devopsy.kinsta.cloud

Category: Blogs

  • Delivering True DevOps on the Mainframe

    Delivering True DevOps on the Mainframe

    Mainframe-inclusive DevOps enables organizations to accelerate application development and delivery so they can stay ahead of market disruptors. Efficient and effective DevOps practices in your mainframe environment allows developers to build, analyze, code, test and manage applications with improved agility and precision. 

    In this interview, Mark Schettenhelm, senior product manager for Compuware, a BMC company, shares the importance of implementing Enterprise DevOps as well as the culture and mindset that helps companies succeed in their DevOps journeys. 

    With over 35 years of experience, Mark is a DevOps expert that has been instrumental in bringing mainframe solutions to the forefront of the industry. He will be speaking more on the topic in his session “Delivering True DevOps on the Mainframe” at Open Mainframe Virtual Summit, a free virtual event taking place on Feb. 11.

    To check out the full agenda or to register for free, visit the Open Mainframe website.

  • The Benefits of Open Source Technologies

    The Benefits of Open Source Technologies

    Over the last 20 years, we have seen the proliferation of open source software and technologies become part of commercial offerings, either as part of the technology stack that powers the product or part of the product itself. Although these two use cases are largely different, both have come to showcase just how useful open source is, not only for the developer community but for businesses as well.

    One of the benefits of working with open source technologies or projects is the free sharing of ideas. Open source brings people together to brainstorm and develop a common piece of technology. The shared love for what they do crosses cultural and geographical boundaries. One of the best-known – and arguably, most important – open source projects is the Linux kernel and operating system. Linus Torvalds released the first version of the kernel to the open source community through a mailing list, sparking worldwide collaborative development and widespread adoption.

    The passion for open source stems from a deeply rooted belief that contributors are solving an important problem, and that they are working towards the betterment of the world as a whole. In many cases, this is demonstrable. The Linux kernel now powers the majority of data centers worldwide, serving billions of users. But it’s not only that subjective passion that has played a key role in establishing open source technologies. The peer-review process of open source projects means that each code commit passes a rigorous, public audit and verification process. It has proven to be a superb way to increase code quality, reduce bugs and regressions and guard against vulnerabilities. Research has shown, objectively, that this process produces higher quality software than the standard, proprietary quality assurance and testing procedures.

    When selecting an open source technology to use in development, there are a couple of issues that need to be considered in order to safeguard the quality of your product. One key consideration is to resist chasing the latest technology fad. Instead, select the right technology for the job. It’s in developers’ DNA to obsess over new and exciting technologies, but this does not always mean that they are appropriate. While Kubernetes may be the right solution if you need to serve millions of users at Netflix-like scale while managing maintenance and cost, it likely isn’t the best choice for a new startup launching the first iteration of their product. In this case, speed of development and flexibility to make changes is more important than scalability (so, perhaps, the startup might be better off using Ruby on Rails or Django). These three projects all share an important characteristic: They have active communities that not only safeguard project features but also maintain them and offer peer-to-peer support.

    When implementing a new feature with a particular technology, this supporting community is very important, since they can greatly accelerate the development of your product. These are people who love what they do and want to see other community members succeed with the technology. In this regard, it’s also important to consider giving back to the projects and communities you benefit from. You can either participate in the communities and help others yourself, one-on-one, or contribute by sharing the improvements that you have made to the open source technology. If you have extended the API, for example, or discovered and fixed bugs, there is no reason not to contribute your changes back and further enrich the ecosystem. The credibility you build in this way can also be a benefit, as people will identify you, your team and your product as supporters of the open source project. It’s a virtuous cycle of collaboration with benefits that should not be underestimated.

    As you and your product become an important part of the open source ecosystem, either because you use open source components or because the core of your product is open-sourced, remember that trust is notoriously hard to build and very easy to lose quickly.

    Whatever one’s feelings are on this matter, the open source community is very careful about who they trust and can easily be alienated by a company that appears not to have their best interests in mind. In order to build trust, it’s important for teams to build credibility. Open source communities are largely merit-based, so unless the community sees proof of expertise and knowledge, they will not automatically trust a self-proclaimed expert. This credibility can even extend to the personal, like the many open source developers who have a large following on social media and lend their credibility to the projects and companies that they work for.

    Finally, when dealing with open source technologies, projects, and communities, it’s key to remember that developers are very sensitive to blatant sales pitches. Authenticity matters in the way that a project, company or brand presents itself. Open source is all about collaboration and community; it’s a relationship built on trust and mutual benefit, not profit.

  • AIOps Builds Organizational Efficiency, Survey Finds

    AIOps Builds Organizational Efficiency, Survey Finds

    Enterprises entered 2020 with big plans. Post-pandemic, AIOps could help them achieve those goals, according to a new research survey from Digitate and CorporateLeader.

    Enterprises entered 2020 with the best-laid plans; many had efforts lined up to expand their use of cloud services and continue their steady efforts to digitally transform their businesses. Then the pandemic happened, and business and IT teams found themselves scattered and with a new playbook: make the organization as effective as it can be while working remotely.

    This sudden shift to remote work exacerbated existing challenges within organizations, from managing hybrid environments, personnel management challenges and teams finding themselves struggling to adjust. Meanwhile, enterprises still had to focus on staying ahead of their competitors technologically. All of these challenges meant there was no room for wasted or time-consuming efforts to manage the underlying business-technology systems.

    To help increase efficiencies, some contend that the answer is artificial intelligence for IT operations, or AIOps. Proponents of AIOps say that AI is needed to augment human decision-making today because of the complexity of modern enterprise environments. Today’s environments often find their operational data spread across on-premises and multiple cloud systems. The result is difficulty in managing infrastructure issues as they arise, and the considerable time it takes to identify and fix IT issues.

    According to a survey of leading European IT analysts and advisories, conducted in fall 2020 by operations automation software provider Digitate and executive network forum CorporateLeaders, the drudgery of managing routine tasks was the most commonly cited reason for turning to AIOps, which was followed by “no proactive capability of detection and correction of system issues” at 64% and “no flexibility to scale with business needs,” also cited by 64% of respondents.

    When respondents were asked to identify the key benefits of AIOps, they highlighted common strategic and operational issues that hinder performance. According to respondents, these include the removal of manual processes (91%), improvements in agility and reliability (82%) and reach predictability (73%). More swift problem resolution also was cited by 73% of respondents.

    In a case study shared within the CorporateLeaders report, Marion Fokkinga, technology advancement manager at Netherlands-based semiconductor maker NXP explained that NXP’s move to AIOps was driven by the company’s swift expansion. “Since 2015, we have been busy with multiple merger and acquisition projects,” Fokkinga explained. “As a result of this, there was less time for innovation and transformation in IT and in the business.”

    The company set out to automate routine operations tasks with AIOps so that their resources could be freed to focus on higher-value tasks. According to Fokkinga, AIOps enables tasks, such as report generation, that previously consumed half a workday to be completed in several minutes. Saving time is the most significant result, said Fokkinga. With AIOps, NXP reports a 97% improvement in incident response time and a 95% reduction of manual effort in some of its supply chain planning work.

    Of course, in the current treacherous business environment, there’s a lot more at stake than simply building enterprise operational efficiencies. Over time, it may come down to the very success of the organization. According to the survey, a full 82% of respondents said that AIOps is necessary to the future growth and transformation of their business. “Respondents who went on to give qualitative answers later in the survey explained that the complexity of hybrid and multi-cloud infrastructures, increasing transactional volumes and the criticality of online business systems make it impossible for traditional IT systems to manage every application and infrastructure without recourse to automation. It was highlighted that the overwhelming amount of data in today’s Operations are simply beyond human analysis capacity,” the report stated.

    One respondent said that, through AI, the performance of some tasks and decisions were improved, as routine tasks were eliminated. That has to be welcome news to enterprises struggling to remain competitive while simultaneously striving to remain productive and agile during a global pandemic.

  • DevSecOps Implementation: It’s About the Data

    DevSecOps Implementation: It’s About the Data

    It seems we are constantly barraged with, “So-and-so announced that their systems had been breached and 80,000 user records were stolen,” notices. In fact, https://haveibeenpwned.com/ lists ten billion hacked accounts.

    That is no surprise. Databases exist to pool related data together. Even NoSQL type databases, which some saw as an opportunity for wildly disparate data to be gathered and analyzed, almost exclusively contain related data sets. We generally don’t want or need to correlate, say, the number of pirates in the world with annual global temperatures, for example.

    One would think, with decades of experience under our belts, we would have a good solution for protecting that data. If it was a simple problem, we would. It is not.

    Databases are the primary target of most attackers. After all, getting access to your user database gives them account names through which they can try and gain elevated privileges. Getting a large amount of user/credit card information gives them a revenue stream by selling them off (though it is now so common that prices on the black market have become depressed, and this isn’t really profitable, given the risk versus the reward, anymore).

    And databases must, by definition, have broad access. A database does not exist in a vacuum; it exists to serve an app. For server-based databases, it almost always exists to serve multiple apps. It must be on the corporate network (even if that network is a virtual private cloud), and it must … offer up data. It has users that have greater privileges than your average customer, and is notoriously difficult to protect with strong protections like encryption.

    Encryption poses problems at multiple levels. It is still a bit slow, for starters. This is the nature of the beast – if it takes X microseconds to respond to a request, encrypted data will take at a minimum X+decrypt time (regardless of where decryption occurs). If encryption is done by column, index fields cannot be encrypted (because “nZ19?SDF” is unlikely to be in the same sort order as “ford explorer”, for example) Which means some data is immediately excepted from encryption. If encryption is handled by the database system, then the time overhead exists, and the database system must send the resulting data over your network … unencrypted. I was involved in a couple of projects that required encrypted databases – the one I can vaguely talk about was putting information about your corporate network onto Android and Apple devices. Needless to say, since phones and tablets are misplaced quite often, and most have weaker security than your average laptop, we needed information about critical infrastructure to be encrypted. It was … painful. We only managed it successfully because corporate networks are finite resources, so the amount of data we needed to store was limited, and we could prove performance wasn’t going to be the issue.

    So what can you do? Continue to follow attempts to adequately encrypt corporate databases. Eventually, someone will crack this problem in a way that is performant, can be debugged and reliably protects the data.

    Until then, protect your databases. Use the tools we’ve talked about in this series to monitor and protect the entire network, knowing that the database is a high-profile target if someone gets in. And use the other security tools available. The major database vendors offer DBMS security tools to evaluate your current status. Some will flag weak passwords, others will monitor for injection attacks (as will development tools discussed in the first few installments of this series). Lock down interfaces to databases – by user, by IP, whatever makes the most secure, but still usable, environment for you. Set up monitors for behavior outside the bounds of normal behavior – a query of 250K records should raise a flag, for example, since the vast majority of apps will only do a subset that can be paginated. Sure, it will probably be a false positive caused by someone hand querying, but the one time it isn’t, you’ll be glad the monitor was there.

    And protect your database backups – be they actual backups or a dump to test. Fewer organizations are using real, unfiltered data for testing, but it crops up in most orgs at one point or another, as testers are trying to look at issues that fake/masked data can’t replicate. For actual backups, those must be encrypted. To lose your customers to a hacker because you had an unencrypted database dump lying around, and the attacker didn’t even have to attack the DB, is downright shameful, and happens too often. Along these same lines, and this should go without saying, but it’s happened enough that I feel compelled,  do not copy large chunks of your database out to an unsecured cloud storage bucket. Some vendors have addressed this issue by not allowing public unsecured buckets, but you can still do this, depending on the cloud you are using. So, don’t.

    The database security market will be best served by being rolled into SIEM and/or XDR. And while I’m in full-on pundit mode, for this statement, I’ll predict that is where it is headed. Database security is as much about overall security as it is the database, so overarching systems are the best place to detect and defend from. So watch for moves in that direction. A holistic view will serve you better in the long run.

    Meanwhile? Keep rocking it. Treat your data like gold, because to hackers, it really is. And, keep running the world’s business. Celebrate your successes as much – or more – than you learn from your failures.

  • Sauce Labs Acquires AutonomIQ to Advance App Testing

    Sauce Labs Acquires AutonomIQ to Advance App Testing

    Sauce Labs is acquiring AutonomIQ, a provider of a scriptless test automation platform based on machine learning (ML) algorithms.

    Matt Wyman, chief product officer for Sauce Labs, said the acquisition of AutonomIQ will play a critical role in enabling Sauce Labs to push testing further left toward developers and, ultimately, “citizen testers” that are becoming part of the DevOps testing tool chain.

    The acquisition of AutonomIQ comes on the heels of the company announcing its intent to acquire API Fortress, an application programming interface (API) testing platform provider. Terms of neither acquisition were disclosed.

    Wyman said the rise of DevOps coupled with an increase in the volume of applications being developed using low-code tools are the primary drivers of a need to shift testing further left. As more citizen developers are building applications, they require access to a testing platform that doesn’t require them to know how to write scripts to test applications, said Wyman.

    The AutonomIQ platform employs machine learning to understand, for example, natural language descriptions of test cases or captured mouse clicks. It then generates synthetic data and test cases that can self-heal when an application changes, said Wyman.

    That approach to testing is more feasible in software-as-a-service (SaaS) environments, where a custom application based on a platform such as Salesforce, ServiceNow, Workday, Oracle or SAP doesn’t tend to change as radically as an application being built from the ground up, Wyman said. Those classes of applications will still require either developers or a dedicated team of testers to build tests using scripts, said Wyman.

    In fact, Wyman said testing those applications is becoming more challenging in the age of microservices. The API Fortress acquisition addresses that issue, because microservices are dependent on APIs to communicate with other microservices, said Wyman. In general, Wyman said Sauce Labs is now moving beyond being focusing only on functional testing of user interfaces.

    It remains to be seen how quickly testing will move to the left. Developers are being held more accountable for the quality of their applications, so testing integration within the application development process has increased. This has led to application testing becoming more tightly integrated with continuous integration/continuous delivery (CI/CD) platforms. Less clear is to what degree those efforts might have reduced the burdens of a dedicated application testing team that typically evaluates applications after they have been constructed.

    Exactly where and how citizen testers are being incorporated into those processes is also unclear. In theory, citizen testers can bring more business process expertise to the testing process. Getting individuals with that level of expertise to make time to participate in application testing while an application is being built can be a challenge.

    Regardless of approach, however, it is already apparent that machine learning algorithms, along with other forms of artificial intelligence (AI), will play a much larger role in application testing in the coming months and years.

  • How Shift-Left Testing Improves DevOps Efficiency and Software Quality

    How Shift-Left Testing Improves DevOps Efficiency and Software Quality

    Shift-left testing is the key to deliver quality software at speed. Developers shift testing left to shorten long test cycles, prevent defects and mitigate risk earlier in the development cycle, rather than in later stages, to avoid rework and delays.

    In this interview, IBM Z DevOps Testing Lead Nathan Cassata talks about shift-left testing, the benefits of shifting mainframe application testing to the left and how IBM Z DevOps testing solutions help accelerate enterprise cloud-native development.

    Nathan is also one of the distinguished speakers presenting at Open Mainframe Virtual Summit. During his session, he will explain how to shift left testing for your traditional z/OS applications.

    To learn more about how testing is integrated into a developer pipeline and how to create real unit tests, attend Nathan’s session at Open Mainframe Virtual Summit on Feb. 11. To check out the full agenda or to register for free, visit the Open Mainframe website.

  • Amid COVID-19, Developers Struggle to Keep Pace

    Amid COVID-19, Developers Struggle to Keep Pace

    It’s been a wild ride for digital innovation. It’s also been a stressful year for developers. At most organizations, the pandemic has increased reliance on digital experiences (and its programmers) exponentially. IT spending is rising, and competition is skyrocketing. More than ever before, the pressure is placed on developers to meet rigorous demands.

    A recent study by Couchbase revealed how developers are revolutionizing digital transformation efforts throughout the COVID–19 crisis. Yet, this output may not be sustainable. The 2020 Tech Lead Survey, which surveyed 450 senior IT decision-makers worldwide, exposed stressors for development teams, which, if not mitigated, could easily result in fatigue and burnout.

    So Much To Do, So Little Time

    Some digital transformation efforts that were slated to take five years have had timelines reduced to a matter of months. In this unprecedented era, flexibility is an indispensable characteristic to adapt to change. In fact, 63% of respondents said that flexibility to change direction on a whim is critical to meeting digital transformation goals.

    But, extreme flexibility comes at a price. Forty-nine percent of respondents indicated their development teams have been asked to do too much in too little time. As a result, 40% of respondents said their development teams were behind schedule with their current projects.

    “In a year when organizations have had to struggle to adapt to new decentralized ways of working and rapidly evolving markets, developers have come under severe pressure to help their organizations adapt,” said Steve Yen, co-founder of Couchbase.

    It’s apparent that developers are under escalating pressure. If the weight continues to pile on, exhaustion could bring overall production to a grinding halt. At least leaders realize who is driving digital innovation — 92% acknowledge developers are the unsung heroes of current digital transformation initiatives.

    Lacking Clear Direction From On High

    Eighty-six percent of respondents experienced challenges with their development teams. However, this does not wholly reflect poorly on developer inabilities — managers have a responsibility to set more explicit guidelines.

    Another obstacle: goal setting. Forty percent of respondents reported that setting clear, measurable goals for their team is a serious challenge. In addition, ensuring developers use the right technology, and ensuring teams understand overarching strategic goals were oft-cited pain points, as well.

    Resolving these issues will be critical to reducing developer complaints and remediating the stressors outlined above. “There needs to be investment in not just people, but also in the technology, management and communication that will help individuals succeed,” said Yen.

    Solution: DevOps

    So, where should architects direct new investments? Well, of the 450 IT leaders surveyed, 92% believe DevOps could have a revolutionary impact on their digital transformation efforts.

    The report refrains from offering specific technical advice, but makes the following general recommendations:

    • Don’t rely on legacy technology ill-suited for the tasks at hand. Current investments must be future-proofed for tomorrow’s scalability and integration requirements.
    • Don’t assume onboarding new tech will be easy. As digital innovation matures, new technology becomes more refined and specialized. As I’ve covered, whether it’s Kubernetes, service mesh or multi-cloud strategies, all require time to learn, along with some pretty specialized skillsets.
    • Take time to communicate with developers and understand obstacles. Be realistic with timelines, and do not ask for too much. Plan out project goals strategically, because haste does not equate to overall speed.

    Under pressure to perform and maintain flexibility, it makes sense that engineers are feeling the pressure of an amplified development pace. As that pace is likely not to decrease in 2021, finding methods to better support developers is key for long-term sustainability.

    At many organizations, a greater DevOps investment equates to operationalizing and automating processes for areas like microservices CI/CD, and networking and zero-trust security. It could also mean supporting developer workflows with some-code tooling. Other institutions are even introducing low-code tools to democratize the development process, intending to relieve some burden from professional engineers.

    Invest in Developers, Invest in Smooth Operations

    On average, development teams grew by 20% in 2020. As expectations for developers rise, so will investment in developers and the processes that support them. As teams move forward, it will be critical to gather feedback and understand what’s causing gridlock so that developers maintain agility and avoid burnout.

    In this competitive climate, choosing the correct people and systems to support new digital advances will be a competitive advantage. “Investing in [developers] in the right way will help them play to win,” said Yen.

    Since 2017, Couchbase has surveyed IT decision-makers on the challenges they face throughout their digital transformation efforts. Here, I highlighted the major takeaways from the 2020 report. You can view the full findings here.

  • Understanding Data Storage: Lakes vs. Warehouses

    Understanding Data Storage: Lakes vs. Warehouses

    Now more than ever, companies are looking for new ways to incorporate data analytics into their daily operations and leverage data-driven insights to improve business functions. They are frequently turning to complex data for tasks like machine learning and artificial intelligence, which are becoming necessary to understand and reach customer segments across industries. However, understanding data storage is a key factor in developing a successful strategy. The two most common storage formats are data lakes and data warehouses – but there are benefits and pitfalls to each that organizations must understand in order to properly capitalize on them.

    Data Lakes vs. Data Warehouses Use Cases

    One effective way to better understand the different functions of data lakes and data warehouses is to focus on the end use case. Typically, there are three types of data consumers: farmers, explorers and executives.

    • Farmers need data and information to execute their day-to-day activities. They must report on the key performance indicators (KPIs) required to execute their job by providing data in a structured format.
    • Explorers are users who want to experiment with data, look at new types of data pools and gather specific insights. If data is presented in a fixed format, it hinders their progress, as they seek data that doesn’t have a pre-defined structure.
    • Executives are responsible for making business decisions, and often require information presented at different aggregates, with the ability to narrow in on data subsets as needed. However, they require information that is somewhat structured, and speed is critical for them.

    If we look at these perspectives more broadly, they essentially boil down to two key types of data usage – the exact needs that data warehouses and data lakes are designed for. Farmers and executives are largely served through data warehouses, which require information to be timely and structured. Some of the main use cases for data warehouses include operational analytics, business intelligence and predictive analytics for data science and machine learning applications. Explorers are best served through data lakes, since the data formats are not predetermined. Data lakes are often most effective for use cases like a centralized data catalogue that enables organizations to view all sources of data in a single place, or recent advances in AI application development that require the processing of unstructured data, such as text, images, video and audio.

    Challenges and Convergence of Storage Formats

    Despite the differences, most companies can use both data lakes and data warehouses for their various analytics needs. However, to successfully capitalize on the benefits, it is also important to understand the challenges. In particular, data lakes present difficulties when it comes to parsing data. They were initially designed to capture data across the enterprise in its natural format, without enforcing schema, so that users could garner more insights; a fundamental aspect in creating a data-driven culture across the organization. However, without a predetermined use case, data lakes can quickly become data swamps. End users were historically unable to figure out whether the data was stale, and ownership was not well established. This has been remedied by taking a use case-driven approach and only including data that has defined use cases or ownership.

    Now that many of the issues surrounding data lakes have been resolved, the two storage formats must complement each other to meet the varying needs of the customer. This has contributed to blurred lines between data lakes and data warehouses. Data lakes are now capable of schema enforcement and answering rapid business intelligence queries, which were traditionally qualities of data warehouses. Data warehouses have separated compute and storage and can read directly from big data file systems, enabling users to read semi-structured data. As such, we are rapidly moving toward integrated data environments and the convergence of data lakes and data warehouses.

    Supporting Data-Driven Initiatives

    For initiatives like artificial intelligence and machine learning to succeed, data must be presented as an immutable entity that can be used for experimentation. With data lakes, it is crucial to separate the data into different zones and maintain a refined zone after transformation. Then, in the refined zone, companies can enforce schema and allow the schema to evolve to ensure the data is ready for machine learning and data science needs. Most importantly, they must catalog the data and enforce metadata management, data quality and governance. Data warehouses, on the other hand, excel in providing data sets ready for discovery and consumption. Companies should integrate these data sets with an interactive data catalog so they are discoverable – this is the most important step in making artificial intelligence and machine learning possible.

    If organizations can learn how to best capitalize on data warehouses and data lakes for their intended purposes, they will be well equipped to uncover key data-driven insights to help guide their business strategy. This will help enable use of other advanced technologies and help transforming them into data-driven companies.

  • CNCF Graduates Open Policy Agent Project to Manage Compliance as Code

    CNCF Graduates Open Policy Agent Project to Manage Compliance as Code

    The Cloud Native Computing Foundation (CNCF) announced this week that the Open Policy Agent (OPA) project, which many IT teams are employing to manage compliance as code, has officially graduated.

    Torin Sandall, co-founder of the OPA project and vice president of open source at Styra, whose compliance management platform is based on OPA, said formal recognition of OPA alongside other CNCF projects, such as Kubernetes, should help further adoption of the open source project that first took shape in 2016.

    Now being advanced under the auspices of the CNCF, the open source agent created by the OPA project is increasingly being incorporated into a wider range of compliance and security platforms. At the same time, more developers are starting to manage compliance as code across a wider range of applications. The ultimate goal is to make it easier to meet compliance requirements using a declarative framework so that responsibility for implementing compliance policies shifts further left toward developers.

    OPA uses a general purpose engine for enforcing policies that uses a set of rules that developers embed within applications using the Rego language. OPA has gained traction among cloud native application developers because it provides a means to enforce policies across a wide range of microservices.

    Sandall said going forward, the primary focus of the OPA project should be to develop and share as many integrations as possible. There are many instances where a use case for OPA has been created, but development teams simply don’t know that use case exists. As a result, many IT teams are attempting to employ compliance as code to address an issue that others have already solved, Sandall said.

    During its time as an incubation project managed by the CNCF, the security special interest group (SIG) within the CNCF conducted two external OPA security audits. The OPA project has also defined a security vulnerability disclosure process and a security response team.

    It’s not clear whether chief compliance officers within enterprise IT organizations have developed an appreciation for OPA. In theory, many compliance issues could be avoided if organizations mandated using OPA – or another approach to managing compliance as code – within their applications. Those compliance issues, of course, are multiplying as the number of compliance mandates expand globally. The challenge is that most compliance teams don’t have much visibility into the application development process.

    In the meantime, as DevSecOps processes continue to mature, it seems almost inevitable they would expand to include compliance mandates, most of which only exist to ensure some base level of security is present. Of course, developers may not want to be responsible for compliance mandates. However, the sooner compliance issues are addressed in the development process, the less likely they are to become DevOps’ problem when deployed in a production environment.

  • Q&A: Embracing the Power of the Mainframe with Deloitte

    Q&A: Embracing the Power of the Mainframe with Deloitte

    Mainframes are still in high demand and continue to be critical to modern IT strategies because of their power, security and reliability.

    The 2020 Mainframe Market Pulse Survey, conducted by Forrester and commissioned by Deloitte Consulting, dives into the role of the mainframe as a strategic component to hybrid cloud environments. Forrester interviewed 261 business and IT leaders to gather and refine data on current perceptions about the mainframe’s place in the enterprise and subsequent plans for its role in future IT strategies.

    Terri Cobb, vice president of alliances at Deloitte, and Bob Miller, solution architect and legacy transformation lead of IBM alliance at Deloitte, answered a few questions regarding the survey and the future of mainframes.

    Terri and Bob are two of our outstanding keynote speakers presenting at Open Mainframe Virtual Summit. During their keynote session, they will share some interesting findings from the survey and discuss why mainframes have a critical role to play in hybrid cloud strategies.

    Q: Why is the mainframe still relevant today?

    Bob: There are three key reasons mainframes continue to remain relevant today: reliability, performance and security. Enterprise organizations have found that other technologies can’t compare to the mainframe in three areas—and they are imperative to an enterprise’s critical operations.

    • Reliability: Due to its design, mainframe failures are rare. In fact, downtime (MTBF) is measured in years and decades—not hours and minutes. When failures do happen, disaster recovery is instant, and users typically don’t know a problem occurred. Distributed platform failures are more frequent than mainframe failures and are usually addressed by purchasing more servers than are required. When one server fails, another can be substituted in using (software) scripts—a process that takes about 15 minutes to accomplish. This includes managing databases, so they are as close to current as possible; something the mainframe does not have to do.
    • Performance: Outside of high-performance computing (HPC) servers, the mainframe has the fastest and most powerful processors in a commercially available server. It’s also able to process transactions quickly, making it the best TPR system in the world.
    • Security: Since its initial design, the mainframe has proven over time to be the most secure platform in the world. This is one of the biggest reasons that governments use it in their operations. Banks, who rely on security of the data they hold, have also been very clear that they will not give up their mainframes in favor of alternate architectures because of the security the mainframe provides.  

    Terri: I agree with Bob that reliability, performance and security are key drivers for the mainframe’s relevance in today’s IT architectures. The vulnerability landscape is constantly changing, and organizations can be attacked across their systems. Add to that concerns around data privacy and regulations and you’ve got a full plate. As seen in our survey, 80% of respondents are focused on modernizing mainframe toolsets in an effort to identify and prevent data breaches, and 73% are increasing their security footprint.

    Data protection and security are so critical, and mainframes remain one of the most secure and powerful platforms available when the right controls are in place. Take banking as an example: Personal financial information has become one of the most protected and heavily regulated types of data in the world. So much so that security measures and compliance programs to protect it consume the largest percentage of a financial institution’s IT budget. 

    Q: What does the future of the mainframe look like? 

    Bob: Despite being around for more than half a century, the future of mainframes has never looked stronger. Our Mainframe Market Pulse Survey found that 74% of respondents believe the mainframe has long-term viability as a strategic platform for [their] organization. Additionally, 91% identified expanding their mainframe footprints as a moderate or critical priority in the next 12 months. Given these responses, mainframes are here to stay and may see an increase in usage. 

    Overall, security is still the best with a mainframe, and it offers a good total cost of ownership compared to distributed servers. IBM also continues to add “modern technologies” to its line of Z series mainframes: AI, machine learning, blockchain, IoT, and more. Given the growth of data and that the mainframe is the keeper of most of the data in the world, it has a strong future as the (secure) repository of choice.

    Terri: Bob mentioned that IBM is adding modern technologies to its mainframes. This is really important as companies leverage AI and machine learning to convert data from every transaction into real-time, actionable insights. 

    Going back to banking, there’s certainly a need to execute large volumes of transactions. But financial institutions also need deep insights about customer needs, preferences, and intentions to compete effectively, along with speed and agility in sharing and taking action on them. That’s easier said than done when data is constantly changing. With the ability to analyze data directly on the mainframe, you can get those near real-time insights and action, making the mainframe an important participant in the AI/ML revolution. 

    Q: Could you tell us a little bit about Deloitte’s 2020 Mainframe Market Pulse Survey? What would you say is one of the most surprising findings from the report? 

    Terri: There’s so much buzz in the marketplace around migrating to cloud. And that made us wonder where mainframes stand in relation to technology priorities for enterprises. It seemed to be a common notion that mainframes were a thing of the past, but our experience told us otherwise. 

    To better understand the market, we enlisted Forrester Consulting to conduct a survey of US-based business and IT leaders across industries to understand their perspective and use for mainframes. What we found was that mainframes aren’t on the way out. In fact, interest and investment appear to be on the rise with 72% of respondents planning to upgrade their mainframes in the next three years. Why? They want to address three key areas: security, storage and software. Those three pillars continue to be a top priority for business leaders across industries, validating the role of legacy systems in hybrid IT strategies. 

    We learned that cloud is an imperative to these leaders, but they also realize not all workloads are ideal for cloud and they lack the right talent to support mainframe and legacy transformation goals. This part of the study stood out to me because it showed that enterprise organizations understand the value of both mainframes and cloud, but they don’t know where to start. For us at Deloitte, our priority is helping organizations determine the best model for their business and bring it to life—which typically involves a hybrid architecture that ties in core, cloud and edge environments. 

    Another finding that stood out was that 93% of respondents indicated it is “moderately” to “extremely challenging” to acquire the right mainframe resources and skills. The survey showed us mainframes are here to stay, but without the proper staffing and skilling we could soon experience a larger issue of maintaining and updating them. This could pose significant setbacks for organizations that depend on the security, reliability and performance of mainframes for critical operations—now and in the future.  

    Q: What can we expect from your upcoming keynote session at Open Mainframe Virtual Summit? 

    Bob: The session will provide a deeper understanding of what the survey showed, highlighting how companies view their mainframe, the challenges they face and their priorities for the near-term. We also discuss the benefits of stepping back to look at what the business needs and why before pursuing an IT strategy that may not meet their priorities.

    To take a deeper dive into the survey results and to learn more about the mainframe, attend Terri and Bob’s session at Open Mainframe Virtual Summit on Feb. 11. To check out the full agenda or to register for free, visit the Open Mainframe website.