devopsy.kinsta.cloud

Category: Blogs

5 Security Threats DevOps Teams Should Know

DevOps security, also known as DevSecOps, is a philosophy in which security practices are integrated into the DevOps process. DevOps security involves creating a ‘security-as-code’ culture with ongoing, flexible collaboration between release engineers and security teams. The DevSecOps movement, much like DevOps itself, is focused on creating new solutions for complex software development processes within an agile framework.

DevOps security is about breaking down silos and promoting open collaboration across teams. It’s about making everyone accountable for security with the ultimate aim of improving the quality and speed of code releases. The adoption of a DevOps security model necessitates a cultural shift across the organization. It requires the integration of security into every aspect of the development and operations processes.

DevOps Security is not just about implementing tools and technologies; it’s about changing the way we look at security. Rather than being an afterthought, security should be a key part of the ongoing conversation from the start of the project to the end.

5 Security Threats DevOps Teams Must Know About

As a DevOps professional, it’s crucial to be aware of the potential threats that could compromise your systems, applications, and data. Let’s take a look at the top five security threats that DevOps teams must be aware of.

Phishing Attacks

Phishing attacks are a common security threat that can lead to data breaches. These attacks involve cybercriminals impersonating legitimate organizations to trick individuals into revealing sensitive information, such as passwords and credit card numbers.

Phishing attacks can be particularly damaging for DevOps teams. They can lead to unauthorized access to development systems and data, which can lead to devastating supply chain attacks. For example, an attacker could trick a team member into revealing their login credentials for a critical system, allowing the attacker to gain access and inject malware into a CI/CD pipeline.

Code Injection

Code injection is another common security threat that DevOps teams must be aware of. This involves the exploitation of an application by injecting malicious code. The attacker can then execute the malicious code to compromise the system or steal sensitive data.

For DevOps teams, code injection attacks can be particularly harmful. These attacks can lead to compromised systems and applications, resulting in data breaches and significant downtime.

Man-in-the-Middle Attacks

Man-in-the-middle attacks are a type of security threat where the attacker intercepts and potentially alters the communication between two parties without their knowledge. This can lead to a range of damaging outcomes, including data theft, session hijacking, and even identity theft.

For DevOps teams, man-in-the-middle attacks can be particularly problematic. These attacks can lead to compromised systems and data, and even the unauthorized alteration of code.

Container Vulnerabilities

Container vulnerabilities are a significant security threat for DevOps teams. Containers are a key technology in the DevOps world, allowing for the rapid and reliable deployment of applications. However, like any technology, they come with their own set of security risks.

These vulnerabilities can range from use of insecure images, to misconfigurations and software bugs, to more serious issues like kernel exploits. If an attacker is able to exploit a container vulnerability, they could potentially gain control over the entire system.

DDoS Attacks

Last but not least, distributed denial-of-service (DDoS) attacks are a significant security threat that DevOps teams must be aware of. These attacks involve overwhelming a production environment with traffic, causing it to become unavailable to users.

For DevOps teams, DDoS attacks can be particularly damaging. Not only can they lead to significant downtime, but they can also result in lost revenue and damage to the organization’s reputation.

How to Mitigate These DevOps Security Threats

While these security threats are concerning, there are effective strategies and techniques that can be used to mitigate them.

Implement Email Security Practices and Tools

To combat phishing attacks, it’s crucial to implement email security tools that can detect and block phishing attempts. These tools can help to filter out phishing emails, reducing the likelihood that team members will fall victim to these attacks.

In addition to implementing email security, it’s also important to provide security awareness training for team members. This training should cover the basics of cybersecurity, including how to recognize and respond to phishing attempts.

Use Input Validation and Sanitization in Applications

To protect against code injection attacks, it’s important to use input validation and sanitization in applications. Input validation involves checking that the data provided by a user meets certain criteria before it’s processed by the application.

Input sanitization, on the other hand, involves cleaning up the data to remove any potentially harmful elements. This can help to prevent malicious code from being executed within the application.

Employ HTTPS and SSL/TLS Encryption for Data in Transit

To guard against man-in-the-middle attacks, it’s important to employ HTTPS and SSL/TLS encryption for data in transit. This ensures that any data being sent between the user and the application is encrypted, making it much more difficult for an attacker to intercept and read the data.

Regularly Scan Containers for Vulnerabilities

To protect against container vulnerabilities, it’s crucial to regularly scan containers for vulnerabilities. This involves using tools that can analyze the containers and identify any potential security risks.

By regularly scanning containers, DevOps teams can identify and address vulnerabilities before they can be exploited by an attacker.

Implement Rate Limiting and Network Filtering

Finally, to mitigate the risk of DDoS attacks, it’s important to implement rate limiting and network filtering. Rate limiting involves restricting the number of requests that a user can make to the application within a certain period of time.

Network filtering, on the other hand, involves blocking traffic from certain IP addresses or ranges that are known to be associated with DDoS attacks. This can help to reduce the impact of a DDoS attack and protect the availability of the application.

In conclusion, DevOps security is a crucial aspect of the DevOps process. By being aware of potential security threats and taking steps to mitigate them, DevOps teams can significantly reduce the risk of a security breach and ensure the ongoing success of their projects.

January 25, 2024
The Evolution of DevOps
In the bustling corridors of the tech world, a revolution known as DevOps reshaped the way software is built and delivered. It’s not just about bridging the gap between development and operations; it’s about fostering a culture of collaboration, innovation and continuous improvement.

Today, DevOps is recognized as a culture of beliefs, practices and principles. As DevOps increases in popularity as the preferred methodology of software development, it’s important to understand how it evolved and what it requires of today’s DevOps engineers.

Evolution of DevOps

Before DevOps became common practice, development and operations existed as two separate components of the application release process. The development team would write code and pass it to the operations team, who would then deploy it to the production environment.

Part of the problem with this process is the tension between what the developers are trying to achieve versus the goals of the operations team.
- Application development pushes for continuous updates to add features, fix defects and make other necessary changes, often as fast as possible.
- IT operations, on the other hand, tries to limit the number of releases as they are responsible for running a stable system with the highest percentage of uptime.
To further complicate matters, there was often no clearly defined or automated process for handing over applications. This would result in miscommunications and misalignments, such as:
- Developers writing code without considering where or how the code would be deployed or passing along poorly-documented deployment guides.
- Operations not fully understanding what they were deploying and why, resulting in inefficiencies. Additionally, any time they would discover issues with the application they would have to send it back to the developers with improvement suggestions.
These situations would cause release delays as operations would struggle with unclear directions or try to resolve unforeseen interactions between the new code and the servers. Server errors could also result in blame games between developers and operations, which would negatively impact company morale. And as this was a continuous process, the development of updates and fixes would continue well beyond the initial launch of an application.

That process began to change in 2007 when consultant Patrick Debois, facing frustrations over the barriers between development and operations teams, looked for a different approach. A meeting in 2008 with software developer Andrew Shafer over “Agile Infrastructure” led to the formation of the Agile Systems Administration Group.

Then, in 2009 Debois watched a livestream of the “10+ Deploys Per Day: Dev and Ops Cooperation at Flickr” presentation from the O’Reilly Velocity Conference. Inspired to host his own event, he launched the first DevOps Days conference in Belgium, which inspired similar conferences around the world.

DevOps quickly gained popularity as companies realized how it could increase efficiencies by:
- Making software development and related operations more reliable
- Reducing the time needed to bring software products to market
- Quickly and effectively delivering software updates
- Improving the culture of work within the organization
DevOps Today

The DevOps mindset changed the culture of software development organizations and evolved into a comprehensive set of practices and principles. DevOps aims to bring both development and operations together by:
1. Shortening the software development life cycle (SDLC) and increasing the velocity with which applications move through the release pipeline.
2. Providing a high level of quality control and ensuring that each update is well tested with a minimal number of bugs or errors.
Today, DevOps engineers have their own role, which often requires a range of technical skills and the ability to work effectively with other teams and departments. Many different methods of rapid deployment and various DevOps toolchains are used across an organization’s development team. These approaches often have different points of emphasis, such as the differing emphases of speed of release, security considerations and user experience between DevOps, DevSecOps and site reliability engineering. For instance, the adoption of microservices architecture. By decomposing applications into smaller, independently deployable services, organizations can enhance deployment efficiency. This allows for quicker iterations and updates and minimizes downtime during deployments, ensuring a seamless user experience. Furthermore, the collaborative culture inherent in DevOps paves the way for faster problem resolution and innovation, fostering an environment where continuous improvement it’s a daily reality. These benefits translate into a competitive edge in the market and drive business growth through technological excellence.

No matter the approach, currently, there are a few consistent sets of best practices for all modern DevOps teams:
- Automation. Automation is a cornerstone of DevOps and affects every stage of the SDLC from infrastructure provisioning to configuration management and testing. By eliminating much redundant manual work, automation can drive down costs and human error.
- Cloud computing. Cloud services provide scalable and on-demand resources, facilitating more flexible and dynamic infrastructure. Use of the cloud speeds developer productivity and efficiency by providing a unified platform for deploying, testing and releasing applications.
- Containerization. Containerization simplifies the process of packaging applications into a single, self-contained unit. Utilizing technologies such as Docker and Kubernetes enables developers to create standardized and portable containers that are deployable across different environments.
- Microservices. The adoption of microservices architecture breaks down large applications into smaller, self-contained services, enabling DevOps teams to develop, test and deploy more efficiently, significantly streamlining the overall process.
- Continuous Everything. DevOps goes beyond the standard practice of continuous integration and continuous delivery (CI/CD) as it also includes continuous testing, monitoring, feedback and operations. By seamlessly sharing insights across various stages, this approach cultivates an ecosystem of relentless enhancement and perpetual progress.
Aspiring DevOps Engineers

There are many professional skills needed to work in DevOps, including expertise in environmental testing, application monitoring and version control. However, true success within DevOps is less about programming skills or managing computing resources but instead comes from the ability to manage extremely complex systems.

In the dynamic landscape of technology, DevOps stands as a beacon of efficiency, collaboration and continuous improvement. DevOps has proven to be a transformative methodology that propels organizations toward a future where innovation, resilience and customer satisfaction are paramount.
January 25, 2024
Will the Rise of Generative AI Increase Technical Debt?

In the last year and a half, we’ve seen a glut of new generative AI-related tools reach the market. Various AI pair programmers powered by large language models (LLMs) are becoming integrated into software development environments. The number of new generative AI startups is staggering, and generative AI seems to be the new “catch-all” to accelerate software development and operations.

In this new paradigm, AI tooling accumulation seems inevitable. Yet, the explosion of new AI APIs, libraries and frameworks has the very real potential to increase technical debt and, in the process, overwhelm DevOps teams. “These new applications and capabilities will require many new MLOps processes and tools that could overwhelm any existing, already overloaded DevOps team,” said Bob Quillin, vFunction chief ecosystem officer.

Below, we’ll consider if and how new generative AI tooling has the potential to exacerbate technical debt. Notably, the rush to adopt AI, shifts in the AI tooling landscape and accelerated code output could all be producers of technical debt. Choosing your tools correctly, iterating thoughtfully and upskilling teams will be important guidelines to mitigate negative outcomes. That, and creating unique solutions to ‘flip the coin’ — using AI to consolidate code and reduce existing technical debt.

How AI Will Contribute to Technical Debt

The rise of generative AI-related tools will likely increase technical debt, both due to the rush to hastily adopt new capabilities and the need to mold AI models to suit specific requirements. “New LLMs and generative AI applications will undoubtedly increase technical debt in the future, or at a minimum, greatly increase the need to manage that debt proactively,” said Quillin. “It starts with new requirements to continually manage, maintain, and nurture these models from a broad range of new KPIs from bias, concept drift, and shifting business, consumer, and environmental inputs and goals,” he said.

Incorporating AI may require a significant upfront commitment, leading to additional technical debt. “It won’t be just a build-and-maintain scenario, but rather, the first of many steps on a long road ahead,” said Prince Kohli, CTO of Automation Anywhere. Product companies with a generative AI focus must invest in creating a data and model strategy, a data architecture to work with AI, controls for the AI and more. “Technology disruptions and pivots such as this always lead to this kind of technical debt that must be continually paid down, but it’s the price of admittance,” he said.

AI is a tumultuous space, and some degree of technical debt will likely be produced by future organizational shifts. “The pace of change and innovation in the AI field itself is exceedingly rapid,” said Juan Orlandini, CTO of Insight North America, citing the staggering emergence of new AI startups and tools. “There will be consolidation, and also, unfortunately, a number of the startups will cease to exist.” When this occurs, teams must grapple with unsupported packages or tools.

Another type of debt is the nature of AI and how it accelerates development across the board. “One of the great values of these tools is the acceleration they bring to development,” said Orlandini. “Simply put, we can put out more features faster.” The other side of this double-edged sword is that AI accelerates the creation of all programming endeavors, even those that become technical debt.

Generative AI-related tools are most likely to accelerate the pace of change and deliver new code development outcomes more quickly. “In the process of consuming their output, there is a possibility of accumulating technical debt if the usage is broad, rapid, and pursued indiscriminately,” said Ajay Sabhlok, CIO and CDO, Rubrik. “Developers, in this case, may be too focused on program execution and forget to pay attention to code complexity, repetition or use of non-standard logic.”

Ways to Mitigate AI Technical Debt

Thankfully, there are specific methods organizations can adopt to manage new technical debt. For starters, you should focus on creating smaller proof of concepts and then iterating as you learn, said Kohli. “When leaders like the head of technology or IT are deploying these processes, they should first create small agile teams that learn fast and disseminate those learnings efficiently,” he said.

Also, technical debt is more likely to accrue when the wrong platform or tool is chosen. Therefore, “organizations should be very deliberate in choosing what products to leverage,” said Orlandini. He encourages IT leaders to avoid relying on companies or products with flashy presentations and poor tech or great tech with poor business acumen. “Our industry is rife with stories of great products with terrible business plans — which ultimately leads to their demise,” he said.

Other experts similarly foresee upcoming shifts that may affect internal operations. “Companies should keep their options open when considering AI model vendors or tool providers,” said Kohli. “They must keep their ‘hands on the wheel’ and be prepared for turns.”

Just like any new technological adoption, generative AI requires forethought. Therefore, putting the same amount of planning and preparation into deploying generative AI as we do for developing coding standards around manual coding could help minimize technical debt, said Sabhlok. “It will help to ease into areas of usage by adopting a tiered approach to expansion and, at each step of the way, review the results against standards, compare notes across the development organization, and course correct where necessary. This can avoid the accumulation of technical debt in the long run.”

“IT leaders should first ensure that additional resourcing and training are in place to both upskill existing teams and hire new talent as required,” said Quillin. “This includes adding observability tools that can identify new and existing forms of architectural and LLM drift. Finally, to always be ready for any new, rapidly emerging future requirements and opportunities, IT leaders should invest in best practices and tools that will proactively keep their app architectures clean and ready for the ‘next big thing.’”

How AI Could Decrease Technical Debt

On the other hand, some believe that if used properly, the contrary is true — that new AI technologies will actually reduce technical debt. “The rise of LLMs, frameworks, and APIs, when applied properly together, will actually reduce technical debt,” said Ashwin Rajeeva, CTO and co-founder of Acceldata. “Code discovery and reuse is more easily accomplished with LLMs.” He points to the ability of this technology to identify duplicative code and consolidate it into a more streamlined interface.

Automated documentation generation is another area where LLMs could help improve code discovery and reduce duplicative efforts. In addition, LLMs could also help reduce the prevalence of code that doesn’t follow company standards, said Rajeeva. “It is much easier for LLMs to understand the company standards by learning from good coding practices and applying it to newly written code.”

Others also see the power of using generative AI to enhance automation across the board. “AI tooling is probably going to help the most in automation, velocity to transform old codebases, and empowering non-coders to accelerate the adoption of new business processes into their workflows,” said Orlandini.

Final Thoughts

AI is a multifaceted subject, and its use could go one of two ways. On one hand, if not used correctly, generative AI could only add to the surmounting technical debt pile. To avoid this outcome, organizations will likely need guardrails on when and how to use LLMs, said Rajeeva. He also advocates “making it a best practice within the corporation with sufficient training for newer developers.”

Then, on the other hand, generative AI could be utilized to respond to technical debt. It has the awesome potential to unlock automation gains and enhance employee satisfaction and retention, especially within older industries that may be behind the technological curve, said Kohli. “With AI and now generative AI, intelligent automation can deliver on all those promises such that it is fast becoming a new pillar of enterprise architecture.”

So, take the new wave of AI with a grain of salt. It will open up immense solutions but will also come with a significant degree of technical debt. Thankfully, there are ways to manage debt caused by AI in a way that can benefit operations and push development objectives forward.

January 25, 2024
Survey: Widespread Inability to Remediate App Vulnerabilities

A survey of 621 IT and security professionals published this week found only 20% are confident in their ability to detect a vulnerability before an application is released.

Conducted by the Ponemon Institute on behalf of Security Journey, a provider of cybersecurity training services for developers, the survey finds 61% struggling to remediate vulnerabilities effectively, with 55% blaming misalignment between development, security and compliance teams for delays.

A third of respondents (33%) said teams lacked a common view of applications and assets, with 38% acknowledging they lack the ability to hold departments accountable for patching applications. Only 11% of organizations believed they patch vulnerabilities effectively in a timely manner, the survey finds.

In the 12 months prior to the study, 54% of respondents suffered a security incident due to an unpatched vulnerability, with 51% experiencing more than eight incidents.

Overall, half (50%) admitted they fail to test the security of their applications after they have been released. Only 36% specifically teach developers to write secure code. Just one-fifth (21%) educated developers on vulnerability remediation. Less than half (43%) have invested in training provided by a third party.

When training is provided, 68% of respondents also admitted immediate feedback is not provided and less than half (47%) said secure coding training is customized to meet developer needs. Half (50%) of those who provided training have no formal assessment to measure knowledge gain, the survey found.

Amy Baker, chief marketing officer and security education evangelist for Security Journey, said the survey makes it clear much work still needs to be done in terms of teaching developers how to write secure code.

In addition, too many software development teams are overly optimistic about their ability to remediate known vulnerabilities the next time they plan to update an application, said Baker. Many developers move on to the next application simply because either the pressure to meet delivery deadlines is too intense or there is some other emerging technology, such as large language models (LLMs), that needs to be learned, she added. In fact, too many organizations are far too focused on the rate at which applications are built and deployed at the expense of cybersecurity, Baker noted.

That’s especially problematic because cybercriminals have become much more adept at monitoring application deployments and updates, she added.

The amount of time between when code is deployed and when cybercriminals begin scanning it for vulnerabilities is now measured in hours rather than days. Developers, unfortunately, are deploying more insecure code than ever. In fact, much of that code is insecure by design, noted Baker.

Overall, nearly half of respondents (48%) only train developers annually, bi-annually or when an incident occurs. More than two-thirds (68%) only train developers on how to implement secure coding practices to meet compliance requirements. In effect, because developers are not taught security in school, what training they do receive is on the job, said Baker.

Clearly, there is still much work to be done when it comes to implementing DevSecOps best practices to improve application security. In the meantime, the amount of code that needs to be patched has already reached proportions that most application development teams are never going to be able to effectively address.

January 24, 2024
Venafi Adds Ability to Prevent Unauthorized Code From Running

Venafi added an ability to prevent unauthorized code from running in IT environments that make use of its machine identity management platform.

Shivajee Samdarshi, chief product officer at Venafi, said the Stop Unauthorized Code Solution leverages the company’s CodeSign Protect offering to ensure that only authorized code can run on any given platform.

The overall goal is to enable organizations to better secure their software supply chains using a zero-trust approach to software based on identity management and code signing to verify software comes from an approved source and complies with policy controls, he added.

All code is signed using private digital certificates or those issued by trusted certificate authorities, said Samdarshi. Before code can execute, the security platforms an organization has in place can be configured to check that digital signature against trusted code signing certificates, he noted.

Interest in securing software supply chains has risen sharply since the Biden administration issued an executive order requiring federal agencies to implement a range of measures, including code signing, to achieve that goal. However, securing software chains is often more challenging than organizations initially appreciate.

In fact, a recent Venafi survey found that 70% of security and IT leaders believe that software supply chain attacks are their biggest security blind spot. Additionally, 85% believe that continuous security validation of the CI/CD pipeline is vital to reduce the risk of vulnerabilities going undetected during the software development lifecycle. A full 88% said they believe machine identity management is essential to the success of zero-trust models that are being more widely adopted across enterprise IT environments.

Arguably, the most important thing organizations need to focus on is making sure application developers and cybersecurity professionals develop a working relationship. The biggest barrier to the adoption of DevSecOps best practices required to secure software supply chains remains largely cultural. For more years than anyone cares to admit, many developers have viewed cybersecurity more as a hindrance to application development that needs to be overcome or circumvented rather than being a core aspect of a quality assurance process. The total number of vulnerabilities that exist in applications running in production environments could likely be measured in the billions.

Remediating all those vulnerabilities may never be practical, but at the very least, DevSecOps teams could make sure that no new code containing vulnerabilities is allowed to execute. Cybercriminals have become especially adept at inserting malware into code that they hope will find its way into any number of downstream applications before they activate it. That capability alone should help mollify cybersecurity teams that are increasingly being tasked with improving software supply chain security. The challenge is those cybersecurity teams don’t always appreciate the impact new policies can have on the pace at which applications are developed and deployed.

Like it or not, software supply chains will generally be more secure in 2024. The only thing that remains to be determined is how much friction will be injected into DevSecOps workflows to achieve that goal.

January 24, 2024
Configuration-as-Code: Trends and Predictions for 2024

Configuration-as-code, often abbreviated as CaC, is an innovative approach to managing and provisioning computing resources. It refers to the practice of handling changes, deployments and updates to software and systems via code rather than manual processes. CaC allows for a version-controlled, reproducible and automated method of managing environments, leading to more consistent and reliable systems.

The essence of configuration-as-code is to treat system configurations the same way that software code is treated. This means that configurations are written in a code format, stored in a version control system and applied through automated processes. This approach brings several benefits, including consistency, repeatability and the ability to test changes before applying them to live environments.

This concept is not just a theoretical approach but rather a practical tool for managing modern digital infrastructure. It’s a key component of DevOps practices, enabling teams to move faster while maintaining control and minimizing the risk of operational issues. Configuration-as-code is a critical tool for managing complex systems and achieving the highest levels of operational efficiency and reliability.

The Evolution of CaC in Recent Years

Over the past several years, configuration-as-code has grown from a niche concept into a mainstream practice adopted by many leading technology companies. This evolution has been driven by several factors, including the increasing complexity of digital systems, the rise of cloud computing and the broader adoption of DevOps practices.

In the early days, system configurations were often managed manually or through ad-hoc scripts. This approach was prone to errors, hard to scale and lacked visibility into changes. As systems grew more complex, the need for a more robust, scalable, and reliable method of managing configurations became apparent. This led to the creation of configuration-as-code.

The rise of cloud computing has been a significant driver in the adoption of configuration-as-code. With cloud platforms, resources can be provisioned and managed via APIs, making it possible to handle configurations through code. This has allowed for much greater scalability and flexibility enabling companies to manage large, complex environments more effectively.

The adoption of DevOps practices and increasingly mature automation frameworks have also contributed to the growth of Configuration as Code. As infrastructure-as-code (IaC) becomes the norm, CaC is becoming a staple of modern DevOps practices.

Trends in Configuration-as-Code for 2024

Looking ahead to 2024, several trends are likely to shape the future of configuration-as-code:

Increased Adoption of Cloud-Native Environments

As more companies adopt cloud-native technologies, the use of configuration-as-code is set to increase. Cloud-native environments are inherently dynamic and complex, making them an ideal fit for configuration-as-code. With CaC, teams can manage these environments more effectively, ensuring consistency, scalability, and reliability. Cloud-native technologies like Kubernetes and Docker also natively support configuration-as-code, making it easier for teams to adopt this approach.

Use of AI and Machine Learning in Configuration Management

Artificial intelligence and machine learning are set to play a significant role in the future of configuration management. With AI and ML, teams can automate even more aspects of configuration management, reducing the risk of human errors and freeing up time for more valuable tasks. For example, AI could be used to predict the impact of configuration changes, while machine learning could help automate the process of optimizing configurations for performance and cost efficiency.

Shift Toward Immutable Infrastructure

Immutable infrastructure means that servers are never modified after they’re deployed. Instead, any changes are made by deploying a new server with the desired configuration. This approach reduces the risk of configuration drift and ensures a consistent environment. Configuration-as-code is a key enabler of immutable infrastructure, making it easier to manage and deploy servers in a repeatable, automated way.

Collaboration and Democratization of CaC

Finally, the trend towards collaboration and democratization in technology will also influence configuration-as-code. With CaC, configurations become more visible and accessible, allowing for greater collaboration between teams. This can lead to better decision-making, less siloed working, and improved overall outcomes. At the same time, configuration-as-code also enables democratization by making it easier for non-technical stakeholders to understand and participate in configuration management.

Predictions for Configuration-as-Code in 2024

CaC is Becoming a Cornerstone in the DevSecOps Approach

The integration of development, security and operations—commonly known as DevSecOps—aims to embed security practices into the DevOps process. As we look towards 2024, configuration-as-code is set to become a cornerstone in the DevSecOps approach.

By treating infrastructure as code, teams can apply the same security practices they use for application code to their infrastructure. This includes performing code reviews, using automated testing, and tracking changes to the environment. With configuration-as-code, security can shift left—being considered earlier in the development process—leading to more secure systems.

Moreover, configuration-as-code can help bridge the gap between security and operations teams. It allows for a shared language and shared tools, fostering better collaboration and communication.

Growth of CaC-as-a-Service

Configuration-as-code-as-a-service is an emerging trend that is set to grow significantly by 2024. This approach allows businesses to outsource configuration management to a specialist third party, which uses configuration-as-code to automate the process. Cloud-based configuration management solutions provide advanced capabilities such as secrets management, centralized configuration management and orchestrated workflows.

Version Control Features Specifically Designed for CaC

Version control systems are a key component of configuration-as-code. They allow teams to track changes to their environment, revert back to previous versions if necessary, and collaborate more effectively. In 2024, we can expect to see the evolution of version control systems with features specifically designed for CaC.

These features might include support for infrastructure-specific languages and better integration with infrastructure tools. Version control tools might also introduce improved support for collaborative configuration workflows, making it easier for teams to work together on infrastructure configuration.

Increased Role of CaC in Managing Edge Computing Environments

As we move into 2024, we can expect to see an increased role for configuration-as-code in managing edge computing environments. Edge computing is rapidly growing due to its ability to bring computation and data storage closer to the location where it is needed, improving response times and saving bandwidth.

With the rise of edge computing, managing these environments becomes increasingly complex. CaC can automate the process of setting up and maintaining these environments, reducing human error and increasing efficiency. This also allows for consistency across different environments, leading to more reliable systems.

In conclusion, the future of configuration-as-code looks promising. As we move towards 2024, we can expect to see an increased role for CaC in managing edge computing environments, its evolution as a cornerstone in the DevSecOps approach, the growth of CaC-as-a-Service, and the evolution of version control systems specifically designed for CaC. These developments promise to bring about greater efficiency, security and collaboration in the realm of infrastructure management.

January 24, 2024
Agile is no Excuse

Did you ever hop in a car and just start driving with no destination? I know someone who used to do that for relaxation, but while I do enjoy a good road trip, the destination is far more important for me than the journey. My Mom lives nine hours away, and I love to go visit her. I know the routes like the back of my hand and just get to enjoy the ride—precisely because I know where I’m going.

Most people wouldn’t sign up for a cruise that refused to tell them what stops were planned or even where the ship was going. But those same people are currently in a boat built by either IT or vendors and they have no clue where that boat is going. This is an issue with the software industry, not with the people in question. I recall a couple of memorable cases (not naming names here, but you no doubt were a victim of or heard of at least one of the examples I can think of off the top of my head) where a vendor suddenly announced they were changing everything, and customers would have to deal with it (moving platform, changing licensing, suddenly becoming a product in a different market …)

That’s crazy. Honestly. You could have a piece of software central to your DevOps operation suddenly change to be less useful or even unsuitable. A company you have a contract with. The advent of “commodity” virtual hardware and everything-as-a-service has made us lose sight of the fact that customers have a need for stability and are not in the least wrong to demand it.

And that brings us to today’s actual topic. More and more vendors respond to “What’s on your roadmap?” questions with, “We’re agile, so we are constantly improving.” That is a non-answer. I am a human, so I’m constantly improving, too. Weaning from a bottle at 18 or 24 months says nothing about the roadmap from today for the next 18 months. As an analyst, I generally start advising users that this stance is bad for them and they should demand any vendor they do business with have a plan that they can count on for at least the next 12 months. And that they should leave vendors that don’t have that, and not sign with ones that won’t if not already a customer. Agile means you are making constant changes. We didn’t ask how often you update; we need to know where you are steering your product. If you can’t answer that question, no one can, and the product is in jeopardy.

The problem is, because we, too, are agile, a lot of IT shops are doing the same thing to their customers. While the feedback loop is shorter and more direct, the fact is that most of you have surprised business users with some new thing. The fact that they often are thrilled to have it doesn’t change the fact that they should have known it was coming long before implementation. Agile doesn’t excuse bad communications, and DevOps is not short for ‘random change on a whim.’

So, demand your vendors offer you predictability – even in a fast-changing market – and offer predictability to your users. It only takes a second to update (automated or via email, Slack, whatever) customers that a change is in the works but not assigned yet. Or even just got assigned; just offer some warning. Be good to your users, and demand vendors be good to you. Agile, DevOps and SaaS do not require unannounced changes (good or bad), so stop acting like they are acceptable when notification systems are already set up.

In short: Stop saying, “We don’t know where we are going, but we’re Agile, so we are getting there super fast!” And stop letting vendors say it to you. You are knocking it out of the park every day. Systems run and people use them and all works as intended… Because of you. Now consider letting users know when changes are coming – not just the big ones, but the ones hidden in “We’re Agile!” Make your vendors do the same to give you peace of mind, too.

January 24, 2024
Mobb Extends DevSecOps Reach of Tool to Generate Patches

Mobb today added an ability to instantly surface patches for vulnerabilities at the time when code is being committed during a DevSecOps workflow.

Previously, the tool provided by Mobb to create validated patches based on the scan results of third-party SAST tools would only surface issues to individual developers.

Mobb CEO Eitan Worcel said organizations can now address these issues within the context of DevSecOps workflow.

The Mobb platform combines proprietary security research and traditional semantic analysis with generative artificial intelligence (AI) to automatically create patches for vulnerabilities. The overall goal is to make it simpler for DevSecOps teams to consistently ensure applications with known vulnerabilities are remediated before they are deployed, said Worcel.

The Mobb approach eliminates the need for IT teams to sort through static application security testing (SAST) scans themselves. Each vulnerability typically requires at least 30 minutes to fix, so the Mobb platform improves application security while simultaneously making developers more productive.

Historically, one of the reasons for the wide divide between application development teams and cybersecurity professionals is that many of the vulnerabilities discovered don’t actually impact applications running in production environments. Development teams then find themselves wasting time investigating vulnerabilities and, when they do determine a vulnerability is an issue, spending time developing a patch. The Mobb tool automatically creates the necessary patch, so there is less of a need to debate which vulnerabilities are worthy of the time required to create a patch.

For decades, application development teams have been attempting to find a way to remediate vulnerabilities as quickly as possible. With increased focus on adopting DevSecOps best practices to address those vulnerabilities, more organizations are now reviewing software supply chains as part of a larger effort to improve application security.

There will, of course, be vulnerabilities that the Mobb tool will not be able to address simply because there may not be enough affected applications to warrant pre-building a patch. Even with the most robust set of rules, it is improbable that an automated tool can, with 100% certainty, safely fix every issue. However, given the number of routine vulnerabilities present in applications, such as SQL injections, there’s plenty of opportunity to improve developer productivity by relying on patches that address common vulnerabilities.

The process by which patches are prioritized, developed and then applied has, of course, long been a source of DevOps frustration. Anything that streamlines that process will go a long way toward improving the overall state of application security at a time when cybercriminals are becoming more adept at exploiting vulnerabilities. The challenge is finding a way to remediate vulnerabilities that developers will embrace rather than resist. The Mobb approach still provides them with control over what patches are applied but the toil involved with creating a patch in the first place has been substantially reduced.

It’s not clear how long it might be before automated approaches to building patches might improve the overall state of application security but, as always, every journey needs to begin with a first step in the right general direction.

January 23, 2024
Legit Security Applies AI to Detect Vulnerable Application Secrets

Legit Security today announced it has expanded the scope of its application security posture management (ASPM) platform to make use of artificial intelligence (AI) to discover secrets more accurately in applications that cybercriminals can actually exploit.

Scanners typically generate high false positive rates to the point where developers often start to ignore them. As a result, it’s not uncommon for secrets to be discovered in an application even though an alert was generated.

Legit Security CTO Liav Caspi said the company is now applying a large language model (LLM) specifically trained for source code along with prompt engineering techniques and heuristics to reduce the level of alert noise that developers would otherwise see when scanning for secrets. The overall goal is to correctly identify access keys, passwords, application programming interface (API) keys and other personally identifiable information (PII) that should not be exposed once an application is deployed in a production environment, he noted.

That capability can be applied to detect secrets across all development assets, including code repositories, source code management (SCM) tools, build tools and logs, artifacts and private and public documentation. In addition, this approach also uncovers toxic combinations of secrets or ones that might lie buried within assets such as source code history or modified Confluence pages that developers often forget exist, noted Caspi.

Legit Security also enables DevSecOps teams to apply preventive guardrails on developer endpoints using the Legit command line interface (CLI) to stop secrets from being exposed before code is pushed. In addition, automated workflows can reach developers as part of a pull request or create Slack messages or Jira tickets to streamline remediation. DevSecOps teams can also continuously triage results to create a baseline that includes exceptions.

As part of a larger effort to secure software supply chains, Legit Security has developed a software-as-a-service (SaaS) platform designed to apply security policies across an entire software development life cycle. The company is now extending the capabilities of that platform using AI technologies to detect secrets in both source code and all the components that make up a development pipeline as they are added.

In the wake of an executive order requiring federal agencies to better secure software supply chains, there is now more focus than ever on application security. Unfortunately, many developers are a little too cavalier when it comes to managing secrets during the application development process. They often leave secrets in plain text to facilitate workflows, but more often than many care to admit, those secrets are not removed before an application is deployed. Knowing this, cybercriminals have learned to scan applications for those exposed secrets. Once gained, they then appear to be just another legitimate user of an application that might not be discovered until malware is activated.

It may be a while before the cultural and technical issues that conspire to make the software supply chain insecure are fully addressed. In fact, the problem may get worse before it gets better—simply because the pace at which distributed applications are being built and deployed only continues to accelerate. At the same, the cost of making a secrets mistake is also only going to increase as regulations become more stringent. In fact, it’s now only a matter of time before stiff fines intended to make an example of one or more unfortunate organizations are eventually going to be levied.

January 23, 2024
2024 Infrastructure Tech Predictions

Ganesh Srinivasan, partner at Venrock, co-authored this article.

2023 was a rollercoaster like none other; from the death of the modern data stack sprawl to the birth of generative AI, we are only at the beginning of a new era in the ‘art of the possible.’ We guarantee 2024 won’t be a disappointment.

With a new year approaching, it’s the perfect time for us to examine what we anticipate being the biggest developments in the year ahead. Here is what we think is going to happen in 2024:

1. OpenAI’s Reign Challenged

With the emerging learnings in core neural net architectures that led to the transformer and dominance by OpenAI, it is likely that their imminent release of GPT5 will be surpassed in specific performance benchmarks by a new entrant on the backs of more efficient architectures, improved multimodal capabilities, better contextual understanding of the world and enhanced transfer learning. These new models will be built on emerging research in spatial networks, graph structures and combinations of various neural networks that will lead to more efficient, versatile and powerful capabilities.

2. Apple: The New Leader in Generative AI

One of the most important players in the generative AI space is only starting to show their cards. 2024 will be the year Apple launches its first set of generative AI capabilities, unlocking the true potential of an AI-on-the-edge, closed architecture with full access to your personal data – showing that Apple is actually the most important company in the generative AI race.

3. Building for Client-First

The last decade has reflected a shift away from fat clients to server-side rendering and compute. But the world is changing back to the client. Mobile-first experiences will be required to work in offline mode. Real-time experiences require ultra-low latency transactions. Running LLMs will increasingly be required to run on the device to increase performance and reduce costs.

4. Death of Data Infrastructure Sprawl

The rapid growth of the data infrastructure needs of enterprises has led to an increasing sprawl of point solutions, from data catalogs, data governance, reverse extract, transform, load, and airflow alternatives to vector databases and yet another lakehouse. The pendulum will swing back to unified platforms and fewer silos to bring down the total cost of ownership and operating overhead going into 2024.

5. Approaching the AI Winter

Generative AI in 2023 could be best characterized as the ‘art of the possible,’ with 2024 being the true test to see if prototypes convert into production use cases. With the peak of the hype cycle likely here, 2024 will experience the stage of disillusionment where enterprises discover where generative AI can create margin-positive impact and where the costs outweigh the benefits.

6. The Misinformation Threat

While image and video diffusion models have unlocked a new era for digital creation and artistic expression, there’s no doubt that its dark side has not yet taken its toll. With a presidential election in the wings, diffusion models as a machine for political disinformation will emerge to become the next major disinformation weapon of choice.

7. AI’s Real-World Breakthrough

Coming out of the ‘field of dreams’ era for AI, 2024 will represent a breakthrough for commercial use cases in AI, particularly in the physical world. Using AI for physical world modalities will unlock our ability to change and engage with the machines and devices around us, from understanding machine telemetry for problem detection to distilling insights across thousands of real-time sensor feeds.

8. S3: The Growing Threat to Snowflake

AWS S3 is about to become the biggest competitor to Snowflake. With a rapidly growing ecosystem of tools emerging as the compute layers on top of S3 leverage their ultra-low costs, high availability, Availability Zone support, and new single-digit millisecond latency service, everyone’s ‘Snowflake cost problem’ is about to have a new set of attractive alternatives.

9. The Rise of Flink and Operational Analytics

If business analytics drove the first wave of the data infrastructure evolution, operational analytics will drive the next wave, with Apache Flink at the center of it. Enterprises will begin en masse adopting real-time and streaming capabilities to begin using data to drive operational decision making. This will create new value in areas such as logistics, financial transactions, inventory management and fraud detection.

10. The Developer AI Stack

Going into 2024, AI’s most significant impact in the digital world will be unlocking developer productivity. From code generation to debugging to build management, AI will unlock a new level of developer productivity that we haven’t seen since the advent of the cloud.

If you agree, disagree or would like to share your own 2024 predictions with us, please reach out on X at @ethanjb and @gan3sh.

January 23, 2024