Category: Blogs

  • Barracuda Networks Partners With Microsoft on SD-WAN Service

    Barracuda Networks Partners With Microsoft on SD-WAN Service

    Barracuda Networks today launched a software-defined wide area network (SD-WAN) service that runs natively on the Microsoft Azure cloud.

    Klaus Gheri, vice president of network security for Barracuda Networks, said Microsoft has made it possible to launch an SD-WAN service using Azure Virtual WAN Hubs, a networking service based on a hub-and-spoke architecture that unifies networking services such as security and routing under a common interface. Those services span branch connectivity, multiple types of virtual private networks, cloud interconnects, firewalls and encryption services.

    Gheri said rather than having to replicate all those networking services, Barracuda Networks is layering a Barracuda CloudGen WAN service on top of the Azure Virtual WAN Hubs to provide a service that, like any other cloud service, can be consumed per billable hour.

    Developed in collaboration with Microsoft, the Barracuda CloudGen WAN service provides the management framework needed to convert Azure Virtual WAN Hubs into an SD-WAN service that IT teams can employ to securely connect remote offices to cloud applications or on-premises IT environments, he said.

    SD-WAN services today come in four basic forms. IT teams can deploy and manage their own SD-WAN appliances. Alternatively, telecommunications carriers make SD-WAN services available on their networks or a managed service provider (MSP) can create its own SD-WAN service by deploying the appliance on points of presence (PoP) on a global network it manages. More recently, cloud service providers have been making SD-WAN services available via the networks they built to connect all their data centers.

    Gheri said Microsoft is now taking that SD-WAN capability a step further by adding a management portal created by Barracuda Networks.

    A recent survey of 750 business and IT professionals conducted by Vanson Bourne on behalf of Barracuda Networks finds more than half (52%) are looking to employ SD-WAN services delivered via the cloud. In comparison, the survey finds 16% prefer to get SD-WAN from an independent vendor, 15% would opt for a telecommunications partner and 12% would rely on a value-added reseller.

    With more application workloads moving into the cloud, the way networks are deployed and managed is evolving rapidly. Instead of connecting branch offices to local data centers to access cloud applications, more organizations are employing SD-WANs to provide direct access to cloud applications without having to backhaul network traffic through a local data center. That approach significantly improves overall application latency and, in many cases, reduces the need to rely on leased MPLS lines from a telecommunications carrier.

    Rather than build those SD-WANs themselves, many IT organizations want to be able to access and manage them via a portal through which they can allocate bandwidth to applications as they best see fit. It’s not clear to what degree IT organizations will continue to prefer to deploy appliances versus consuming SD-WAN as a service. However, given the complexity of managing SD-WANs, there’s a high probability that SD-WAN services delivered via existing cloud networking infrastructure will soon become a widely employed alternative.

  • DevOps Deeper Dive: Google Roils Open Source Community

    DevOps Deeper Dive: Google Roils Open Source Community

    Google this week agitated the bulk of the open source community by launching the Open Usage Commons consortium to protect the trademarks of open source projects, starting with the Istio, Angular and Gerrit projects it launched.

    Launched in collaboration with SADA Systems and some independent contributors, the stated goal of the Open Usage Commons is to help open source projects assert and manage their project identity through programs specific to trademark management and conformance testing.

    Istio is a service mesh that runs on top of Kubernetes, while Angular is a web application framework. Gerrit is a code collaboration tool.

    Unlike previous open source projects that Google played a major role in developing such as Kubernetes, Google has yet to contribute these three projects to an open source consortium. That decision has members of the open source community now questioning Google’s commitment to open source software.

    In fact, IBM, which launched the Istio project in collaboration with Google, this week said the Open Usage Commons does not meet the level of open source governance IBM expects. Originally, IBM said the expectation was that Istio would be contributed to the CNCF once it achieved a level of maturity. That contribution would include Istio intellectual property and the trademark. Now IBM is encouraging Google to reconsider its Open Usage Commons approach.

    If Google continues to hold on to the intellectual property rights for open source projects such as Istio, those projects will become little more than a community project that Google exercises control over, said Priyanka Sharma, general manager of the Cloud Native Computing Foundation (CNCF), which oversees the ongoing development of Kubernetes, among other open source projects.

    “It’s not in the spirit of open source,” said Sharma. “I don’t think you can even call it open source.”

    Other open source initiatives will be hesitant to build on top of projects such as Istio if the intellectual property belongs to a single vendor, added Chip Childers, executive director of the Cloud Foundry Foundation (CFF). The trademark is never the main issue, he said.

    “The trademark is only part of the consideration,” said Childers.

    In the case of Istio, the decision to launch Open Usage Commons might also draw more attention to a Service Mesh Interface (SMI) project being advanced under the auspices of the CNCF. That interface promises to make it easier to rip and replace one service mesh for another.

    In the meantime, Google may be trying to maximize its investments in open source projects that until now have tended to benefit rivals more. In terms of consumption of cloud services based on Kubernetes, Google is a distant third at best to Amazon Web Services and Microsoft.

    In general, there are more open source projects than ever. However, some of the entities that launch those projects have complained that cloud service providers simply turn those projects into cloud services in a way that consumes most of the revenue opportunities any open source project might generate.

    Google now appears to be exacerbating those tensions further by trying to retain control over the open source project it leads, while selling services based on other open source software projects. It’s not clear to what degree this rift might drive a wedge between multiple open source factions. Google with this move may just drive more members of the open source community into the arms of AWS and Microsoft. However, for the moment at least, none of the projects covered by the Open Usage Commons trademarks are so critical that they could not be replaced by any one of several alternative projects that are truly open source.

  • Bringing NetOps Up to Speed With DevOps

    Bringing NetOps Up to Speed With DevOps

    Automation can be an unwieldy topic for network operations and DevOps teams who have enough challenges working together cohesively. Networks have been traditionally viewed as the long pole in the tent for emerging DevOps practices.

    But for DevOps practitioners and business leaders alike, there’s good news: NetOps are more prepared than ever to embrace automation and programmability—increasing the likelihood of on-time service delivery, with far less friction between IT teams.

    According to Enterprise Management Associates (EMA), a strong majority (77%) of organizations deem network automation a high priority, and 58% have already implemented or are planning to implement, approved solutions. This is an important and promising shift.

    Traditionally, network leaders have favored an operating model that emphasizes stability and resiliency over agility. Understandably so, as any network interruption can have a cascading impact on the business’ operations and profitability.

    While ensuring five 9s of availability remains a top priority for NetOps, the growing need to support DevOps, containerized infrastructure for applications and cutting-edge digital services—among other initiatives—continues to highlight some of the glaring inefficiencies of traditional network management tools that are too error-prone and bound by scalability issues.

    With the right automation framework, NetOps can play an equal part in enabling DevOps practices by becoming more adaptable to evolving business and application requirements in the cloud and locally.

    Centralizing Management With Cloud-Based Service Delivery

    For decades, improving agility has been a dyed-in-the-wool practice for network teams. Organizations worldwide have now realized enormous benefits by implementing new software-defined management tactics that allow the network to become more centralized, programmatic and dynamic in nature. By disaggregating software from hardware, networking teams now can manage many more services and devices with less effort and resources.

    Among NetOps’ new arsenal of tools and best practices, centralized management has become one of the key ingredients driving toward greater efficiencies. Utilizing a cloud-based approach for provisioning, deploying and managing network services closely mirrors the way IT has spun up cloud storage and compute over the last decade. Now, DevOps teams no longer have to wait days or weeks for the NetOps team to provision the right networking resources so that they can begin designing, testing and deploying new applications.

    Along with the added efficiencies, NetOps teams have greater and more uniform control over device configurations and policies, where security vulnerabilities lie in wait if these do not establish a zero-trust environment. Orchestrating these elements centrally, rather than device by device, places far less burden on individual network operators for protecting high-value corporate assets. Rock-solid network access control also reduces the risk of security or performance degradation that commonly arise from using an ad hoc patchwork of scripts, templates and CLI commands.

    Advancing Network Automation Frameworks

    Because creating a cloud-native network infrastructure does not all happen with the press of a button, network operations won’t become fully automated overnight. Other factors come into play that inhibit broader adoption of automation frameworks, including budget constraints, difficult technology implementations that lack integration with legacy systems and skill gaps for existing staff.

    It’s essential that NetOps teams embrace a network automation framework that aligns to current and future operating models. Through proactive collaboration, NetOps folks can extend the value of automation platforms already used by their DevOps or application counterparts.

    Fortunately for NetOps teams, myriad networking vendors today readily offer pre-built, certified solutions for DevOps platforms, making it easier to get started on a cloud-native journey by automating activities such as device onboarding and configuration changes. This way, network administrators can leverage existing vendor partnerships, in-house knowledge and technology that is already proven within the larger IT environment.

    Additionally, network engineers shouldn’t need—and won’t have the extra time—to become top-notch developers to take advantage of programmability during their cloud-native journey. Developing basic programming skills is advantageous, but network management systems that offer Python scripting, a consistent set of APIs and webhooks can perform the “heavy lifting” when it comes to enabling extensibility with third-party IT platforms.

    Today, this level of extensibility includes being able to integrate with third-party IT service management tools. A common use case that can realize significant time savings and greater network and application availability is to auto-trigger and assign an incident ticket when a performance SLA is breached. It’s very easy to collect and use machine learning-based tools to correlate all of the relevant diagnostics data in order for a network operator to immediately begin a root cause analysis and quickly resolve the issue.

    On the Horizon: AI-Driven Operations

    Another core aspect of DevOps is continuous improvement—both in terms of elevating service levels, as well as enhancing user experiences. But faster rates of change resulting from continuous improvement processes can negatively impact application performance, and the network is often the first to be blamed.

    But there is a huge silver lining within this cloud created by faster rates of change, which also highlights another growth area for NetOps teams to learn and master. That is, the use of AIOps.

    Today’s networks are bound by human scale. When things break, it takes a human to realize it broke, research the issue and then apply the fix. While traditional management and monitoring tools can alleviate some of the burden, alert fatigue often becomes a huge problem—in other words, too many false alarms, false positives or, worse yet, drawing attention away from more critical issues.

    AIOps tools and technologies mitigate these issues and limitations by combining artificial intelligence, machine learning, and advanced network analytics to automate many aspects of traditional monitoring and troubleshooting. Once deployed, IT organizations have the ability to predict and preempt failures,\ or quickly recover from issues when they do occur. This includes being able to:

    • Leverage ML-trained data sets to continuously monitor network performance and detect anomalies.
    • Eliminate guesswork by prioritizing fixes or improvement efforts and validating that those efforts have the desired business impact.
    • Continuously optimize network performance based on benchmarks.

    Put another way, AIOps systems are worth their weight in gold by helping networks move toward a self-healing, self-securing and self-optimizing model. Even in the interim, during the early phases of deployment, such AI-assisted operations can help IT identify and resolve network- or user-impacting issues faster and easier. The results are that dramatic.

    Next Steps: Bring a DevOps Mentality to NetOps

    Contrary to popular belief, the goals of NetOps are not diametrically opposed to DevOps. Both groups want to deliver more value and help the business innovate.

    Equipping NetOps teams to build on existing DevOps-based automation frameworks, paired with AI-driven insights and modern management tools, will go a long way in ensuring frictionless delivery of new services.

    Now is the time for network operations teams to get to know your DevOps team, learn how they operate and come together to create new methods for advancing the organization’s IT mission. The investment in time and effort should be a creative win-win for both groups and produce a big payoff in IT’s strategic position and importance to the organization.

  • Product vs. Project: Balancing Management Roles for Success

    Product vs. Project: Balancing Management Roles for Success

    Many businesses today rely on project management to ensure that all the activities that are required to help the business function are able to do so efficiently. The importance of project management is ingrained into many businesses, and doesn’t need to be justified—or does it? For software development companies, product management also needs to be considered just as much, if not more. To determine whether both or one is needed, and to what extent, business leaders need to first recognize the similarities and differences between the roles of the project manager versus the product manager, and what each can bring to the business.

    The key to understanding the differences starts with the descriptive writing mantra that everyone learned back in school: the 5 Ws (and 1 H), otherwise known as who, what, when, where, why and how. Though the who and where are generally self-explanatory, you can easily understand the difference between product management and project management by understanding which of the other four questions each job answers. Both positions fulfill critical roles in effective product delivery.

    Product Management: Getting Concrete Answers

    Product management answers the questions of “what” and “why.” These are important because, for every product you build, you need concrete answers to these questions.

    What

    The fundamental question that we’re asking here is, “What are we building?” Many enterprises have a product range that spans across dozens of different markets. Though this is great for the business and investors, it’s not an effective way for a team to work. When you ask a team to build or support a product, they need a clear vision of what that product will actually do. This is especially true for software products because it’s easy for them to lose their identity if they attempt to do too much.

    In a big enterprise, a “do everything” mentality can cost more over time. It’s likely that you have many software teams, and each one is building software that’s designed to suit a specific part of the market. When those teams implement software that duplicates some functionality already provided by your business, you’re wasting time and effort.

    This is where a good product manager is valuable. They help keep software teams focused on what they’re building and rein in the desire (by developers and executives alike) to grow the software outside the job it needs to do.

    Why

    The other major question that product managers answer is, “Why are we building this?” For developers, why is often more important than what. Work is almost always interconnected with the work of other teammates. When teams understand why they’re building something, it’s much easier to understand how those connections should work. It also gives developers information about which trade-offs they should make when implementing a feature, such as simplicity and usability versus speed.

    It’s the job of the product manager to understand and convey the why of the product. They do that by conversing with executives and project stakeholders to understand how this product fits into the overall business need.

    Project Management: The Thoughtful Side

    Project management, on the other hand, answers a different set of questions. A project manager’s job is focused on the how and when.

    How

    Large software projects are complex, with many interdependent and interlocking pieces. Efficient software project managers understand those interdependent requirements and plan for them. They organize the project’s tasks so that by the time someone is ready to work on one piece, its dependencies have already finished. Developer downtime is minimized and it enables those developers to focus only on the problems they need to solve for each task.

    Managing these kinds of interdependent requirements is the most valuable thing that project managers do for their software developers, though it can often be missed by executives, who are much more focused on the second project management question: when?

    When

    This is the visible project management question, “When is that project going to be done?” External stakeholders don’t care about how or why. They usually only care about what when the final product isn’t what they expected. But when is a question that’s top of mind for every single team leader who waits for a software project to be finished.

    This is also the most difficult question to answer. It’s almost impossible to reliably predict how long it will take to deliver a feature—not even a whole project, just one part of it. Something that seems simple at the outset turns out to be much more complicated. Alternatively, sometimes something you think might take two weeks instead takes only a day or two.

    The Balancing Act

    In most traditional cases, both product and project management are crucial for software delivery pipelines to run smoothly. However, many enterprises are now moving their deployment infrastructure toward a continuous delivery model, which adopts DevOps principles. For teams that practice continuous delivery, the question of when something is coming out can sometimes feel less important. Additionally, many software teams transition toward agile software principles, which makes the collective software team responsible for the question of how. Third-party planning tools can also make it easier for software teams to answer the how and when questions for themselves.

    For this reason, many teams are transitioning away from using dedicated project managers. Instead, they move much of that responsibility to the teams and focus their planning efforts on the product itself. However, the most successful projects answer all four questions effectively. When you don’t have a good answer to one or more of these questions, the project can end up stressful and frustrating.

    The people answering these questions might change over time, as it has changed already. The crucial point is to just ensure that you do have people who are dedicated to solving these questions and relaying this information to their teams. This is the smartest way to ensure projects stay on track and deliver the product that is expected and needed.

  • Can NetOps and SecOps Finally Get Along?

    Can NetOps and SecOps Finally Get Along?

    For years, the very definition of NetOps and SecOps has involved friction and even contentious relationships that make their respective jobs more difficult and lessen their efficiency and effectiveness. Much of this conflict originates from having charters that are seemingly in opposition to each other. At the surface, NetOps stands for connectivity, openness, speed and capacity. In contrast, SecOps comes across as binary opponents, posting for far too many regulations with segmented connectivity and a more or less closed or impaired environment.

    The truth is, however, both groups have the same goals:

    • Ensuring business operations and agility.
    • Protecting resources.

    The network is only important in its ability to connect users, systems, applications, information or data and other resources, ensuring effective business operations and agility. The network is means to an end, and not necessarily an end to itself. In a somewhat similar way, security is also not an end, but, rather, the means to an end. Security exists to protect these same users and resources. It’s all about the users and resources being able to run business operations effectively and with the agility and flexibility necessary to give it strategic advantages. Reflecting on this perspective may help NetOps and SecOps realize that they are not so far apart from each other.

    Both NetOps and SecOps struggle with many of the same issues. Both are usually overworked and understaffed, responsible for critical components or aspects of business, face constantly changing environments and challenges and slowed by cumbersome processes and a lack of agility. Because of these things, NetOps and SecOps are largely in the same boat, sharing the same storm.

    netops secopsThe lack of agility is a particularly important issue, as new technologies and techniques are constantly being developed that enable security teams to stay ahead of—or at least keep pace with—attackers. Motivated attackers tend to be far more innovative that defenders and can use anything at their disposal to accomplish their goals. Entire cybercriminal supply chains exist to provide attackers with applications, utilities, routines and even services to conduct their campaigns. These things can and will be used against defenders.

    On the other hand, deploying a new security solution on the network is generally a long, involved, cumbersome process. Even changing solutions involves considerable effort. Sometimes the rules or process gets invented along the way, compounding the difficulties. Additions or changes to the network involve tedious review processes mostly dictated by NetOps. The NetOps team also faces some of these same difficulties in adding or changing network management or monitoring solutions.

    While a careful review is warranted, current processes are too time-consuming and involved. One significant improvement can come from NetOps and SecOps coming together with an established and codified approach for network changes or additions. Getting issues out on the table for discussion is a great start. This means more collaboration and a joint learning cycle on short- and long-term organizational objectives. Both groups need to understand and appreciate the concerns of the other and realize their common ground. Prioritizing issues and agreeing on a fundamental set will ease the overall process, reduce unwarranted fear and antagonism, and eliminate much of the inventing the process on the fly.

    An emerging approach seeks to establish a centralized deployment point for both networking and security solutions with pre-established rules agreed upon by both teams. Ideally, many of the concerns can be addressed or mitigated by hardware and software designed to enforce policies or rules, provide failover as necessary, prevent performance degradation or add to the attack surface. These can allow solutions to drop into the network while offering guarantees of performance or availability.

    Streamlining deployment of shared management will result in much-needed agility and also boost efficiency and overall effectiveness. It will also lessen the typical tensions or outright opposition.

    NetOps and SecOps are much closer to each other than either realizes. Their shared guardianship of users and resources can benefit from joint discussions, plans, tools and policies. Not only can they better accomplish their own charters of connecting and protecting while providing agility and flexibility, but they also can become far more efficient with their operations. They need each other, and their organizations need the vital contributions from both. As typically said in security jargon, “A chain is only as strong as its weakest link.” The new paradigm of security-driven networking is about preventing weak links through the collaboration and synergy between NetOps and SecOps.

  • Survey Finds IT Teams Rising to COVID-19 Challenge

    Survey Finds IT Teams Rising to COVID-19 Challenge

    In many ways, the COVID-19 pandemic has been the ultimate test for IT teams. The bulk of many workforces overnight became remote workers. Many of those end users are now starting to return to the office, but no one knows for sure if they will be sent back home again because of another flare-up.

    A survey of 519 IT professionals conducted by ManageEngine, a provider of IT service management (ITSM) software, suggest most IT teams have risen to the COVID-19 challenge. According to the survey results, 85% of respondents said they were equipped with the right remote-support equipment or were able to procure it quickly to enable a productive remote work environment. In addition, 83% of respondents said they believe IT will be better appreciated in terms of budgets, salaries and recognition in the wake of the COVID-19 crisis.

    Overall, nearly three-quarters (72%) said the ITSM tools continue to be effective despite remote work conditions. For example, 40% cited knowledge management as their greatest challenge, while just over 50% noted that prior to the pandemic Bring Your Own Device (BYOD) policies were non-existent in their organizations.

    In terms of mobile computing devices, only 32% said they were already providing them. Nearly half (47%) are now planning to provide them.

    Self-service support options aren’t being used by 28% of the organizations, and of those who do use them only 40% found they truly helped. Among the respondents who use chatbots for their self-service, 50% found them beneficial for remote support. Only 7% of respondents felt that the service desk wasn’t up to meeting the remote IT support challenges that the pandemic presented.

    In addition, only 40% said they are equipped to tackle the increase in security and privacy concerns that result from more employees working outside the office.

    Cloud services were also critical, with more than half of respondents (53%) saying such services helped their organization’s business continuity. However, 20% of respondents said they did not have a business continuity or disaster recovery plan in place for emergency situations. Among those who had them, 50% were happy with those plans. Almost a third (29%) of respondents admitted they did not do enough prior testing of their action plan.

    A fifth of respondents also noted shadow IT is impacting services and applications, while nearly a third said they were unsure.

    Pradyut Roy, a product manager for ManageEngine, said it’s apparent many IT organizations will need to update IT policies and processes in the wake of the pandemic. It’s also probable the IT environment will become more heterogeneous in the wake of the pandemic as, for example, more desktops move into the cloud, said Roy.

    In general, IT teams will need to adjust to a much more fluid IT environment. Many more end users will be rotating in and out of the office to enable organizations to comply with social distancing mandates. Regardless of what the new normal becomes, however, it should be apparent to all by now that IT will play a more central role in most business decisions from here on out.

  • Microservices vs. Monoliths: Which is Right for Your Enterprise?

    Microservices vs. Monoliths: Which is Right for Your Enterprise?

    With microservices projected to grow globally at a 22.5% rate between 2019 and 2025, the choice between monolithic and microservices architectures needs to be carefully considered. If you are wondering what microservices are best suited for, or whether your business should stick to monolithic or switch to microservices, here are a few cardinal points to take into consideration.

    What Is Monolithic Architecture?

    A monolithic application is built on a single code base with a variable number of modules. The number of modules depends on the complexity of the business and its technical features. The whole application—and dependencies, when applicable—are built on a single system with a single executable binary for deployment.

    A monolithic architecture has distinct advantages and disadvantages that should be evaluated when deciding when selecting the optimal type of architecture for the application.

    Monolithic architecture pros:

    • Fewer cross-cutting concerns: The majority of applications typically have a large number of cross-cutting concerns. Running them all on a monolithic architecture facilitates hooking up components.
    • Less operational overheads: Avoids the additional costs stemming from microservices such as interservice communication, service discovery and registration, load balancing, decentralized data management or distributed logging, for example.
    • Complex testing: Testing for microservices is considerably more complex than for monoliths.
    • Better performance: As shared-memory access is faster than interprocess communication, a monolithic architecture typically has better throughput performance.

    Monolithic architecture cons:

    • Overly tight coupling: Entanglement increases the difficulty of isolating services for upgrades or independent scaling when the application evolves.
    • More difficult to understand: As the application grows and the number of layers and dependencies increases, understanding the system becomes increasingly difficult.
    • Slow build and test create releases: Upgrades imply recoding the entire application to factor in the dependencies and side effects.
    • Hard to distribute development: Tightly integrated applications are difficult to break into chunks, which complicates the creation of a distributed team effort.
    • Usually requires opting for a single programming language: Integrating more than one language in a monolithic application is fraught with challenges, typically preventing the integration of components written in a different language, which might limit the flexibility of adding features best suited to an external language.
    • Complicates the adoption of third-party tools: Adding self-contained third-party components, for example, cloud-native, to a single code base with multiple dependencies requires complicated hookups to different layers of the monolithic application.

    What Is Microservices Architecture?

    Microservices architecture is designed to accommodate the need for large application development by providing a suite of modular components and services.

    When considering what microservices are particularly well-suited for, the following advantages and disadvantages should be taken into account:

    Microservices pros:

    • Better organization: Microservices are organized around business and technological capabilities, in units that are independently deployable.
    • Decoupled: Each unit can be independently upgraded without requiring a complete overhaul of the application.
    • Performance: Flexibility in opting to privilege performance or flexibility as needed, including independently scaling heavily used services by isolating them from the remainder of the application.
    • Fewer mistakes: The hard-to-cross boundaries between microservice units limit the technical possibility of generating mistakes, notably cascading ones.
    • Easier onboarding of new developers: They only need to master the microservice unit they will work on instead of the entire application architecture.
    • Scalability: Each microservice can be scaled independently, while also adding new components.
    • Improved fault isolation: As modules work independently from each other, a failure in one module does not affect another.
    • Elimination of vendor or technology lock-in: As each microservice module can be operated independently, replacing underperforming modules with better ones from an alternate vendor is relatively easy.
    • Ease of understanding: As services are broken down into modules, understanding the functionality of a module is easy for developers.
    • Smaller and faster deployments: Each service can be scaled independently as needed, instead of scaling the entire application. This can lead to cost savings.

    Microservices cons:

    • Cross-cutting concerns: Microservices require handling cross-cutting concerns such as externalized configuration, logging, health checks, metrics, service registration and discovery and circuit breakers, as well as those specific to the technologies used by the microservices.
    • Higher operational overhead: Microservices deployment typically leads to an increase in the number of units and containers, increasing the management and operation cost overheads.
    • Security threats: Microservices architecture presents an expanded attack surface. Securing a containerized application requires managing privileged access at image, container, node, pod and namespace levels, ensuring encrypted tunneling from ingress to egress and other elements that require baking in security from the beginning.
    • Multiple complexities requiring management:
      • Communication between services on a technological level, and between teams on an operational level.
      • Selecting the optimal pattern from the several microservices patterns available.
      • Provisioning sufficient IPs.
      • Provisioning resources (memory, CPU, disk) to accommodate each cluster requirements.
      • Maintaining multiple programming languages and frameworks.
      • Handling the incompatibilities between existing tools and new service dependencies.
      • Accounting for automation tools for each service requiring individualized testing and monitoring.
      • Achieving data consistency between each service’s individual database and transaction management system.
      • Handling the number of processes that can grow exponentially when load balancing and messaging middleware are considered.
      • Provisioning for the increase in documentation overhead stemming from the need to keep schemas and interface documents up to date.
      • Refactoring of an application built on monolith architecture is a massive undertaking for large enterprise applications.
    • Complicated global testing: Global testing requires that each dependent service be tested first. This can be partly assuaged with automated testing.
    • Difficulty in debugging problems: Debugging requires inspecting each service log independently, increasing the workload.
    • Deployment challenges: Microservices are written in a variety of frameworks and languages and require distinct resources, scaling and monitoring, making orchestrating the deployment challenging.
    • Large versus small product companies: Though the benefits of microservices are invaluable for large companies, adopting a microservices architecture creates overwhelming complexities leading to slower implementation and unnecessary cost increases for small companies.
    • Higher costs: Without careful and strategic planning, cloud service bills may balloon due to the increase in data stemming from intraservices calls and the increase in resource requests to account for scalability and lack of friction.
    • Cultural changes: Microservices require the company to have an agile DevOps culture.

    As microservices architecture provides a better way to manage growing data sets, leverage cloud storage and automation and deploy solutions fast, microservices are usually preferable to monoliths. However, they might not always be the best choice for an organization. Before opting for microservices, a careful examination of your company culture and business objective is imperative.

  • How to Minimize Latency and Its Impact on UX

    How to Minimize Latency and Its Impact on UX

    Latency can have an enormous impact on user experience. Here’s what you need to know to mitigate latency before it impacts your customer experience

    Businesses have been digitizing for decades, but recent events have accelerated the process beyond all expectations. Customers are now using more digital services than ever, and their switching costs are often extremely low. That puts enormous pressure on businesses to deliver not just online services but also consistently high performance. Businesses that once measured performance in seconds now measure it down to the millisecond and even the microsecond. For that reason, they’re eager to minimize latency and its impact on their bottom line.

    Latency can be defined as the delay before a transfer of data begins following an instruction for its transfer. However we define it, its effects are clear: A study by Amazon found that 100 milliseconds (ms) of latency cost 1% in sales. A similar study by Google found that a half-second (500 ms) lag in returning search results reduced traffic by 20%. A study by Loadstorm shows that latency can have similar effects on any business’s conversion rates. Long latencies lead to abandonment of shopping carts and frustrated users leaving your site to find the same information, product or service elsewhere.

    The moral: As businesses try to convert users and move them through their pipeline, latency can be the greatest enemy. But how do you measure it, and what can you do about it?

    Measuring Latency

    Given the impact of latency on the user experience, it’s surprising how many businesses don’t give it enough attention—or even measure it properly. A common mistake is to focus on average performance, which is ultimately a theoretical measurement that might not reflect actual end user experience.

    A better, more meaningful, way to measure real-world latency is with percentiles.

    Latency is typically calculated in the 50th, 90th, 95th, and 99th percentiles, commonly referred to as p50, p90, p95, and p99. Imagine 10 latency measurements: 1, 2, 5, 5, 18, 25, 33, 36, 122, and 1000 milliseconds (ms). A p50 measurement represents the median performance of the system. In this case, the p50 measurement is 18 ms, meaning 50% of users experienced that latency or less. The p90 measurement is 122, meaning that 9 of the 10 latencies measured less than 122.

    Each measurement within a given percentile reflects a real latency that actually impacted the experience of at least one, but likely many more end users.

    By contrast, the mean of our 10 measurements comes to roughly 125 ms, not even close to the midpoint in the observed data–in fact, slightly above the 90th percentile.

    It is vital to keep in mind the outliers, what are called “long-tail latencies.” Under real-world conditions, p99 (and higher) latencies are often the ones you need to worry about most.

    Gil Tene, the CTO of Azul Systems, addresses this problem in his presentation, “How NOT to Measure Latency.” He notes that p99 latencies can easily impact a far larger than expected proportion of users. If a typical user session involves five page-loads, averaging 40 resources per page, about 18% of users will experience at least one response longer than even the p99.9. He also points out that the average response percentile is experienced by more than 95% of users will be the p99.97 latency.

    As Google engineer Luiz André Barroso put it:

    “When a request is implemented by work done in parallel, as is common with today’s service-oriented systems, the overall response time is dominated by the long tail distribution of the parallel operations. Every response must have a consistent and low latency or the overall operation response time will be tragically slow.”

    In other words, the slowest operation in a set of parallel operations usually defines the user experience. It doesn’t matter that 99% of the operations finish quickly if the other 1% holds everything up. This explains why it’s not enough to keep p95 latencies blazing fast. You have to keep long-tail latencies (p99 and up) consistently low as well.

    Causes of Long-tail Latency

    To fix the problem of long-tail latency, we need to understand why it occurs. Long-tail latency has many causes, but, significantly, it is not usually caused by application-specific problems or normal network lag. Instead, long-tail latency has systemic causes, usually related to problems in the underlying infrastructure. These can include pauses due to Java Virtual Machine (JVM) “garbage collection,” context switches, database repair, cache flushes and so on. This makes long-tail latency very tricky to diagnose and fix, as it’s often a “whack-a-mole” exercise.

    Disk I/O and Network Bottlenecks

    The main causes of long-tail latency are network and system bottlenecks. IT commonly invests heavily in the best components available: great solid-state drives (SSDs, and associated NVMes), CPUs and memory. But it often shoots itself in the foot by configuring a “narrow” network that bottlenecks all that highly performant hardware.

    SSD settings are also commonly misconfigured. Cloud SSDs have two associated throttles: burst and sustained. Background operations such as streaming and compaction can chew up the sustained throughput, which may be 1/10 of burst. While the backend process hogs I/O, there is no capacity left for frontend, user-induced operations. While some transactions will be able to use the burst capacity,  the steady-state frontend traffic will start backlogging and eventually time out.

    Speed Mismatch

    Database performance is strongly influenced by the combined speed of CPU and memory on the one hand and disk speed on the other. CPU tends to be faster, while disk tends to be slower. SSDs are catching up with CPUs, but the rule still generally holds.

    Speed mismatch is a more common problem with write workloads bounded by disk speed. This can happen either because the disk is slow or because the payloads are large. Large payloads shift the bottleneck to the disk. When the time comes to write to disk, any relative disk slowness will cause queries to back up in the buffer. This will result in outlier p99 latencies.

    Exceeding Your Latency Budget

    Every system is designed with a “latency” budget, which is the ratio of latency to throughput. p95 and p99 latency are a function of the throughput a given system is designed to support. You can think of this ratio in terms of highway traffic and throughput as the number of lanes on the highway. More lanes mean that the highway can support more vehicles, and hence more trips. That’s throughput. Latency is defined by the speed limit. Having many lanes combined with a slow top-speed reduces the overall number of trips. The ratio between the two defines the latency budget.

    Ideally, if you just add more throughput you should be able to reduce latencies, right? Well, not necessarily. Just like traffic on freeways can expand to fill an extra lane, still leaving you stuck in a traffic jam, you can easily overwhelm systems that weren’t designed well to begin with, even if you try to add more throughput. In fact, trying to add more throughput can degrade all of your latencies. In the routing world, that sort of poor architectural consideration is called bufferbloat.

    If a system is trying to add too much throughput while other bottlenecks still exist in a system, then you only end up with longer latencies, even to the point of transactions timing out. That can exacerbate a bad situation since all failed transactions will attempt one or more retries.

    Systems that handle big data have several considerations. These include the most obvious hardware-oriented factors; storage (the reason why NVMe SSDs are widely prevalent these days, for example), CPU cores, memory (RAM) and network interfaces.

    Modern servers running on Intel Xeon Scalable Processor Platinum chips are common across AWS, Azure and Google Cloud. Server needs are based upon how much throughput each of these multicore chips can support.

    Additional considerations get into how your database system was designed to handle data distribution and replication for high availability, peer-to-peer versus leader/follower designs, how it minimizes hops and redirects between servers, effective use of caching, how it efficiently it utilizes all the hardware available to it and so on.

    These are all components that define a system’s latency budget. It’s important to understand and stay within those limitations. When they are exceeded, outlier latencies are virtually assured to occur.

    Latency and the Database

    So far we’ve treated long-tail latency as a systemwide phenomenon. Now let’s consider the role of the database. Most HTTP and API requests result in at least one, if not more, database calls, often a mix of reads and writes. Hence, the database plays a central role in the end user experience of latency.

    NoSQL databases were invented specifically to address the need for low-latency, globally distributed data stores. The basic premise of the NoSQL database is the ability to “scale out” on cheap, commodity hardware. When more capacity is needed, administrators simply add servers to database clusters. This simplicity, however, has morphed into a vulnerability. Clusters often grow out of control, resulting in a phenomenon called “node sprawl.” The architecture of the first-gen NoSQL databases actively encourages larger clusters of less powerful machines. From the perspective of latency, this architecture virtually ensures inconsistent p99 performance due to more internode traffic, context switches, disk failures and network hiccups, all of which create latency outliers.

    One database that is particularly susceptible to this problem is Apache Cassandra. First, Cassandra is implemented in Java, making it vulnerable to pauses caused by garbage collection (GC). Some monitoring teams even have a dedicated metric devoted to GC stall percentage. Compaction and repair operations, which become more onerous in larger clusters, add to the outliers that plague Cassandra deployments.

    Second, Cassandra has limited ability to utilize modern hardware for compaction and streaming. Since Cassandra is an “append-only’ system, keeping data coherent for reads requires a compaction process. Servers with a large number of cores are readily available on public clouds, IaaS and for on-prem deployment. However, Cassandra can’t scale compaction linearly with the increased number of available cores, so it cannot effectively utilize those larger servers. This limitation results in higher read latency due to the need to deploy many more smaller servers in the clusters.

    Since Cassandra exposes settings for storage media, JVM heap cache and concurrency on read and writes, the burden is placed on administrators to properly configure the system for specific workloads. When workloads are unpredictable and spiky, administrators must constantly tune the Cassandra cluster to optimize read and write latencies.

    Many IT organizations turn to external caches as an aid to insulate end users from the poor long-tail performance of their databases. Caches are often used to enhance read performance but write latencies derive little or no benefit. Transactional systems, which depend on real-time performance, cannot drop mutations, so caches offer no help. Transactional systems depend on low long-tail latency for writes as well as reads. If spikes are too frequent, the client experience deteriorates, becoming very sluggish.

    Still, front-end cache for reads is often a necessary evil, to the point where it is treated as obligatory. However, maintaining coherence between cache and persistent storage is a well-documented hassle that can easily bog down operations and negatively impact customers. The best approach is to identify a system that intrinsically combines cache and persistent storage in a way that optimizes performance and data integrity.

    Winning the Battle for Consistently Low Long-Tail Latency

    With these issues in mind, there are a number of guidelines your organization can follow to minimize long-tail latency.

    • Design a system that ensures the lowest p99 latency based on your organization’s current and future throughput targets.
    • Don’t ignore performance outliers. Embrace them and use them to optimize system performance.
    • Reduce the number of components in your architecture, from redundant cache systems to bloated hardware infrastructure. Shrink database clusters by scaling vertically on more powerful hardware.
    • Adopt database infrastructure that scales linearly with your resources: CPU, memory, storage, network and number of nodes in the cluster.
    • When using database-as-a-service (DBaaS) offerings, look out for “scaling bloopers”—points at which you can’t scale linearly and have to increase spending beyond the marginal benefit you get from the system.
    • Make sure your DBaaS vendor can offer multi-region deployments, so you can utilize the offering near your application, eliminating long-haul data traffic. While this will not reduce latency within a database, it will reduce end-to-end database latency between the database and the client application.

    Latency often gets short-shrift in IT calculations because it’s so poorly understood and so badly measured. But you can’t ignore it. It does its damage whether it’s recognized or not (and the less you recognize it, the worse damage it does). Luckily, as we’ve seen, there are good ways to measure latency and squash it down to size. With the right metrics and an informed strategy, businesses can turn what used to be a fearsome adversary into a customer-experience advantage.

  • SaltStack Looks to Automate DevSecOps Processes

    SaltStack Looks to Automate DevSecOps Processes

    SaltStack announced today it has integrated its automation framework with a variety of third-party security platforms to further the adoption of best DevSecOps processes.

    Mehul Revankar, director of product management for SaltStack, said version 6.3 of SaltStack Enterprise provides integration with offerings from Splunk, Tenable, Qualys, Rapid7 and Kenna Security. Data generated from vulnerability scans conducted using tools from Tenable, Qualys and Rapid7 can be directly imported into SaltStack Enterprise to inform automated DevSecOps processes, while integration with Kenna Security makes it easier to automate and prioritize vulnerability remediation based on the level of risk.

    Revankar said that latter capability is crucial because remediation efforts should not be prioritized based on the severity of a vulnerability alone. For example, a vulnerability may be discovered in an application that sits behind a firewall, but if that application doesn’t provide access to the web an organization may decide to not patch that vulnerability immediately regardless of its severity because the risk of a breach is still relatively low, he said.

    These capabilities will enable SaltStack Enterprise to serve as a foundation for providing security orchestration, automation and response (SOAR) capabilities within the context of a DevSecOps process by making it easier to incorporate cybersecurity within the context of a larger playbook for automating the management of IT, he added.

    Most of those playbooks will be developed by DevOps teams in collaboration with cybersecurity professionals, noted Revankar.

    In addition to improving DevSecOps processes, SaltStack hopes to make it easier for external applications such as Splunk and Datadog to consume data generated by its framework by providing compatibility with Prometheus, an open source IT monitoring tool developed under the auspices of the Cloud Native Computing Foundation (CNCF). A SaltStack Enterprise Splunk add-on tool has been added to the Splunkbase repository.

    SaltStack is also making available a performance and health dashboard to enable DevOps teams to track 25 SaltStack Enterprise metrics that are surfaced using the Prometheus data format.

    The open source Salt framework on which SaltStack Enterprise is based has emerged as a popular option for automating IT processes. Because it is based on Python, the barrier to adoption for Salt in terms of programming expertise is comparatively low to other programming languages. As such, more IT operations teams have been inclined to learn Python to leverage Salt to automate processes.

    Like most vendors that have adopted open source business model, SaltStack extends the capabilities of Salt via an enterprise edition that it both extends and provides commercial support.

    Interest in IT automation is on the rise as organizations of all sizes look to maximize what limited cybersecurity resources they have and cut costs. IT automation in the form of SOAR presents an opportunity to consistently apply cybersecurity policies more broadly without having to increase the size of the IT organization.

    The challenge, of course, is having the expertise required to build a playbook. In the case of open source frameworks, many of those playbooks are shared among the members of a community such as Salt. Regardless of how those playbooks are acquired, it’s clear that as IT becomes increasingly more complex most IT organizations are not going to be to do without them.

  • Cloud Foundry Foundation Updates CLI to Extend DevOps Processes

    Cloud Foundry Foundation Updates CLI to Extend DevOps Processes

    The Cloud Foundry Foundation (CFF) today released an update to its command-line interface (CLI) that will enable DevOps teams to build more granular and complex workflows spanning multiple processes across the open source platform-as-a-service (PaaS) environment.

    Announced at the Cloud Foundry North American Summit, version 7 of the Cloud Foundry CLI employs updates to the application programming interfaces (APIs) exposed via the Cloud Foundry PaaS to invoke package, droplet, build and process control resources while adding resources such as sidecars, manifests and deployments.

    The updates to the CLI and associated APIs will make it possible to enable rolling application deployments, run multiple processes within the same container and add metadata to objects.

    Chip Childers, executive director of the CFF, said most of the organizations that have adopted the Cloud Foundry PaaS are already fairly advanced when it comes to implementing best DevOps practices. The latest version of the CLI will make it possible to tighten DevOps feedback loops within the PaaS environment.

    In general, CFF is positioning the Cloud Foundry PaaS environment as a common framework for building and deploying applications on traditional virtual machines and Kubernetes clusters. The CFF has launched an incubation project, dubbed KubeCF, that enables a virtual instance of the Cloud Foundry runtime to be deployed on Kubernetes. At the same time, the CFF has made available Project Eirini, another incubation project that enables the Cloud Foundry scheduler to be replaced by Kubernetes, and Project Quarks, which allows the CF Application Runtime to be packaged using containers.

    The CFF has also launched Cloud Foundry for Kubernetes (cf-for-k8s), a more ambitious effort to replace the underpinnings of the PaaS environment with a Kubernetes foundation. That initiative should result in Cloud Foundry requiring much less IT infrastructure to be deployed. The CFF has also committed to embracing other cloud-native technologies such as the Istio service mesh.

    As part of that effort, the Bosh framework that the CFF created to automate the deployment of its PaaS will also eventually be replaced by a framework optimized for Kubernetes environments.

    Childers said it’s now clear Kubernetes will mature to the level required to support an enterprise-class application development environment. The opportunity now is for IT vendors such as VMware, SUSE and others to deliver an application development environment that makes developers more efficient than any other on cloud-native infrastructure, said Childers.

    For example, VMware today is making available a public beta of the VMware Tanzu application service for Kubernetes based on the cf-for-k8s project.

    Contributors to the CFF project are clearly trying to make up for lost time. Rival PaaS environments such as Red Hat OpenShift have long been integrated with Kubernetes. The CFF community, however, is betting more enterprise IT organizations will embrace Kubernetes once they discover various distributions of a PaaS environment they already rely on is available on that platform.

    Whatever the path chosen, the one thing that is clear is the Cloud Foundry PaaS is about to become a lot more accessible to organizations that, no matter how great the developer experience, previously balked at its overall size.