Category: Blogs

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

    Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    LinkedIn

    Well
    Raleigh-Durham-Chapel Hill, North Carolina
    Principal DevOps Engineer – Team Lead
    $180,000 to $200,000

    CareerBuilder.com

    Apple
    Cupertino, California
    Cloud DevOps Engineer – Enterprise Systems
    $138,900

    Indeed.com

    General Dynamics Information Technology
    Indianapolis, Indiana
    Capado Salesforce DevOps Engineer
    $116,000 to $174,000

    SimplyHired

    John Hancock
    Boston, Massachusetts
    Senior DevOps Engineer
    $109,000 to $138,000

    Dice.com

    IT Trailblazers
    Houston, Texas
    DevOps Lead
    $100,000 to $120,000

  • Teleport Assist Leverages Generative AI to Democratize DevOps

    Teleport Assist Leverages Generative AI to Democratize DevOps

    Teleport has made available a chat interface, dubbed Teleport Assist, that makes use of OpenAI’s generative artificial intelligence (AI) application programming interfaces (APIs) to enable DevOps teams to troubleshoot infrastructure issues more easily.

    Using the natural language interface (NLI) provided by Teleport Assist, DevOps engineers can ask questions and give instructions in English to massive fleets of servers. Capabilities include being able to suggest commands and scripts for debugging and resolving common issues and then generating commands for review before they are applied.

    In future versions of Teleport Assist, support for other cloud resources, such as SQL databases and Kubernetes clusters, will be added. Teleport Assist currently supports Secure Shell (SSH) and bash scripts, with support for additional languages and interfaces to be added over time.

    Teleport CEO Ev Kontsevoy said it’s already clear that many of the scripts that DevOps engineers rely on today for IT management will be replaced by generative AI platforms. The average IT administrator will be able to invoke DevOps platforms via an NLI that eliminates the need for extensive programming expertise, he added.

    In effect, the NLI surfaced by generative AI platforms will serve to democratize DevOps expertise, Kontsevoy noted.

    It’s still early days as far as the adoption of generative AI by DevOps engineers is concerned, but it’s already apparent that its impact will be profound. It will increase the pace at which applications are built while making it easier for software engineers to manage large codebases. Most of the generative AI advances thus far improve developer productivity, but tools such as Teleport Assist show how generative AI will also make it easier for more organizations to adopt DevOps best practices that previously were limited to organizations that could afford to hire and retain significant numbers of software engineers.

    At their core, generative AI platforms are fundamentally changing the way humans interact with machines. Instead of requiring a developer or engineer to create a level of abstraction to communicate with a machine, it’s now possible for machines to understand the language humans use to communicate with each other. A a natural language interface will soon enable DevOps engineers to ask generative AI platforms to not only surface suggestions but also debug applications and even write code. The accuracy and quality of those results will vary depending on how the large language models (LLMs) that trained those platforms were, but over time there will be a wide range of LLMs that are trained to be used within specific domains such as DevOps.

    The issue is determining how to organize DevOps teams as more tasks become automated. Generative AI doesn’t replace the need for IT professionals, but it does make it simpler to manage IT at unprecedented levels of scale. In fact, at this point, the proverbial generative AI genie is out of the bottle, so there is no going back. The only thing left to decide is how quickly generative AI becomes pervasively applied.

  • Mezmo Simplifies Management of DevOps Telemetry Data

    Mezmo Simplifies Management of DevOps Telemetry Data

    Mezmo has added additional capabilities to streamline the flow of telemetry data within DevOps workflows as part of an effort to make it simpler to surface insights and reduce the total cost of observability.

    The company has also added integrations with more data sources to the Telemetry Pipeline platform, along with controls that make it simpler to optimize data storage and usage. For example, an Events-to-Metrics Processor capability identifies and extracts metrics from logs to make them easier for third-party tools to consume.

    Mezmo CEO Tucker Callaway said these additions collectively make it simpler to surface insights that will make DevOps workflows more efficient. Previously, the company added capabilities such as rollback and redeploy, sequential parsing, error history management and data sample management to enable DevOps teams to manage telemetry data more efficiently.

    In effect, Mezmo is making it easier to apply engineering best practices to the massive amounts of telemetry data generated across DevOps workflows, he noted.

    No one knows for certain if all that data will require the addition of data engineers to DevOps teams, but as DevOps continues to evolve, it’s clear there is a need to cost-effectively manage data at scale. DevOps teams that embrace observability are quickly discovering that storing logs, traces and metrics for an extended amount of time can quickly become cost prohibitive. Naturally, there’s a lot more sensitivity to those costs during challenging economic times.

    In theory, of course, various forms of artificial intelligence should automate data engineering best practices, but in the meantime, there simply isn’t enough data engineering expertise available. The need for a platform to optimize the flow of telemetry data across DevOps workflows is becoming more acute.

    It’s not clear how quickly DevOps teams are embracing observability, but it’s clear that relying on predefined metrics to monitor IT environments is no longer sufficient. DevOps teams need to be able to query telemetry data to, for example, identify bottlenecks created by dependencies between microservices. Resolving those issues can’t be slowed down by a lack of data to query. Most problems can usually be traced back to a recent update to an application, but there are always going to be some issues that require access to historical data. That historical data should be quickly and easily available, especially since application downtime directly equates to lost revenue for many organizations.

    Observability, regardless of cost, is rapidly becoming a requirement for DevOps teams’ success as application environments become more complex in the cloud-native era. Dependencies between the microservices that make up those applications are too difficult to track and analyze without the aid of an observability platform. The challenge is not every observability platform provider is equally concerned about how much it costs to store all that data. Striking the right balance between the amount of telemetry data collected and the cost of storing it has become a much larger concern.

  • Google’s Shiny New AI Dev Environment — the ‘Experimental’ Project IDX

    Google’s Shiny New AI Dev Environment — the ‘Experimental’ Project IDX

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Google’s full-stack, browser based development environment in the cloud. It’s not just a Copilot clone, but aims to help you “get an app from zero to production.” (more…)

  • DevOps Download: What to Know About Life in the Cloud(s)

    DevOps Download: What to Know About Life in the Cloud(s)

    According to the 2022 Flexera State of the Cloud Report, 89% of cloud customers now use multiple cloud hosting providers. Nearly nine out of 10 might sound high, but it tracks with the anecdotal evidence we’ve seen. For varied and good reasons, companies are spreading their usage across multiple hyperscalers rather than putting all their eggs in one basket.

    In this article, I’ll take a look at what life in the cloud(s) looks like today. Along the way, I’ll examine the value that companies and their DevOps teams can derive from this approach, the challenges to be aware of, use cases for making the multi-cloud move and more.

    What is Multi-Cloud?

    Multi-cloud is a type of cloud strategy approach where an organization uses computing services from at least two cloud providers to run their applications. Instead of a single-cloud stack, these environments include two or more public or private clouds, or a combination of both. With multi-cloud, you can have an application running on Google Cloud Platform (GCP), another in Amazon Web Services (AWS), and maybe one on premise for hard-to-move applications.

    There are three kinds of cloud setups. Single cloud is when workloads run solely on one environment. Hybrid cloud entails overlapping workloads across multiple clouds, such as operating the same programs on different providers for business continuity purposes. The final setup is planned multi-cloud, which disperses applications and usage across providers along specific lines, like having compute intensive applications with one provider and data analysis applications with another.

    Got a Preference?

    Make no mistake, using multiple cloud providers is more complex than a single host, but as its popularity shows, the benefits can carry more weight. Foremost, that’s because an organization gains the flexibility to create a best of all worlds situation, based on factors like the following:

    • Operational preference: Users may like different features from different providers, and splitting types of use can yield the ideal setup. For instance, a customer may run compute on AWS but want their business intelligence and machine learning on GCP. In this deployment, the front-end app could gather the needed information, then send the data to the other provider for analysis and ML.
    • Regulatory requirements: Certain workloads may require data storage in specific regions, but not all cloud vendors have multiple “regions” in each country. Companies that want to use the cloud can set up a “multi-region” environment by having one region on AWS and a second region on GCP within the same country.
    • Cost savings: Cloud providers offer different savings plans. For a savvy user, structuring a flexible program can take advantage of each to significantly reduce costs. It’s also a great way to avoid the pitfalls of lock-in and can make it easier to go elsewhere should a provider lose your trust.
    • Failsafe Options: Outages happen, so companies needing 24/7 access to apps will sometimes run portions redundantly on two hosts to ensure smooth operations. For example, a retail app may run on GCP and AWS with live failover between them. That way, if one goes down the other can kick in without noticeable downtime.

    Not Without its Challenges

    The benefits to running a multi-cloud setup are clear, but there are some challenges as well. A carefully planned multi-cloud setup can save money, but a careless approach will duplicate operations and cost. It also leaves companies vulnerable to mistakes that can lead to significant overrun, especially for hybrid cloud operations, which can be extremely complex. Specialists must be well versed in FinOps principles and experienced at writing modern applications that can scale and work across regions and clouds, to ensure success in a multicloud approach.

    Coming to Terms

    You’ll undoubtedly come across a lot of new ideas and terminology when researching cloud setups. Here’s a few of the more crucial ones to become familiar with as you plan strategy.

    • Lift and shift: This refers to cloud-to-cloud migration, in other words, taking what you have in one cloud and putting it in another, whether it is private to public or public to public.
    • Move and improve: This usually refers to migrating while making a small change to take advantage of a public cloud feature. For instance, you could be using open source Kubernetes on premise but want to move to a managed version. Eliminating management of Kubernetes would require a minor change but it improves operations greatly.
    • Cloudbursting: On premise offers hard limits to capacity. For companies able to anticipate business peaks, cloudbursting can scale workloads to an on-demand public cloud for a short period. For example, a retailer who operates on premise may cloudburst on Black Friday in order to handle a volume increase.
    • High Availability: The goal of this is to eliminate single points of failure by enabling users to continue working even if one of the IT components that an applications depends upon fails.
    • Disaster Recovery: Clouds offer solutions to help an organization restore critical systems and data after a disaster strikes. Recovery comes in three “heat levels”: Cold is for data backup only, warm restores operations in several hours, hot is for near-instant resumption of cloud operations.

    People and Processes

    The most important considerations for operationalizing multi-cloud are people and processes. Providers pump out new services fast, and not only can it be difficult for staff to keep up, it can be demoralizing when they’re unable to. Allowing time to succeed, fail and learn is key, and larger companies might consider designated specialists for each platform.

    When it comes to processes, management and security are highly customizable, but it requires deep knowledge to get them right. Operating via infrastructure as code rather than ClickOps is a must. The latter is a time consuming approach that requires selecting options in a provider menu and introduces both operational and security risks in the form of configuration drift.

    Life in the Clouds

    Multi-cloud brings strong benefits to DevOps. Organizations can get the right infrastructure balance based on their needs. Distributing workloads can reduce the impact of outages and bolster resiliency. There’s greater opportunity for cost savings, and scaling is simple. Ultimately, multi-cloud operational enhancements can result in more reliable and innovative solutions, which delivers on the mantra of DevOps itself.

  • Most Organizations Benefit From a Mature Cloud Strategy

    Most Organizations Benefit From a Mature Cloud Strategy

    Today’s cloud adoptions are wide and varied. Large enterprises are composed of vast, hybrid multi-cloud strata, often incorporating legacy technology acquired at various times and haphazardly equipped from department to department. But a fractured cloud approach can leave IT wanting in terms of shared automation and standard security policies.

    Not all organizations have addressed best practices around common areas like CI/CD, resource optimizations, or common policies for multiple clouds. And many teams are just getting the hang of the new cloud-native stack. But studies show that a mature approach to cloud operations can pay dividends in the long run—and this approach hinges on cloud platform teams.

    HashiCorp recently released the findings from its third annual State of Cloud Strategy Survey, which surveyed 1,000 technology practitioners on their cloud adoptions. In short, the report discovered that increased cloud maturity equates to increased overall value. Below, I’ll distill the major findings from the report to better understand how cloud-native operations are maturing.

    State of Cloud Maturity

    Most organizations are moderately increasing their cloud investments. Overall, 56% increased their cloud spending in the last year. Increases were much higher for higher cloud-maturity organizations and stilted for lower-maturity organizations. The findings demonstrate general confidence in cloud adoption, even amid economic uncertainties.

    There is also persistent optimism in multi-cloud strategies. In fact, 73% of companies said a multi-cloud strategy helped advance or achieve their business goals. And to successfully accomplish a multi-cloud strategy, respondents ranked security, uptime and availability, infrastructure scalability and regulatory compliance as top factors.

    However, there is still a lot of waste in the cloud. Nearly all organizations (94%) said they have avoidable cloud spending. These expenses most commonly stem from areas like over-provisioning resources, idle or unused resources, cost premiums or a lack of expiration date on cloud resources.

    Benefits of Maturing Cloud-Native Operations

    Overall, there are many reasons for adopting a multi-cloud approach—the report found reliability, cost reduction, security and governance and digital transformation as top motivators. And on average, high-maturity cloud adopters tend to reap the rewards more often, the report found. Some of these top rewards ranged from a stronger security posture to better visibility and increased automation. Furthermore, half of high cloud-maturity organizations reported successfully saving money using multi-cloud.

    Most interestingly, perhaps, is that high-maturity cloud adopters said they are better equipped to attract, motivate and retain talent than lower-maturity cloud adopters (74% compared with 48%). It’s generally easier to pull in talent when operating with attractive cutting-edge technologies that look good on a resume.

    Spotlight on Platform Teams

    Even then, skills shortages remained the top bottleneck in most organizations’ ability to operationalize multi-cloud and set up platform teams. This can be side-stepped by reskilling or upskilling staff, incorporating more consultants or increasing the budget. But the best strategy is to standardize on a common operating model.

    In that vein, investments into the platform engineering concept are rising. In fact, 92% of organizations are adopting, standardizing or scaling platform teams. Low cloud maturity firms tend to lag on platformification, most likely due to lacking the necessary skills to build and maintain internal developer-facing infrastructure, like the tools used to measure and improve developer productivity and satisfaction at LinkedIn. Others are still on the cusp of exploring how to implement it.

    The idea of platform engineering is still taking root, so it was interesting to see how organizations described the platform teams’ roles and responsibilities. The results showed platform engineers commonly take the reins on everything from architecting solutions to tooling acquisition and internal evangelism. Here are the five top-cited roles for platform teams:

    • Develop and standardize a cloud infrastructure strategy (95%)
    • Architect cloud solutions (95%)
    • Create and distribute cloud management, operational policies and best practices (94%)
    • Determine which cloud vendors and/or technologies are used in production (93%)
    • Define and measure site reliability (91%)

    The Path to Cloud Maturity

    In general, companies are still confident about their cloud trajectories. But, getting to a mature multi-cloud state will take work. One area that needs further scrutiny is cybersecurity, as password or credential leakage is now seen as the most prevalent cloud security threat. Organizations will require better DevSecOps best practices to avoid such leaks. That, and certain open source cloud-native tools could also aid security and compliance efforts.

    A mature cloud strategy will also require localizing development efforts through shared platforms and increasing infrastructure automation. On that note, 83% of organizations say automation tools are important or extremely important to operationalize their multi-cloud infrastructure. More automation for cloud-native areas like CI/CD, observability and Kubernetes management could also abstract complexity and fill the skills gap.

    As the HashiCorp study clearly showed, those organizations that have matured their cloud strategy are far better off because of it. They tend to understand their workflows better and can more seamlessly introduce new automation. Now, it’s only a matter of getting there …

  • Datadog Updates Aim to Improve Logging, Testing Efficiency

    Datadog Updates Aim to Improve Logging, Testing Efficiency

    At its recent DASH 2023 conference, Datadog revealed Flex Logs and Intelligent Test Runner, two major new capabilities aimed at improving logging and testing efficiency for engineering teams.

    Omri Sass, director of product management at Datadog, said Flex Logs introduces a new middle tier of log storage between real-time querying and cold archives. As Sass explained, this provides a cheaper option for retaining logs beyond the typical two weeks for occasional analytics and investigations. By decoupling storage from compute for reading logs, teams can independently scale each based on their needs. This enables retaining rich log data for months or years to uncover long-term trends, he said.

    In addition, Sass noted that Flex Logs helps address common log analysis limitations around storage costs and rehydrating archives. The feature better aligns log pricing with specific use cases beyond just troubleshooting. According to Sass, this evolution in log storage tiers will likely shift more logs from legacy on-premises systems to its cloud platform.

    The second capability, Intelligent Test Runner, leverages observability signals to optimize CI test suites. As Sass explained, comprehensive test automation in CI pipelines often increases deployment times and flakes. Intelligent Test Runner inspects code changes to determine associated tests, ignoring irrelevant ones, which helps avoid long wait times for minor changes just to exercise unaffected areas.

    By tapping into existing telemetry around code commits, test health and runtimes, the feature adapts testing to each code modification. Sass explained that observability data has matured enough to enable real-time optimization like this. The end result is faster CI validation, so engineering teams can ship updates more rapidly.

    Sass highlighted how Flex Logs and Intelligent Test Runner are Datadog’s attempts to address real pain points developers face around managing log data life cycles and CI speed bumps. Sass said he believes this combination of depth in core disciplines like logs and application performance monitoring (APM), along with expanding into adjacent developer workflows, is key to solving these issues through innovation.

    Looking to the future, the observability space continues to evolve rapidly as emerging technologies and practices expand monitoring beyond traditional IT infrastructure. Companies handling modern workloads expect their observability platform to provide comprehensive visibility as development toolchains and architectures grow more complex, with the next generation of observability likely incorporating advanced analytics, automation and AI to help engineers tame systems at ever-increasing scale and speed. 

  • Data Management: Cloud Technology or Data Centers?

    Data Management: Cloud Technology or Data Centers?

    Traditionally, larger enterprises have relied on in-house server hardware equipment for their data management needs, optimized to run high-performing applications with a certain degree of assured security and reliability. 

    However, the high costs and technical expertise required to manage these solutions effectively often render them inaccessible to startups and emerging businesses. But, as the old saying goes, necessity is the mother of invention. 

    With the growing demand for cost-effective, efficient data management solutions, the tech industry has witnessed the advent of cloud technology and data center colocation rental services. These alternatives pave the way for startups and small businesses to handle large volumes of data without straining their budgets.

    This article will compare and contrast cloud technology and data center services to help business leaders make well-informed decisions about their data management needs and the solutions that can help them.

    Understanding Data Center Colocation Services

    Data center colocation services offer an enticing solution for companies that require robust data management capabilities without incurring high capital expenditure for securing storage hardware, along with storing and powering them. 

    Essentially, this solution is like renting a space for your data in a specialized facility. These data centers provide a secure environment with the necessary power, cooling, and physical security for your server, storage, and networking equipment.

    In opting for colocation services, companies can leverage state-of-the-art data center infrastructure without the burden of high upfront costs and ongoing maintenance responsibilities associated with owning a private data center. This also allows businesses to focus more on their core competencies rather than the intricacies of data center management.

    However, data centers come with their own set of unique challenges. For instance, they often require a certain degree of technical expertise on the part of the business to manage their servers. This means hiring or training staff to handle server management, increasing the overall cost of this solution.

    Additionally, data centers’ effectiveness can sometimes be influenced by physical proximity. The closer your operations are to the data center, the better the performance can be. This geographical factor can pose problems for businesses operating in multiple locations or managing data across different data centers.

    The Power of Cloud Technology

    In contrast to relying on data centers, cloud technology offers businesses of all kinds and sizes immense scalability and flexibility in terms of data management solutions. 

    As a service that delivers computing infrastructure, software, or storage as a service via a network connection, typically the Internet, cloud technology eliminates the need for physical proximity to servers. It is quickly scalable, both upwards and downwards, as per business needs, ensuring that you only pay for what you use.

    Moreover, the ability of cloud technology to integrate various services can simplify business operations and enhance customer engagement. For instance, many businesses are now offering cloud-based text-to-pay systems that allow customers to pay from any device, providing ease of transaction while simultaneously gathering customer data in the cloud.

    Cloud services can also provide robust disaster recovery and business continuity solutions. However, businesses often cite concerns about data security and privacy in the cloud. Although most cloud service providers implement best-in-class security protocols, the very nature of the cloud—being an off-premises solution—necessitates a high level of trust in the provider.

    AI and Data Management Solutions

    If your business relies heavily on AI applications, you must understand how your data management solution supports this need. AI requires high-quality, well-managed data to function effectively. Here, cloud technology often presents an edge over traditional data centers.

    Many cloud service providers offer built-in tools and services designed to better facilitate AI implementation, including pre-trained machine learning models and AI platforms as a service. These resources can dramatically reduce the time, costs, and complexity that come with implementing AI, particularly for small to mid-sized businesses without extensive in-house AI expertise.

    On the other hand, while data centers might not have these built-in tools, they offer robust performance capabilities for AI workloads and often provide more control over the data, which is vital for sensitive AI applications.

    Keep in mind you can turn to other server-based solutions for storing data as well. For example, if your application relies on a significant amount of PDF content to store data and function effectively, hosting those files on a server such as a server-side PDF SDK will allow you to process those documents on the server via an API. This will then allow you to autoamte your document processing and convert large volumes of your PDF files. 

    Web Hosting Requirements

    Your current web hosting requirements can also significantly impact the choice between data center services and cloud technology. Shared hosting services may be sufficient for businesses with low-traffic websites or applications, and if you don’t need to store a lot of data, but as your traffic increases and the website grows, so do your hosting requirements. 

    Cloud hosting solutions offer excellent scalability, allowing your website to grow with your business. As traffic surges, cloud servers can easily handle the increase, maintaining website performance and user experience.

    Conversely, with a dedicated data center, you’re generally limited to the capacity of the server you rent. To increase your capacity, you may need to physically upgrade the hardware, a process that can result in downtime and potential loss of revenue.

    Considering Cost Implications

    The overall cost of your chosen solution will be a key factor when deciding between data center colocation services and cloud technology. Each service has unique cost structures that can vary between providers, and understanding these can significantly impact your company’s financial health and resource allocation.

    With data center colocation services, the costs are generally more predictable. You pay a fixed amount based on your rented server space and the bandwidth you use. This stability can be advantageous for budgeting purposes, especially for businesses with steady data usage and processing needs. However, you may also incur additional expenses for any necessary hardware upgrades, maintenance, or increased bandwidth usage.

    What’s more, there’s the indirect cost of employing or training staff to manage the servers, plus the potential costs of transportation to and from the data center, particularly for businesses not located near their rented server space. These costs can add up and should be factored into the total cost of operating within a data center.

    Cloud services, conversely, operate on a pay-as-you-go model. This solution can be much more cost-effective for businesses with shifting data needs since you can readily scale up or down based on demand, ultimately only paying for the resources you actually use.

    Choosing the Right Path for Your Organization

    Unfortunately, there’s no one-size-fits-all solution for effective data management. Each business has unique needs, requirements, and considerations that necessitate a carefully tailored approach. When choosing between cloud technology and data center colocation services, business leaders must carefully consider several key factors to determine the right solution for them.

    If scalability, flexibility, and AI integration rank high in your data management strategy, cloud technology presents an excellent solution with its on-demand resources and array of built-in tools. On the other hand, data center colocation services provide robust performance capabilities, greater control over data, and predictable costs—features that may appeal to businesses with more consistent data management needs.

    Understanding your current web hosting requirements and the potential cost implications of each solution are also crucial elements to consider in your decision-making process. The demand for efficient, secure, and cost-effective data management solutions will only continue to grow as data storage needs expand rapidly.

  • Low-Hanging Fruit, 2023 Edition: Part One

    Low-Hanging Fruit, 2023 Edition: Part One

    We’ve been cranking it out, haven’t we? Generating cool new toys for the business, creating new infrastructure to host those new toys and trying our best to secure all this new stuff while maintaining both our sanity and our cadence. And we’re doing it. Kind of.

    One thing we’re naturally lagging behind on is security. While we don’t purposely shortchange security in our DevOps processes these days, it always takes a bit to figure out the best way to secure new technologies after they’re implemented. And we’re implementing a ton of new technologies. So our security staff (and increasingly, DevOps/SRE teams) is rushing to play catch-up. One area where this is screamingly apparent is APIs. We’re spewing them across the organization, often without cataloging or responsibility. This makes sense, as in many cases, the API is just an evolution of the function call. “I need a service, it is a good generic service, let me throw it up and we can use it from wherever the client ends up deployed,” type of thing. The problem is that leaves a ton of attack surface not truly protected. Because without cataloging or responsibility, there is no way for security to know about many of these APIs.

    API Scanning Technology

    That brings us to today’s topic. If you haven’t done so yet, it is past time to look at API scanning technology. It comes standalone and bundled with pretty much any API security product on the market and is increasingly bundled with other development security or even development tools. And the whole point is to get a list of APIs. Oh, most commercial implementations do something with that list–include it in static testing, drive it into WAFs, whatever—but just having the ability to inventory what is running on your network is reason enough to stop doing less important stuff and figure out what your exposure is. And the tools make it easy. They come in two flavors, and we should consider both.

    Static API Scanning

    The first type digs through source code and API specs to come up with the list of what is supposed to be running on the network. The big weakness of this method is that it only knows what it is told. This is static API scanning.

    Dynamic Scanning

    The second watches network traffic for API calls and then documents them, possibly even generating API specs for you. The big weakness of this method is that it only discovers what is being accessed on the network while it is watching traffic. Currently, unaccessed APIs are not caught, nor are ones on unreachable networks. Unsurprisingly, this is dynamic scanning.

    As usual, the two together are more powerful than apart. By implementing both technologies, an organization can work toward a hardcore comparison of what should be running on the network versus what is running on the network. This goes beyond detecting unreported APIs, it also means that zombie APIs or runtime drift can be discovered by comparing what is there to what should be there.

    If you’re not doing this, consider adding it to the toolbox. Setup is not onerous, and the reports are lists of APIs and parameters that can be reviewed at leisure. Some commercial products that offer these two functionalities take it quite a way beyond list generation, and if comparisons are made, work hard to understand just how much each toolset can do.

    And keep rocking it. We need more tools to lock down the new perimeter precisely because you and your team are tackling new technologies and platforms to better serve the business. We are increasingly seeing security tooling catch up with the broad selection now available, so go implement them.

  • DevOps Guide to the Salesforce Summer 2023 Release

    DevOps Guide to the Salesforce Summer 2023 Release

    The second installment of Salesforce’s 2023 releases provides some great eye candy for DevOps pros. From new admin features to user enhancements and the anticipated Flow updates, a lot is covered in the nearly 700-page Salesforce Summer ‘23 release. Let’s break down the highlights of some appealing features, why these updates will save all Salesforce users time and energy and explore key details of the impending transition to Flows.

    First, we’ll break down notable updates from this release that will save you time, help DevOps teams automate faster and enhance the experience for both you and your customers.

    User Enhancements

    There are lots of great adjustments to some tools we know you’ve been waiting for and some we hope will be made available to all users.

    ● Mass Quick Actions on Related Lists: This is a beta feature that you can opt-in to try. You can now add and update records directly from a related list—a time and tab saver! This feature has been requested many times and will decrease the need for custom-built interfaces. For instance, if you’re on an Account and want to edit the related Contacts, you can add, edit or mass update directly from the Account screen. This saves clicks and stops new tabs from opening and losing your spot, etc. Allowing users to update in bulk is a major win!

    ● Einstein Search: Advance your search capabilities by having additional field types to search within, such as picklist, which were not previously searchable. For example, if you have a picklist field on Contact, you can search for one of the values and any records with that selected value will appear. Users will get more relevant results in their search. This new enhancement is in beta, so we’d highly suggest opting in to give it a test drive.

    ● Lightning reports and dashboards improvements, including:

    Enhanced reports and dashboards with images and text descriptions let you add visualizations to your dashboards with company logos, helpful imagery or clarifying text. Explain exactly what the Dashboard is providing with helpful messaging or encourage the sales team with positive feedback about their work. This will not only better guide end users throughout the dashboard but will also increase engagement and personalization.

    Additional dashboard filters permitted: Dashboard filter allowance jumped from 3 to 5, making dashboards more configurable and customizable for different views and end users.

    A new ‘post to Slack’ option on dashboards: share analytics across your Slack workspaces so your colleagues can view, share, and subscribe to dashboard details and view in real-time.

    Note: While all of these improvements to reports and dashboards are amazing features, they are only available to unlimited edition users. We hope Salesforce will trickle this down to enterprise users soon.

    ● MFA auto-enablement continues: Unless you’re using a single sign-on (SSO) solution like Okta, Salesforce mandates the use of multifactor authentication (MFA). Hard enforcement is coming by spring 2024 when Salesforce initiates a full rollout, so we’d suggest getting ahead of it by implementing this now.

    Flows

    With the forthcoming transition to Flows, we find that the more Salesforce does with Flows, the better. In general, it gives users better tools to deliver to customers and offers better experiences overall. These Flow Builder updates are key:

    ● Send API callouts without using code (this is in beta). This is like having Postman-like capabilities right in Flow!

    ● Create screens that react to changes from other components on the same screen. This is huge, since you can’t create reactive screens in Flows right now. Workflow optimization is all about reducing clicks, which users can now achieve with reactive forms (this is also in beta).

    ● Log emails and use email templates with the ‘Send Email’ action. This was rigid before, as users had to pull in their own templates or make very basic emails in Flows. This is a basic but hugely helpful upgrade.

    Honorable Mentions

    • The new Undo field change feature: A lot of you have been waiting for this (ourselves included) since there is no such thing as “undo” in Salesforce … until now!
    • New Salesforce connect adapter for GraphQL: Developers and system architects will be happy to see this feature that allows you to access your external data by connecting to AWS Aurora via GraphQL queries from Salesforce as if the data were native. This saves you from having to copy and store your external data in Salesforce with complicated syncs.

    We’re all always hunting for ways to save time and simplify processes. Once again, Salesforce delivered with the Summer ‘23 release. Fewer clicks, bulk actions and more sharing and collaboration capabilities. And this one has a little bit of excitement for everyone–admins, developers and end users.

    The best thing you can do is to experiment with ways to optimize. There’s a lot in beta, so roll your sleeves up and dig in! Happy summer!