devopsy.kinsta.cloud

Category: Blogs

  • Blueprints for a Secure, Future-Proof Hybrid Cloud

    Blueprints for a Secure, Future-Proof Hybrid Cloud

    For today’s organizations, hybrid environments are a given. Whether for legacy reasons, regulatory requirements, or other specific needs, some of an enterprise’s critical data is likely to reside on, or in some cases, revert to, on-premises. However, other equally crucial data might be more efficiently and cost-effectively suited for storing and accessing in the cloud. Hence, hybrid.

    Despite their logic and many benefits, hybrid environments bring new levels of complexity. And they bring greater vulnerability, with ever more devious cyber threats probing the multitude of network access points. More than 80% of breaches now involve data stored in hybrid environments, according to IBM’s Cost of a Data Breach 2023 Report.

    That’s why, to avoid data loss and maintain a comprehensive level of protection across the entire environment, organizations need a blueprint for adopting and evolving their hybrid systems. The right solution enables data protection across workloads, providing the hybrid enterprise with the flexibility to protect data wherever it is today — and wherever it might be in the future.

    A growing multitude of organizations in various industries have successfully implemented blueprints of this sort, built on the following foundational considerations:

    Cost-optimization: A solution that can span a hybrid environment — SaaS, software and on-premises — and reduce infrastructure to manage and save administrative time.

    Air-gapped security: Backup of the most critical data in cloud locations that can’t be accessed through whatever network or networks might be the focus of a cyberattack.

    Fast recovery: Flexible, performance-optimized storage combined with the ability to send an air-gapped copy to the cloud for ransomware protection.

    Broad coverage: An integrated set of software, appliance and SaaS offerings that span hybrid environments — and can evolve with the organization.

    Simple management: Single-pane-of-glass dashboards for monitoring the hybrid environment while reducing management overhead.

    Reliability for peace of mind: Leveraging industry-leading, trusted platform solutions rather than unproven point products.

    Now’s the time to see it in action.

    Ensuring an Insurer’s Data Backup

    In Israel, Harel Group is the country’s top insurance and financial services provider, managing a large volume of data and investments. As such, a critical priority for the company is to ensure all that data is 100% backed up and can be restored without any issues.

    Harel Group were using a secure solution to reliably protect more than 1.5PB of data in its on-premises environment. More recently, though, it has sought the flexibility and efficiencies of moving part of its infrastructure to the cloud. However, stringent industry regulatory requirements meant Harel could store sensitive data in the public cloud only if it could be backed up and stored as efficiently, securely and reliably as the on-premises data. What they needed was a SaaS solution.

    “A SaaS solution takes care of data availability, but not the backup operation of the data,” said David Ben-Eli, system IT infrastructure manager for Harel Group. “We knew from day one that in taking on Microsoft 365, we would need a SaaS solution with good restore functionality that satisfies our business model and strategy.”

    And so, Harel designed a blueprint based on a fully managed SaaS platform. The initial stage involved protecting approximately 1,000 of its employees’ mailboxes, which will soon cover more than 5,000 mailboxes.

    The SaaS solution also enabled Harel to move its on-premises storage securely to the cloud, which has the dual advantage of reducing infrastructure costs and air-gapping its backups to mitigate the risk of ransomware attacks. “We have peace of mind that our data is secure,” Ben-Eli said. And the entire cost of the SaaS solution “is less than the cost of hiring more people.”

    Backing up and protecting a company’s data in a hybrid environment is challenging enough. To be a vendor providing those capabilities to other companies comes with additional challenges.

    A Vendor Puts its Data in Order

    Evolutio, based in Madrid, is a leading enabler of cloud services that provides more than 5,600 kilometers of deployed networks with 6,100 virtual machines across three data centers. Its goal is to support customers’ digital transformations and foster their agility, flexibility and innovation capacity to optimize their business value.

    To meet Evolutio’s needs, Alain Rodriguez, head of services management office, had to find an easy-to-use solution that consumed minimal resources to manage backups and security for Microsoft 365. His blueprint aimed to protect critical data before anything could go wrong.

    So, Evolutio chose a single platform to back up and restore data for internal systems. By implementing a fully hosted SaaS-based solution, Evolutio no longer needs to worry about purchasing and maintaining equipment yearly. There is also no upfront investment required and no additional costs for support from the vendor. As a result, Evolutio’s business can grow on demand.

    Resolving a Global Data Sprawl

    Woodward, Inc. is an American designer, manufacturer and service provider of control systems and components for aircraft engines, industrial engines and power systems. The company has been growing significantly across dozens of global networking sites, with expansion that quadrupled the size of data and backed-up servers.

    Virtual machine sprawl ate into company resources while complicating backup operations requiring standardized procedures. Slow legacy servers and apps made it impossible to meet recovery point objective (RPO) and recovery time objective (RTO) targets. And the absence of a coherent, comprehensive disaster recovery plan worsened things.

    Topping this off was increased backup storage costs via disk and tape and a need for central management or cross-department visibility into data protection and backup policy compliance. There was no blueprint, in other words.

    After trying unsuccessfully to address its needs with various disparate solutions, Woodward decided to replace everything with a comprehensive cloud-based backup and recovery platform. The company switched all global sites to this solution. As a result, Woodward has reduced the overhead of managing their data protection, can consistently enforce backup, restore and retention policies and has unprecedented comprehensive visibility and reporting across the end-to-end environment.

    “I used to cringe when I received a restore request since backups would frequently fail,’’ said Loren Leveque, senior manager of IT and system networking. With the cloud-based platform, he said, “I am ready to support the backup, restore and archive needs of our company.”

    Supporting Dozens of Manufacturing Plants

    Linamar Corporation is a diversified global manufacturing company and world leader in designing, developing and producing highly engineered products. Because the Canadian company supports 61 plants globally, a cloud approach became necessary to streamline efficiency in backup and recovery.

    Linamar had recently shifted from Microsoft Exchange on-premises to cloud-based Microsoft 365 for its 7,000+ users worldwide, and the company’s tape-based backup system didn’t support it. The built-in Microsoft 365 data protection was a start, but it couldn’t handle the rapidly expanding demands imposed by Linamar’s global network.

    By moving to a cloud-based backup and recovery platform supporting Microsoft 365, Linamar saved the costs and administrative time previously needed for managing tapes. And backup is no longer a full-time job – it’s more like “when you need it, set it up,” said Kristian Smith, Linamar’s manager of technical services and support. Restores can now be handled 100% within the team and take hours to execute, not weeks.

    Bringing it All Together

    The examples might be as varied and numerous as enterprises worldwide with crucial data to protect. But these and any other success stories all have at least one thing in common: They took a blueprint approach to ensuring that their hybrid environment is secure and sufficiently future-proof.

  • AWS Cost Management in 2024

    AWS Cost Management in 2024

    AWS cost management involves strategies and practices aimed at controlling and optimizing the expenses associated with using Amazon Web Services (AWS). As businesses scale and diversify their use of AWS services, it becomes crucial to manage costs to ensure cloud expenditures remain aligned with business objectives and budgets. Effective cost management in AWS encompasses understanding billing and account structures, monitoring usage and costs in real-time and making informed decisions about resource allocation and deployment.

    At the core of AWS cost management is the ability to visualize and analyze cloud spending. AWS provides detailed billing reports and cost management tools that enable users to track their usage patterns, identify trends and pinpoint areas of inefficiency. Many organizations use third-party tools to get more detailed insights and savings recommendations. This data-driven approach allows organizations to adjust their cloud usage to avoid unnecessary costs, such as by shutting down idle resources or choosing more cost-effective service options.

    Furthermore, cost optimization techniques, such as selecting the appropriate pricing models (e.g., Reserved Instances, Savings Plans), optimizing resource utilization (e.g., scaling resources to match demand) and applying cost allocation tags for granular tracking, are critical components of AWS cost management. These practices help businesses allocate cloud costs accurately across departments or projects, enabling better planning, budgeting and accountability.

    The Importance of Cloud Cost Optimization for DevOps Teams

    Cloud cost optimization is crucial for DevOps teams to ensure efficient resource utilization and cost-effectiveness in cloud environments. As cloud infrastructure becomes more complex and dynamic, DevOps teams face the challenge of balancing performance, scalability and cost. By adopting cost optimization strategies, teams can identify wasteful spending, optimize resource allocation and ensure that cloud investments align with business goals and operational requirements.

    For DevOps teams, cloud cost optimization involves continuous monitoring, analysis and adjustment of cloud resources. This iterative process allows for the fine-tuning of systems to achieve optimal performance without overspending. Techniques such as auto-scaling, choosing the right instance types and employing cost-effective cloud services are part of this optimization. 

    Additionally, implementing budgeting controls and cost alerts helps prevent unexpected expenses, enabling teams to allocate resources more efficiently and respond quickly to changes in demand. Through effective cost optimization, DevOps teams can contribute to the overall financial health of an organization by maximizing the value of cloud investments while supporting rapid development and deployment cycles.

    AWS Cost Management Best Practices in 2024

    Cloud cost management is evolving. Here are some of the best practices that will become more important in 2024 and beyond.

    Adopt Serverless Architectures Where Appropriate

    Serverless architectures, also known as function-as-a-service (FaaS), allow developers to build and run applications without having to manage any servers. This means you only pay for what you use, which can significantly decrease costs when compared to traditional server-based architectures.

    In addition, serverless architectures can scale automatically to meet demand, eliminating the need for manual intervention. This can free up valuable time for your IT team to focus on other important tasks. Furthermore, serverless architectures are highly flexible, allowing for rapid development and deployment of new features and applications. This can significantly reduce time-to-market, which can provide a competitive advantage in today’s fast-paced digital economy.

    Utilize Spot Instances for Flexible Workloads

    Another effective strategy for AWS cost management is to utilize Spot Instances for flexible workloads. Spot Instances are spare AWS EC2 instances that are available at up to 90% off the On-Demand price. This means you can significantly reduce your AWS costs by strategically bidding on and using Spot Instances when demand is low.

    However, it’s important to note that Spot Instances are not suitable for all workloads. They are best suited for flexible, interruptible workloads that can withstand occasional downtime. This includes tasks such as batch processing, data analysis and non-critical background tasks.

    In addition, it’s crucial to have a robust strategy in place to handle Spot Instance interruptions. This can include setting up Auto Scaling Groups, using Spot Fleet or leveraging third-party tools. By effectively managing Spot Instances, you can significantly reduce your AWS costs while maintaining operational efficiency.

    Implement FinOps Principles

    FinOps, or cloud financial management, is a set of principles and best practices designed to help organizations manage and optimize their cloud costs. Implementing FinOps principles is a critical component of AWS cost management in 2024.

    FinOps involves three key principles: Visibility, optimization and governance. Visibility means having a clear understanding of your cloud usage and costs. This can be achieved through comprehensive tagging, detailed cost reporting and regular cost reviews.

    Optimization involves ensuring that you’re using your cloud resources efficiently. This can involve right-sizing your instances, leveraging savings plans and reserved instances and automating your resource management.

    Governance involves setting up policies and procedures to manage your cloud costs. This can include setting up budget alerts, implementing cost approval workflows and regularly auditing your cloud usage and costs.

    Leverage AI for Cost Optimization

    Leveraging artificial intelligence (AI) for cost optimization is a growing trend in AWS cost management. AI can analyze vast amounts of data quickly and accurately, providing valuable insights into your cloud usage and costs.

    For example, AI can identify inefficiencies in your cloud infrastructure, such as underutilized instances, unnecessary data storage, or expensive data transfer. By addressing these inefficiencies, you can significantly reduce your AWS costs.

    In addition, AI can provide predictive analytics, allowing you to forecast future cloud usage and costs. This can help you plan your budget more accurately and make informed decisions about resource allocation.

    Use Sustainable Computing to Reduce Costs

    Sustainable computing, or green computing, is the practice of using computing resources efficiently while minimizing environmental impact. By adopting sustainable computing practices, you can not only reduce your environmental footprint, but also reduce your AWS costs.

    One strategy is to use energy-efficient instances, such as those powered by the AWS Graviton2 processor. These instances deliver superior performance while consuming less power, resulting in lower costs.

    Another strategy is to utilize AWS’s carbon footprint tool, which can help you measure the carbon emissions associated with your AWS usage. By reducing your carbon emissions, you can reduce your environmental impact and potentially qualify for carbon credits, which can offset your AWS costs.

    In conclusion, AWS cost management in 2024 requires a comprehensive approach that includes adopting serverless architectures, utilizing Spot Instances, implementing FinOps principles, leveraging AI and using sustainable computing. By following these best practices, you can effectively manage your AWS costs, optimize your cloud infrastructure and ensure the maximum return on your cloud investments.

  • Tabnine Extends Generative AI Testing Platform by Embracing RAG

    Tabnine Extends Generative AI Testing Platform by Embracing RAG

    Tabnine today revealed that its namesake generative artificial intelligence (AI) platform for creating test code can now surface more accurate and personalized recommendations based on specific code and engineering patterns.

    At the same time, Tabnine also announced that Tabnine Chat, a tool for interacting with the large language models (LLMs) at the core of the Tabine platform using a natural language interface, is now generally available.

    Data that resides in a codebase or an integrated developer environment (IDE) can now be used to extend the large language models (LLMs) on which the Tabnine platform is based using retrieval augmented generation (RAG) techniques. Previously, the Tabnine platform would only generate test code based on the data that Tabnine had exposed to its LLMs.

    Tabnine president Peter Guagenti said RAG makes it possible to provide additional contextual awareness for the test code generated along with documentation and explanations of the test code created. The overall goal is to leverage generative AI to make it easier to shift more responsibility for application testing further left toward developers, he noted.

    That approach enables developers to create and run more routine tests earlier in the software development life cycle, which should provide application testing teams with more time to run more complex tests before applications are deployed, added Guagenti. Rather than being a job killer, generative AI will eliminate rote tasks that most members of the DevOps team don’t really enjoy doing, he noted.

    Tabnine uses a mix of LLMs it developed with Google to apply generative AI to application testing. Unlike general-purpose LLMs, the ones used by Tabnine were trained using a narrower base of testing code that the company curated using tests made freely available on the internet.

    It’s now only a matter of time before generative AI is applied across the entire software development life cycle (SDLC). It’s not clear how automated testing will become in the age of AI, but the overall quality of applications should steadily improve as more tests are run. The goal is to make it possible to conduct more tests without slowing down the overall pace of application development.

    There continues to be as much irrational exuberance about AI as fear and loathing. Still, DevOps teams that committed early on to ruthless automation will naturally be at the forefront of adoption. The immediate challenge is assessing what functions will be automated and the impact those changes will have on the way DevOps teams are currently structured. Ultimately, the goal is to eliminate as many of the bottlenecks that conspire to slow application development and deployment while simultaneously improving the quality of the application experience.

    It may be a while before generative AI is pervasively applied across DevOps workflows, but one of the first places it will undoubtedly manifest is in test automation. The challenge and the opportunity now is determining how best to apply it in a way that augments DevOps teams that arguably have never had enough time to properly test code in the first place.

  • 3 Quick Fixes for Event-Driven Architecture (EDA) Complexity

    3 Quick Fixes for Event-Driven Architecture (EDA) Complexity

    Event-driven architecture (EDA) and the adoption of event streaming throughout enterprises are increasingly becoming essential architectural requirements for businesses across almost every industry. However, the more companies use it, the greater the complexity becomes. Event portals can play a pivotal role in not only gaining comprehensive insights into the intricate and expanding event-streaming ecosystem but also facilitating the auditing, management and governance of events.

    According to a recent IDC Infobrief, 93% of companies employing EDA across various applications reported that EDA either met or exceeded their expectations. Moreover, 82% of IT leaders intend to apply EDA to two to three new use cases within the next 24 months.

    Nonetheless, the number of event streaming use cases results in a surge of data volumes. This, in turn, entails the adoption of more brokers, projects and products for event streaming. For instance, an organization might use open source Kafka for one specific use case while turning to brokers like Confluent for another and Amazon MSK for yet another distinct purpose.

    While the real-time processing of data is certainly a positive development, numerous experienced EDA adopters have yet to maximize its potential. Frequently, the situation involves a one-to-one exchange, where a stream is consumed only once, or organizations, having advanced through various stages of maturity with multiple streaming use cases, find themselves entangled in a complex network of brokers, clusters, topics and overlapping schemas.

    Let’s explore three typical challenges that organizations encounter as they progress toward event-driven maturity.

    Success Needs Visibility – Make Sure Your Event Portal Can Provide It

    Application decoupling is great for runtime, but this lack of visibility on both the publish and subscribe side can cause issues when making changes to existing applications. Application producers don’t know who the consumers are and consumers don’t know who the publishers are.

    An event portal offers a single window into an event-steaming ecosystem. It provides a native discovery agent to scan, for instance, a Kafka cluster and its schema registry to produce a visual representation of every topic and its schema(s) across multiple versions–and, importantly, who its consumers are.

    If an organization were to decompose its monolithic applications into event-driven microservices that communicate with each other via, say, Apache Kafka, one of the biggest challenges is to understand and manage the infrastructure and information flows.

    Specifically, how to see the microservices affected by a given change before deploying a new feature or function to ensure it won’t bring that system down – even for as few as five seconds.

    By using an event portal, organizations can automatically scan their system and visualize a complete map of endpoints and event streams instead of manually diagraming event streams between microservices.

    Using Data at Its Best – in Real-Time

    Let’s extrapolate the poor visibility issue from one application across the entire enterprise.

    For instance, if you’ve been using Kafka for several years, especially with many departmental or specific application-type use cases, your Kafka cluster now is a treasure trove of real-time data. But data is most valuable at the moment it’s produced – as per Forrester: “Data is, without a doubt, valuable. But when stored in vaults and locked down, it is not.” Real-time data is the most valuable data that exists. But siloed event streaming data means other departments, decision-makers, customers and partners don’t know about it – therefore, it’s not getting shared or reused to its full potential.

    Typically, developers don’t have anywhere to go to find this data treasure trove. Some have resorted to building Confluence or Wiki pages that try to document that this data exists, using SharePoint or Word documents. Noble intentions, but without real-time data mining and updates, this information quickly gets stale and out of date.

    Again, this is where an event portal makes a difference, providing a perpetually up-to-date catalog of data detailing all topics, event streams, schemas and pub/sub interfaces for each application, along with owners and points of contact, as well as changes for each of the managed EDA entities. This helps expedite development by letting developers easily share, discover and re-use any existing Kafka or event streaming asset, both inside and outside the organization.

    For a real-world example of this in action, look at the Federal Aviation Administration and its SWIM (system-wide information management) infrastructure that distributes real-time information to FAA systems across the United States.

    Through secure gateways, external partners of the FAA can tap into the flow of events. Airlines and other industry partners that need the SWIM data get it in real-time, without perpetually requesting updates. Whether it’s the availability of gates at an airport, the position data of planes in the sky, or the weather for a region – external partners have the latest information without needing to ask.

    Don’t Forget to Govern Event Streams!

    The decentralized and dynamic nature of event-driven systems introduces unique security challenges. One of the common trade-offs with event streaming is that it does include access control rules, but developers can err on the side of being too permissive to ensure agility. If streams are not visible, properly cataloged, and data updated regularly, this presents problems with data security, governance and compliance.

    Using an event portal designed to give organizations visibility and control over their event streaming can turn security from reactive – to proactive. Users can organize systems into application domains, create and import payload schema definitions in a variety of formats, including AsyncAPI, define event interactions between applications and microservices, and create events and associated topic addresses using topic structure-proven practices. With the right visibility, administrators can ensure security, governance and compliance with internal policies and government regulations.

    EDA to the Rescue!

    A single, multi-broker event gateway technology offers a solution for organizations to uncover, regulate and oversee the life cycle of their real-time event streams throughout the enterprise. Its significance will continue to grow as more organizations adopt EDA as a fundamental platform.

  • What Does Build Quality Look Like in Software Design?

    What Does Build Quality Look Like in Software Design?

    With rapid developments in artificial intelligence (AI), mobile applications and modern software in the last year, the enterprise software market is expected to grow exponentially. Market revenue is projected to reach $292 billion in 2024, and developers are constantly implementing innovative measures into the software development life cycle (SDLC) to ensure a seamless, high-quality creation process. One of the best ways to achieve this is by leveraging modern build health tools to monitor a multi-faceted project’s overall quality and performance.

    Build health tools automate the creation of executable applications from source code and encompass several areas to ensure the stability and health of the software build process. From automated testing to security scanning, developers rely on these tools and processes when defining a modern approach to software development. Before diving into the intricacies of build health quality, it is necessary to grasp the complete significance of the SDLC when attaining the final product in a global marketplace.

    The Significance of the SDLC

    The SDLC is the process in which developers plan, write, modify and maintain software. This methodology applies to software developed for computers, mobile phone applications, video games and other systems. Adhering to this process allows developers to reach the optimal outcome for the final product. The life cycle includes everything from the planning and brainstorming stage to setting up maintenance and operations after the product has launched. It ensures success by providing a more structured approach to building and developing software. This becomes increasingly important as the software market’s value continues to rise.

    Since 2020, the demand for software engineers has doubled. Because it’s essential for business leaders and developers to keep up with the latest trends and innovations, the need for software knowledge will continue to grow exponentially. Currently, software is typically delivered in one of two ways:

    • On-premises. End users install and run the software themselves on the desired device. This serves as a more secure delivery method for highly-regulated industries.
    • Software-as-a-service (SaaS). This cloud-based method allows end users to access the software online rather than through a traditional download/upload. This enables providers to offer a subscription-based/pay-as-you-go structure for users. The provider is responsible for the hosting and maintenance.

    Developers rely heavily on build health tools to ensure a smoothly running life cycle. Build health tools play a huge role in determining a seamless development process.

    The Role of Build Health Tools in Modern Software Development

    Build health tools essentially fill the gaps in the development process and enhance the software build quality. These tools deliver automated testing methods by creating multiple testing scenarios to ensure full functionality. They help developers see the different data points necessary for garnering a 360-degree view of the software and its status.

    The tools also impact resource utilization and response times. Using key performance indicators (KPIs), they monitor the build quality while enhancing build production to ensure it is better than what was previously developed. In that way, it is constantly growing and improving to guarantee the project reaches a smooth and seamless completion for the developer. From there, the tools can create multiple datasets in less time, which significantly reduces overall software development time.

    Common Challenges of Build Health Tools in Software Design Projects

    There are several challenges with using build health tools. The most common obstacle is that automated tools and testing lack the human touch that comes from developers and their manual work. Although build health tools can perform simultaneous tasks quicker than a more manual approach, they overlook the full spectrum of available resources to improve the build. These tools are so focused on functionality that they fail to incorporate the prior research and available resources that often serve as key building blocks for a successful development project. For this reason, it is important to have developers working in conjunction with build health tools to provide a balance between manual and automated software testing.

    Developers can leverage build health tools to seek out the KPIs that determine the software’s quality at a given stage of the SDLC, from initial development and quality assurance (QA) to the final phases of staging and production. Some of these KPIs include:

    • Exceptions. Make sure there are no new exceptions from the previous build versus the production stage.
    • Test coverage. Ensure that adequate testing is performed on the current build by defining what application programming interfaces (APIs) need to be included for certification, along with the number of executions required.
    • Automated data validation. Make sure data is accurate and useful while remaining enforceable by the designated standards.
    • API testing. Test the overall interface for smooth performance with trustworthy data to advance the program/project. It is also important to compare performances during different SDLC stages to confirm the status of the API, dependency, database, and functionality.
    • Memory/CPU usage. Measure the overall usage of the central processing unit (CPU) and its memory to ensure stability and efficiency.
    • Requests per minute. Evaluate the rate at which the software can receive and execute certain requests delivered by the end user to ensure optimal efficiency.
    • SQL coding standards. Enforce standards and limitations for the overall coding within the interface by measuring quality, security, efficiency, and sustainability.

    While these are only a few of the KPIs detectable with the aid of build health tools, it is essential to note how these tools can benefit a successful software release. Developers can compare the differences between current and prior builds throughout the SDLC to fully gauge any changes, developments, improvements, or downgrades during production to a successful launch.

    Current Events and the Future of Build Health Quality for Developers

    There are many examples of current organizations effectively leveraging available build health tools for project success. Software developers will continue to adopt new and innovative methods using AI and automation capabilities to ensure more efficient testing and higher build quality.

    The future is bright for contemporary software engineering. As unexpected as the AI boom of 2023 was for the tech world, the future of modern software development may hold even more surprising developments. Build health tools are expanding and perfecting the creation process for enterprises and developers worldwide. As build quality improves on the back end, the customer experience for global industries will improve on the front end. The potential for software enhancements and innovations in this way is what makes the journey exciting.

  • Arm Extends Processor Architecture to Transform IT

    Arm Extends Processor Architecture to Transform IT

    Arm today extended its processor portfolio to add two offerings that increase the performance-per-socket provided by 50% and performance-per-watt provided by 20%, respectively.

    Part of the Arm Neoverse Compute Subsystems (CSS) family of processors, these third generation Neoverse IP processors include an Arm Neoverse CSS V3 design to improve performance and Arm Neoverse CSS N3 design to improve energy consumption. Arm, for example, envisions the first instances of the N3 being used in networking and data processing units (DPUs) that require thermal design power measurement of as low as 40 watts.

    Dermot O’Driscoll, vice president of product solutions for the Infrastructure Line of Business at Arm, said Arm is already working with partners to manufacture these next-generation processors that will find their way onto system-on-chip (SOC) subsystems. Arm assumes responsibility for configuring, optimizing and validating a complete compute subsystem for key use cases on behalf of its partners, he noted.

    As part of that effort, Arm is continuing to work with partners to provide early access to SoCs to enable their software development teams to construct applications using simulation and emulation tools as next-generation platforms are being developed and deployed, he added.

    That approach helps ensure that software that is optimized for these processors is available at the time when SoCs become available, noted O’Driscoll. Variations of those Arm processors now routinely show up everywhere from the network edge to cloud computing environments to provide IT teams with an alternative to x86 processors that, so far, are not able to match the price/performance of Arm processors that are also more energy efficient.

    DevOps teams are under more pressure than ever to improve application performance without increasing the overall carbon footprint of their IT environments. Achieving those goals will require everything from more energy-efficient processors to modernized software that makes optimal use of IT infrastructure resources, especially as more inference engines are deployed to run artificial intelligence (AI) models, noted O’Driscoll.

    The challenge right now is many DevOps teams lack the tools needed to track overall energy consumption within the context of their application environment, but as DevOps continues to evolve, it will only be a matter of time before energy consumption metrics become a standard element of an observability platform being relied on to optimize DevOps workflows.

    In the meantime, as IT infrastructure environments continue to evolve, IT teams should expect to be deploying applications on a wide range of Arm, X86, graphical processor units (GPUs) and other classes of processors designed to optimize specific types of workflows. At the same time, Arm is advancing the development of “chiplets” that are optimized to run specific types of workloads within a larger SoC rather than deploying different platforms to run a specific class of processors.

    It may take a while for IT teams to wrap their arms around all the different processor options that are now at their disposal, but as the number of processor architectures being used continues to expand, the need for DevOps expertise will continue to increase.

  • Why DevOps is Key to Software Supply Chain Security

    Why DevOps is Key to Software Supply Chain Security

    DevOps is designed to increase business value and responsiveness through rapid, high-quality service delivery, made possible through fast-paced, iterative IT service delivery. The term DevSecOps emerged as a way to remind us that security was always intended to be part of the software delivery process. However, with the barrage of attacks on the software supply chain showing no signs of abating, the question now is whether even the tightest DevOps pipelines can maintain the pace-protection balance.

    It’s important to note that the term “software supply chain” has been used primarily to refer to the tools and processes used to build and deploy software applications. Now, however, with the rise of infrastructure-as-code (IaC), the term also refers to tools and processes used to build and deploy IT infrastructure.

    Meet Mandates, Reduce Risk

    Software supply chain attacks such as SUNBURST, HTTP/2 Rapid Reset or the breaches associated with the MOVEit vulnerability have fed news cycles for the last few years, and that likely won’t change anytime soon. Attacks on the software supply chain increased 742% since 2020. What we are seeing as a result are new concerns about supply chain security and DevOps requirements. This has led to confusion and often a mish-mash of tooling that may exacerbate rather than mitigate supply chain security issues.

    Arguably the most impactful salvo over the software supply chain security line was president Biden’s 2021 Executive Order 14028, which established new mandates, including the delivery of SBOMs, as minimum requirements for software used by the U.S. federal government. More recently, the FDA has mandated that “all medical devices running software must create and maintain” SBOMs. I expect to see government and industry requirements increase over time.

    These are just a couple of relatively recent examples. There are many more—and no doubt many more to come.

    So, if you’re moving at the speed of DevOps, how do you address these current and future mandates for software supply chain security, as well as the continually emerging vulnerabilities and attacks? I would venture to say that only by moving at the speed of DevOps—and within the parameters of the DevOps model—can organizations not only meet mandates but also effectively reduce risk for the business.

    Indeed, it’s not a matter of whether DevOps is viable within the current security climate but what requirements need to be added to support and enhance current DevOps work.

    New Guidelines, New Processes, New Tools and New Data

    In response to these new threats and regulations, the software community has been working on developing and updating guidelines to help organizations improve the security of their supply chains—for example, SLSA, NCSC UK supply chain security guidance and NIST cybersecurity supply chain risk management. However, these new guidelines can be complicated and require new processes and new tools.

    Before adding any new tooling or changing any processes, it’s critical to examine existing tools to determine whether and to what extent they satisfy supply chain security mandates. Organizations must also evaluate how well existing processes work to protect the business, then strategically add/subtract from there as needed.

    No matter what solutions are leveraged, more and different tools generate reams of more and different data. What’s important — and to whom? How do I manage the data? When can I trust it? Where do I store it? What problems does the new data help me solve? Organizations will need a way to effectively sift this information and deliver the right data to the right teams at the right time. To preserve the ability to quickly and continuously innovate, it will be important to focus on shifting security left as well as integrating automation whenever and wherever possible.

    As new security metadata becomes available, such as from SBOMs, new solutions for managing that metadata will be key. An open source initiative sponsored by Google, GUAC is designed to integrate software security information, including SBOMs, attestations and vulnerability data. Users can query the resulting GUAC graph to help answer key security concerns, including proactive, preventive and reactive concerns.

    Continue to Shift Security Left

    Another way that organizations can maintain their DevOps momentum while protecting the software supply chain is to continue to invest in shifting security left in the software supply chain. The software community has been talking about this for some time, but many organizations struggle to implement impactful changes. Security teams must work to understand how software is built and collaborate with development and DevOps teams to ensure that improvements are made to both application and infrastructure-as-code supply chains.

    We need to go beyond shift-left vulnerability analysis to ensure that we are evaluating the quality of configuration-as-code (for both applications and infrastructure), that we are taking advantage of new recommendations, and that we are leveraging new attestation solutions designed to work with pipelines such as sigstore and Tekton Chains. After all, the sooner an issue is discovered, the more quickly it can be addressed and the less disruptive and costly it is to fix it.

    No One-Size-Fits-All Solution

    While all of these solutions mentioned here are helpful, there is no single product or framework that will enable organizations to maintain the security-innovation balance. Success, rather, will require a focus on agility, flexibility and effective communication and collaboration—the very hallmarks of the DevOps model.

    Rather than being obviated by the demands of software supply chain security, DevOps provides the opportunity to integrate the kinds of protections that can prevent or mitigate supply chain vulnerabilities and breaches. DevOps also enables organizations to quickly and effectively respond to new threats and new requirements.

    With that said, there’s no doubt that organizations will need to think differently about how they manage software security, including the strategic evaluation and integration of tools that will meet current and future regulatory mandates and, more importantly, protect the business over time. Organizations may also need to think about weighing security over speed, at least until all of the pieces of the software supply chain protection puzzle are in place—but also when future circumstances warrant a fresh look at how to best balance the DevOps pace-protection balance.

  • Cycode Brings Generative AI to App Security Posture Management

    Cycode Brings Generative AI to App Security Posture Management

    Cycode today added generative artificial intelligence (AI) capabilities to its application security posture management (ASPM) platform to make it simpler for DevSecOps teams to identify the root cause of vulnerabilities in complex distributed computing environments.

    At the same time, Cycode is adding plugins for VS Code and JetBrains integrated development environments, a command line interface and pull request scanners to make it easier to identify security issues as early as possible during the software development life cycle (SDLC). Cycode also revealed today it now has more than 75 connectors to various security tools commonly used within DevSecOps workflows.

    Amir Kazemi, director of product marketing for Cycode, said the company is using OpenAI’s generative AI platform to provide a natural language interface for invoking the Risk Intelligence Graph that is at the core of the Cycode ASPM platform. As part of that effort, Cycode is now also making available an Executive Dashboard that, based on all the dependencies uncovered, provides summaries of risks that make it easier to discern what is occurring across an application environment.

    The platform, as a result, can now provide automated risk scoring for vulnerabilities based on actual severity and potential impact to the business, said Kazemi. The overall goal is to make it simpler to secure software supply chains by facilitating the proactive collaboration between application developers, DevOps engineers and cybersecurity professionals, he added.

    It’s not clear what impact generative AI is going to have on how DevSecOps workflows are constructed, but making it easier to identify the root cause of security issues in application environments made up of monolithic applications, microservices and event-driven frameworks is now essential. Application security has simply become too chaotic to effectively manage without help from AI, noted Kazemi. In its current state, application security is simply unmanageable, he added.

    The challenge is that just because a zero-day vulnerability has been discovered, it doesn’t always follow that application development teams know where every instance of it exists within their application environment. It’s not uncommon for DevSecOps teams to discover outdated versions of components that have known vulnerabilities to be running months after a patch in an updated version of that component has been made available.

    DevSecOps teams are, of course, always trying to strike a balance between the level of threat a vulnerability represents and the possibility that the patch that should be applied might break an application. However, given the risk to application environments, it’s becoming less risky to patch an application than it is to hope that cybercriminals don’t exploit a known vulnerability.

    While much DevSecOps progress has been made in recent years, it’s clear there is still much work to be done. Hopefully, generative AI will make it simpler for application development teams to address issues more rapidly than ever. In the meantime, however, DevSecOps teams should assume cybercriminals are looking to exploit the same AI capabilities to discover vulnerabilities they can exploit faster than ever.