Category: Blogs

  • An Analytics Workload is a Critical Data Management Tool

    An Analytics Workload is a Critical Data Management Tool

    From an organizational perspective, an analytics workload is a way to gain a data-driven business advantage. Analytics workloads can serve a primary objective that translates to an actionable business impact (such as analyzing A/B testing results, understanding user retention or finding anomalies in a flow, for instance) or can serve in a supporting role for analysis (such as improving dataset quality, preparing a dataset for user consumption or adhering to a data-related regulation).

    Ideally, a workload should have a measurable ROI and should be monitored on key performance metrics such as business impact, time to deliver, cost of execution and total spend versus allocated budget. Managing workloads this way is extremely challenging for data teams. In reality, the impact of big data analytics projects – and the effort and resources spent on them – tends to be unpredictable.

    You can place workloads on a spectrum: on one end, you have workloads that are very close to their business consumers. On the other end, you have workloads that serve auxiliary and support purposes. The latter are the hardest to track, budget and measure their return on investment (ROI).

    Query vs. Workload

    When data platform teams are tasked with evaluating and implementing the infrastructure needed for an analytics workload, they tend to look at it from a technical requirements perspective. An analytics workload is a set of queries that read and write datasets; it consumes compute, storage and memory resources and has an expected level of availability, robustness and performance.

    One traditional approach for improving cost and user experience in a workload is to focus on specific queries – identifying the slow, heavy and expensive ones and optimizing them one by one. While many single queries can be made better (faster, cheaper) by rewriting and optimizing, this approach often misses the big picture, leaving money on the table.

    Knowing Which Queries to Focus On

    Stripped of workload context, queries can only be evaluated on cost or response time. But business-critical queries may not be the most expensive, nor the slowest ones. Having the full view of the workload allows for prioritizing efforts much more effectively.

    Behavior Fluctuations

    The most important query on Mondays is probably very different from the most important query on Fridays, so the effectiveness of optimizing one or both queries may be small. The workload perspective enables you to identify patterns and leverage insights for effective optimization.

    Cloud Elasticity

    Unlike legacy data platforms, the cloud enables a brute-force approach to solving performance problems by adding elastic resources on demand. While this approach can work to improve a specific query, cost quickly gets out of control when applied to all queries. Understanding the workload is key to distinguishing when a brute force solution is right, and when you need to spend the time to build a different data flow.

    Cloud Decoupling

    In legacy IT environments, where queries were competing for a limited pool of resources, optimizing a single query had significant impact. But in cloud environments where resources scale elastically, queries compete with each other on a much smaller scale, if at all. Therefore, optimizing single queries has very little impact on the overall performance of workloads.

    Measuring Performance by Looking at the Median

    The heaviest or slowest queries are in the top percentile of queries. When trying to improve the overall user experience, the median performance can matter more, but it is indirectly affected when handling the extremes, so it tends to be less effective.

    The Long Tail

    In many workloads, a few highly visible queries can paint a misleading picture. It is common to have less than ten queries responsible for 20% of the load, and thousands of undistinguished “simple” queries responsible for 80%. Therefore, when data teams are trying to reduce cost, focusing on the most expensive queries may draw attention away from lower-hanging and easier optimization opportunities in “simple” queries.

    “Big Picture” Optimization

    Actions that improve a query (such as changing the layout of a dataset) may result in unintended consequences to other queries. Only a workload perspective can help evaluate the wider impact across other queries.

    The Cluster Approach to Optimizing Big Data Analytics

    Another traditional approach to optimizing data platforms is analyzing behavior from the cluster perspective. Most data platforms offer decent cluster monitoring of technical metrics, such as CPU load and RAM usage.

    But, focusing on cluster-based KPIs will draw attention away from the elements that have the highest impact. Understanding the workload entails understanding the business logic of queries: repeating query patterns, hidden dependencies, failure modes.

    Looking at this from a cluster perspective limits you to technical parameters, such as CPU usage. Without understanding the workload, data teams will miss issues such as a repeating calculation (to be made into an ETL flow) or an inconsistent calculation flow (like having different ways to compute the same business KPI).

    In environments where clusters are shared between different workloads, data teams often encounter additional challenges:

    Workloads Have a Business Context, Clusters Don’t

    From a cluster perspective, there is no inherent prioritization between queries, and data teams find it difficult to focus only on business-critical workloads. The outcome is often reverting to focusing on specific queries, which doesn’t offer an effective solution.

    Workloads Have Different Needs

    Take, for example, an ETL workload which may require a large amount of RAM, run hours and which must be finished by 7 am. An interactive data product workload may be composed of thousands of queries that each must return in under 2 seconds. Analyzing the cluster as one unit can lead to suboptimal behaviour of both workloads. While this example can be considered simple to detect, many workloads that seem similar can have widely divergent needs.

    As data lakes gain momentum as production-grade, big data analytics architecture, data teams need to shift attention from optimizing queries to measuring, analyzing and optimizing workloads. In the early days of big data, data warehouses were isolated data platforms tasked to deliver insights for a very specific set of business questions. But as the cloud rapidly evolved, the mere migration of data warehouses to the cloud is not enough. The next stage is moving production workloads to the data lake.

    Storage is so much cheaper, and organizations want to run queries on any dataset, whenever they need it. It’s this heterogeneous collection of many different queries that requires workload-level visibility to ensure each workload can truly meet performance and budget requirements.

  • TechStrong TV: How to Build and Refine Your DevOps Skills with OpsCompass

    TechStrong TV: How to Build and Refine Your DevOps Skills with OpsCompass

    The role of DevOps is constantly evolving as new technologies and trends keep emerging and reshaping the business. It is critical for DevOps engineers to continuously learn about the latest tools, best practices and technology, and be able to adapt to change.

    There are many ways for DevOps teams to refine their skills in order to become high performers. In this TechStrong TV interview, OpsCompass Co-Founder and CTO John Grange and Engineer Amy Wall join Mitch Ashley to discuss upskilling and how to build and maintain your software, development, cloud and technology skills in the fast-paced world of cloud. John provides a look into the future and where our skills need to move next, while Amy graciously shares her journey into software development and some valuable lessons learned along the way.

    OpsCompass is a leader in Cloud Security Posture Management (CSPM) offering an enterprise SaaS product that provides security and compliance management in cloud platforms.

    The video interview is immediately below, followed by the transcript of the conversation. Enjoy!

    Transcript

    Mitch Ashley: I have the pleasure of being joined by two really interesting folks. We’re gonna have a great conversation, I’m looking forward to this today—Amy Wall, who is an engineer with OpsCompass, and then John Grange, CTO with OpsCompass. Welcome to you both. Good to be chatting today.

    Amy Wall: Thanks. It’s great to be here.

    John Grange: Yeah, thanks for having us, Mitch.

    Ashley: Absolutely. You bet. Let’s do this—how about if we have you both introduce yourselves. Maybe, John, if you go first, introduce yourself—tell us a little bit about OpsCompass and what the company does, too, and then hand it over to Amy and you can tell a little bit of your background.

    Grange: Excellent. Again, I’m John Grange, I’m co-founder and CTO of OpsCompass. OpsCompass is a really powerful SaaS product that does security and compliance management in the cloud. And what that really means is, you know, we’re really helping DevOps teams, CloudOps teams get the visibility, have the intelligence and the control they need to run a successful cloud operation.

    You know, my background really plays a lot into what OpsCompass does and kind of the cloud security space. I’m a career entrepreneur. I’ve co-founded a number of companies, from top five global Microsoft ASP.NET hosting provider to a health and wellness SaaS product. So, I have a lot of experience, and our team has a lot of experience in kind of the infrastructure security compliance space. The cloud, obviously, was a big game changer, because a lot of the things that we used to deliver through a variety of different software products or hosted solutions inside data centers, we can now build software to easily do it in the cloud.

    Ashley: Mm-hmm.

    Grange: So, that’s kinda how I got into the business through kind of that hosting and infrastructure space, and now here we have OpsCompass, which is leading the charge with helping customers with their security posture, their compliance—all these different aspects of running or having a well-run cloud.

    Ashley: Sure is a fun and interesting space to be in and I think we’ll get into that, too. Amy, how about you? Just a little bit of introduction, and I think we’re gonna get into more of your story, too.

    Wall: Sure, yeah. I’m Amy Wall, I’m a DevOps engineer at OpsCompass. I have the pleasure of working with John Grange, working under John Grange, and kind of forming this exciting new product, OpsCompass. And so, I’m kind of—where I’m at in my career and on my cloud journey is really in a space where I’ve kind of come to it from a software engineering perspective. I’ve been a software engineer for years now, and you know, been going through the steps and kind of getting the skills under my tool belt, upskilling on the cloud path so that I can become a full DevOps engineer for OpsCompass. So, really been learning with OpsCompass and growing with OpsCompass as they sort of kind of figure out and carve out their space in the cloud infrastructure.

    Ashley: Mm-hmm. Isn’t that nice when you work with, you find a company that’s really compatible with what your goals are and what you wanna learn with where you are in your career? That’s awesome.

    Wall: Huge. Absolutely.

    Ashley: Well, that’s a little bit of what we’re gonna talk about, the upskilling is kind of a general, I guess, tag, label for it. We’re gonna explore a little bit, and you volunteered to share your story of how you got into software and how you’ve evolved into software in the cloud and DevOps, and then maybe take a look forward, you know? We’re here in December thinking about getting through the holidays and everything else going on and thinking about the new year. Maybe John can share with us some ideas on that, too, and we’ll explore some of those things about how do we prepare ourselves for the next things that are coming.

    So, let’s start with your story. I’ll let you tell it however you’d like, but you know, maybe how did you get into software?

    Wall: Sure, yeah. I always like to joke that if I told my 12-year-old or 14-year-old self that I was a software engineer or DevOps engineer, I would not believe it, at that age.

    Ashley: [Laughter] 

    Wall: But yeah, I really didn’t have a super traditional path. You know, I was a Humanities major in college. I left college and I became a content editor and then later a project manager in the marketing space. And I really enjoyed it, but kind of along the way, I got exposure to various technologies, I got a little exposure to programming, I got some exposure to IT, and over a few years, I realized that I just loved it, and that’s what I really wanted to do. And my favorite days at work were the days where I was able to kinda solve, you know, software problems or technology problems, whatever.

    So, I did, like, a total career 180 about five years ago and took a U-turn, learned how to code, and my first job after that was at OpsCompass or a subsidiary of OpsCompass that OpsCompass then later purchased. And so, I’ve been working in software ever since as a software engineer. And it wasn’t until OpsCompass a couple of years ago, I think two or three years ago, when I was able to join that amazing team of engineers where I started to really ramp up my cloud journey. You know, I had become pretty strong in the fundamentals of software engineering, and you know, I’d become really used to kind of the experience of learning on the job. You know, that’s kinda the nature of software engineering itself, and it’s the nature of DevOps, and it’s really the nature, I think, of cloud, because there’s new technologies coming out all the time and everybody’s kind of learning a way to navigate the space a little bit better all the time.

    And so, yeah, I just kind of figured out how to learn on the job and continued learning on the job, and now I’m surrounded by world class cloud engineers and John Grange, our CTO, who have excellent mastery in this space, and it’s been a blast to kind of learn together with them and figure out how this entire ecosystem works.

    Ashley: Wow, very complimentary of the company. Be careful, John, she may have an ask.

    Wall: [Laughter] 

    Grange: Yeah, I know. This is—this is great. No, but in all seriousness, you know, just from our perspective, even, having somebody who’s a rock star at this point, like Amy, it’s hard to find cloud expertise. And you have to be able to find people that are interested in growing, willing to grow, have that interest—like, it sparks that fire, so that then you can enable that and you can grow a lot of your own expertise, and it’s a really powerful thing, but I think it’s something that a lot of companies, particularly like us, have to do today to stay around.

    Ashley: Mm-hmm. You really do have to invest in people and give them the right, whatever ways that they learn, the right opportunities. You know, there’s also the person side of it, too. One of the best things I learned in college from a Computer Sci professor was, he said, “Everything you know now is gonna be obsolete in a year, so you need to keep learning. You have to have a thirst, just a hunt, a desire for learning just to keep—keep going.” 

    And it seems like that’s consistent with what your journey’s been, Amy. Maybe talk about what the evolution from some of the technologies you started developing software in to getting into cloud—what kind of things are you doing today?

    Wall: Sure, yeah. So, I started where I think a lot of new coders start is, I started on Ruby on Rails, and I used it for years, and I actually still use it a lot of the time. But yeah, I started there, and then I worked in the consulting space for a few years where I was able to kind of bring to life a lot of customers’ ideas, clients’ ideas, and I loved that, that was really exciting.

    And so, from there, I kind of have just begun dipping my toe a little bit in all the cloud has to offer. I still have a ton to learn. But our infrastructure has a number of different resources in various clouds. You know, I get to work with AWS, I get to work with Azure, I get to work with Google Cloud Platform. So, you know, any given day, I could be working on any one of those technologies. I could be spinning up Lambda, I could be debugging something in Typescript or JavaScript, whatever it is.

    But yeah, it was definitely a journey along the process, but we have a team, like I was kinda mentioning before, we have a team that we all, I think, feel that we’re in it together a little bit. And so, there’s a great energy where I think we kind of all learn together, even the master practitioners will continue to kind of get new certifications as they come out, will continue to offer advice, and will continue to learn.

    And so, I’ve never really felt like I was the baby in the room, so to speak, [Laughter] or that I was less skilled than anybody else, per se. I kinda just felt like—okay, we’re all making ourselves better, sharpening our skills, getting better all the time, so.

    Ashley: Especially, it can be an advantage in a technology area that’s relatively new, because everybody’s learning it, right? Nobody’s been doing it for 20 years or whatever makes you an expert.

    I’m curious, too, did you find mentoring, kind of learning from peers, things like that were helpful, since everybody’s learning at such an accelerated pace moving into the cloud, whether it’s on the UI side or on the software infrastructure side?

    Wall: Hugely, absolutely, yeah. Our lead architect, Nick Allmaker, is an excellent mentor for us. You know, his knowledge never ceases to amaze me, and he’s really, really helpful. He’ll always—he’s always willing to take some time out of his day to spend a couple extra minutes on a pull request or help you figure something out.

    But, you know, even earlier on in my software engineering education, I remember having a teacher who told me, “Always T.S., try it and see.” [Laughter] And I think I mentioned this in a blog recently, but that’s been hugely helpful to me as I’ve moved into this space, because you know, for me at least, in learning cloud and in understanding the ecosystem, tutorials online can really only take you so far. Sometimes, you just have to, you know, go in there and spin up a Lambda, you know, spin up an EC2, and figure out what’s going on, play with it, move it around a little bit.

    And so, I definitely—that’s a big insight that I’ve learned is that just get in there, try it. A lot of the clouds, I think all of them, in fact, have a free trial where they give you a little bit of free canister to play with at the beginning. I used that for all of them, absolutely, and you just, you know, spin up resources. 

    And I think in addition to that, having a third party like OpsCompass where you have kind of that visibility into every single resource that you have going on in every single cloud can be super helpful to someone. Obviously, helpful for experts and helpful for people who are in the cloud security posture management space, but also helpful for people like me who are learning and who don’t really understand or who are kind of putting the pieces together of what changes do what and what resources are like others, how similar is an Azure function to an AWS Lambda, and having that kind of visibility into all of your clouds and all of your resources can be hugely helpful.

    So, you know, I kind of had that advantage at OpsCompass where, you know, I’ve definitely had a leg up, for sure, in being able to kinda learn this stuff.

    Ashley: Mm-hmm. Opportunity is everything. Sometimes it’s self-created, and sometimes it’s the situational company, et cetera. I’m curious, John, what’s your perspective on, because you’ve, you know, you’re obviously probably in a little different place in your career, but as yourself and folks you’ve worked with, what are some of the mentoring and kinda helping others advance in their careers have you seen to be really successful—either for yourself or people you’ve worked with.

    Grange: Sure. Well, you know, there’s a couple things that come to mind, and one of them Amy just mentioned, being able to go and mess with something, being able to go out into the cloud and play with the resource and have kind of both the curiosity, the time, the capability to be able to go do that is a really powerful thing. And in the cloud, when all of these services are changing and being—you know, there’s a couple hundred different ones on AWS—there’s literally something new every day.

    Ashley: Mm-hmm.

    Grange: So, I think that that’s a big part of it. The other thing that I learned early on from mentors of mine that I also try and share with the team is that when there’s these big trends—you know, cloud is an example, but then also, you know, some of what you see with big data and AI, et cetera, there’s the sort of application top layer trend that’s all of the robust sort of user applications for those technologies. 

    But for those to actually come to fruition and for that trend to really be powerful, there’s gotta be all this plumbing underneath that isn’t as—it’s not as glamorous and not everybody thinks about it, but as those spaces burgeon, it’s not just the mobile app that’s using AI to really change kind of directions in navigation, it’s the whole industry of sort of the infrastructure beneath that needs to serve those sorts of trends and applications. And those end up being great places to go and learn about. And there’s tons and tons of opportunities, sort of, in the wake of those big trends and the leading kind of applications and companies.

    So, I always like to, even in our product, you see a little bit of that, but I even try and tell, you know, folks on our team that we need to be looking at things that way, as these trends are big. What kind of plumbing do the customers need? What are the dots that need to be connected? What’s the kinda unglamorous thing underneath that everybody’s gonna need that we can learn a lot about and solve the problems around?

    Ashley: I’m curious, Amy, have you seen that? Has that been consistent with your experience, too?

    Wall: Absolutely, yeah. I think—yeah, per what John was saying, I do really think that there is kind of an ecosystem to cloud and we’re trying to always stay on top of it, in front of it, you know, figure out what’s going on with it and view it from kind of like that 30,000 foot view, so we can really understand it as a whole picture.

    So, yeah, I think there’s a great knowledge share, for sure, and I think that’s hugely important to figure out where is this going, what is going to be happening in 5 years, in 10 years? Where do we need to start working now so that we’ll still be relevant, we’ll still be making sense at that time? And it’s not always easy to guess, but definitely, there’s a lot out there in the industry that you can kind of get a feel for that.

    Ashley: I think we’re in violent agreement. [Laughter] The best developers I’ve worked with really knew it from the operating system, the whole software stack, the network—you know, not an expert in every piece of it, but knew how it all fit together and how to make it all work and kinda hum and get to the performance that you need or make the right decisions on how you want to, the architecture you want to use and what parts you do and don’t want to use.

    You know, another thought—you may have mentioned this in your article, too, Amy, and I’ll put a link to the article in the description—open source is another fantastic resource. You talked about getting free time on cloud services and using sampling software—it’s a great place to watch how software’s built, in a little bit different way, in an open way, open community, but using that as well can be super fantastic. And by the way, everybody’s using open source in their products and their IT systems, their applications. And so, the more you know about it, the more you can leverage it, right?

    Wall: Absolutely, yeah. I love—I just, I love the idea of open source. You know, I think it’s—I love the ideology of it. I think it’s fantastic, and certainly, we do use it. And I think open source is the place where a lot of people kind of go to exchange ideas in the cloud space right now. You know, we have a lot of—Twitter, for example, Tech Cloud Twitter is always really exciting and people…yeah, I think people are making some really interesting things right now with open source, and it’s an exciting place to be.

    Ashley: So, let’s kinda turn the lens from, you were talking a little bit about your background, John sharing a little bit of his as well—turn the lens to kinda thinking forward, right? Things have changed. It’s a different world in the last nine months, for sure, and a lot of organizations have accelerated digital transformation projects. We’ve got data in my analyst firm to back this up very strongly. 

    The move to the cloud is accelerated, and you know, not stopping. It’s gonna continue to move even quicker. And I know you think about a lot where you’re going as a CTO with your company and your product and your technology, John. What thoughts do you have as you think over the next 6, 12, 24 months kinda into the where we’re going and how that might influence what people might learn or maybe how they learn?

    Grange: Mm-hmm. I actually—that’s a great question, and I’d actually go back to the comment I made before about some of the different trends. And, you know, just like we’ve had the DevOps trend over the last handful of years, there’s a whole number of kind of portmanteaus, right, the CloudOps and DataOps and AIOps.

    And I think that as some of these, you know, Fortune 1000, Fortune 2000s start to become more cloud mature, you’re gonna start to see more of the need for, okay, not just general DevOps where you really understand the cloud platform and orchestrating and automating workloads and things of that nature, but you understand the details of AIOps, for instance, which is a much different challenge, it has lots of other issues with data issues and labeling and things of that nature. Similar issues with sort of DataOps engineering—lots of new problems, really important business solutions to be built there for organizations that are already pivoting their organizations to prioritize these things, particularly after the pandemic. 

    DevOps is all about efficiency, and now what companies are saying is, “Hey, you know, coming out of the pandemic, we’re gonna prioritize our most innovative projects higher and we’ve got to push to be more efficient. We can’t have the cloud spending overages, we can’t have these big breaches that are costly reputationally and financially. We’ve gotta get more efficient.

    So, I think that those are the big things that, coming out of the pandemic, I’d be thinking about. If I were kind of a DevOps practitioner out in the field but also what I’m thinking about at OpsCompass is we’re, you know, looking out, we’re looking into how can we provide more value to our users for some of these really specific use cases that are driving very significant value for companies that are implementing them.

    Ashley: Mm-hmm. I’m curious, too, then, without getting into customer details, but as you’ve worked with your customers through the pandemic, through economic challenges, recovery, that kind of thing—what changes are you seeing in the market with the customers that you’re working with? Are they emphasizing different things, stepping back and taking new directions or trying to get better at just the core things? What’s happening?

    Grange: Yeah. You know what? It’s interesting. From my perspective, it’s very much almost no new phenomenon. It’s almost all just an acceleration of things that we were already seeing.

    Ashley: Mm-hmm.

    Grange: So, in other words, a lot of our kinda strategic plans that we thought were maybe a year out all of a sudden became, you know, “We need them, like, yesterday.” So, I think that a lot of those trends around remote work were already in place. I think a lot of—you know, many of the projects that we’re seeing companies, you know, prioritize, put a higher priority on, those projects already existed. Now, they’ve just become more important.

    Unfortunately, a lot of these IT teams and cloud teams shrunk during the pandemic. So, they now have the requirement that they’re more efficient and everything else, but they have, in many situations, fewer resources to work with.

    Ashley: Mm-hmm. Well, though that’s hard, it’s almost always that growth comes through investing again, so at some point, that starts to rebuild on that efficiency.

    Grange: It’s the story of IT, right? The story of IT—being understaffed and overly important.

    Ashley: Yeah, I don’t think I’ve met an IT team that said, “You know, we just have too many people. I’m not sure what we do with all these folks.” [Laughter] 

    Grange: Yeah.

    Ashley: You know, it’s interesting—I agree with you about, it’s very much accelerating. Another trend I would share—let me see if you concur with this—is, you know, you have the fortunate, if you wanna think of it that way, situation of being in a company where your software is your product, right? So, you can connect the dots between work that Amy’s doing or someone’s doing a test or someone’s doing customer service or architecture or what you’re doing in your role, John. You can connect that to the business and why you want to invest in AI and machine learning or whatever the next thing is.

    That can be really hard to do when you’re in a bank or an insurance company or something else where there’s a lot of distance between what I’m doing in my job—especially in a Fortune 1000 company or above. With that acceleration, though, and I think because of DevOps and AsteriskOps being adopted across different functions, a lot of that is about driving that connect the dots to why we’re going and where we’re going there, and how to accelerate, right? So, the efficiency can be for financial purposes, but recovery can also require agility, very fast response. You know, markets change, our supply chain is gone. We gotta rebuild that in a totally different way—so, guess what? Software is critical. It’s not just a back office thing. Thoughts?

    Grange: Hey, I think that’s exactly right. And, you know, using the financials as an example, you know, many of these financial companies were spending an extraordinary amount of money on reducing their risk, their technology risk, their physical security data centers, really expensive software to secure it all. And you’re exactly right, one of the accelerating trends is that efficiency. That’s not efficient at all. Capital One now has moved—they’ve shut down, now, all of their data centers around the world. They’re completely in the cloud.

    Ashley: Mm-hmm.

    Grange: That’s kind of an outlier example now, they’re like, the only one. But they’re all—I can tell you, just on experience with our own customer base, the mid-market is moving very quickly that way, too. Because they just realized that—hey, we don’t have to, we now don’t have to build data centers, we don’t have to have these huge capital budgets. We can be more efficient, we can be more operational. We can—to your point, the agility that’s required with how quickly this technology’s changing, you almost don’t have a hope unless you’re in the cloud. You know, you can stand up your own container stack in your data center and set up a rack and buy hardware and do all that, or you can go turn on, you know, Amazon’s Elastic Container Service and go with it. I mean, it’s just, it’s a whole different ballgame. And, yeah, I think that that’s a good example, Mitch.

    Ashley: Excellent. I’m curious, Amy, your perspective on it, too. Will you—in your role when, kinda, you think about your career and where you’re moving as well as the company, how is the current situation influencing how you’re thinking about what you do next, what you learn, and how you can maybe help others accelerate their learning?

    Wall: Hmm. Yeah, I agree with both of you, that I think the pandemic has had a real—there’s a renewed sense of urgency because of it. And so, I think a lot of us have had a moment to kind of take a step back and think a little bit from a broader perspective about what our company is, what our company is doing, what we are doing, where our careers are going—all those kinds of things. 

    And yeah, I think people are having an opportunity to figure out—like John was kind of saying, John mentioned the infrastructure for working remotely was largely in place before the pandemic, but that wasn’t always true, and that wasn’t true for every company. And so, I think there’s a lot of catching up that’s happening right now, and yeah, there’s definitely this added urgency behind all of it because of the state that the world is in right now.

    Ashley: Yeah, it’s interesting. I was running IT for a while at a prior job, and we were at this beginning of—stopped thinking about it as we were working remotely or working remote and think of it as work anywhere. 

    And it seems like that’s totally apropos now, that’s—you know, if you think about forward, it’s not like we’re all gonna show up back in the office after we vet the vaccine or whatever, even if things are in good shape, you know, public health wise, there’s a lot of things that, you know, we’ve been doing this for a year, two years or whatever the time’s gonna be. People are gonna build on it and leverage that, at least I think. I don’t know if you all agree, but I think this is the work anywhere that we’re in now.

    Grange: Well, CFOs got a little taste of really, really small travel and entertainment budgets, and I think that, as those start to come up, I don’t think that the tolerance levels will be quite where they were before the pandemic.

    Ashley: Yeah, we’ve proven, right, what we can do.

    Grange: Yeah.

    Ashley: Also interesting, you know, folks have talked about, we’ve made decisions a lot faster, too, in some cases. You know, we were debating—do we use Team or Slack or whatever, you know, for a year and suddenly in a week, two days, we decided it. Like, why can’t we do that all the time? Well, maybe not always you do that, but we’ve shown we can accelerate a lot of things.

    Grange: Well, I think that another thing that happened is, I think that American companies in particular, I can’t comment as much internationally, but American companies, I think, got very good in this, in the 21st Century at buying software—maybe even before that. 

    But I don’t think that companies are very good at actually adopting and using software, and I think one of the things that the pandemic did is, like, everybody bought teams and bought all this stuff from these, you know, the big tech companies, and nobody really fully adopted it, fully implemented it. It was always just kind of another thing on the shelf, and I think that that’s another thing that’s happening right now.

    Ashley: Mm-hmm. Getting greater adoption. 

    Grange: Lots of the collaboration technology, lots of the things that we all kinda use are now becoming highly mission critical business processes that we care about. So, we’re, like, fully adopting them.

    Ashley: Just the essential tools in the toolkit versus, “Yeah, I’ll use it if I have to talk to that team” or something, [Laughter] that group. As you’re thinking about the technology stack, Amy, you know, John was talking about adopting software. I remember a time in my career where folks felt like they had to write all of it, right? I mean, yeah, they used a database system, or—you like to build software, so build as much of it as you can.

    Today—yeah, you write software, but you want to, is there a better container management system than Kubernetes? Well, let me go check it out. You know, I don’t necessarily want to write my own. Maybe I do wanna do it as an open source, but you’re really a software integrator, software builder as part of the whole process, not just a software developer. Is that how you view things?

    Wall: Absolutely, yeah. Yeah, I’m a big proponent—totally, yeah. I always say, “If you can avoid it, don’t reinvent the wheel.” And everyone says that, but not everyone always takes that to heart.

    Ashley: Mm-hmm.

    Wall: And I think a lot of the times, especially when you’re in a software team, you’re in a development team and you’ve kind of got your head down and you’re really working hard on code, I think it’s really easy to kind of lose sight of the broader picture.

    And, you know, just last week for example, we had this problem we were trying to solve where some customers weren’t—you know, there was a miscommunication between our software and some customers. And, you know, I kind of just was able to take a step back and—

    Wall: – you know, customers weren’t, you know, there was miscommunication between our software and some customers, and you know, I kind of just was able to take a step back and say, “You know, if we just think about this and maybe document it, write about it, you know, find some documentation online, you know, find a good article, perhaps, that we could recommend, I think we could solve this problem without writing any code at all.” And we did. And I think those kinds of solutions are happening a lot, for sure.

    I mean, and you mentioned open source earlier as well, and I think that plays into it to a huge degree as well.

    Grange: That’s what I was about to say Amy, is that that goes right back to what you were saying, Mitch, with the open source. And I think that’s why open source sort of is kind of supreme right now. Go find a library, go find a package that already does this, go find a service that we can just integrate APIs with, you know—let’s not reinvent the wheel.

    Ashley: I remember being on some panels of, you know, “Should you use open source?” and my answer was, “I can guarantee you your competitors are.” Talk about a source of innovation that you can get for little or no cost—I mean, yeah, there’s a cost with it, but you better leverage it, you know, [Laughter] in the right way for your company as well.

    Let’s talk a little bit about OpsCompass. I’d love to hear, maybe, some of the future directions you’re heading. You’re not announcing anything here today, but what are the kind of things you’re thinking about since we’ve talked about this evolution of where the cloud and technology and skills need to go? What’s happening at OpsCompass as you evolve and change and play a leadership role in the industry?

    Grange: Sure. Well, for us, the way we like to think about the product and the product strategy is, what’s going on in the cloud space, what are customers doing, and then how can we provide kind of visibility and intelligence across those different dimensions?

    So, I talked a little bit about kind of some different AI products and services that we were starting to see companies use more containers. We obviously—that’s kind of a number one use case for our customers today. So, we’re fairly strong there, but we’re gonna get much, much stronger.

    But another big part of it for us is the DevOps pipeline. We provide visibility into what the pipelines are doing today, but it’s becoming so much more critical to the full cloud processing companies. They’re becoming more DevOps mature that we are going to, you know, kind of completely blow out that kind of set of functionality in our product over the next year. So, we’re excited about that. And you know, our customers are really looking—you know, you can parse through a lot of the technical explanations for problems, but what they’re really trying to do is get control, and the definition of control is a little bit different than it was in the data center. And there’s some more subtleties and things to it, it’s got a little bit more texture, I like to say.

    And so, it requires a different approach and when we can combine, you know, the deep visibility into what they have with the intelligence and context around, you know, what’s happening and the state of things, that’s kinda how you end up getting control. And there’s processes and people involved and everything else, but kind of everything we do—and we kind of, you know, eat, breathe, and sleep that kind of mantra, and we’re constantly poking and prodding at the clouds, working with the clouds. We work with all three at the corporate partnership level. So, we’re just really—we’re having a lot of fun, and it’s sort of the key problem of the age right now is just the different teams, all these different people, different resources, different services. It’s just sort of the impact of this sort of scale and kinda chaos a little bit. So, there’s just so many great problems to solve around making sense of it all.

    Ashley: Mm-hmm. Excellent. Amy, anything from your perspective you would like to add or talk about?

    Wall: Yeah, I think John is just spot on. And I also think, from an internal company perspective, you know, what’s happening within OpsCompass is being mirrored by companies across the globe right now, which is that we are really kind of getting a feel for how to operate as a totally distributed team, like you were mentioning earlier. We have employees now all across the United States and internationally. We also work with customers and _____ abroad.

    So, we have this—I think we’re kind of learning along with our customers how to kind of interact with a more global ecosystem than we had before and how to kind of bring all of these, all of the water cooler conversations or all of the idea sessions or brainstorming sessions and whatever onto Slack, onto Teams online so that we can all engage.

    So, that’s definitely a change that I’m seeing internally and that I’m not, I don’t see going away when the pandemic is over, and I see it becoming something that goes on to the future.

    Ashley: Yeah, that’s very wise. I think it’s very sticky kinds of behavior changes and work patterns that will be with us for a long time to come.

    Well, I’ve really enjoyed, this has been a fun conversation talking with you both and it’s just—it’s so much fun to share real experiences that we’re having in our jobs and our careers and also doing it in a way that hopefully this conversation can benefit some other folks, you know, along the way who may have similar or maybe different experiences that they might pick up from what we’ve talked about.

    So, before we wrap up, to check out things at OpsCompass, John—OpsCompass.com, is that correct?

    Grange: Yep, you can go to OpsCompass.com, check out more about us. We have a free trial, really encourage people to go jump in, check out the product. Again, it’s built by a bunch of DevOps engineer cloud nerds for our sort of brethren, if you will. So, love getting feedback and let us know if there’s any, if there’s anything that we can help you with.

    Ashley: Built by DevOps people, for DevOps people, right? [Laughter] 

    Wall: Exactly.

    Ashley: Exactly. Well, Amy Wall, it’s been fantastic talking with you. Thanks for sharing your story and your insights. 

    Wall: My pleasure.

    Ashley: And John Grange—similarly, your insights as well as kinda where we’re headed and a fun conversation with you. Both the best, have a great holiday, and we’ll see you into the new year.

    Wall: Thanks a lot, Mitch.

    Grange: Thank you, Mitch. Be safe.

    Ashley: You, too.

  • Operations Model: DevOps, NoOps, AIOps or None of the Above Ops?

    Operations Model: DevOps, NoOps, AIOps or None of the Above Ops?

    Within an organization, an operations model must be fit-for-purpose and be able to adapt as business needs change. At the same time, changing technology necessitates an advancement in how an organization operates. Small and medium-sized enterprises are faced with the difficult choice of how much to invest in operations and which approach to choose. In light of the numerous possibilities, companies need to identify the right upgrades for their needs. For instance, should a company now using a traditional operations model invest significantly to reach DevOps? Or would AIOps better fit customers’ needs? Is NoOps an option?

    There is no “correct” answer. Each option comes with pros and cons and important budget considerations. That is why every business needs to evaluate the appropriate system for its products and its customers with three concepts in mind: cost, goals and experimentation.

    Operations Models

    Traditional IT operations (ITOps) is the process of designing, developing, deploying and maintaining the infrastructure and software components of a specific product or application. It also ensures the customer experience is delivered through traditional means of support such as tickets and escalated paths for resolutions.

    DevOps is a process for accelerating the delivery of features to the application or product infrastructure in a consistent model with less human intervention, while also providing a better quality product through automation in the software development life cycle.

    An AIOps process introduces data science into the operating model by learning the behavior of the systems, scaling according to the needs of a platform (both infrastructure and customer usage of the platform). It expands the horizon of DevOps through the introduction of machine learning, focusing on data generated from the hardware and software systems, and allows organizations to grow organically based on demand.

    NoOps, although the name suggests otherwise, is an advanced approach to managing IT operations through the mindset that everything is derived as development. This model is best applied with startups and companies with high technological maturity.

    Typically, these companies have advanced skill levels to deliver the best experience by adapting to the new industry trends of both software and hardware maintenance practices. NoOps is at the opposite end of the spectrum from traditional operations, and it’s largely a theoretical concept at this point.

    NoOps is a fully automated, cloud-based approach that eliminates the operations team, aside from an integrated team focused on life cycle. The self-managed system requires resiliency and a high level of maturity with fail points that have already been addressed. NoOps, or high maturity structures, will also provide quick learning on drawbacks, customer and product needs. However, moving toward a self-maintained system requires upkeep for advances and innovation.

    Invest in an Operations Model to Reach Higher Levels of Maturity

    The first factor to consider in evaluating an operational approach is cost. Each level of IT maturation is gradual, incremental and expensive. Costs vary depending on the size of the company and the type and number of products. A small company that seeks to move from a level 2 to 4 maturity would need to make a significant financial investment.

    Some questions to consider when looking at operations model upgrades include:

    • Does this make sense for the business?
    • Will the investment allow for scaling?
    • Will it increase customer loyalty and trust in the brand?

    Next, it’s important to consider overarching goals and brand identity. The appropriate level of maturity might depend on the company’s value proposition. If, in the company’s vision, technology is at the heart of its journey, the company needs to invest, at a minimum, in a DevOps operating model to have the competitive edge to grow the business and meet its needs. If the company’s vision is to retain existing business and gain customers through continued investment in innovation based on the trend analysis of their core business, then AIOps will have the best ROI. If the company’s vision, culture and mission are intertwined with technology, adapting to NoOps is the right move.

    Know the Product, Customer and When to Halt

    Still, it’s important not to overreach with an operations model that might not fit the customer. To make a sound decision for the organization, it is important to understand the model, the product, customer base and when to halt an operational model and invest in a new one. The leadership team needs to ask how adaptable its end users are before implementing changes. Take, for instance, the poor consumer response to replacing live customer service representatives with automated features. Some end users were not prepared to adapt to the massive change in the platform or service offerings this move entailed.

    Product-driven businesses often don’t see investing in new operations models as worthwhile. This mindset can result in continual churn that creates a backlog and increased operating costs for maintaining systems and services. Another important consideration in deciding which operating model meets the company’s needs comes through experimentation. That is because finding the right operating model for an enterprise can’t be done with a cookie-cutter approach. The point is to maintain the existing quality and productivity while investing in outcomes that will garner more trust and confidence in the company. If you do this right, the end user will appreciate the changes, and the company will outperform the competition.

    Allow for Operations Failure

    Enterprises should expect failures during experimentation with different models and plan to pressure-test an advancing model for the cracks that will emerge. It is important to invest in failure to understand why and how the model did not perform to expectations. Those failures provide valuable insight and important data, result in significant learning about products and customers and help you know what to improve or modify going forward.

    An operations model serves as the backbone for any business that wants to grow. Smart operations investments will ensure adaptability, competitive advantage and customer loyalty. But there’s no one-size-fits-all, easy-to-follow recipe for each enterprise. Whether the investment results in AIOps, NoOps, DevOps or traditional operations is unique to each organization and needs to be calculated with the brand, customer and end goal in mind.

  • Plutora’s Bob Davis: Work From Home and Value Stream Management

    Plutora’s Bob Davis: Work From Home and Value Stream Management

    American writer Orison Swett Marden said, “Success is not measured by what you accomplish but by the opposition you have encountered and the courage with which you have maintained the struggle against overwhelming odds.” After the year that’s passed, with operations and development teams forced to scatter and work remotely, it’s a sentiment DevOps teams are currently all too familiar with.

    This demand to keep DevOps teams productive under the extraordinary circumstance of 2020 has placed an increased emphasis on effective management, including on value stream management tools, so leaders and team members can have greater visibility into delivery pipelines.

    To get a sense of the state of the value stream management market, I reached out to Bob Davis, chief marketing officer at value stream management platform provider Plutora. Below is an edited version of our conversation.

    George Hulme: Thanks for taking the time today, Bob. Could you tell us a little about Plutora?

    Bob Davis: We are a value stream management platform provider. When I first arrived here, we recognized that sales, marketing, financial and human resources teams all have their systems of record. They have Salesforce, ERP (enterprise resource management) systems, and various financial and HR platforms that enable people to practice their profession more easily. IT didn’t have anything like that at the time.

    We set out to provide that capability for the software development side of IT. Today, the market is caught up. Everybody is moving into value stream management as a platform to provide that visibility across an entire toolchain, from the idea to production. That’s where we play. We’ve been in this space since it began over two years ago. The market is just exploding with the work-from-home trend, and how the pandemic kicked digital transformation into high gear.

    Hulme: It appears that a significant percentage of the work-from-home trend is here to stay. I’m seeing surveys showing about 19% of people previously suspected that they’d be working from home in a year. That figure jumped now to near 50%.

    Davis: If you start to parse what work from home means, you’ll find it means many different things to different organizations. Some have a hybrid model with people working from home two to three days a week. I recently read a Gartner survey that said 74% of organizations were going to have some element of work from home. It’s not all or nothing.

    Some companies have decided that they are not going back to work until well into this year. All of these companies have to make sure they have governance compliance in place for this new workforce, and that they can successfully manage the complexities of software development. These challenges are at least an order of magnitude, if not more so, more difficult than typical office workers working from home.

    Hulme: Is one of the reasons behind those challenges struggling to maintain being on the same page across the organization?

    Davis: That’s a great point, George, because when we go out with our teams at many organizations, a lot of the effort helps people fast-track their processes. We are asked, “What is the best practice for automating builds? How often should I be automating builds? What KPIs do I establish to make sure that people are striving to accomplish what we need them to accomplish?”

    For example, one of the things that Lean and Agile methodologies promote are smaller work items, quicker check-ins, faster processes. They encourage cutting work down into smaller bundles to be done more quickly so that teams can iterate much more rapidly. We’ve seen that managers will often create a KPI for a performance management program to measure how often code gets checked.

    That’s horrible because now I can just check in code all the time. Yet, are people making actual progress? Are they actually delivering software, or are they just checking in small iterations of code all day?

    Organizations have to be very careful with how they manage people. They have to be cautious with what metrics they set up to keep their eye on delivering value and delivering software more quickly. This is something organizations struggle with. They want to know where to start and what metrics they need to implement. And how to make those metrics visible so people can see and understand them. That’s what provides the ability for product owners, managers, executives and other stakeholders to view the progress and status of what’s going on without disrupting people with calls and endless meetings.

    Hulme: That has to be tremendously more challenging with the work-from-home trend than years prior.

    Davis: I recently heard a great quote: “As people end up working from home, the need for human contact and human interaction, socialization, is peaking.” People are hungry for that. At the same time, the need for managers to not be in the face of the employees has never been higher. That is, the motivation and the productive nature of employees is proportional to how well they feel trusted. And it’s proportional to how well they understand where they’re headed and understand how to do their job and are left alone to do that job.

    It’s a leap of faith to leave people alone and simply trust them. You need systems that provide you the ability to collaborate; watch the progress. You need systems that will help you understand where people might be struggling, all without having to dig in and micromanage your people. Indeed, as we are learning, managers can effectively do this with Zoom, or Slack, or some other tool that provides good communication flow within a work-from-home environment. But in software, the handoffs and dependencies are so complicated that those tools are simply not enough. You need a collaboration tool that provides effective management in software development.

    Hulme: Do you believe remote development teams can communicate as collaboratively as they did in person, with modern software collaboration tools?

    Davis: Yes, I think they can. Especially when office collaboration tools, such as Zoom and Slack, and software collaboration tools work together. We can leverage Slack to communicate tasks. So we not only layer on top of the individual tools people have and integrate with them, the practitioners working within those tools can make it available to all of those stakeholders involved in that process. And when there are tasks or handoffs, the system can be configured to notify them how they prefer to work: email, Slack, instant messenger, task list on the dashboard. There’s a lot of different ways, depending on how people want to work.

    Not only that, but it can automatically alert people to what is happening and what’s needed. Fascinatingly, one of the interesting yet deceptively tricky questions to get an answer to is, “Where’s the status of a feature?” If a team is in the process of building something out, and they have a specific feature, such as check cashing in a banking app, it should be a pretty straightforward question to get answered.

    Yet, about seven or eight different teams are working on various aspects of that application. For instance, there’s a product owner who, without the right collaboration system, has to go and essentially track all of those teams down and find out where their status is.

    With a software collaboration system, you can make that query without bugging anybody. In some respects, you can collaborate more efficiently and more productively than you can when you’re all sitting in the same room. That’s because before, we would have walked over and interrupted somebody. Now you’re just looking at a dashboard, or you’ve gotten an alert on Slack, and you see what you need. Boom.

    Hulme: How important do you think it is to have useful data and that value stream knowing where things stand to keeping the system flowing and individuals knowing where they fit on deliverables?

    Davis: I think the ambiguity, unexplained delays and unforced errors are among the things that upset human beings the most. Just ask somebody that’s standing in a line that’s not moving, and it hasn’t moved in a while; how restless the crowd gets. The nature of software development is such that there are tremendous numbers of handoffs, no matter how you do your development.  It doesn’t, whether it’s an old fashioned waterfall or the most advanced development and deployment models in operations at places like Spotify — you have a lot of handoffs. And if you can’t see what you’re doing because you don’t have visibility into those parts, then you’re going to run into an incredibly frustrated team. And you are going to see a lot of finger-pointing when the question comes up, “Why didn’t this release go out?” And then there’ll be five or six different groups pointing to different reasons. You get a lot of anger, a lot of discontent.  And it’s something you have to avoid if you are going to succeed.

  • Ambassador Insights: Enterprise Digital Transformation

    Ambassador Insights: Enterprise Digital Transformation

    Digital transformation has been on the minds of many organizations for a few years now, but since the onset of the COVID-19 pandemic last year the need to transform IT infrastructures has taken on a sense of urgency. The rush to work from home coupled with the shift to online everything has pushed organizations to adopt the tools and technologies necessary to enable IT agility for all users.

    In this inaugural episode of Ambassador Insights, featuring DevOps Institute ambassadors Sean Davis, information security advisor, DevSecOps, at TransUnion; Jennifer Fischer, executive director of the Center of Innovation and Professional Studies at Felician University; and Pankaj Gupta, senior director of Product Marketing, Cloud ADC, and SD-WAN at Citrix, we take a look at some of of the factors driving digital transformation, the need for security in digital transformation initiatives and how organizations can get started on their transformation journeys now, if they haven’t already.

    The video is below, followed by a transcript of our conversation. Enjoy!

    Transcript

    Charlene O’Hanlon:  Hey, everybody, this is Charlene O’Hanlon, Chief Content Officer at MediaOps, and I am just thrilled to pieces to be introducing a brand new segment that we have on TechStrong TV which we’ll also be running on the DevOps.com website. It is a panel discussion that I’ll be having monthly with DevOps Institute ambassadors—you see three of them right here on the screen with me. As I said, it’s the first in what I hope will be a series of monthly panel discussions with these ambassadors and other ambassadors on the future topics that we have on DevOps.com.

    The first inaugural discussion will be on Enterprise Digital Transformation, and the featured topic will be changing every single month, so this week it’s Enterprise Digital Transformation, next month it will be on Cloud Native.

    So, I’m looking forward to all these discussions, but I wanna go ahead and kick off this first one with our speakers today. First up, we have Sean Davis, who is Information Security Advisor, DevSecOps, at TransUnion. Hi, Sean, thanks so much for joining me today.

    Sean Davis: Thanks for having me, Charlene.

    O’Hanlon: Next up, we have Jennifer Fischer, who is Executive Director of the Center of Innovation and Professional Studies at Felician University. Jennifer, thank you so much for joining me today. Good to see you.

    Jennifer Fischer: Thank you, Charlene. Pleasure to be here.

    O’Hanlon: Alright, and last but certainly not least, we have Pankaj Gupta, who is the Senior Director of Product Marketing, Cloud ADC, and SD-WAN at Citrix. Pankaj, thank you so much—as always, great to see you.

    Pankaj Gupta: Thank you, Charlene. Glad to be here.

    O’Hanlon: Okay, great. Well, as I said before, the topic of this panel discussion is on Enterprise Digital transformation, which I know is a huge topic to swallow. There are so many things that we can say about Enterprise Digital Transformation, but it’s certainly a topic that has been on a number of organizations’ minds, especially since the onset of the pandemic and the rush to basically align their business practices with digital transformation efforts to be more productive and to stay relevant in today’s fast-paced business environment.

    But as I said before, a lot of things have changed since the onset of COVID, and I want to kinda maybe set the stage a little bit by asking you guys—where do you think digital transformation and these initiatives have kinda progressed since the onset of COVID-19 and that rush to remote work that so many organizations have had to kinda go through? Whoever wants to start?

    Gupta: I can take the first crack, Charlene. This is an excellent question. The impact of COVID is twofold. First of all, it’s realization by IT and business for the need of the digital transformation. So, that’s first, is the faster realization of the need for digital transformation.

     And the second thing is about execution speed of digital transformation has increased tremendously due to COVID in the last one year or so. IT and business are more in lockstep than ever before. IT is more aligned now with the business outcomes. In the last 12 to 18 months, we have seen four phases of it. The first was, it started just with business continuity. How do I get my business moving in this new COVID environment? Then focused more into employee productivity, because as they started working more from remote.

    And then, more people started working remote, workers started working from remote, then security became very paramount, that, “How do I secure all of them?” And I think the next phase which is coming is that digital transformation will be more about hybrid workforce; some of the employees coming back to the office. So, that’s the fourth phase which I see for that.

    And in this environment, talking to customers, I have seen CIOs, the number one priority is to keep employees engaged, remain productive from anywhere, from any device they are working. They want reliable connectivity for every employee whether they are working from home. They also want us to ensure that same application experience, whether they are there in the office or now working from home.

    But what is also keeping them awake is that now these workforces working from home and home networks are not as secure as the corporate infrastructure. So, when employees access these applications or direct Internet access, their endpoints or home network doesn’t become an entry point for vulnerabilities into the infrastructure.

    O’Hanlon: Right, right, right.

    Fischer: Yeah, I fully agree, and I echo the need for a focus on security and a remote workforce. I think that really will become the foundation for digital transformation going forward. And I think it’s really interesting to look at the longer term impacts, transformational impacts on some key industries. So, when we think about things like telehealth and online learning and consumer facing applications like in retail and grocery and food delivery and those types of things, you know, you really have to plan for this hybrid environment as we’ve discussed going on for an extended time.

    And, you know, whether some of it will ever truly sort of come back, right? I think, to some degree, you know, some of the convenience and the productivity and the benefits that have been realized through this will be here to stay for the longer term.

    Davis: Absolutely. I’m thinking about—the pandemic has been a really great pressure test of a lot of these concepts that we’ve heard for years across the industry, remote work being one of them. You know, everyone says, “Oh, we get better productivity because there’s remote work.” But what this seems to have done is, it’s really allowed the business to pressure test how well they can pivot. What does that mean for their customers? Because now customer needs are different, what they’re looking for that’s a priority to them is a little bit different. Internal needs of the organization are different. Now, you know, you’re shifting focus from just delivering those products to ensuring they’re highly secure, right?

    So, a lot of these things we’ve been preaching in the industry for a very long time, especially around DevOps and DevSecOps, are really starting to take a front seat in organizations. One of the brilliant things that I’ve seen because of the pandemic over the last year is, even organizations who don’t have formal transformation initiatives and efforts in place are forced to still go through some type of transformation with their organization to maintain competitiveness or even survive. Because now it’s not just about thriving in the environment, it’s about understanding how to pivot to even survive. We’ve seen a lot of retail industries go bankrupt, we’ve seen a huge shift in real estate, right—so, how businesses decide, even with their hybrid strategies, how they’re gonna renegotiate contracts with all of this office space that’s sitting idle right now, and does it make more sense for them to shift there?

    So, there’s a lot of operational considerations that are being made by organizations as well as some unique opportunities and unique challenges are starting to be presented. I think HR is starting to take a front seat a lot more in initiatives. You look at employee wellness—it’s more important than it’s ever been, and it’s giving the opportunity for these guys to stand at the front lines and finally be cheerleaders or their organizations in a way maybe they haven’t had an opportunity to have a spotlight shined on.

    Because a lot of us think HR sits in the background, and now, a lot of their programs are really pivotal and the cornerstone of how businesses are going to move forward and look at employee care, satisfaction. You know, onboarding is a lot different. You know, it’s pretty reveletional to see just a lot of these things we’ve been talking about in the industry, even before DevOps, that people have played around with and said, “These are better concepts or better ways of business,” but now we’re actually pressure testing them through a real world tragedy and pandemic and seeing how that plays out and what that looks like for each and every organization.

    O’Hanlon: Yeah. You know, it’s interesting, because we’ve been talking about digital transformation for years now, and there was a lot of talk, but not a lot of action. And I think it was because a lot of organizations really just couldn’t wrap their brains around it. You know, they didn’t have, like, a reason to do it beyond, you know, providing customer satisfaction or keeping up with their competitors.

    But, you know, having this pandemic occur kinda gave them a reason to really go and say, “Alright, this is what we need to do to (a) keep our employees productive, (b) provide that top quality customer experience, and just kinda keep the wheels on the bus.” And, you know, before, it was more like—okay, well, we’ll see these, we’ll measure by certain metrics and maybe we’ll see an increase, maybe we won’t. Is that enough for us to do digital transformation?

    But I also think that it’s important for—and Sean, you alluded to this—digital transformation impacts so many different areas of the business, it’s not just about improving customer experience. It’s not just about making employees more productive. It’s about keeping them same, you know, [Laughter] with the HR apps and things like that and employee wellness. It’s amazing how, by having that laser focus on digital transformation, once there was a reason to do it, a real, legitimate reason to do it, companies that have undergone the digital transformation and are still undergoing them have really started to thrive and they’ve been able to pivot their business successfully. And that, to me, I think is—you know, it’s a success story. If you really take a seat at, you know, take a look at what’s been done so far and just the fact that so many organizations have been successful so far in their efforts.

    And I didn’t want to take that off the rails, but I wonder how much of that is, when we’re talking about DevOps, where does that fit into a lot of these kinda success stories, if you will, with the organizations? I mean, is it a central core of digital transformation efforts, or is it more of a tool, if you will, within a larger process? Whoever wants to answer that one.

    Davis: I’ll hop in first this time, if you like.

    O’Hanlon: Yeah, sure.

    Davis: So, with DevOps, I think there’s a unique opportunity that a lot of organizations are taking. At the core of most digital transformations, at least I’ve been part of and been privy to from peers in the industry, they’re very centered around technology. You’ll hear the term “every business is a software company” being thrown around. Now, while that may not always ring true for everyone, I believe the spirit of what they’re trying to say is, there’s a better way for us to use technology to enable a better customer experience, a more valuable outcome or our customers, and through leveraging that technology, we’re able to see better returns and give back to the community in a lot of different ways beyond just our products.

    DevOps, I think where the real value comes is, there’s been this evolution over the last year or two where people are starting to realize that a value chain, or the supply chain of an organization and the value that’s being delivered doesn’t end when the product is in our customers’ hands, but it’s when value has been delivered to our customers’ customers, right? So, we go to that Nth degree to make sure that not only are we just selling something and saying, “Hey, have a great day” because we got it in your hands as fast as possible, but we’re able to use feedback loops and telemetry to actually say, “How successful is this for your customers? You know, what type of experience are your customers having? How can we work with you and partner to have a deeper relationship than just a buyer and seller?” Right? So, we’re starting to see a lot of that proliferate the industry.

    The pandemic’s also provided us a really great opportunity to take a step back, because everyone is slowing down, everyone’s having to adjust and pivot and say, “How do we overhaul all the systems?” Right? Instead of looking at this, you know, where, “Let’s improve this silo” or, “Let’s improve this area of the business,” we’re able to start bridging a lot of those areas instead of just saying, “Well, you know, let’s throw the hammer down and start busting these silos”—

    O’Hanlon: Right.

    Davis: – “let’s start bridging a lot of these areas and understanding where the challenges are.” It allows us as leaders of our organizations to dig much deeper to understand broader problems with the organization, and we can see that, once again, going back to how that’s being pressure tested, right.

    We all know, as building continuity plans, that looks really great on paper, but if it’s not put into practice every year, and what better way, unfortunately, to practice that than actually experiencing a real outage, a real security breach, a real pandemic do we put those things through the paces to say, “Is the theory and the practice that we put on paper actually practical and applicable to what we’ll do in real life?” and then suss out where those problems or challenges are with the execution of that plan to be able to reinforce that plan and strengthen it so we can deliver better value, both internally to our organization and externally to our customer and market.

    Gupta: I think before the pandemic, for many of the organizations, digital transformation was an initiative. It was a goal, it was a project.

    O’Hanlon: Mm-hmm.

    Gupta: But during the pandemic, digital transformation has become a necessity.

    O’Hanlon: Yes.

    Gupta:  And when a project becomes a necessity, that means that what you’re really looking for is the agility and speed and ability to respond faster, almost in real time. And this is not just about IT, this is about wall to wall, end to end processes. And IT is that connecting tissue of the overall digital transformation, and the foundation of that is the DevOps. Because DevOps brings automation, brings ability to respond faster. And the technology trends which have happened in the last five years, like the emergence of the cloud, ability to auto scale in cloud, ability to automate things from the cloud, more and more people are working remote. Ability to deploy automation tools which are delivered from cloud, because IT is not going back to the office.

    So, DevOps has become a very critical component to achieve that speed. Every company’s starting point is different. For cloud native companies, they already have a lot of implementation of their IT into the cloud already—if not, more and more companies have started moving. And that is actually creating new opportunities for the DevOps engineers overall. It is their skill set which is tremendously needed in this marketplace, and it will continue to grow. And that’s where the places like DevOps Institute help to build that skill set for IT teams across the world.

    Fischer: Yeah, absolutely. And I would add that, from the point of view of transformational outcomes, you know, one of the key things there is making sure that cultural change has been institutionalized. And so, you know, from the standpoint of DevOps, and sort of coming back full circle to your question, Charlene, around, you know, is it a core or is it something broader—it’s both, right? Because, of course, it’s underlying the technology and the ability to achieve success is there, right, within the pipeline.

    But beyond that, you know, there’s relevance as well, even in business functions, if we’re talking about the opportunity to identify new revenue streams or looking at the overall impact of building a continuous learning culture and the ability to accelerate change—these are things that translate to every area of the business. So, from my perspective, you know, DevOps really has that overall end to end impact to be able to deliver against. And I totally agree with my co-panelists that the pandemic has been that driving force to be able to surface that and really, you know, sort of shine a light on the value that it can add in a time of crisis. But from a long-term perspective, the value certainly continues to be there.

    Innovation as well has a significant role to pay here, too, right? So, just in terms of being able to innovate faster, to be able to look at that pivot point as was described earlier that, you know, that’s a huge learning curve. I mean, there’s some pain that went along with that, you know, having to do it through the pandemic, but there’s also some long-term gains in being able to understand resiliency and responsiveness in that time of crisis.

    O’Hanlon: Yeah, it’s really, it’s been amazing for me to see how quickly organizations have been able to undergo these digital transformation efforts and really understand what their business needs. It’s almost like they—you know, they just kinda launched, if you will. It’s just like, from zero to 60 in, like, nothing.

    Fischer: Exactly.

    Gupta: Mm-hmm, yeah.

    O’Hanlon: But, that said, are we too late for organizations that haven’t started their digital transformation processes yet? I mean, those that may be a little slow to start, they recognize the value, they just haven’t been able to kinda get their stuff together yet to do it, but you know, is it too late for them? And if not—I hope not, I hope not—but if it’s not, what are some of the things that maybe they need to keep in mind as they start to think about undergoing a digital transformation process? You know, what are maybe some of the best practices that they need to consider?

    Jennifer, I’m gonna let you start with this one because, you know, this is your turn, so. [Laughter]

    Fischer: Sure, sure. And I think, you know, interestingly, I think the same principles hold true, right, in terms of best practices for digital transformation, whether we’re talking about, you know, in terms of the pandemic or not, right?

    O’Hanlon: Mm-hmm.

    Fischer: The key thing, the most important thing is that introspection and insights, right? So, really understanding and being honest about and knowing your business, right, understanding what those end to end processes are, knowing and understanding your marketplace, knowing and understanding your customers so that, to Sean’s point, when you do wanna deliver to that Nth degree, you’ve got the insights there as part of your end state, right, that you wanna achieve.

    So, I think all of those things hold true in either case, and then bringing them together into a well-defined strategy that reflects—honestly reflects, right, the strengths and weaknesses of your own organization. And then, last but not least, I think something that often gets not as much attention as it needs to, having metrics in place, right, so that you’ve got that continuous learning ability over time and being able to come back and not only say, you know, “Did we achieve what we set out to?” but on an ongoing basis, where do we need to continually pivot and shift our efforts to make sure that we stay.

    And, of course, as goals change—I mean, we talked a little bit before about what happens when this is done, right? So, be it a hybrid workforce or some of the other trends that we might expect to see in 2021 with DevOps and, more broadly in business and in the economy, how do we help ourselves and our business partners to be able to continually pivot in that very agile way? And, you know, so to me, it’s about those three things, right? Having the right insights, the right strategy and tactics to find, and then third, the right metrics in place to keep you on point.

    O’Hanlon: Alright. Sean or Pankaj, do you guys have any best practices you want to share?

    Davis: Sure. So, I want to answer your earlier question—no, it’s not too late.

    O’Hanlon: Okay. [Laughter]

    Davis: There is no such thing as too late. Please, if there’s any business out there, you have not gone through a digital transformation now, it is never too late.

    O’Hanlon: Good.

    Davis: Now, the second part of that I will caveat with, because I think it just needs to be said. A lot of the practitioners feel this way, but it’s not often announced, and I don’t believe it’s always heard enough—transformation is not about just carrying you from one state to the other. I really wish that the industry as a whole would start to adopt digital evolution. Because that’s really the truth of what we’re doing. We should be evolving every single day. We’re adapting to the pandemic, and then we will adapt to the next event that occurs within our industry—good or bad.

    We’re constantly adapting to the needs of our employees. We’re adapting to these new technologies and frameworks and ways of doing business every single day. That’s an evolutionary step that will never change. The transformation is just the spark, the catalyst, if you will, for that evolution to begin and to be recognized and, you know, as Jennifer had mentioned earlier, institutionalized in the organization, right? And that’s your culture, that’s your people, that’s your technology, whether it’s DevOps, whether it’s agile—whatever it is, right? There’s never, it’s never too late to start.

    From the perspective of best practices, I know I’m gonna sound like a broken record to all those that have probably seen millions of videos on the culture of transformation, but start with your culture. And I don’t just mean implementing programs that are making onboarding easier or customer satisfaction—employee satisfaction. But I mean, really start by taking stock of where your organization is right now. You don’t have to be light years ahead, you don’t have to be like Netflix, you don’t have to be like Amazon or Microsoft. You are your own unique entity. You will be the next whatever company, right, that somebody is going to want to model the great things that you do.

    I always think back to the TPS system, Toyota Production System, right? Toyota was massively successful in being one of the best manufacturers in the entire world despite giving the secret away to the rest of the world and all these other manufacturers adopted it, but they still were not able to achieve the same level of performance as Toyota, because it was built by Toyota, for Toyota. This was the way they did business, they felt this worked best for them.

    And I think that’s a sorely missed or overlooked area in a lot of transformations is—there’s so many frameworks, there’s so many ways of doing it, there’s so many quote-unquote best practices that are out there. Take a look at where your organization is. Take a look at where your people are and think about where you want to be. And then find things that align to that, that help you be successful, and eventually, you’ll start noticing you’re creating your own processes—you’re creating your own frameworks, you’re creating your own ways forward, and then share those with the world, right? Because it’s not just enough to consume something, see that it works, and move on, but take the lessons that you’ve learned and the things that you’re creating and share that out in the world. Maybe someone else is able to use that and perpetuate their business in a positive direction.

    O’Hanlon: Alright.

    Gupta: I think Sean and Jennifer covered many, many great points, and there are so many great practices. We are in 2020, so if you sum all the numericals in 2020, it comes to the fore, and I’m going to cover the 40 best practices.

    First, I think Sean and Jennifer did a wonderful job explaining that embrace the cultural shift. It is a new way of thinking, it’s a new way of doing. But to succeed in this cultural shift, IT skill set is the most important part. You must shift the culture, all ________ aligned, but if you don’t have a skill set inside that organization, you will not succeed. So, as you are embracing this cultural shift, invest in the IT skill set. That’s the first.

    The second one is design and build for speed. Because the automation and the speed to respond to the market differentiates the winners versus losers.

    So, the philosophy should be to automate everything you can, and that’s where the DevOps comes into the play. Look for every possibility which you can automate. And automation requires the DevOps skill set, but it also looks at your applications in a different way. What I can modernize so I can reuse those functions—that’s what the microservices kind of application brings into that.

    DevOps is also about modernization and connecting them together, so they work like a machine, one after another, one feeding another. So, that’s that whole part.

    Also, start thinking, as we move into 2020 or 2021—how do I build a self-correcting infrastructure? And cloud is already giving you auto scale, resiliency—all those pieces into that. We don’t have to go into detail, but when you’re building and designing for the speed, see what are things that can achieve that.

    Third thing, which is going to be more and more critical, is the security first, security first, security first.

    O’Hanlon: Yes.

    Gupta: The recent SolarWinds example taught us so much. A small component on a broader enterprise, a small crack or vulnerability can impact the whole ecosystem.

    And in this world of application and API, where API has become the lifeline of the businesses and more and more digital transformation related business, are you protected your applications in API? As we move into the world of the multi-cloud, do I have a consistent security posture across multi-cloud? So, those are some of the things, that security first rather than the bolt-on.

    O’Hanlon: Mm-hmm.

    Gupta: And the last is that build for visibility. What I mean by invest into your observability stack, build into tools and mechanisms to give you a visibility inside what is happening in your infrastructure, what is happening in your application. Because if you don’t see, you can’t fix it.

    To summarize—embrace the digital shift, embrace the cultural shift, but make sure you have the right skill set to do that, design and build for speed, security first (no more bolt-on security) and visibility, visibility, visibility. Because if you can’t see, you can’t fix it.

    O’Hanlon: Excellent. Excellent. Well, all are great points, all are great best practices, and I want to thank all of you, all three of you for your expertise today during our discussion. Great stuff.

    If organizations have not begun their digital transformation efforts, now is the time. I think every organization understands the importance of digital transformation now more than ever, and it’s great to hear that it’s not too late—thanks, Sean. And it’s security, as Pankaj and Jennifer both mentioned—super, super important, and it should be an integral part of digital transformation efforts.

    We have lots of information about digital transformation and what’s happening in the space in general and some—you know, again, some of the best practices on DevOps.com. So, I do urge everybody to check out the website and read up what we’ve got on digital transformation.

    Guys, before we close things out, any parting words, any parting advice on digital transformation or DevOps in general?

    I guess not, alright. [Laughter]

    Gupta: This is the time—this is the time that will create the stories which you will tell to your grandkids.

    O’Hanlon: True. Absolutely.

    Davis: Yeah, I think focusing on doing what’s right for your organization and doing what’s right for your customers, take care of your people, take care of your customers, don’t just do what’s easy. Because there can be so much change that’s going on that it’s very easy to say, “Okay, well, we can revisit this,” right, and generate a lot of cultural debt that never gets paid back off.

    Fischer: Yeah, I was thinking similarly, you know, there’s—in some way, too, you know, the reality of the pandemic conditions has been a level of exhaustion, I think, as well. And even despite that, it’s important not to keep focusing ahead and making sure that things that might be beneficial, particularly, coming up on the radar, trends for ’21 that could be taken advantage of—you know, don’t lose the momentum. Even though it’s been an exhausting past number of months, keep the momentum going and take advantage of the exciting trends that are on the way for 2021.

    Davis: Absolutely.

    O’Hanlon: Excellent. Alright. Well, on that note, I do want to thank all three of you, Sean, Jennifer, and Pankaj. Thank you so much for your time today, thank you so much for your expertise, and love to have you guys back on a future panel discussion or even on TechStrong TV. So, thank you, again, I appreciate it, and thank you, all, for watching and we’ll see you next time.

    Gupta: Thank you.

    Davis: Thanks, Charlene.

    Fischer: Thank you.

  • Approaching Security as a Fundamental Element of Software Development

    Approaching Security as a Fundamental Element of Software Development

    How we really integrate security into the SDLC? What are some of the best practices around secure software?

    In this episode of TechStrong TV, Jill Britton, director of compliance, and Stuart Foster, product manager at Perforce, joined us to discuss how to improve application security by making security a fundamental component of the software creation process.

    The video is immediately below, followed by the transcript of the conversation. Enjoy!

    Transcript

    Mitch Ashley: I have the pleasure of being joined buy a couple of folks that I’ve talked with before on a webinar and a few other videos. Jill Britton and Stuart Foster from Perforce. Welcome to you both.

    Stuart Foster: Thanks for having us, Mitch. 

    Jill Britton: Thanks.

    Ashley: Let’s start off with some introductions. Since you’re ahead in the time zone here, Jill, how about you go first?

    Britton: Okay, thanks. I’m Jill Britton. I’m the director of compliance for static analysis tools here at Perforce. I look after areas regarding coding standards, functional safety standards, security standards, anything in that area.

    Ashley: Excellent. Stuart, you want to introduce yourself? Tell us about Perforce, too. 

    Foster: Sure, yeah. I’m Stuart Foster. I’m a product manager for our static analysis products, both Klocwork and Helix QAC. And a little bit about Perforce, we help with enterprise development and DevOps at scale. We have a lot of various tools that help accelerate development projects in terms of your planning. So we have project and portfolio management tools, requirements management tools. We have things that help in the create area of the DevOps infinity circle for issue management version, asset management, code review. We have static analysis. We have various functional test case management and things like that that also fit in the verify. And we have a lot of tools that are here to drive your product at a high quality to market. 

    Ashley: Excellent. Excellent. Well, very timely conversation at least here in the U.S. with security of software, in this case distribution with the SolarWinds situation. We’re not going to be talking about that, but strongly the topic of secure applications is right in there, right at the top of the list. Let’s first start, I know we’re going to get into some coding standards and some things like that to equip people with some things that they can use. Maybe we first start with DevOps is more than just – and shift-left is more than just, okay, let’s start having meetings or talk on Slack with the security people and then suddenly we’ve shifted left. You know, there’s a lot more to how we really integrate security into the process of creating software. Maybe, Stuart, if you want to start sharing some of your thoughts about that and of course, Jill, get your perspective as well. 

    Foster: Sure, yeah. I mean you think about DevOps, you think about agile development and it’s the ownership of code; but outside of simply delivering functional requirements for your products, your applications, you know, a lot of teams are just thinking about security. So there’s a necessary to build that in directly. And what that leads you in to is selecting tools, selecting processes to ensure that you’re kind of baking in the security into your pipelines and making it automatic. That starts with thinking about coding standards and things like that. So there’s plenty of secure coding standards that you can focus down on. I think Jill has a couple of words for that.

    Ashley: I’m sure you do. Go ahead, Jill.

    Britton: Oh, I have many, many words on that. The important thing is that you pick the standard that you are going to be comfortable with, that you are going to be able to apply. If you’re supplying a product to a supplier, you will probably be told which ones to use. But you’ve got I think that cert – oh, where, it’s from Carnegie Mellon University. They’ve been looking at security for many years now and it builds up and it also takes experience from both academia, tools, developers, actually anybody who wishes to contribute and then of course it is looked at all the contributions. So this good security standard because it is there.

    But connected to that you’ve got the Common Weakness Enumeration so administered MITRE, and that is actually just a collection of vulnerabilities that have been seen and proved in the field. So you’ve got this whole wealth of experience and you want to avoid doing what the problems other people have seen. That’s where these kind of standards come in. CWE I would argue isn’t a coding standard. It’s more a measure. You know, have I seen this problem? Have I got this problem? And there’s another related set of numbers, let’s put it that, which is common vulnerabilities and that’s even further down the line. Before you even get to see weaknesses, there are vulnerabilities and you just have to use this information in your own developments. Don’t do what somebody else has already done is kind of the way to look at it in security in particularly. 

    Ashley: It isn’t like we don’t know how to create secure software. We do but we kind of do the same thing over and over, the same mistakes, right? 

    Britton: That’s right. 

    Ashley: Sometimes just out of not knowing and sometimes just human error. Sorry, Stuart, you were going to jump in there too. 

    Foster: I was going to say, so effectively one of those, CWE is effectively describing issues that are not necessarily related directly to a language; and the other ones are specific rules that you follow to ensure that you don’t run in to these types of vulnerabilities or weaknesses, right?

    Britton: That’s right. That’s it.

    Ashley: Yeah, there are specific things that are in Java, PHP, you know specific languages that are very well used, very popular of course. Go ahead, Jill.

    Britton: No, the thing is when you look at the CWEs, they are categorized to languages or to systems or just to general sort of areas; but there are then what they call the lists. So you’ve got a list for C and a list for C++ and there’s a list for Java. Then you also have a top 25. Now a top 25 may or may not apply to your own product, but it’s always worth having a look. If those ones don’t apply, there’s another sort of secondary list. It’s emerging, and you could look there. There’s always something to check against for any sort of software.

    Ashley: Are most of the things on that list you find have been there for a while? SQL injection, buffer overflows, things like that? Or do they tend to be newer things? Are we seeing the same things over or would we find a lot of new things?

    Britton: It’s a variety. You do see the same ones over and over again. There are some weaknesses that were on the 2011 list and are still in the 2020, but there are new vulnerabilities as new types of development come in and you get more skilled hackers really. You’ve always got to consider that the hacker is always one step ahead.

    Foster: And you kind of see that these standards or these top 25 lists, they change after every couple of years and they spend their time kind of reviewing the vulnerabilities that have been found in opensource projects and other places and kind of give them a weighting. So while you may see the top 25 have a pretty similar overlap between multiple years, their rankings change. So it kind of shows to you that in general software is becoming more secure but not as secure in these new areas. So you see some vulnerabilities lower and the new ones come up at a higher rate. I think it also depends on where software development is currently is in terms of market. What’s the new hotness? Is it Internet of Things connected to software? Is there a new language coming out that has never been attacked? So you see the priorities change on these top 25 lists.

    Ashley: Let’s step back for a moment. How would a development team or developer – I assume most folks are probably familiar with at least CBEs or some things like that, but maybe they haven’t dived into the top 25 for CWEs. What’s the best way to do that? Is it just go out and read about them, educate yourself? Do people, do development teams like, okay, I’m gonna dive into this and research a little bit more and I’ll share with you or how do people apply this to their teams?

    Britton: Well, there’s several ways they apply it. Sometimes they just hear about it, something like we’re doing talking today; and they go, oh, is this going to be relevant to me. And look, it’s a few things. As I said, sometimes a supplier specifies the angles to have proof that you’ve checked against this. And of course the static analysis tool, we can map checkers and messages against these vulnerabilities and these weaknesses so that we can show your code is exhibiting these features. But it’s really important to know what you’re going to be looking for and then do something about it as the static analysis tools can show you, yes, you’ve got this vulnerability but really it’s not off point just leaving there. You must do something about it.

    Ashley: You know, it’s interesting. So many, not everyone of course, so many of the vulnerabilities are about input, right, to a user interface of some type, web, OS command, mobile device. It’s a lot about neutralizing, dealing with the input that you’ve received, making sure that they’re not injecting something that they shouldn’t, getting access to a directory, all kinds of things like that. So it’s things that apply across multiple technology stacks and multiple applications. So generally speaking it’s not like this is a skill you’re going to use on one app and then you have to relearn it for the next app. You carry that stuff with you. It’s part of your skillset you build as a software engineer. 

    Britton: Yeah, it’s education, isn’t it? You know, it’s just everybody gets more and more experience of this type of issue. It’s not that long ago that security wasn’t at the heart, but now it is.

    Foster: And if you think about it, you know there’s kind of different levels of maturity in terms of security, right? You start developing because you know you have some types of vulnerabilities and you start working towards that. But if you think more longer term about your projects and how they might be very important IP or pieces of software that are embedded over time, it becomes more important to think about security because, you know, being able to fix some issues that you know about versus following a secure coding standard to ensure that the reliability, the strength and hardening of your software to begin with means that years down the line when somebody has integrated your piece of software into some type of embedded system that can never be touched, then you’re lowering the risk of there being vulnerabilities permanently out in the market for a very, very long time. So that becomes kind of the second level maturity when you’re developing and thinking about developing more secure software.

    Ashley: Now you mentioned, I forgot which one of you mentioned something about you might encounter something under a contract with the customer that requires specific security standards. One example I know that you all deal with quite a bit is ISO 26262 for automotive industry. Here you’re dealing with safety of course as well as security. Talk a little bit about how something – do the industry-specific standards really kind of go off the reservation to do something really different or are they building on what we do generally in software and then applying it to their specific domain?

    Britton: We could take ISO 26262 which is for vehicles. It’s very much good practice. It’s nothing totally off the scale. They recommend for software the use of a coding standard. You are allowed to use any coding standard you like, but then there are specific categories of software violations that you need to be able to detect so whatever you do. MISRA is sort of the classic for 26262 because it was developed for vehicles. But you have other industries with very, very similar requirements from software and now we’re moving into the scale of security. Back to vehicles again, it’s ISO 21434 which isn’t out yet; but that also requires the use of a coding standard and the violations they’re looking for are still very, very similar. It’s the same type of things. Quality software is what we’re always looking for.

    Foster: Because as I kind of mentioned a minute ago, you think about a car, that’s a big rolling embedded system that’s more or less permanent once it’s complete and it’s really hard to fix later. So you can understand how security as an oops, we’ll go back and fix it versus security as a process becomes more important. That’s exactly why ISO 21434 is becoming a thing or will becomes a thing once it’s releases. But we already have customers in industries looking at it and following along and understanding what that impact is going to be because to connect the cars was a big rolling computer.

    Ashley: You know, this is a little bit kind of parallel to just creating software but not too long ago I went through a web trust audit and very much like a standard like you’re describing it is do you have a process, do you have something that you follow, should follow, and do you follow it and do you have evidence of that. So many of the standards are just the technical details of what you should do to write pure code. It’s do you have the processes around that and are you following those and in some cases you do an audit. Necessary if you want a WebTrust, for example, certification or others. So it’s not just writing secure code, it’s if you say you’re going to do it, then you have to do it and demonstrate that you’re doing it and have some form. So what I’m saying is it’s really an investment that you’re making by writing secure code following some of these standards, but then that’s going to help you down the road meet other requirements. 

    Foster: Yeah, it makes it easier when you’re trying to implement say ISO 27001 which is information management security management requirement compliance thing. And there’s controls in there and what you’re talking about per the audit is putting in controls for your business and there are various areas in those controls that in many ways relate to the software that’s developed within the company. So yeah, by following some of these security standards you’re in essence helping with those controls later when/if you go and certify your company as that type of ISO requirement.

    Ashley: You know, Jill, I know you deal a lot with governance and some compliance and things like that. What are some of the best practices around secure software? We’ve touched on quite a few already but are there some other thoughts on other best practices to help people move up that maturity scale?

    Britton: Well, it’s a very basic part of any process really. Choose your metrics. How are you going to actually measure and see how you are progressing through your process? And similarly to software weaknesses, when you get your metrics, what are you going to do with them? There’s no point in collecting a whole collection of them and saying, yep, we’ve got our metrics. What does it mean? Does it mean that we have got 27 security violations last week? Oh, great, we’ve got a number. But what are we going to do about those 27 or so security violations? Again, it’s back to process. What is your process? What is an acceptable level of these metrics? And you can have metrics working all the way through the cycle right from requirements to development and test. You can actually have measures of how you are progressing through your cycle.

    Foster: And also what you find when you look at a lot of these security standards and their vulnerabilities, they have kind of the impact likelihood, cost to remediate, potential issue or risks that you see in the market when one goes out. So alongside that, a lot of the standards as well have kind of a risk scale or a prioritization that helps you – gives you an idea of where to start. And then in terms of the process, it’s not always a matter of running a tool or trying to follow these standards and trying to fix all the bugs. It’s important to start somewhere. What we typically call it is baselining where you kind of know your current quality of your software as it is right now, and the point is to start following a security standard and stopping new vulnerabilities from being introduced, and then you can go back and start working on the prioritization of what to fix to start cleaning up. Right?

    And also when you look at it and it seems insurmountable, you might want to spend some time looking at your past kind of customer weaknesses that were found or bugs that were found and kind of understanding in addition to what the standard is important, looking at what types of vulnerabilities you’ve produced or have reported back and focus there. That’s a good start, you know? You know kind of what your developers’ training weaknesses are and then you can implement kind of teaching, learning, training processes as well to help getting your development team more comfortable, more experienced in dealing with these types of issues. 

    Ashley: Sometimes also building on what you said, it can help bring to light other issues along the process like, for example, we keep getting libraries introduced into code that we don’t realize are there and they show up as a security vulnerability. Okay, well, let’s go fix that part of the process too so we know that those things are there and when updates happen they go through some defined process. Another one might be it’s not just new things we find but also repeats, things we consistently find, occasionally over and over whatever frequency. Okay, if we’re fixing them but how do we stop introducing them? What are good ways to help that? It might be education tools, et cetera. Lots of ways to do that. So to both of your point, to your point too, Jill, don’t ask questions you’re not going to do something about the answer, right? 

    Britton: That’s right. That’s exactly right.

    Ashley: So you have to take action on it and of course that’s ultimately why you’re doing it. You’re not just going through the motions to meet some paper standard because that will catch up with you very quick if you do something like that. 

    Britton: _____. It will. You’re absolutely right.

    Foster: Just buying yourself technical debt and risk.

    Ashley: Yeah, exactly. And it will catch up with you. How do you introduce this to some people words like process, standards, compliance, audits, anything with an ISO in front of it? Those kinds of things just sort of kick up the you’re cramping my style here, right? You’re putting a damper on my ability to be creative and write code. I’m bring a little bit hyperbolic, but not everybody reacts to those things favorably. How do you position this with organization so that it’s not just a dreaded thing we have to do, there’s actually really business value to it and it’s good for you and your career?

    Britton: Well, the whole thing with following a process is the developers can be involved in this process and then go through their careers excel help develop this process. But the process shouldn’t be stifling. It should never stifle the creativity. The whole idea of the process is tell me what you do and how do you prove that’s what you do? Okay, that’s fine. Now maybe how can we tweak it and do a little better? It’s the pro thing of continuous improvement that comes up in all the audits.

    We’re actually ISO 9001 certified. So we’re all going through this on a regular basis. You know, but we’re not trying to stifle our developers. They will say, “Well, okay, we have this process. It’s not quite working for us. Can we make some modifications?” We go, yeah, looks fine. We talk to the necessary people and usually it’s absolutely fine. So we involve the developers all the way through and they will then follow it because it’s their own process. 

    Foster: Yeah, I think the goal is the least amount of friction and introducing it over time. And as Jill said, there’s continuous improvement, right? It’s a long-term goal. It’s not something that’s done once and you get over the big hump of pain and it’s a ton of crunch work. It’s just something that you do over time. You look at agile development, right? People do standups. There’s processes, you know. There’s a level of documentation and planning that isn’t overly annoying. You know, the goal of DevOps is to automate a lot of those finicky processes so that they’re fast, they’re repeatable, they give time back, right? They report information back as quickly as possible so that they can be resolved quickly, right? That’s just lowering the friction, the pain of going back and fixing a feature or some sort of development commit, right? And then you’re just layering on another check layer of security, right? And it should be painless. It should be easy.

    As you mature over time, then the quality is going to get better and that goes back to the metrics that Jill was mentioning, not just having a number but seeing that number go down. And then having your teams be able to see that kind of dashboard or information as a feedback mechanism to say, you know, you can visually see the qualities improving. You know, customer reports of issues from the field are going down because our quality is going up. Why? Not just because of security but because of all the automation and the unit tests and checks that you have written and you’ve made the effort to produce better quality code and it’s going to pay dividends. 

    Ashley: I like the idea of tying it a continuous improvement process whether you label that as quality or other things because you can apply that to your DevOps process, to your tool chain, to the quality of your code, safety, security, making compliance easier for you, just improving your overall how you write software, maybe workflows and things like that. So you can make some of these compliance activities or standards activities really part of just maturing your organization and getting better at what you do, working on the organization as well as in it.

    Question for you, how do things like the privacy laws, you know, GDPR, CCPA for California, do those fall into this realm as well? Do they impact the developers as we’re talking about the use of customers’ information and of course we’re handling that in the applications? Is that something developers need to be that familiar with or is that more of the marketing department that are sending e-mails to people?

    Britton: It’s not greatly down with the developers, but it really depends on the type of data that they’re handling. Looking at the tools that Stuart and I work with, we’re not getting/bringing in external tools because it’s a static analyst tool. So we’re not looking at that. But when you get to things in the field, the developers have to be aware if they are going to be handling personal information and they then do have to have GDPR and that has to be included into any process – how are we going to handle this.

    Foster: Yeah, and there are coding rules that, you know, try to help with these types of things. You know not having hard coded secure passwords, not using magic numbers, various levels of encryption that should be written, or warnings that you’re using an outdated type of like encryption in your software, the ability to handle unvalidated inputs and outputs. Things like that are going to help cover some of the requirements for GDPR. So you need to kind of understand how your system is interacting with other systems and securing your APIs and all things like that. So it’s not just your piece of software at that point. Your developers need to be aware as to how your software is going to be used and implemented and how it’s going to communicate with other pieces of software or systems. 

    Britton: That brings us back to the weaknesses we were discussing earlier because there are weaknesses that actually cover that type of data.

    Ashley: Exactly.

    Britton: What are you doing with it.

    Ashley: Vulnerabilities in our software could lead to the loss of data. That could be a violation of those privacy laws of course, as well as other impacts, whatever it was. Well good. This has been a lot of fun. I’ve really enjoyed talking with you about this aspect of creating secure software. We’ve mentioned static code analysis and tools a little bit. I know this isn’t a commercial about Perforce, but would one of you just kind of position for us where in the process of what we talked about today where Perforce really plays in kind of your specialty in this area?

    Foster: Yeah, sure. So in terms of our product which our static analysis products, both Klocwork and Helix QAC, we fit in many different areas of kind of a development pipeline and process. We exist to make sure vulnerabilities are found while the developer is currently typing their code on their desktop. We also fit in for gated checks and quality checks in your SI/CD pipelines so we can quickly report back issues and also your typical if you’re running a nightly on a server or if you’re deploying checks and building your software in the cloud and provision instances and any sort of thing like that. We’re basically available anywhere. So we help you shift left as far as you want. We provide those security checks anywhere just for the ability to drive what I would call continuous compliance. 

    Ashley: Excellent. Great. Well, Stuart, Jill, it’s been a lot of fun talking with you and hope everyone – wish you the best in your journey on creating even more secure software. We’ll speak with you again soon. Take care. 

    Foster: Awesome. Thanks, Mitch. 

    Britton: Thanks.

  • Moving Legacy Applications to the Cloud

    Moving Legacy Applications to the Cloud

    Even in 2021, many companies still run business-critical, legacy applications on-premises, just as they have for the last 20 to 30 years.  The midrange server hardware, and their unique architecture, on which many of these applications run is both their biggest drawback and biggest advantage; the benefits of being able to vertically scale a platform were measured against the drawbacks of the necessary custom hardware. Migrating the workloads running on these types of systems to the cloud, which can potentially offer huge benefits, presents some unique challenges – here are four strategies for doing this, with pros and cons for each.

    Option 1: Lift and Shift

    The “lift and shift” option means you’re simply representing the on-premises network within a cloud service provider. This is the easiest and quickest option.

    Until recently, this was not an option for most legacy applications. This was because the main hyperscale clouds did not offer dedicated infrastructure as-a-service (IaaS) implementations for several common data center operating systems. The process required purchasing a vast amount of dedicated hardware to offer as-a-service to customers, and it wasn’t clear if the demand warranted that cash outlay.

    Recently, however, it’s clear that the only way for organizations can leave behind the data center is by moving business-critical applications to the cloud. There are now hyperscale cloud providers that offer lift and shift options for even the most demanding workloads.

    Despite these benefits, it’s important that a lift and shift approach is carefully planned before executing. Even a couple of seconds of downtime in traditional application workloads can cost businesses thousands of dollars. Finally, organizations should understand that they won’t be using the cloud to its full potential simply by recreating their on-premises environment.

     Option 2: Rewriting or Refactoring

    Refactoring a traditional application into a cloud native application has been the de facto migration option for many years. It provides greater long-term cost savings than other options, because previously underprovisioned data center resources can now be consumed on-demand in the native FaaS offerings of hyperscale cloud providers. The compute capacity is nearly limitless, and only scales as resources are being used.

    However, refactoring to cloud native services does have major risks, such as high short-term costs. Refactoring an existing business-critical application is typically much more complex than a simple lift and shift. Also, an application that has been part of the core business stack will have likely accrued many dependencies and interfaces with other systems and added modules that must be accounted for.

    Another consideration is that legacy interfaces must appear identical to other systems post-migration, otherwise you must expand the scope — including other systems in the migration project that originally weren’t planned. Many of the hyperscale cloud providers do not support legacy interfaces in their cloud native services. Scope creep can become a real issue in this scenario, and your organization could lose sight of the migration timeline.

    An enterprise service bus (ESB) is one potential solution to the problem of legacy interfaces. An ESB is typically deployed as a “bus” between various business applications, ensuring that all those interfaces use a common interface. The ESB handles the network, transport, routing and delivery of messages and content. However, ESBs add yet another layer of complexity, increasing the risk of failure for the overall refactoring project.

    Option 3: Dynamic Lift and Shift (Reshape)

    Reshaping an application to the cloud typically lies somewhere between the lift and shift and the refactoring strategies. It’s similar to lift and shift, but usually involves some minor modification to the application to take advantage of native tools within the cloud infrastructure. An example is adding automated launch and tear down of development and test environments.

    One of the main advantages of a reshaping is that it is cost-effective. An organization will see significant cost savings over a simple lift and shift, for example, by only having to pay for the hours that the development and testing machines are powered up and running.

    It also means that the development teams are free to experiment with refactoring certain applications without a hard deadline (such as a data center exit.) Finally, a dynamic lift and shift strategy allows development teams to leverage cloud native functionality, such as infrastructure as code, to automate traditional workloads without retraining on a whole new development stack.

    Option 4: Drop and Replace with COTS

    Another option is to replace your custom application for one that is commercial off the shelf (COTS). For example, replacing a custom-built customer relationship management (CRM) system with a vendor’s product.

    This is not feasible for some organizations because of their business environment constraints, but it is recommended when possible. COTS products (that are typically SaaS) usually have a repository for various connectors to different legacy applications; however, this is largely dependent on the size and maturity of the COTS product.

    It’s important to note that one of the largest risks of considering a COTS application is the skills within the organization. If the current development team’s skillset lies with custom, traditional applications, they will need extra time to retrain and develop the extensions to integrate the COTS product with their existing environment.

    Migrating any application to the cloud is a large undertaking. There will always be risks when moving existing on-premises applications to the cloud, but in general, the overall positive impact of moving legacy applications far outweigh any risks, regardless of the approach you decide to take.

  • Meet the Winners of the 2020 DevOps Dozen² Awards

    Meet the Winners of the 2020 DevOps Dozen² Awards

    This is the moment you have all been waiting for. It is time to announce the honorees for the 2020 DevOps Dozen² Awards, and we couldn’t be more excited to share the names of the most outstanding leaders and tools in the DevOps community. Although, I must say, all the finalists have done an amazing job at making the DevOps community better through their mentorship, service and innovative ideas, and every single one is deserving of special recognition.

    The DevOps Dozen Awards recognize the best of the best in the maturing DevOps space and this year’s winners have demonstrated exceptional leadership and support to the community through 2020 and the COVID-19 pandemic. Last year was a tough year for all of us for sure, but it was also a year of agility, innovation and rapid digital transformation. The 2020 honorees have displayed resilience, determination, commitment and willingness to embrace change in a year of unprecedented challenges to drive their business—and the industry—forward. Congratulations to each and every one of the honorees.

    Winners have been chosen from among the finalists with general public voting being weighted for 40% of the final total and our judges selections for 60% of the weighted total. Our team has gone through thousands of votes to pick out the winners in each category—it was not an easy task. Many thanks to our panel of judges for making the hard calls and to everyone who voted and nominated candidates.

    Ladies and gentlemen, I am proud to present to you the 2020 DevOps Dozen² Awards honorees:

    DevOps Dozen Community Awards

    Best DevOps Industry Implementation

    Lloyds Banking Group, the largest financial services organization in the UK, is the winner of the Best DevOps Industry Implementation award. Lloyds Banking Group has invested heavily in driving the adoption of Agile development and DevOps practices across its business to strategically modernize its digital service capabilities and align with customer expectations.

     

    Best DevOps Survey/Analysis/Research

    The Best DevOps Survey/Analysis/Research award goes to Puppet’s 2020 State of DevOps Report. The report focuses on two areas that can help organizations scale their DevOps initiative: a platform approach to software delivery and applying DevOps principles to change management. It is the ninth year in a row that Puppet produces a State of DevOps Report. It is the longest-running and most widely referenced DevOps research in the industry.

    Best DevOps Related Video Series (Video)

    The Best DevOps Related Video Series is DevOps Unbound, a bi-weekly video series that focuses on DevOps, automation, CI/CD and testing. Top industry leaders join the series to explore the challenges and issues that software delivery and IT teams face on a daily basis.

     

    Best DevOps Related Podcast Series (Audio Only)

    The Modern Mainframe: Building a Better Software Delivery Platform is the Best DevOps Related Podcast Series. The Modern Mainframe is a podcast by Compuware that explores mainframe modernization and how to transform mainframe culture, processes and tools with DevOps to help your business compete in a digital age. Building a Better Software Delivery Platform is episode 9 of the podcast, featuring Compuware DevOps Architect Rick Slade.

    Best DevOps Books / eBook of the Year

    Standing On Shoulders: A Leader’s Guide to Digital Transformation by Jack Maher and Carmen DeArdo is the Best DevOps Books / eBook of the Year. This must-read provides leaders with practical, actionable information about the breadth of Agile, Lean and DevOps topics that are generally dealt with individually; and explains how each of these are necessary but alone are not sufficient to avoid market disruption of your business. The authors focus on how to build an employee and customer-obsessed culture with an organizational structure that drives speed and efficiency, while leveraging technology to enable speed to value that is faster, safer, better and cheaper.

    Top DevOps Evangelist

    The Top DevOps Evangelist award goes to Helen Beal, chief ambassador at DevOps Institute. Helen is a well-known DevOps evangelist leading the DevOps Institute Ambassador program’s efforts to provide broad-based thought leadership and localization. She is an analyst at Accelerated Strategies Group and an editor at InfoQ. Recently, Helen has been working with a group of ambassadors to develop a new, online DevOps Capability Assessment (DOCA), launching in 2021. Taking on strategic advisor roles with Plutora and Moogsoft has given her the opportunity to dive deep into value stream thinking and observability. She is the host of Day-to-Day DevOps, a BrightTalk series that focuses on topics ranging from neuroscience, to ChatOps, to AIOps and everything DevOps related.

    Best DevOps Transformation (Non-Vendor)

    The winner of the Best DevOps Transformation award is Fidelity Investments, a financial services company that supports financial institutions with innovative investment and technology solutions to grow their businesses. Fidelity’s embrace of cloud-based platforms has yielded tangible improvements, such as better operational resiliency.


    Best DevOps Virtual Event of the Year

    The DevOps Dozen award for the Best DevOps Virtual Event of the Year goes to DevOps World 2020. The virtual event, featuring more than 100 business and technical breakout sessions, focused on how DevOps is transforming the world of software delivery and how businesses are adapting their ways of thinking during the COVID-19 pandemic. Top industry leaders discussed where DevOps is headed and how the audience can best leverage advanced practices to succeed in the future.

    Most Innovative DevOps Open Source Project

    Grafana Loki was chosen as the Most Innovative DevOps Open Source Project. Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus.

     

     

    DevOps Executive of the Year

    The DevOps Executive of the Year is GitLab CEO and Co-Founder Sid Sijbrandij. Sid’s career path has been anything but traditional. He saw the first Ruby code in 2007 and loved it so much

    that he taught himself how to program. It was during his time as a Ruby programmer that he first encountered GitLab, and quickly discovered his passion for open source.

    In 2012, he helped commercialize GitLab, and by 2015, he led the company through Y-Combinator’s Winter 2015 batch. Under his leadership, the company has experienced 50x growth in the last five years, expanded from nine to more than 1,300 remote team members across 65+ countries and regions and is now valued at $2.75 billion. A champion of the open source community and a pioneer in scaling remote organizations, Sid is altering conventional wisdom on DevOps practice.

    Best DevOps Presentation of the Year

    On Ramp to Open DevOps for Mainframe by George DeCandio, chief technology officer of the Mainframe Software Division at Broadcom, is the winner of the Best DevOps Presentation of the Year award. In this keynote presentation, George DeCandio explained what you need to adopt an open strategy and how you can integrate with existing DevOps tools such as Git and Jenkins, or into existing cross-platform CI/CD pipelines. George discussed how Zowe, OMP’s first project devoted to the mainframe, is opening mainframe system commands, data sets and source libraries so you can integrate with tools that know nothing about mainframe.

    Best DevOps.com Article of the Year

    How to Reduce Engineer Burnout During COVID-19 by Henry Jewkes, staff software engineer at Split, is the Best DevOps.com Article of the Year. Henry explains how to cope with burnout effectively as it becomes increasingly common during the COVID-19 pandemic.

     

    DevOps Dozen Tools and Services Awards

    Best End to End DevOps Tool/Service

    The winner of the Best End to End DevOps Tool/Service in 2020 is GitLab. GitLab has demonstrated to be the most efficient solution for DevOps teams to collaborate and build software. The GitLab solution is the result of the collaboration between thousands of community contributors and feedback from the more than 100,000 organizations that have adopted GitLab to power their DevOps transformations. The GitLab community contributes code, documentation, translation, design and product ideas based on their real-world challenges, making GitLab more useful and valuable.

    Best DevOps Repo/GitOps Tool/Service

    The DevOps Dozen award for the Best DevOps Repo/GitOps Tool/Service goes to GitHub, the most popular open-source version control code repository. GitHub is great to manage and maintain code in the cloud and contribute to projects quickly with automatic environment setup.

     

    Best CI/CD Tool

    CircleCI was chosen, by the public and the judges, as the Best CI/CD Tool. CircleCI is the leading CI/CD solution for software innovation at scale. The CircleCI platform allows teams to build and deliver software in the cloud or on their own infrastructure. CircleCI manages more than 35 million builds per month on Linux, macOS and Windows.


    Best Value Stream Management Tool

    The 2020 DevOps Dozen winner of the Best Value Stream Management Tool is Digital.ai Value Stream Platform. Digital.ai enables the world’s largest enterprises to accelerate their digital transformation initiatives by combining industry-leading enterprise Agile planning, application security, continuous testing, software delivery and AI-powered analytics in the first intelligent value stream platform. Digital.ai Value Stream Platform provides a unique view of the software delivery lifecycle through the customer experience lens to better align with business objectives and scale Agile and DevOps processes.

    The Digital.ai Value Stream Platform features end-to-end connectivity, visibility with AI-powered analytics, continuous testing and quality, release management and flow optimization, and measurable outcomes through quantified metrics. The platform allows organizations to set business goals based upon market needs, deliver products and technologies to achieve those goals, measure and analyze results, and make adjustments to continuously improve.

    Best Observability Solution

    The award for Best Observability Solution goes to Splunk Observability Suite, a comprehensive combination of solutions designed to help IT and DevOps teams tackle new monitoring challenges that other tools haven’t been able to effectively address. The Observability Suite helps users maintain the highest levels of business performance and adaptability, improve release quality and velocity, improve developer efficiency, minimize downtime, and deliver world-class digital experiences.

    Best DevSecOps Solution

    JFrog Xray was voted the Best DevSecOps Solution of 2020. JFrog Xray is a universal impact analysis product enhancing artifact security, container security and OSS license compliance across your DevSecOps pipeline. JFrog Xray scans your artifacts, builds and Release Bundles for OSS components being used, and detects security vulnerabilities and licenses in your software components.

    Best Testing Service/Tool

    Tricentis Tosca, a continuous testing platform that accelerates testing to keep pace with Agile and DevOps, is the winner of the Best Testing Service/Tool of 2020. With the industry’s most innovative functional testing technologies, Tricentis Tosca breaks through the barriers experienced with conventional testing tools. Simplifying end-to-end functional testing, Tricentis Tosca automates tests across all layers of modern enterprise architectures.

    Best Kubernetes Platform/Service

    The Best Kubernetes Platform/Service award goes to Red Hat OpenShift Container Platform. 

    Red Hat OpenShift is an open source enterprise Kubernetes platform offering a consistent hybrid cloud foundation for building and scaling containerized applications.

    Best Cloud Native Security Solution/Service

    Styra’s Declarative Authorization Service (DAS) is the winner of the Best Cloud Native Security Solution/Service award. Styra DAS was purpose-built to solve the authorization challenges of cloud-native, containerized application, and the infrastructure they run upon. Built on the open source project Open Policy Agent (OPA), Styra policy-as-code solutions have been proven in production, at scale, in many of the largest cloud-native deployments in production today.

    Styra DAS allows enterprises to define, enforce and validate authorization policy across services, teams, clusters and clouds. As businesses move their cloud-native applications from development through to production, Styra DAS provides the tooling to minimize the risk of human error, offload compliance overhead and ensure security and compliance best practices are enforced across your environment. Styra DAS simplifies policy creation with a built-in library of best practices and security policies, as well as a point and click interface for building custom policy from scratch.

    Best DevOps for Mainframe Solution

    It was very difficult to choose a winner in this category. There was a tie between two solutions, CA Endevor Bridge for Git by Broadcom and Compuware’s Topaz, and after a long discussion the judges decided that both should be honored as the Best DevOps for Mainframe Solutions of 2020.

    CA Endevor Bridge for Git is a component of the CA Endevor Integrations for Enterprise DevOps. It connects Git to Endevor via an Enterprise Git Server, such as GitHub, Bitbucket or GitLab. Git as well as traditional mainframe developers can easily collaborate on the same mainframe application managed in Endevor. Only code that is pushed from local Git repository to the Enterprise Git repository is recognized by the integration and gets propagated to Endevor.

    Topaz is a modern Agile platform of mainframe development and testing tools that integrates into the DevOps toolchain, empowering any developer, regardless of experience, to understand and work on any program, no matter how old or complex, so that their organizations can easily maintain and innovate from their base of mainframe investments.

    Best DevOps for DataOps/Database Solution

    The Best DevOps for DataOps/Database Solution is InfluxDB. Developed by InfluxData, InfluxDB is an open-source time series database that empowers developers to build IoT, analytics and monitoring software. It is purpose-built to handle the massive volumes and countless sources of time-stamped data produced by sensors, applications and infrastructure.


    Best New DevOps Tool/Service Provider

    The winner of this category is Opsera, the first continuous orchestration platform for DevOps teams. The Opsera platform automates any CI/CD toolchain, enables declarative pipelines and provides unified insights across the entire software delivery process.

     

     

     

    Winners will receive both digital and physical trophies and badges celebrating their achievements.

    Thanks for supporting DevOps.com and the DevOps community. For more information, visit the 2020 DevOps Dozen² Awards website and stay tuned for the 2021 DevOps Dozen Awards.

  • OpsRamp Extends AIOps Reach to the Network

    OpsRamp Extends AIOps Reach to the Network

    OpsRamp today announced its AI-enabled IT operations management (AIOps) platform now has the ability to analyze network flows and communications traffic.

    Ciaran Byrne, vice president of product management for OpsRamp, said the new analytics capabilities will make it possible for IT teams to correlate the IT events OpsRamp already tracks on servers and storage systems against multiple types of traffic moving across a corporate network.

    OpsRamp is based on a software-as-a-service (SaaS) platform that simplifies IT adoption of AIOps without having to build and maintain their own management platform or install an AIOps platform on their own infrastructure.

    Rather than acquiring a separate platform to analyze network traffic, OpsRamp is adding an OpsRamp NetFlow monitoring module, for analyzing packets using the NetFlow protocol developed by Cisco, and an OpsRamp Unified Communications monitoring module, for analyzing voice and collaboration data.

    OpsRamp NetFlow provides real-time diagnosis of network latency across wide area networks (WANs). It generates alerts based on network traffic utilization, and delivers insights into network utilization patterns by identifying source, destination, protocols and applications that impact services.

    OpsRamp Unified Communications works in a similar way, surfacing alerts and insights about traffic patterns impacting, for example, Zoom or Microsoft Teams.

    With more employees working remotely, the need to analyze network traffic has become more acute, said Byrne. Network performance degradations can have a major impact on overall application experience, Byrne said.

    Communications and collaboration platforms like Microsoft Teams pose particularly stubborn challenges, because they offer IT teams little to no visibility into that traffic, Byrne said.

    It’s unclear whether – and to what degree – networking and other IT operations will converge, but as AIOps platforms become more accessible, the ability to correlate IT events across multiple infrastructure classes as they transpire will steadily improve. While that may not lead to IT role consolidation anytime soon, it should enhance the level of collaboration teams can achieve.

    In the meantime, AI is poised to have a profound impact on how IT environments are managed. The amount of time spent in “war rooms” performing root cause analysis can be sharply reduced through the use of machine learning. As algorithms surface insights, IT teams will be better able to proactively address issues before they have a major impact on application performance and user experience. It may take time for IT teams to fully trust AIOps platforms, but in the near future, IT professionals will avoid working for organizations that don’t have such platforms in place. For IT professionals, keeping complex application environments running without AIOps platforms will be nearly impossible.

    Of course, transitioning to any type of new IT management platform is no small undertaking. However, as AIOps platforms continue to evolve, the overall cost of managing IT should also decline as leadership justifies the costs of these tools.