devopsy.kinsta.cloud

Category: Blogs

  • Enterprise Software Development Will Break the Speed Limit in 2021

    Enterprise Software Development Will Break the Speed Limit in 2021

    For some, 2020 was the year for software development speed … but not for everyone. Startups and SMEs climbed on board the CI/CD, shift-left and agile development train en masse – and reaped the benefits of faster iterations and tighter release schedules.

    But the “big kids” got left behind. Core enterprise applications – the legacy systems with 1+ million lines of code that do the heavy lifting in many corporations – have not yet made the switch to the world of rapid release cycles. And this is natural; enterprises are rightfully more cautious by nature, and because the technology driving this evolution was not mature by enterprise standards.

    But in 2021, that’s going to change.

    Here are four speedy predictions for pushing enterprises over the speed limit in 2021, and some of the companies making it happen.

    Four Enterprise Software Development Speed Predictions

    #1: AI-based test generation will make enterprise development faster and better

    Testing automation is crucial for any software development organization trying to transition to CI/CD. But enterprise stakes are arguably high, and enterprise code is by nature inflated, often carrying significant technical debt. Preparing suitable test coverage manually is resource-heavy, to say the least. But a new generation of AI-powered testing automation tools solves this problem for you. Solutions from companies like Ponicode and Diffblue allow enterprises with large code base apps to embrace CI/CD by bridging the technical debt gap in testing while still meeting release cycles.

    #2: Test avoidance tech will make a dent in unnecessary testing

    Running tests on an entire build for one small code change is overkill – no one’s arguing that. But until recently, there wasn’t much of an alternative to ensure the ironclad quality that enterprises require. In 2021, solutions from companies like Sealights and Launchable (which counts among its investors Jenkins creator Kohsuke Kawaguchi) will help enterprise software development teams deliver quality at speed. The key is the effective use of machine learning to reduce test cycle times and run only relevant tests, not the entire test suite, to ensure faster iteration cycles.

    #3: High Performance Computing will move toward distributed computing

    Compute power will remain a bottleneck to development in 2021 – but the processing arms race will likely change. As enterprises get used to virtualizing their infrastructure, they will think twice about investing heavily in dedicated multicore build/render machines powered by next-gen processors. Instead, they will look to virtualized processing power like distributed computing, cloud bursting, and spot instances – which provide the massive scalability enterprises require at build time, while still maintaining a more reasonable price-performance ratio.

    #4: Managed CI/CD in the cloud will automate enterprise release pipelines

    Managed CI/CD, like Amazon’s CodePipeline and Azure Pipelines, help enterprises save time setting up and maintaining CI/CD infrastructure, scaling up during peak times and maintaining security. These services, while not for everyone, will continue to gain popularity in 2021. A key reason for increased adoption is that they allow companies to scale much faster: without hardware or software, development teams can push a button and suddenly gain 20 more build servers. Moreover, managed CI/CD enables faster onboarding of new teams, simpler creation of repositories and more streamlined work with multiple geolocations. Finally, pay-as-you-go models, no upfront fees and no commitments are increasingly attractive to enterprises in tough times.

    Put the Pedal to the Metal

    Newly released AI-powered products and mature hosted services from big-name cloud providers are changing the face of enterprise-level development. In 2021, we’re going to see teams supporting backbone enterprise applications increasingly moving to CI/CD, shift left and agile development methodologies. Because everyone – even enterprises – deserves to break the speed limit.

  • Measuring the Business Benefits of AIOps

    Measuring the Business Benefits of AIOps

    Staffing levels within IT operations (ITOps) departments are flat or declining, enterprise IT environments get more complex by the day and the transition to the cloud is accelerating. Meanwhile, the volume of data generated by monitoring and alerting systems is skyrocketing, and Ops teams are under pressure to respond to incidents more quickly.

    Faced with these challenges, companies are increasingly turning to AIOps – the use of machine learning and artificial intelligence to analyze large volumes of IT operations data – to help automate and optimize IT operations. But before investing in a new technology, leaders want assurances that it will bring value to end users, customers and the business at large.

    Leaders looking to measure the benefits of AIOps and build KPIs for both IT and business audiences should focus on key factors such as uptime, incident response and remediation time and predictive maintenance to prevent outages that could affect employees and customers.

    AIOps KPIs include employee productivity, customer satisfaction and web site metrics such as conversion rate or lead generation. AIOps can help companies cut IT operations costs through automation and rapid analysis; it can support revenue growth by enabling business processes to run smoothly and deliver excellent user experiences.

    Specific IT and Business Benefits

    AIOps can digest operational data and spit out actionable recommendations for keeping important systems running at peak efficiency. These are the most-cited benefits of the technology:

    • Alert management: In most cases, the first problem AIOps systems will address is reducing the volume of noise: the torrent of alerts that inundate IT operations. AIOps uses clustering and pattern matching algorithms to eliminate as much as 90% of false alarms and other redundant or irrelevant alerts, making it far easier for staffers to focus on what really matters.
    • Incident prioritization and routing: AIOps systems can learn, over time, which types of alerts should be sent to which teams, reducing redundancy and confusion when, say, networking and database teams both get the same alert related to an incident.
    • Event correlation: AIOps can correlate alerts and event data to identify the root cause of an outage or application slowdown so that IT teams can respond faster.
    • Advanced anomaly detection: AIOps systems can identify anomalies to proactively detect abnormal conditions and relate them to business impact. For example, AIOps can predict if a system will run out of disk space based on projected growth or seasonal patterns, even if the growth is non-linear. Or, if there’s a sudden increase in the number of failed server requests, the technology can determine whether the server in question is handling a mission critical task or simply performing routine backups.
    • Automation: AIOps can be used to handle routine tasks such as backups, server restarts and other low-risk maintenance activities which otherwise involve heavy manual effort.
    • Predictive analytics: A more advanced use case could involve predicting events before they happen – such as detecting when network bandwidth is reaching its limit or storage capacity is nearing threshold.

    Seven KPIs for AIOps

    These common KPIs can measure the impact of AIOps on business processes:

    1. Mean time to detect (MTTD): This KPI refers to how quickly it takes for an issue to be identified. AIOps can help companies drive down MTTD through the use of machine learning to detect patterns, block out noise and identify outages. Amid an avalanche of alerts, ITOps can better understand the importance and scope of an issue, which leads to faster identification of an incident, reduced downtime and better performance of business processes.
    2. Mean time to acknowledge (MTTA): Once an issue has been detected, IT teams need to acknowledge the issue and determine who will address it. AIOps can use machine learning to automate that decision-making process and quickly make sure that the right teams are working on the problem.
    3. Mean time to restore/resolve (MTTR): When a key business process or application goes down, speedy restoration of service is key. ITOps plays an important role in using machine learning to understand if the issue has been seen previously and, based on past experiences, to recommend the most effective way to get the service back up and running.
    4. Service Availability: Often expressed in terms of percentage of uptime over a period of time or outage minutes per period of time, AIOps can help boost service availability through the application of predictive maintenance.
    5. Percentage of automated versus manual resolution: Increasingly, organizations are leveraging intelligent automation to resolve issues without manual intervention. Machine learning systems can be trained to identify patterns, apply solutions, such as previous scripts that were executed to remedy a problem, and take the place of a human operator.
    6. User Reported versus Monitoring Detected: IT operations should be able to detect and remediate a problem before the end user is even aware of it. For example, if application performance or web site performance is slowing down, ITOps should get an alert when the issue can be measured in milliseconds; they can then fix the issue before the slowdown worsens and affects users. AIOps enables the use of dynamic thresholds to ensure that alerts are generated automatically and routed to the correct team for investigation, or automatically remediated when policies dictate.
    7. Time savings and associated cost savings: The use of AIOps, whether it’s to perform automation or more quickly identify and resolve issues, will result in both operator time savings and business time-to-value improvements. These have a direct impact on the bottom line.

    These seven AIOps KPIs can be correlated to business KPIs around user experience, application performance, customer satisfaction, improved e-commerce sales, employee productivity and increased revenue. ITOps teams need the ability to quickly connect the dots between infrastructure and business metrics so that IT is prioritizing spend and effort on real business needs. In the future, as machine learning matures, AIOps tools may even recommend ways to improve business outcomes or provide insights as to why digital programs did or did not succeed.

  • Avoiding SolarWinds-Like Threats: The Impact Across DevOps Teams

    Avoiding SolarWinds-Like Threats: The Impact Across DevOps Teams

    Roundtable 6: The SolarWinds and FireEye compromise demonstrated the devastating effectiveness of a supply chain cybersecurity attack. How should CISOs, cybersecurity organizations and application delivery professionals prepare? Will suppliers be required to disclose or validate supply chain security measures?

  • HAProxy Updates Data Plane API to Simplify Service Discovery

    HAProxy Updates Data Plane API to Simplify Service Discovery

    HAProxy has updated the open source HAProxy Data Plane application programing interface (API) to include service discovery capabilities alongside native support for the Consul service mesh being developed by HashiCorp.

    Version 2.2 of the HAProxy Data Plane API also adds support for file handling, SSL certificates, map files and configuration files for its Stream Processing Offload Engine (SPOE).

    HAProxy is best known for the open source load balancing software of the same name that is widely deployed by DevOps teams. As an extension of that platform, HAProxy Data Plane makes it possible to dynamically add and configure front ends and back ends and then route application traffic between them.

    Daniel Corbett, director of product and marketing for HAProxy, said the HAProxy load balancing software coupled with the Data Plane allows IT organizations to create a gateway through which they can manage their APIs.

    Corbett said the company is currently rounding out a suite of offerings, dubbed HAProxyOne, that are extensions to its load balancing software and that add a control plane and a service mesh to its portfolio. The company has already added a Kubernetes ingress controller to its portfolio.

    At the same time, however, HAProxy Data Plane will make it simpler for DevOps teams to integrate other offerings, such as Consul, within the control plane being developed by HAProxy, Corbett says.

    Corbett said, collectively, HAProxy will provide a suite of tools through which DevOps teams will be able to more easily manage application delivery across IT environments that span multiple platforms.

    HAProxy is not the only load balancing software provider with similar ambitions. The issue that HAProxy will address is the need for a framework that can apply equally well to both monolithic applications and microservices-based applications, Corbett says.

    In 2021, a major battle is brewing for control over the infrastructure that DevOps teams use to deploy applications at scale. Alongside proxy servers and load balancing software, IT organizations are starting to use API gateways, service meshes and ingress controllers as the number of APIs through which data flows rapidly increases. In effect, these technologies provide the connectivity infrastructure required to route data between the applications that make up a distributed computing environment.

    It’s still early days, though, as advocates for competing open source projects make their cases for the hearts and minds of developers. However, given the profound impact these decisions are likely to have on IT operations, it’s likely many organizations will soon standardize on one suite of offerings to minimize complexity.

    Whatever the result, applications environments are, in fact, becoming more complex. IT organizations will soon find themselves running monolithic applications alongside a raft of microservices-based applications, all of which need to use APIs to integrate with each other. Decisions made today about how best to integrate those APIs will have a profound impact for years to come.

  • Red Hat Expands RHEL Subscription Program for Developers

    Red Hat Expands RHEL Subscription Program for Developers

    Red Hat is extending its developer program to make it simpler for both individual developers and small teams to access a free Red Hat Enterprise Linux (RHEL) operating system subscription.

    These programs are launched in the wake of Red Hat’s decision to no longer invest in an open source CentOS Linux distribution project. Many developers employ CentOS to build applications that are later deployed on RHEL in a production environment.

    Starting in February, an existing no-cost Individual Developer subscription for RHEL can be used in production for up to 16 systems in an on-premises environment or in the cloud. Previously, developers were limited to using the subscription on a single machine. Red Hat is also making it easier for teams of developers to join this program at no additional cost via an existing subscription their organization may already have.

    In place of CentOS, Red Hat is positioning the CentOS Stream as a hub through which development teams will gain access to a continuously updated Linux distribution that will become the next minor update to RHEL. The Fedora project, managed by Red Hat, will continue to exist as the vehicle through which the RHEL community experiments with major innovations.

    Brian Exelbierd, head of RHEL community projects, said these changes should ultimately prove to be a boon to DevOps teams, as they will better align the instances of applications being developed with existing instances of RHEL running in production environments. Historically, there was a significant amount of effort required on the part of DevOps teams to move an application developed on CentOS to RHEL, said Exelbierd.

    At least two other entities have rushed to fill the perceived CentOS gap. Gregory Kurtzer, one of the co-founders of CentOS, along with the support of more than 650 contributors, has launched Rocky Linux to make sure IT organizations have access to a fork of RHEL without a subscription. At the same time, CloudLinux is pledging to spend $1 million annually to create a distribution of Linux, dubbed Project Lenix, that is also based on a fork of RHEL. CloudLinux previously provided a hardened edition of CentOS that has been installed more than 200,000 times by 4,000-plus customers.

    Exelbierd said Red Hat is not trying to subvert those efforts, but it does have a vested interest in making it simpler for developers to build applications that eventually get deployed on production systems. Red Hat only generates revenue when organizations pay to subscribe to an instance of RHEL that gets deployed in a production environment.

    Regardless of what operating system developers employ, unless organizations decide to deploy CentOS in production environments, all paths eventually lead to RHEL. It will be interesting to see how far organizations will go in supporting a fork of RHEL that, in many cases, was employed simply because a developer didn’t want to pay for full subscription.

  • Career Driven

    Career Driven

  • DevSecOps Implementation: Intrusion Detection

    DevSecOps Implementation: Intrusion Detection

    Originally, this series was just going to be four articles on the DevSec side of DevSecOps. There are many reasons for this, but primarily because that side is cleaner. The other reason is that these topics are beyond the work we were doing at Accelerated Strategies Group.

    But we’ve had a number of requests to continue, and I’ve used many tools in the space, so on we go.

    Intrusion Detection

    Intrusion detection (IDS) started because attackers were getting through firewalls, and, once inside, seemed to have free rein. Intrusion detection wanted to offer another option for detecting and stopping attackers by watching things inside the firewall for indications your organization had been compromised. Relatively quickly, intrusion detection was supplemented by intrusion prevention (IPS). The idea of prevention was to proactively make changes based upon known issues to keep intruders out. Intrusion detection offered information about what paths attackers were exploiting, and intrusion prevention would plug them. Note that IDS and IPS are often further subdivided into host-based (HIDS) or network-based (NIDS) systems. Since their role – detection of intruders – is the same, for this overview we will discuss them together. A serious deep dive into IDS/IPS should look at HIDS and NIDS separately.

    In the DevSecOps space, some have folded these into security monitoring, but they are still performing the same basic tasks – just much better. In fact, if you found intrusion detection to be limited and clunky to work with because of rules maintenance and fingerprinting issues, it’s probably time to take another look. Here’s why:

    Problems With Traditional Intrusion Detection

    The problems with pure rules-based intrusion detection were two-fold.

    First, rules were hard and fast.

    “Look for X and Y and Z. If all are present, raise an incident.” This tended to result in only two types of rules – ones that were too narrow, and thus brittle, or ones that were too broad and that buried IT/security staff in alerts.

    Second, those rules were outdated before they hit the network.

    The old adage “You are always fighting the last war,” (meaning you are doing what worked the last time you won) is more true in IT security than almost anywhere else. For a rule or a fingerprint to be assembled, it has to have been seen. That means we were perpetually protecting against previously successful attacks and doing little against emerging threats. Security vendors took a lot of steps before coming to our current solution, which is a great step in the right direction.

    Attacks against IT infrastructure share a lot of commonalities. Purely rule-based systems counted on tribal knowledge to code those commonalities into rules. It was clunky and imperfect. Templates helped, by adding common items based upon the type of rule you were creating, but, like rules, they tended to be static and old news.

    Enter Machine Learning

    Bright people with an eye on the ever-changing environment knew that we needed something that could adapt to multiple attack forms/vectors and draw the type of conclusions that security analysts were tasked with. The ability to reduce the number of alerts that get raised is pretty close to miraculous. Anyone with a web presence sees thousands of security events a day, as attack bots and scanners automate chunks of the attack matrix. Some kind of solution to weed out the false information is nearly mandatory, as no organization has the manpower to monitor at those levels and reasonably follow up on threats.

    Machine learning (ML) makes connections between alerts – that might not be a big deal in isolation – and other events that, together, make a case for human intervention. Added to fingerprinting and rules, it is a powerful addition. While a successful attack would require going through rules and making certain you covered the behavior/changes found in the new attack, ML can take that information in and adapt automatically.

    This is cranking through volumes of data we couldn’t even imagine a decade ago, and finding anomalous behavior, correlating it and alerting where necessary. How much it reports up the chain is generally configurable, allowing an organization to tighten the flow of alerts that analysts have to deal with.

    Go With the Flow

    More recently, flow evaluation has become a positive step in the monitoring process. If this connection/user moves from A to B to C, it might be an attack. This allows for another way to rate suspicious activity and raise it to an analyst’s awareness.

    An increasing number of vendors are moving the analysis portion of these activities into their hosted environment. This is a “great strength/great weakness” solution – putting the data points gathered from your system into their cloud allows them to correlate events and improve all customers’ responses. The other side of the coin is that you are paying them operational costs each month, and for most vendors, you’re charged based on how much of the service you use. This has budget implications. It also assumes you have connectivity to their service. If you don’t, for any reason, no analysis will be done on collected data. A careful rollout and contingency planning are in order for this scenario to be successful.

    Integration with security information and event management (SIEM) systems is ubiquitous. We’ll talk about SIEM next; I just wanted to include here that IDS/IPS vendors are feeding SIEM.

    IDS isn’t perfect, and there are a ton of other things out there to help, but it’s a step in the process, one you should consider as you gear up your DevSecOps to professional levels. Some of you are using the tools, but don’t have them integrated into your DevOps systems. This is a nudge to do so. If resolution of an attack automatically creates tickets for Dev to make the code (or ops to make the config) more secure, it absolutely is a plus to the organization responding proactively.

    Keep kicking it. These are just tools, and they’re useless without you. Figure out what your organization needs, and update those needs regularly as the environment (both attackers and architecture) continually changes around you.

  • BYOPC Solves Endpoint Provisioning Challenges

    BYOPC Solves Endpoint Provisioning Challenges

    For many cloud-first companies, workstation imaging isn’t “a thing.” The notion that an IT organization might need several days – or even weeks – to onboard a new employee by provisioning an imaged laptop with correct security policies and only approved applications on it is absurd. The constraints of operating in an admin-centric model for IT service delivery would completely erode the agility that cloud native engenders.

    But let’s say your company was born before the cloud era. Or, suppose your company operates in a highly regulated industry, like financial services or health care, for example. For your company, workstation provisioning may still be a very real thing, and it may be weighing you down. That’s why a bring-your-own-PC (BYOPC) policy could be the answer.

    Now, take that basic provisioning problem and multiply it by a few orders of magnitude. That’s what happened to many companies in the crush to support remote workers in response to COVID-19. Most weren’t ready for the scale of the problem, and some had no means to enable secure remote work for their privileged users. So, when it came time to pivot to a remote-first stance, many IT organizations were unprepared, unprotected and overwhelmed. Between budgeting, acquiring endpoints and the provisioning of those devices, many companies incurred enormous opportunity and financial costs.

    But what if that didn’t have to be the case? What if, instead, there was an option to enable every new employee or newly remote worker instantaneously? What if the company didn’t have to bear the capital expense of purchasing new laptops for each employee? And what if the company didn’t have to carry the operating expense of having an army of IT admins whose job requirements are little more than commissioning and decommissioning workstations as new hires come on, as existing employees pivot from working in-office to working at home, and as others leave the organization?

    Scaling and Simplifying Enterprise Endpoint Provisioning

    Companies can unburden themselves by instituting a bring-your-own-PC (BYOPC) policy. BYOPC allows companies to scale back on investments in new laptops while allowing them to scale up their support for remote work. BYOPC provides employees the freedom to work how and from wherever they want, on whatever endpoint makes them most comfortable. Allowing employees to use their laptop of choice also offers the side benefit of helping to maximize worker productivity.

    At the same time, BYOPC helps companies to reap significant capex and opex savings. Permitting employees to use non-corporate devices reduces demand on IT admins’ time while also avoiding cost attributed to the purchase and maintenance of corporate endpoints. BYOPC, then, is a rare win-win for employees and the IT organizations that must support worker productivity, as long as the IT organization can effectively operationalize it.

    Gartner recognizes that BYOPC is on the rise, saying that companies need to “… support BYOPC practice, as it will be necessary for a long-term work-from-home strategy.” Further, our own research bears this out: in a survey we conducted recently in conjunction with Team8, we found that more than three out of four companies (78%) allow employees to access corporate networks or applications from a non-corporate device.

    Pairing BYOPC with a New Model for Endpoint Security

    Of course, a company can’t simply institute or dramatically scale a BYOPC policy without deploying or commensurately expanding a robust endpoint security policy. And this is where things get interesting: according to Forrester, spending on endpoint security had been rising, year-over-year, even before COVID-19 pushed so many companies to expand their remote access policies. During 2020, that investment has soared. However, we also know that 70% of security breaches start at the endpoint. So, it’s reasonable to conclude that something in the endpoint security ecosystem has to change, regardless of whether companies institute BYOPC or stick with traditional provisioning of corporate-managed devices to provide secure remote access.

    Companies have traditionally relied on a variety of isolated workspace approaches to provide corporate security while permitting workers to download questionable applications or visit dubious websites. Think app sandboxing or legacy remote access solutions like virtual desktop infrastructure (VDI) or desktop-as-a-service (DaaS). VDI and DaaS separate desktop images and applications from the user’s device. The images and applications reside on servers that are usually positioned in the cloud.

    Authorized users access VDI or DaaS resources from thin clients, corporate-managed laptops or user-owned devices, leaving no corporate assets vulnerable on the endpoint. With app sandboxes, threats that come in from the sandboxed application are contained within the sandbox, preventing malware from affecting the operating system (OS).

    These isolation methods have provided some level of protection, but each has shortcomings that experienced bad actors are able to exploit. Likewise, browser isolation is yet another strategy that works well within its confines – blocking malicious web content – but browser isolation also leaves other vectors completely exposed. Given that each of these isolation methods has significant gaps that leave corporate assets vulnerable to attack, the isolated workspaces market has been ripe for disruption.

    That disruption has come in the form of OS-based isolation. OS-based isolation allows an end user to have multiple operating systems on a single endpoint, allowing unrestricted access to the internet, email and non-privileged information via an unlocked OS while reserving a second, privileged OS for accessing only high-value corporate assets, including sensitive data and other systems.

    This privileged OS restricts internet access, prevents the user from installing or running unsanctioned applications, and rejects all peripherals. Corporate data is encapsulated on the same endpoint in the isolated environment and cannot be exfiltrated.

    From an enterprise perspective, key attributes of an enterprise-grade OS isolation solution must include purpose-built tools to centrally manage isolated environments remotely, supported by a robust and fine-grained set of networking, clipboard and data security policies such as access control, application management and insights across the entire workforce. With OS-based isolation, breaches may still happen in the non-corporate environment, but there’s no possibility of exfiltration of malicious code, meaning the corporate environment remains protected.

    There were days when every employer provided its workers with company-managed mobile devices. In many cases, those days are long gone. It may still take a while before the expectation of working on a company-provided laptop becomes nothing more than a memory, too. But the time is right to give workers the freedom to use an endpoint of their choice without opening up the company to security threats. Doing so will make workers happy, relieve the budget pressures on IT, and still allow security teams to sleep at night. That’s what we call a win-win-win trifecta.

  • Rookout Tool now Debugs Third-Party Code

    Rookout Tool now Debugs Third-Party Code

    Rookout revealed today it has extended its eponymous debugging tools to include third-party applications.

    Shahar Fogel, Rookout’s CEO, says most organizations today are building applications that rely heavily on code or modules developed by a third party. Rookout now makes it possible to analyze and debug that code before it is incorporated within a larger application environment, Fogel said.

    That’s crucial, because many of the operational issues a DevOps team is likely to encounter can be traced to flawed code written by someone outside of the IT organization, Fogel said. This new capability will reduce the amount of time DevOps teams spend trying to deduce the root cause of an issue, he said.

    Many IT organizations erroneously assume that all the code running in their environments has passed through a continuous integration/continuous deployment (CI/CD) environment, Fogel said. In reality, it’s not uncommon for developers to deploy code directly into a production environment in the name of expediency. Not all of that code, however, may have been written by the developer. Many developers wrongly assume the code they download from a repository was properly vetted and debugged.

    Rookout now makes it possible to debug both open source code and proprietary code written by a third party or present on an application deployment platform, said Fogel. Rookout collects the local variables, function arguments, tracing data, call stack and other relevant data, and can identify issues down to specific lines of code. Support for third-party code has been extended to the call stack level to enable developers to see how code execution flows across their own and third-party code.

    As more responsibility for applications shifts left toward developers, organizations need to provide them with tools to analyze applications and the platforms they run on. Beside building applications faster, one of the primary theoretical benefits of DevOps is the notion that developers can build more resilient applications, because it’s ultimately their responsibility to remediate any issues that arise after an application is deployed in production. In practice, that’s difficult to achieve when developers have no visibility into code that they didn’t write themselves.

    Going forward, there’s going to be a lot more third-party code running in production, as developers reuse application code encapsulated in containers downloaded directly from registries, Fogel said.

    The degree of accountability developers have for their appliations’ code currently varies widely by organization. However, given the right tools, and enough time, most developers would prefer to debug both the code they write and any they have incorporated, even if it were written by someone else. That desire, however, requires more time to build and test applications. Of course, it’s worth the tradeoff if developers encounter fewer incidents that require developers to debug applications after they are deployed in a production environment.

  • Quali Raises $54 Million in New Funding to Help Enterprise DevOps Streamline Infrastructure Complexity

    Greenfield Partners and JVP co-lead new round after record sales of CloudShell Platform to Global 2000 and innovators around the world

    Austin – Jan. 19, 2021 – Quali, the Infrastructure Automation at ScaleTM company, today announced $54 million in new funding, co-led by Greenfield Partners and JVP. The company will use the funds to further expand its stellar customer base, enable new partnerships, strengthen its market leadership position, accelerate CloudShell innovation, and grow the Quali team.

    Quali’s CloudShell platform simplifies cloud infrastructure, making it accessible and secure for application development and deployment, accelerating digital transformation. Quali’s mission is to unlock business value encumbered by technology operations, and to unleash the time and talent of technology teams so they are free to build the future—to develop, test, and deploy with simple self-service at any time, on any cloud, or even on-prem.

    Despite COVID-19, Quali has experienced a record year, with significant growth, serving customers such as Cisco, Microsoft, Dell, Verizon, multiple banks, and cloud service providers. Quali investors see the immense potential in bringing automation to the masses. In addition to the continued support from Kreos Capital, this round also welcomes a fund managed by Hamilton Lane as a new investor.

    While traditional Infrastructure as Code (IaC) players have focused on catering to a relatively small set of experts, Quali’s technology simplifies the user experience—effectively making cloud infrastructure, and its complexity, invisible to the application teams who need it.

    “Development teams are burdened by the time and complexity of setting up and operating cloud infrastructure. Quali empowers developers to develop, testers to test, planners to plan, and ops to operate by offering safe and productive access to hybrid cloud infrastructure”, said Quali CEO, Lior Koriat. “Since Quali’s most recent funding in 2018, the company experienced rapid growth in sales, platform innovation, and expanded its own workforce globally.”

    ”Quali has proven its position as a market leader in the DevOps and Infrastructure Automation category, servicing tier-1 customers across multiple segments,” said Erel Margalit, Founder and Chairman at JVP. “This is one of our most fascinating companies, and we are happy to join forces with Shay Grinfeld, Managing Partner at Greenfield partners, and Boaz Dinte, Managing Partner at Qumra Capital, who helped build leading companies in this category such as Jfrog, BigPanda, and others. Alongside Yoav Tzruya, Quali’s Chairperson, and the vast experience of JVP in building international companies such as CyberArk and QlikTech, we are confident that together with Lior and Quali’s great team both in Israel and the US, the company will become the next big thing.”

    Quali’s new Board Member, Shay Grinfeld, Managing Partner at Greenfield Partners, said, “Our investment thesis was built around Quali’s unique ability to streamline cloud and infrastructure complexity for application and technology teams with the growing adoption of DevOps methodology and CI/CD procedures. We are impressed with their recent growth and are excited about the opportunity to build an exceptional business.”

    “With the growing adoption of DevOps and CI/CD best practices, beyond early adopters, challenges related to scaling such practices are becoming more prevalent—removing operational, process and knowledge bottlenecks, reducing costs, assuring governance and unifying infrastructure. This is where Quali shines”, stated Yoav Tzruya, General Partner at JVP and chairperson of Quali, “While Atlassian and JFrog solve needs around process management and streamlining dev-to-prod, Quali focuses on abstracting away and automating infrastructure, and enabling the CRO to focus on sales, instead of the complexities of demos and POCs, the developers to develop instead of spending resources on IT and cloud provisioning, and operations to offer best in class customer experience instead of worrying about costs and governance”.

    “What attracts me to Quali is their ability to bring essential automation technology directly to the masses (developers) without requiring deep expertise,” said Boaz Dinte, a board member of Quali and JFrog. “It’s the same thing that impressed me as an early investor at JFrog and I could not be more excited about Quali’s future.”

    “Quali’s automation framework further enhances our ability to build tomorrow’s future today, allowing Verizon to deliver amazing new technology to our customers at the speed of DevOps,” said John Musa, Manager at Verizon Wireless.

    New Customers: Category-leading companies in consumer electronics, telco, banking, technology, media, and more rely on Quali to deliver more productivity, faster time to market, and reduced business risks.

    New innovation: In addition to 1-click infrastructure setup, Quali’s CloudShell Platform features the industry’s only “no-click” auto-decommissioning of cloud environments as well as its unique auto-tagging capabilities, both of which are essential for cloud cost visibility and cloud cost control.

    New employee growth: With aggressive hiring goals in every functional area, Quali will nearly double its employment, filling multiple new positions at its new offices in Austin and Tel Aviv and across the US, Europe, and Asia.

    More information on open positions can be found at https://www.quali.com/about-us/careers/.

    About Quali

    Headquartered in Austin, Texas, Quali provides the leading platform for Infrastructure Automation at Scale. Global 2000 enterprises and innovators everywhere rely on Quali’s award-winning CloudShell platform to create self-service, on-demand automation solutions that increase engineering productivity, cut cloud costs, and optimize infrastructure utilization. For more information, please visit https://www.quali.com/ and follow Quali on Twitter and LinkedIn.

    About Greenfield Partners

    Greenfield is an Israel-based investment firm focused on early growth stage technology and tech-enabled businesses. With a dual presence in Tel Aviv and New York, the Greenfield team fuses investment and operating experience, deep local Israeli roots, and an expansive global network to support entrepreneurs in their quest to build thriving technology companies. Greenfield’s roots date back to 2016, when it was established by TPG Growth as an investment platform for early growth technology investments in Israel. An independent fund since 2020, its culture remains grounded in this heritage, bringing the rigor and depth of private equity to early growth investing. The Greenfield team continues to serve as Senior Advisors to TPG Growth, and in this context seeks opportunities for collaboration on selected large-check, growth stage investments in Israel. Its portfolio includes such companies as Avanan, BigPanda, Guardicore, and Vast Data. More information about Greenfield Partners is available at www.greenfieldlp.com.

    About (JVP)

    Jerusalem Venture Partners (JVP), founded and led by Dr. Erel Margalit, is an internationally renowned venture capital fund. JVP has raised $1.4 billion to date across nine funds, and has been listed numerous times by Preqin, and other rankings, as one of the top-ten consistently performing VC firms worldwide. JVP has built over 150 companies, leveraging a broad network of partners and market expertise to help companies become global market leaders. JVP was recently chosen by New York City and EDC to lead the cyber security cyber hub in NYC. Among the pioneering firms of the Israeli venture capital industry, JVP has been instrumental in building some of the largest companies out of Israel, facilitating 12 Initial Public Offerings on NASDAQ, including CyberArk Software, QLIK Technologies, and Cogent Communications among others. https://www.jvpvc.com/