. In fact, in the short term there is likely to be “an ugly brawl” between cybercriminals and defenders as both sides race to apply AI for ill and good, respectively, he added.

In short term, cybercriminals might enjoy an added AI advantage, but there is an opportunity now to leverage data lakes and the observability platforms infused with AI to make it possible to securely build and deploy applications across IT environments that only become more complex with each passing day, said Clawson. In fact, IT teams have reason to be cautiously optimistic about the future of cybersecurity in the age of AI, he noted.

Observability platforms will, of course, play a major role in helping to achieve that goal. As the data collected is increasingly normalized it should become much simpler to correlate events to proactively troubleshoot applications in ways that also make it possible to respond faster to newly discovered vulnerabilities and breaches. The challenge, of course, is finding the funding needed to enable DevSecOps teams to move beyond monitoring tools that today only track a set of pre-defined metrics that don’t provide nearly enough insight into the root cause of any given issue.

May 8, 2024
StarTree Makes Observability Case for Apache Pinot Database

StarTree broadly enhances its real-time database platform by adding query support for metrics, logs and traces.

StarTree today made a case for becoming the foundation upon which observability is gained in IT environments by adding support for metrics, logs and traces to its real-time database platform delivered as a cloud service.

In addition, the company is also making generally available a StarTree ThirdEye service for detecting anomalies and identifying the root cause of application issues. It has also made a free serverless computing tier available on its cloud service.

Viable Alternative to the Legacy Database

Announced at the Real-Time Analytics Summit conference, StarTree Cloud is based on Apache Pinot, an open source columnar database optimized for real-time analytics, originally developed by LinkedIn. StarTree, via a private preview, is signaling that it views Apace Pinot as a viable alternative to the legacy database, upon which observability platforms DevOps teams use to troubleshoot IT environments.

StarTree, to further advance Apache Pinot, is also now adding a vector indexing capability to Apache Pinot along with support for a write application programming interface (API) to facilitate real-time synchronization with extract, transform and load (ELT) pipelines and additional integrations to Grafana and Tableau to improve visualizations.

Chinmay Soman, head of product for StarTree, said the issue with existing databases is they are not designed to scale to the level of performance that modern application environments will require.

Early Days for Achieving Observability

It’s still early days for achieving observability in application environments but many DevOps teams are now moving well past simply monitoring a set of pre-determined metrics. Observability platforms enable DevOps teams to launch queries that make it easier to troubleshoot applications. Not every DevOps team knows what queries to investigate. With the rise of artificial intelligence (AI), it’s becoming more feasible to rely on machine learning algorithms to analyze application environments using metrics, logs and traces stored in an observability platform.

Few DevOps teams will build an observability platform themselves but the capabilities of the underlying databases on they are based are critical, said Soman. DevOps teams should make certain the databases used in these platforms today will be able to scale to meet real-time processing requirements that will only steadily increase as more complex applications are deployed across distributed computing environments, he added.

In the meantime, StarTree is moving toward providing more observability capabilities via the managed database service it provides via the cloud.

It’s only a matter of time before DevOps teams need deeper levels of visibility to manage modern application environments in real time. As organizations become more dependent on software than ever, even the most minor glitch can now have a major financial impact. The challenge DevOps teams face, of course, is finding the funding needed to acquire these capabilities.

In the meantime, DevOps teams should at the very least start assessing which of the many monitoring tools being employed today might one day be rationalized by an observability platform, that in time might lower total costs by streamlining DevOps workflows that today are often more disjointed than anyone cares to admit.

May 8, 2024
Free Workshop from Security Risk Advisors Empowers Organizations to Select Optimal OT Security Tools

Philadelphia, Pennsylvania, May 8th, 2024, CyberNewsWire

Security Risk Advisors (SRA) announces the launch of their OT/XIoT Detection Selection Workshop, a complimentary offering designed to assist organizations in selecting the most suitable operational technology (OT) and Extended Internet of Things (XIoT) security tools for their unique environments.

Led by seasoned OT/XIoT security consultants, the workshop provides participants with an invaluable opportunity to gain insights into both best-in-class and novel solutions, to identify those closest aligned to their specific needs.

In today’s increasingly interconnected digital landscape, the importance of choosing the right OT/XIoT security tools cannot be overstated. These tools serve as the first line of risk reduction and defense against cyber threats targeting critical industrial processes and infrastructure.

Making informed decisions, whether adding a new solution or replacing an incumbent, significantly impacts an organization’s ability to mitigate threats and protect its assets. During the half-day consultation, participants will delve deep into their OT/XIoT security environments, examining current tools and analyzing their infrastructure. The free workshop will result in personalized recommendations of the best-fit solutions from industry vendors.

“We recognize the importance of selecting the right security tools for cyber-physical environments,” says Jason Rivera, Director of OT/XIoT Security at SRA. “Our workshop empowers organizations to make informed decisions, giving confidence that their selection is fit for purpose.”

Submit your application here.

About Security Risk Advisors

Security Risk Advisors offers Purple Teams, Cloud Security, Penetration Testing, OT Security and 24x7x365 Cybersecurity Operations. Based in Philadelphia, SRA operates across the USA, Ireland and Australia. For more information, visit SRA’s website at https://sra.io.

Contact

Marketing Manager
Douglas Webster
news@sra.io
215-867-9051

May 8, 2024
The Role of DevOps in Orchestrating Enterprise-Wide Cloud Security

Moving to the cloud presents several security challenges for enterprises, including protecting the organization from data breaches, misconfigurations, compliance issues and unauthorized access. Moreover, the dynamic nature of cloud environments, with resources being provisioned and de-provisioned on-demand, adds complexity to security management. Organizations should implement robust security measures such as encryption, access controls and regular security audits. Training employees on best practices for cloud security is crucial to mitigate risks and ensure data protection in the cloud environment.

These items should be top of mind.

Automation: The practice of DevOps promotes automation across the software development lifecycle, including security processes. By automating security tasks such as vulnerability scanning, code analysis and configuration management, DevOps teams can identify and address security issues early in the development process, reducing the risk of vulnerabilities in production environments. Furthermore, incorporating security into the DevOps pipeline allows for continuous monitoring and testing of security controls, ensuring that any vulnerabilities are quickly identified and remediated. This proactive approach to security helps to strengthen the overall security posture of cloud environments.

Continuous Monitoring: DevOps encourages continuous monitoring of cloud infrastructure and applications. Through monitoring tools and techniques, DevOps teams can detect security incidents in real-time, allowing for immediate response and remediation. This proactive approach helps mitigate potential security threats before they escalate into significant breaches. By continuously monitoring for any anomalies or suspicious activities, DevOps teams can also improve their incident response capabilities and minimize the impact of security incidents. This ongoing vigilance is essential in today’s dynamic threat landscape to protect sensitive data and maintain the trust of customers.

Infrastructure as Code: With the adoption of infrastructure as code (IaC), DevOps teams can define and manage cloud infrastructure using code. This enables consistent and repeatable deployments and enhances security by ensuring infrastructure configurations adhere to security best practices. By treating infrastructure as code, organizations can implement security controls such as encryption, access controls and network segmentation programmatically, reducing the risk of human error and misconfigurations.

Collaboration and Communication: DevOps fosters collaboration and communication between development, operations and security teams. By breaking down silos and encouraging cross-functional collaboration, DevOps ensures that security considerations are integrated into every stage of the software delivery pipeline. This collaborative approach helps align security objectives with business goals, enabling organizations to achieve a balance between innovation and risk management.

Security First: DevOps promotes an approach where security is integrated into the software development process from the outset. By embedding security practices such as secure coding principles, threat modeling, and security testing into the development workflow, DevOps teams can identify and address security vulnerabilities early in the development lifecycle, reducing the likelihood of security incidents in production. This proactive approach helps organizations save time and resources by preventing costly security breaches that could occur later in the software development lifecycle. Collaboration between development and security teams means DevOps can enhance overall organizational resilience to cyberthreats by fostering a culture of security awareness.

Compliance and Governance: DevOps helps organizations maintain compliance and governance standards in the cloud. By automating compliance checks and implementing security controls as code, DevOps teams can ensure that cloud environments adhere to regulatory requirements and internal policies. This reduces the burden of compliance management and enhances security posture. Furthermore, by continuously monitoring and auditing cloud environments, DevOps teams can quickly identify and remediate any compliance issues that may arise. This proactive approach to compliance and governance helps organizations avoid costly fines and penalties associated with non-compliance.

DevOps is critical in orchestrating enterprise-wide cloud security by promoting automation, continuous monitoring, infrastructure as code (IaC), collaboration, communication, shift-left security, and compliance and governance. By integrating security into every aspect of the software delivery pipeline, DevOps enables organizations to embrace the agility and scalability of the cloud while effectively managing security risks. As enterprises continue to use cloud technologies to drive innovation and growth, DevOps will remain essential in ensuring that security remains a top priority. By implementing DevSecOps practices, organizations can proactively address security concerns early in development, reducing the likelihood of vulnerabilities in production environments. This holistic approach to security enhances overall cybersecurity posture and fosters a culture of shared responsibility and accountability across teams.

May 8, 2024
Mind the Shift: Answering Common Questions About OpenTofu
I recently returned from KubeCon EU where I participated in the first-ever OpenTofu Day and an Evolution of Infrastructure-as-Code panel discussion. During the conference, dozens of engineers and tech execs asked me questions about the OpenTofu project. They wanted to ascertain if it made sense for them to switch to OpenTofu, whether for testing purposes or to make the IaC management tool a permanent fixture in their tech stack.

Many people shared similar questions and concerns which, notably, were still the same as those expressed during the GA release. Now, on the heels of the OpenTofu v1.7 release, I’m taking the time to summarize my answers to those frequently asked questions and to share my (understandably biased) insights on the advantages of adopting it.

What Does “Drop-In” Replacement Mean?

In our communications, we commonly refer to OpenTofu as a “drop-in replacement” for Terraform. Unsurprisingly, the most common question I was asked was, “What does ‘a drop-in replacement’ really mean?”

As a developer, I understand where such questions come from. “Drop-in replacement” sounds more like a marketing promise than a technical specification. With that in mind, let me clarify what we mean.

To try OpenTofu, follow these steps:
1. Install OpenTofu.
2. Use the tofu command to execute your previously terraform commands (e.g.,tofu plan instead of terraform plan, tofu apply instead of terraform apply, and so forth).
And that’s it.

You don’t need to change a single line of code in your Terraform configuration. You can continue using all your favorite providers and modules, public or private. They will all just work.

By “drop in” we mean literally the minimal possible amount of effort with the fewest possible adjustments.

What’s the Best Time to Make the Switch?

Another question I encountered, often implied rather than asked directly, was, “Should I start with OpenTofu now or wait a while?”

Setting aside my personal bias, I can sum up my answer with a simple, undeniable fact: No future scenario is likely to make the switch easier than it is right now.

Let me explain.

The ease of transitioning between OpenTofu and Terraform comes from their complete interoperability in 1.6 stable versions. The ability to switch between Terraform and its open-source successor with a simple command alias means there’s effectively no cost to trying OpenTofu.

To me, this suggests that if you’re considering giving OpenTofu a try—whether sooner or later—the best time to do so is now.

Will the Projects Diverge?

Inevitably they will. However, there’s more to consider.

Ease of migration is a top priority for us on the OpenTofu team, and it is equally important to our community. This commitment ensures that we will manage any divergence between versions carefully.

Take OpenTofu v1.7 as an example. This version introduces several features, such as the much-anticipated state file encryption. But importantly, all these additions are opt-in. This approach exemplifies our commitment to not locking users into OpenTofu against their preferences.

Starting with OpenTofu is essentially a low-effort trial. The worst-case scenario is that you end up with a free, open-source version of Terraform that includes some additional, optional features to explore.

This was the mindset of several people I spoke with at KubeCon who were adopting OpenTofu as a future-proofing strategy. Doing so would let them keep their options open and help them avoid being locked into any specific vendor-ecosystem or IaC management tool.

What About Community Support?

Support for the project is gaining momentum. Key players including Alpine, Brew, and GitLab have already moved away from BSL-licensed Terraform binaries to ensure long-term open-source interoperability and to address their unique needs.

These are just a few examples. The shift in HashiCorp’s licensing terms, compounded by its recent acquisition by IBM, has sparked concerns about long-term viability and compatibility. These are unlikely to go away anytime soon. For many people in the community, this positions OpenTofu as a logical and straightforward path to return to business as usual.

Moreover, adopting OpenTofu also serves as a way to tap into the wellspring of community contribution that dwindled for Terraform following the licensing change.

As a vendor-neutral Linux Foundation project, OpenTofu remains true to Terraform’s original open-source ethos, drawing on the collective wisdom and diversity of the FOSS community.

This commitment to openness, reinforced by the project’s transparent governance through a multi-vendor technical steering committee, ensures that community innovation can flourish.

But don’t just take my word for it. Form your own opinion by joining our Slack community (2,100 members and growing), or follow the discussions on our GitHub repo. You can also keep up with our project updates and engage in open discussions by following us on Twitter or LinkedIn, and by joining our office hours.

Looking Forward

Switching to OpenTofu isn’t the right move for everyone. For example, if you’re deeply embedded in Terraform Cloud, it may be more practical to stick with HashiCorp.

However, the undeniable fact is that currently, the effort to experiment with OpenTofu is as low as it’ll ever be.

So, if you are looking for a true open-source project backed by a vibrant and enthusiastic community, or you just foresee a future where OpenTofu would fit into your tech stack, the best time to dip your toes in the water is right now.
May 8, 2024
Hunters Announces Full Adoption of OCSF and Introduces OCSF-Native Search
San Francisco, United States, May 7th, 2024, CyberNewsWire

Hunters, the pioneer in modern SOC platforms, today announced its full adoption of the Open Cybersecurity Schema Framework (OCSF), coupled with the launch of groundbreaking OCSF-native Search capability. This strategic advancement underscores Hunters’ commitment to standardizing and enhancing cybersecurity operations through open, integrated data sharing frameworks.

Uri May, CEO of Hunters, explained the strategic significance of this move, stating, “Adopting OCSF as our primary data model represents a transformative step in our journey to elevate cybersecurity operations. Alongside this, our new advanced OCSF-native search functionality is set to transform how security data is searched and analyzed, offering unprecedented efficiency and precision.”

Democratizing Security Operations with OCSF

The adoption of OCSF provides a unified, standardized language across cybersecurity tools and platforms, simplifying data integration and analysis workflows. The adoption fosters frictionless interoperability and enables enhanced collaboration among cybersecurity professionals, promoting flexibility and innovation by eliminating constraints imposed by proprietary data formats.

“Adopting OCSF will not only enhance our AI-driven security solutions, but also enable seamless data integration across vast and diverse datasets, dramatically improving the speed and accuracy of threat detection and response,” added May.

Some of the benefits of adopting OCSF include:
- Streamlined Operations and Enhanced Collaboration – practitioners use common security language, promoting efficient sharing of insights and best practices, bolstering collective defense strategies.
- Breaking Vendor Lock-in and Data Silos – Organizations are not constrained by proprietary data formats from specific vendors.
- Revolutionizing Threat Hunting and Investigation – By shifting from logs to context-aware events and objects, OCSF enables multi-stage attack analysis and context-rich threat hunting.
- Accelerating AI and Gen-AI in Security – Standardized data schema accelerates the development of AI-driven security solutions.
OCSF-native Search Functionality: A New Era in Cybersecurity Analytics

Hunters is thrilled to launch their revolutionary OCSF-native search functionality, designed specifically for SOC analysts and threat hunters. This innovative technology addresses the complexities of “query engineering” by leveraging a universal data schema—OCSF—to streamline the search process across diverse data formats and environments. The new search capabilities not only reduces the frustration and errors associated with traditional query syntax but also enhances both general and specialized investigation capabilities, transforming how security teams interact with data and significantly accelerating their operations.

OCSF-Native Search is Revolutionizing Search in the following ways:
- Event and Object Based Searching: A New Search Paradigm – Hunters SOC platform introduces event and object-based searching, eliminating the complexities of source-specific log formats, by enabling analysts to search cybersecurity events and objects without the need for field normalization or navigating diverse log formats.
- Democratizing Data Analysis: Equipping Analysts of All Levels for Success – OCSF-native search simplifies the search experience, eliminating the need for SQL proficiency or specialized knowledge in tools like Kibana or KQL. With an intuitive interface tailored to the OCSF model, analysts of all experience levels can quickly become proficient, bypassing traditional complexities and lengthy training sessions.
- Entity Investigation Curated Workflows: Investigations with a Single Click – With this new capability analysts can pivot directly from Hunters alerts to Search with a single click, automatically populating and executing queries for deep context. This eliminates the need for manual query building, facilitating a seamless investigative workflow that allows analysts to efficiently explore and analyze security incidents.
- Timeline Experience: Enhanced Chronological Insight for Security Analysis – A new timeline-based approach to search enables analysts to explore the chronological progression of security events. This feature provides insights into patterns, anomalies, and potential threats, enhancing the investigative workflow. Analysts can identify correlations, track threat evolution, and streamline investigations efficiently.
“Our new search functionality is a game-changer for both experienced and novice security practitioners,” says Yuval Itzchakov, CTO at Hunters. “It elevates SOC operations by providing Tier 1 analysts with the clarity needed for higher-level analysis and democratizes security insights, making advanced investigations accessible to more team members.”

Contributing to the Community – OCSF Mapping

In conjunction with this new product release, Hunters is also proud to contribute to the cybersecurity community by sharing one hundred mappings of security logs to the OCSF schema. This contribution is part of their commitment to fostering an open and collaborative environment where knowledge sharing accelerates innovation and strengthens security postures across the industry.

The full adoption of OCSF and the launch of our OCSF-native search functionality mark significant milestones in Hunters’ ongoing mission to innovate and automate cybersecurity analytics and operations. By embracing open standards and providing powerful, intuitive search capabilities, they are not only advancing our platform but also contributing to a more interconnected, efficient, and effective cybersecurity ecosystem.

To learn more, users can visit us at RSAC Booth #4317, Moscone North, or contact us on www.hunters.security

Contact

Ada Filipek
Hunters
ada.filipek@hunters.ai
May 7, 2024