Category: Blogs

  • Eclipse Foundation Delivers on Jakarta EE Promise

    Eclipse Foundation Delivers on Jakarta EE Promise

    The Eclipse Foundation today announced the general availability of Jakarta Enterprise Edition (EE) 8 Full Platform and Web Profile specifications and associated technology compatibility kits (TCKs).

    Announced during the JakartaOne Livestream virtual conference, Jakarta EE 8 is the follow-on open source platform to JavaEE that provides a foundation for building cloud-native applications using a familiar Java construct.

    Mike Milinkovich, executive director of the Eclipse Foundation, said the availability of Jakarta EE 8 represents a milestone in that it is the first official release of a full Jakarta platform since Oracle agreed to give up control of Java EE to the Eclipse Foundation.

    Its specifications are fully compatible with Java EE 8 specifications and include the same application programming interfaces (APIs) and an instance of Javadoc using the same javax namespace. Its TCKs are based on, and fully compatible with, all Java EE 8 TCKs. Jakarta EE 8 will not require any changes to Java EE 8 applications or their use of javax APIs. The specifications were developed under the Jakarta EE Specification Process, which replaces the Java Community Process (JCP) for Java EE.

    The Eclipse Foundation is announcing the certification of Eclipse GlassFish 5.1, an open source compatible implementation of the Jakarta EE 8 Platform. Eclipse GlassFish 5.1 is fully tested under the open source-licensed Jakarta EE 8 TCKs for the Full Platform and Web Profiles.

    IBM today also announced that Open Liberty, an open source implementation of the WebSphere Liberty application server, has been fully certified as being compatible with Jakarta EE 8 profiles. All vendors in the Jakarta EE Working Group, including Fujitsu, IBM, Oracle, Payara, Red Hat and Tomitribe, have committed to certifying their Java EE 8-compatible implementations.

    Milinkovich said Jakarta EE 8 should drive a wave of innovation as more than 10 million developers who already know Java employ the platform to build cloud-native microservices that can be deployed using containers on Kubernetes platforms. In fact, he said, the number of cloud-native applications based on microservices that will be built and deployed in the enterprise will soon accelerate. As that transition occurs, the number of organizations embracing best DevOps processes to manage those applications also should significantly increase because the rate at which Jakarta applications will be built will be faster than Java applications historically have been built.

    Collectively, Milinkovic also noted that despite the rise of rival programming languages, these and other forthcoming efforts will drive a resurgence in interest in Java programming languages that will ensure Java’s continued dominance of enterprise IT environments for many years to come.

    Of course, the primary reason IT vendors are excited is they no longer need to pay royalties to Oracle. It’s not clear how much of those savings might be passed on to IT organizations. What is apparent is that organizations that are required to employ open source technologies whenever possible are going to be a lot happier now that Jakarta EE 8 has finally arrived.

    — Mike Vizard

  • Agile and DevOps Success Needs Continuous Testing

    Agile and DevOps Success Needs Continuous Testing

    One of the central ways to progress an agile transformation is to introduce continuous testing. With all such changes, it is cultural as much as technical. The expected outcomes are less broken builds and reduced time from break to fix, as well as a yardstick for measuring the team’s ambition for improvement.

    The Testing Bit and the Continuous Bit: Testing should be part of any agile developer’s skillset; the shift is to apply it to the whole build pipeline. Continuous implies automation, with the build featuring as a living thing whose state is always changing. The infrastructure options have expanded with the advent of cloud computing and virtual containers.

    Let’s say your teams’ developers work on components, independently buildable and testable chunks of the whole app or service. They receive stories and tasks to improve a customer journey and then add functionality to implement these. And when done, they check their work into your team’s code repository.

    Starting with One Developer, One Laptop and One Test

    The initial testing focus for a single developer (or pair) working on code will be the unit test and the coverage test. Whether writing the test first or code first, the unit test pokes the bounds of the new code and the coverage test checks that all code paths are exercised.

    As an example, maybe the developer has implemented the “customer wants to deposit money” story on an accounts component of a banking system. The tests should check what happens if a user deposits zero, negative or fractional money and the coverage confirms the tests have wandered down all possible the code paths of the new feature. In this way, coverage tests also prevent a developer from adding code without introducing the corresponding tests.

    At this point, it is worthwhile making sure tests are run as part of the build so every time the developer builds the code all the unit tests are run. This is a fairly standard thing for most build systems to do. The bottom line is the chance of checking-in breaking code is greatly reduced.

    Now the Bigger Picture

    The new code worked on your developer’s laptop, the tests passed and they checked-in the code. But in a busy enterprise team, other developers are also working on the same component, maybe even on the same file. This is no different from working on a book chapter with several authors. Your developer worked with a stable snapshot of the code. It is quite possible changes were made by others that conflict with the changes your developer just made. So how do we proceed?

    This is the purpose of the central build. The job of the central build is to check out all code for that component, build it and run all associated tests whenever new code is checked in. In today’s world, the likely path would be to create a container on a cloud server, where the component can be built from scratch, and then all the tests run against it. Traditionally, a tool such as Jenkins would watch for git check-ins and kick off a build. The result is the team always knows if the overall build is green (working) or red (broken). A developer must understand the central build is the true source of truth, not what is happening on their laptop. So, the latest check-in leads to a correctly built component. What next?

    There are three general types of testing needed to develop a software system. Tests that make sure new features work correctly and don’t break the component, tests that make sure the components still work with each other and those confirming the customer journeys your component participates in all work as expected. There would be no point in making a deposit function without a customer journey test that proves a customer can deposit cash with the system.

    The second type of testing, usually referred to as integration testing, needs an environment where all current successfully built components can communicate with each other. Today, that may mean some form of container orchestration with the system’s components placed and managed in their containers. Tests of a customer journey may involve emulating the customer’s manipulation of a website or mobile app, depending on how the application or service is accessed. These are the tests stakeholders are most interested in as they confirm what has been requested in the stories actually work. As with integration testing, these tests may be run less often.

    I Mock Thee

    Mock (or fake) services and data are a necessary part of the testing process, and usually, must be maintained and extended as part of the testing. A feature story may require a developer to spend more time developing or extending a mock service than writing the code it helps test. For example, a mock account with some transaction history is needed to test a new deposit function.

    Live environments can never be entirely simulated in test environments. Sometimes a live service uses a paid for third-party service, and it would be too expensive to use in testing. It is usually the case that the development staff are not permitted to work with live customer data.

    The Build Is Alive

    All the structures mentioned are just products of one simple attitude: “How do I know if this works?” For continuous testing to thrive, engineers should always question whether every part of the system is being tested and whether the tests are being evolved at the same pace as feature development. When tests or mocks are missing, an agile team refers to technical debt. This is as it implies, something that must be paid for later.

    When team members realize they cannot just check-in code and go to lunch without checking the central build, that is a good sign. Information radiators such as large screen displays of the build state should be used to get the extended team to understand the state of the build is everyone’s concern, throughout the lifecycle.

    — David Eastman

  • Virtual Instruments Aims to Meld DevOps, ITSM Worlds

    Virtual Instruments Aims to Meld DevOps, ITSM Worlds

    Virtual Instruments today announced additions to an IT management platform that leverage machine learning algorithms to identify application drift and dynamically right-size virtual machines.

    Tim Van Ash, senior vice president of products for Virtual Instruments, said version 6.2 of the company’s VirtualWisdom platform is part of an ongoing campaign to meld the traditional world of IT service management with best DevOps practices using an AIOps platform. As part of that effort, Virtual Instruments last month acquired Metricly, a provider of tools for monitoring cloud costs in real-time.

    The latest update to that platform also adds tools to monitors, reports, forecasts and alarms against the capacity consumption rate of any application, while a capacity forecast alarm now allows IT teams to specify how many days, weeks or months they wish to be notified prior to potential capacity exhaustion occurring on any one node or cluster.

    Finally, Virtual Wisdom 6.2 provides access to updated VirtualWisdom Proactive Dashboards that provide access to Smart Charts, through which the AIOps platform now supports annotation, linking and smart naming in addition to topology views that are specific to a set of IT infrastructure or an application.

    Van Ash said the Virtual Instruments approach to AIOps is that it allows IT teams to respond to changing application conditions in real-time and set granular limits on how much capacity can be consumed by any particular application. For example, IT teams can ensure that specific applications are given a Platinum-level preference that prevents any other application from consuming resources allocated to that application, he said.

    In general, Van Ash said Virtual Instruments is pursuing an application-centric approach to AIOps that will make it easier for IT organizations to optimize IT infrastructure capacity dynamically. Rather being overly focused on utilization rates and tracking events, AIOps platforms need to be able to address the entire IT life cycle as it relates to the value that IT environment has to the business, he said, noting today many DevOps teams are building and deploying applications with little regard or actual control over the service levels those applications need to achieve and maintain. The goal, he said, is to provide a single platform through which DevOps and IT operational teams steeped in legacy IT service management (ITSM) models such as ServiceNow can collaboratively achieve a common set of goals.

    A day of reckoning is coming for proponents of DevOps and IT teams that have built sprawling IT environments employing ITIL-based processes. Those ITIL-based processes are not especially flexible, but they have been employed successfully to roll out applications at scale consistently. Advancements in AIOps should go a long way to bring the two schools of IT management together by making it easier to bend the available IT infrastructure resources to the will of multiple application developers trying to share a common pool of resources.

    In the meantime, no one should expect AI to solve their problems magically overnight. It takes a while for algorithms to solve all their IT headaches. However, the days when the relationship between developers and IT operations teams could be described as mostly contentious soon may be coming to a merciful end.

    — Mike Vizard

  • The State of DevOps Report 2019 Is Out

    The State of DevOps Report 2019 Is Out

    The Accelerate State of DevOps Report 2019 is out like every other year. Now, let’s talk about the key findings of this year’s survey:

    • The Industry Continues to Improve, Particularly Among the Elite Performers: Proportion of high performers have tripled, now comprising 20% of all teams. This shows the improvement is real for those who really are doing the right things.
    • Delivering Software Quickly, Reliably and Safely Is at the Heart of Technology Transformation and Organizational Performance: It is evident that speed, stability and availability leads to organizational performance in terms of profitability, productivity and customer satisfaction.
    • The Best Strategies for Scaling DevOps in Organizations Focus on Structural Solutions that Build Community: High performers favor strategies that create community structures at both high and low levels of organization. Having established community of practices, having proof of concepts, helps them become more resilient and successful. Dojos are becoming more and more important.
    • Cloud Continues to Be a Differentiator for Elite Performers, and Drives High Performance: The use of cloud as defined by NIST Special Publication 800–145, is predictive of software delivery performance and availability. High performers are 24 times more likely to execute all five capabilities of cloud computing:
      1. On demand self-service
      2. Broad network access
      3. Resource pooling
      4. Rapid elasticity
      5. Measured service
    • Productivity Can Drive Improvements in Work/Life Balance and Reduction in Burnout, and Organization Can Make Smart Investment to Support It: To support productivity, organizations can foster a culture of psychological safety and make smart investments in tooling, information search and reducing technical debts through flexible, extensible and viewable systems.
    • There Is a Right Way to Handle the Change Approval Process, and It Leads to Improvements in Speed and Stability and Reductions in Burnouts: Heavy weight change approval processes such as CAB, negatively impact speed and stability. In contrast, having a clearly understood process for changes drives speed and stability, as well as reduction in burnouts. It is nice to see ITIL 4 has adopted this best practice, and the CAB there is no longer mandatory.

    The study was done on varied departments and industries.

    Software Delivery and Operational (SDO) Performance

    Over the last 6 years, a set of key metrics has been developed to measure SDO performance which provides a high-level system view of software delivery and performance and predict an organization’s ability to achieve goals. Last year, one operational metrics were added and found this measure helps delivering superior outcomes.

    This puts the focus and proves operational performance adds to the overall performance of the organization and helps in achieving the outcomes. Availability becomes an important component to recognize the outcome and co-create value. In ITIL 4 we also find this being brought out in the Service Value System. Importance of operations in adopting DevOps is very important.

    The SDO for Elite Performers as per the Accelerate State of DevOps Report 2019

    This year the report has shown two research models to help drive improvement in both improvement in performance and productivity.

    Use of cloud has been one important factor. How it is used leads to the benefit generated out of it.

    The Five Essential Characteristics of Cloud-Related Result:

    Only 29% of the respondents who said they use cloud infrastructure agreed or strongly agreed they met all the five essential characteristics of cloud computing as defined by NIST.

    The report talks about technical practices.

    Executing for maximum effect:

    • Concurrent efforts at team and organization levels
    • Continuous delivery using automation
    • Team-level technical capabilities
    • Organization-level technical capabilities

    Factors within are:

    Importance of architecture still remains important at organization level. Relook at the change process, it’s an important point highlighted in this year’s report. Use of cloud services is giving more improvement. DR testing is as critical as any other testing.

    Change management needs to be tuned to facilitate continuous delivery. It should not be heavyweight and on the other hand do not compromise risk. Points to be looked at in change management are:

    1. Implementing segregation of duty
    • Use Version Control
    • Use Infrastructure as Code
    1. Role of CAB becomes more strategic
    • Helping teams to implement capabilities that improve performance by providing guidance and resource
    • Weigh important business decisions that require a trade-off or sign-off at higher levels of the business
    • Shifting detailed code review to practitioners and automation and providing more time for strategic decisions to leadership
    • Transition from gatekeeper to process architect and information beacon
    1. Clear change process with proper delegation of authority

    Psychological safety helps in improvement of performance.

    This report talks about improving productivity. How do we improve productivity? The following factors can help:

    • Useful and easy-to-use tools
    • Technical professionals and tools
    • Internal and external search
    • Technical debts

    Finally, the approaches to improve–heatmap of DevOps transformation strategies by performance profile.

    Learn more about the Accelerate State of DevOps Report 2019 and attend the DevOps India Summit 2019 to hear the global experts.

    — Niladri Choudhuri

  • DevOps Experience 2019: Peace, Love and DevOps

    DevOps Experience 2019: Peace, Love and DevOps

    DevOps Experience 2019 is coming, and it’s gonna be groovy, man.

    This year’s virtual event is all about peace, love and DevOps understanding, with a heavy emphasis on understanding. As with last year’s event, DevOps Experience 2019, sponsored by DevOps.com parent company MediaOps, is chock full of information and education for those in the DevOps space, presented in a virtual reality environment. DevOps Experience is a true virtual conference, complete with theaters to view the keynotes and presentations, a conference lobby to chat and socialize and a virtual trade show floor with virtual exhibitor stands equipped with videos, downloads and company representatives on hand to share information.

    And perhaps the greatest thing about DevOps Experience 2019? You don’t have to leave the comfort of your desk.

    DevOps Experience 2019 will feature keynotes from a lineup of DevOps luminaries including:

    • John Willis, CEO & Founder, Botchagalupe Technologies
    • Nicole Forsgren, Research and Strategy, Google Cloud
    • Jayne Groll, CEO, DevOps Institute
    • Gary Gruver, President, Gruver Consulting

    Additional speakers will include Alan Shimel, MediaOps Editor-in-Chief and Founder, DevOps.com and Security Boulevard; and Chris Miller, Principal Security Program Manager, Veracode. In addition, the event will feature a number of Spotlight Sessions with topics designed to provide even greater value to attendees.

    This daylong virtual event is a great way to mix with others in the DevOps space without the hassle of traveling. It’s also a perfect excuse to wear your Grateful Dead t-shirt to the office.

    DevOps Experience 2019 is scheduled to be held Thursday, Oct. 10 at 10 AM EST, at a computer or mobile device near you. Visit the website for more information or to register for this daylong event. Registration—which is free, by the way—also includes access to the event on-demand.

    So pull on those bell bottoms, weave some flowers into your hair and join us for what’s sure to be an educational DevOps lovefest. Peace.

    — Charlene O’Hanlon

  • Aspects of Machine Learning on the Edge

    Aspects of Machine Learning on the Edge

    Machine learning (ML) is hard. Making it work within the confined environment of an embedded device can easily become a quagmire unless we consider, and frequently revisit, the design and deployment aspects crucially affected by ML requirements. A bit of upfront planning makes the difference between project success and failure.

    For this article, our focus is on building commercial-grade applications with significant, or even dominant, ML components. Edge devices, especially ML enabled ones, don’t operate in isolation; they form just one element of a complex automated pipeline.

    You have a device, or better yet, an idea for one which will perform complex analytics, usually in something close to real time and deliver results as network traffic, user data displays, machine control or all three. The earlier you are in the design process, the better positioned you’ll be to adjust your hardware and software stack to match the ML requirements. The available tools (especially at the edge) are neither mature, nor general purpose. The more flexible you are, the better your odds of building a viable product.

    Let’s start by describing a hypothetical device and we’ll work through some ML considerations of the design. As we discuss the design, we’ll visit and revisit DevOps automations that go hand in hand with these other engineering processes.

    A Smart Security Camera

    For our design, let’s look at a networked security camera. As an IoT device, it’s continually connected to the internet. We’ll assume our device will have at least 4GB of SDRAM, a 64-bit ARM CPU and run an embedded Linux that supports an Anaconda Python distribution, OpenCV, DLIB and TensorFlow.

    Our ML related goals are first, recording and labeling interesting frames, and second, alerting security personnel to suspicious activity. We are constrained by various physical, environmental and cost factors. To make the best use of the available data, we’ll need to use ML to examine and classify multiple objects from every image frame. We’ll use a cloud service to handle the second goal, so here, ML on the edge concerns image recognition. How should we proceed?

    Process the Images in the Cloud?

    We’ll need to recognize various objects in the frames, such as people, faces, vehicles, etc. Each object set requires execution (inference) of an ML model, which produces a set of bounded, labeled objects. A typical camera will record about 30 frames per second. Couldn’t our camera just send that data to a cloud provider? Ignoring other considerations, this is about 2.5 million images/day; even at a deep discount this would be billed at about $1000 a day, and that’s for each recognition model applied. Clearly, we’ll need to make other choices.

    Let’s start by examining the raw input stream. Each raw 720p (standard HD 1280x720px) frame uses about 5MB, so if we were to send 30 frames/sec over the network we would need an incredible 1.5Gbps connection (about a terabyte every two hours). For full HD and higher, multiply this by four to 10 times. We will not be sending raw, uncompressed video. Our problem is our ML models will only work against individual image frames. Where should we make our trade-offs?

    Video produces vast amounts of data, but very little information in a given frame is new; this is why various compression techniques work extremely well, and raw data reductions of 100-1000x is typical. These reduced rates of 15 down to 1.5 Mbps is fairly reasonable, so perhaps we can do our ML inference using cloud services, as long as we host our own machine instances rather than paying for ML services. Depending on our workloads, we can expect to process 24×7 video for between $50 and $200 per month.

    Having decided to host our ML models in the cloud, we now need to manage a corresponding set of DevOps considerations. Do we have enough compute power to manage the service? How will we scale the workload as the number of edge machines increases? What are the storage and data retention policies? And of course, since we’re dealing with images of people, how will we manage privacy concerns and the associated legal and political ramifications.

    What should bias us toward more cloud processing?

    • Our initial development budget is more limited.
    • Our ML models have not been proven effective in limited processing/memory environments.
    • We need the flexibility to rapidly change the models we use for processing.
    • We know the network connectivity is robust and offline operation is not required.
    • Our budget for cloud services can significantly exceed the cost of our edge hardware.

    The choice between processing in the cloud, or on the edge is not a binary one. Designs can massively benefit from even limited edge computing; in some cases, simple detections (motion/vehicle/human/face) can be implemented on the edge to reduce cloud workloads by orders of magnitude with no loss in utility.

    Can We Do Most of the Work on the Edge?

    If we’re using Python with C library acceleration on our quad core ARM, simple ML models such as face detection (not recognition) may handle 10 to 20 frames/second, but 30/fps on anything like a full sized image will not be possible. Deeper, more complex models won’t fit into our limited RAM, and if they did fit, we could see inference times exceed a second per frame. We’re now faced with the realities of life on the edge: trade-offs.

    Once we’ve committed to placing our models into the edge device, we’ll need continuous integration (CI) and deployment services to support our product. These will let us train and retrain our models in the cloud, automate the process of validating improvements and produce the embedded code that updates the models in our target devices.

    Since we initially used models well suited to GPU based servers, can we just add a GPU to our device? In a word, yes, but with some very real costs. Adopting an alternate SoM with GPU support will provide a magnitude of improvement in inference performance, but will double or treble the unit cost and power consumption will increase. Such changes may incur significant non-recurring engineering as adjustments, rewrites or retraining of the model will be required to take advantage of the new hardware. Non-recurring engineering is a one shot cost associated with a change to a part, assembly or system.

    In some cases we can plug an Intel Movidius Neural Compute Stick (NCS) into a spare USB port and see 5x to 10x boost in per image rates. These are supported by the Intel OpenVINO toolkit, but there will be some development time to get things running and not every model can be made to work.

    The next tool in the box is Field Programmable Gate Arrays (FPGA) development. It’s a chore to incorporate these into our board design, but performance can be equal or better than GPUs (on some models), and power consumption is lower. The Intel OpenVINO Toolkit supports Arria and Stratix FPGAs for DNNs. Pricing can be prohibitive.

    Finally, if our device will be produced in large quantities, it can be worth a few million dollars of NRE to build an Application Specific Integrated Circuit (ASIC). The sunk cost of ASIC design can be huge, but the lower unit costs will make up for it. We’ll go this route only once our design has been proven, locked down and we are sure the market can take the volume needed to break even on these engineering costs. I should note architectural improvements in dataflow processing of DNNs in ASICs, such as Vivienne Sze’s work, show promise for dramatic improvements in weight, power consumption and cost. If you are planning for a longer term, don’t rule out these developments.

    What would make our edge processing easier?

    • Start with low footprint models such as TinyYOLO, MobileNet or SqueezeNet.
    • Accept lower frame rates for image processing in our design.
    • Evaluate the ML models with the hardware specifics and tool sets in mind, up front.
    • Provide automated DevOps services to update models in your devices.

    Building our ML models to run on edge devices will involve significant development costs. Tool chains do not install seamlessly, and it’s common to spend days to weeks tweaking the environments. Development and testing on these platforms tend to be slower and involve more manual steps than we’re used to in our DevOps environments.

    Running models on the edge will increase our DevOps complexity. Our cloud workload will be lower, but now we’ll include cross compilation, embedded code builds, download management of larger images and various additional test and validation stages. These will be on top of the training, load balancing, data retention, privacy and security issues we need to address for a cloud-only system.

    Conclusions

    What else will affect our choices here? The nature of the inputs can really matter. If our camera visualizes traffic on a busy roadway, or people in an airport terminal, we can expect almost every frame will contain something of interest; if we’re monitoring the bottom floor of a parking garage–not so much.

    To recap:

    • Cloud services for video rate ML are cost prohibitive.
    • Integrate DevOps early to complete your product support system.
    • Understand and characterize your input data by volume, scale and importance.
    • Recognize not every model can execute on edge hardware.
    • You have more choices in edge hardware than you thought.

    Although there are still challenges to building more intelligence into devices, it’s important to realize every year these constraints are fewer, the tools get better and the devices become more powerful. A compelling argument can be made that most data processing should occur as close to its source as possible.

    — John Fogarty

  • Weighing the Cost of Improper DevSecOps

    Weighing the Cost of Improper DevSecOps

    Simply put, data breaches are terrible news for companies. And, the costs associated with such attacks continue to escalate. A recent IBM-sponsored report found an average price of 3.92 million per breach.

    Not adapting security automation and vulnerability scanning into development pipelines could have a drastic effect not only on cost but workload efficiency and team morale. With these sorts of headaches, it’s vital to consider the repercussions for not adopting secure (and lean) armaments and auditing procedures.

    Can organizations adopt DevSecOps beyond the buzzword it has become? In this article, we’ll uncover some startling evidence on the state of Kubernetes vulnerabilities and discuss what companies can do to rectify.

    Trends in Kubernetes and Istio Vulnerabilities

    It’s astounding how much in DevOps is left exploitable. Secrets are routinely unknowingly left in the open due to human error. These are the most common gateways for attackers. Plugging these gaps is the first, albeit obvious, step.

    There’s proof of an epidemic, too. A recent study conducted by Alcide ran a live production analysis of over 500 cloud-native environments across the globe. According to their findings, “89% of deployment scans show companies are not using Kubernetes’ secrets resources, with secrets wired in the open.”

    This means the majority of Kubernetes environments share susceptible to data breaches in some form. Among the 5,000 scans run, the Alcide report found secrets are commonly left open in a few areas, including:

    • Workloads that had to connect to cloud resources that exist outside the cluster
    • AWS access keys to connect to those resources
    • Tokens for workloads that require API access to external databases
    • Credentials for S3 buckets

    Gaps in Best Practices for Kubernetes and Istio

    Kubernetes brings many nuances to the table. It’s a sophisticated system, with a wide range of use cases and cloud-native experiences. These require extensive auditing and compliance checks to safeguard deployment.

    According to Gadi Naor, CTO and co-founder of Alcide, Kubernetes requires a good level of expertise. However, “there is a knowledge gap that DevOps doesn’t have,“ said Naor.

    Much of this gap lies in Kubernetes secrets handling and network policies. On top of Kubernetes, service meshes are a next evolutionary leap. Istio, an architecture layer for creating network policies is ten-fold more complex, according to Naor.

    On network policy creation, “75% of the scanned deployments use workloads, which mount high vulnerability host file systems; while none of the surveyed environments show segmentation implementation using Kubernetes’ network policies,” stated the Alcide study.

    These are compelling platforms, but best practices must meet the growing number of potential attack vectors.

    Why You Should Approach CI and CD Security Separately

    Many pundits now link continuous integration (CI) and continuous deployment (CD) together as if they’re synonymous. However, they are separate concepts. Securing them, in the same manner, could decrease overall efficiency.

    Scanning all resources created in the CI phase against security auditing could waste time and resources. For example, if you’re standing images for CVEs and only deploy 20% of those images, that is a lot of wasted exercises.

    Rather than scanning all environments in the CI phase, Naor believes you should focus on scanning 100% of images for CD. Therefore, security tooling is leaner, and anything deployed will be assuredly safe.

    Takeaways on the Cost of Poor DevSecOps

    Infrastructure components such as Kubernetes and Istio are powerful allies to the DevOps minded teams. These environments do come with their nuanced security concerns, which must be addressed. Otherwise, the data breach price tag is high.

    To intercept system frailties before the black hats do, you must consider the following:

    • Scan for the Obvious: Utilize automation to discover secrets, keys, tokens, left in public repositories.
    • Scan in a Lean Way: Maintain a lean security environment that retains your engineer’s attention.
    • CI vs CD: Recognize the security nuances between integration versus deployment.
    • Add Auditing Tooling Strategically: Adopt compliance and auditing tooling that doesn’t create friction with existing developer workflows.

    As Naor said, “Don’t ignore the obvious stuff.”

    — Bill Doerrfeld

  • 4 Challenges OEMs Face When Implementing New Technology

    4 Challenges OEMs Face When Implementing New Technology

    Like many others, the manufacturing industry is moving to a subscription-based business model. This new way of doing business is being referred to as servitization and it is forcing manufacturers to no longer strictly sell new products, but instead sell access to and the outcome those products deliver. This is fundamentally changing the way manufacturers have traditionally done business and is not only encouraging a shift to subscription-based pricing models, but also Products-as-a-Service.

    As manufacturers implement the processes and resources necessary to make servitization a reality, implementing new technology will be key to success–laying the foundation for success today and in the future. More specifically, machine learning and predictive analytics will become especially important for predictive maintenance, process optimization and supply chain management. While there are opportunities to capture a significant competitive edge using these technologies, there are also significant challenges specific to the manufacturing industry. Some of these noteworthy challenges include:

    Efficient and Secure Data Connectivity

    Complex, capital equipment (think construction equipment, agricultural equipment or industrial machinery) is built and designed to last, on average, 30 to 40 years. As a result, these machines must be very reliable. Today, however, the majority of equipment in service has upwards of 20 to 30 years remaining in its lifespan. However, almost none of these products were built or designed for IoT connectivity–creating the challenge of retroactively fitting existing equipment with IoT-enabled parts.

    In addition, a majority of this equipment operates in some of the harshest and most rugged environments in the world. Whether it’s an electro-submersible pump 3,000 feet below the surface of the ocean or a mining truck in a remote mine with little to no cellular connectivity, efficiently connecting this type of equipment to collect relevant data is a difficult challenge and oftentimes cost prohibitive.

    Even if manufacturers manage to connect this equipment, there is an added challenge of doing it in a way that ensures cybersecurity. Rogue elements that could gain malicious access to this equipment could have serious safety and economic consequences–and could even implicate national security in some instances.

    Sparse Data

    Newer machine learning algorithms, such as Deep Learning and Recurrent Neural Nets, have been groundbreaking for capabilities like image and voice recognition. However, these algorithms are also very data hungry, requiring millions–if not billions–of similar data points from millions of users.

    Because complex industrial equipment is intended to last for decades, failures are generally rare. Think about it: There have been just a handful of actual engine failures during flights for the entire global commercial fleet, which amounts to nearly 30,000 aircraft. Assuming an average of 2.5 engines per plane, the global commercial aircraft engine fleet is less than 100,000. While certainly a large number by itself, it is relatively small when considering these engines vary greatly in design and thus any single engine type that could be modeled together would be even smaller.

    Manufacturers of industrial equipment or durable goods also tend to be reluctant to share data, especially if their competition could potentially benefit from it. The challenges of efficient connectivity, rare failures and relatively small numbers of similar equipment in a fleet leads to the sparse data problems in the Industrial IoT (IIoT) realm.

    Domain Expertise

    While domain expertise to successfully apply machine learning and predictive analytics is required in the consumer world, in the manufacturing space, it is much more critical. Machines and processes are designed using physics and engineering principles. And, the context in which machines operate and behave is very important for accurate training models and analyzing results. Without appropriate context, there becomes a “garbage in, garbage out” problem as sensor data and machines alone do not capture or provide any context. This is where domain experts who can make sense of historical data for accurate model training as well as interpreting results are critical.

    The impact of making an incorrect decision can have expensive–and sometimes catastrophic–results that aren’t seen in the consumer-facing domain. For example, re-routing an aircraft mid-flight could cost millions of dollars for an airline. If that decision is made because of bad data and an incorrect prediction, it would be a very costly mistake. For us as consumers, we have some aspect of domain expertise for problems in the consumer world, whereas a trained pool of engineers with the relevant design, operational and maintenance expertise is a very small pool. And this, combined with the problem of baby-boomer retirement where expertise is lost at a significant rate, there is a real challenge to capture the knowledge and best practices required to deliver value.

    Data Ownership

    Currently in the manufacturing sector, there aren’t industry standards for data security, ownership or accessibility. Currently, many manufacturers are wrestling with who owns and has access to the data. Is it the manufacturer who designs and builds the equipment? Or, is it the third-party entity that rents and operates it? Or, is it the financial entity that may be the legal owner? What about the supplier that provides a component that is part of a larger piece of equipment (e.g. an aircraft engine that works in conjunction with the aircraft, with each component manufactured by a different entity)?

    Manufacturers being risk-averse in nature, are being very conservative in interpreting and applying the myriad patchwork of regulations being brought in other industries, including data security standards. This is limiting them in adopting more connected processes and strategies. The industry must accelerate efforts to establish industry-wide standards as well as regulatory frameworks for data ownership, data-sharing, interoperability and testing of systems and end-to-end security to overcome the roadblocks for faster adoption of these technologies and realize the promised benefits.

    The shift to servitization will require manufacturers to completely re-think how they operate–new organization structures and skilled resources, new incentive models, new KPIs to measure success and new processes. They will have to become data-driven organizations investing in technologies to connect and track products, collect data and efficiently analyze massive amounts of operational and service data, using technologies like IoT, machine learning and predictive analytics. This will strain manufacturers’ existing organizations and IT infrastructures, necessitating investment in highly scalable, cloud-based solutions to lay the foundation for a successful future. Manufacturers that embrace these changes will be the winners, while others will struggle to stay relevant. In fact, the ones that can successfully adapt to these paradigm shifts will be able to gain significant competitive advantage and market share.

    — Vivek Shah

  • DORA Report: DevOps Maturity Levels Rise

    DORA Report: DevOps Maturity Levels Rise

    The annual DORA report on DevOps shows a marked increase among Elite performers compared to last year

    The DevOps Research and Assessment (DORA) arm of Google Cloud today published the results of an annual survey that suggests there have been marked gains in the level of DevOps maturity.

    The “2019 Accelerate State of DevOps Report,” an annual global survey of 31,000 IT professionals, finds 20% of the respondents now consider their organizations to be “Elite” DevOps performers, up from a comparatively paltry 7% a year ago.

    The Elite group reported their organizations routinely make multiple code deployments per day. By comparison, low performers reported deploying code somewhere between once per month and once per six months. The normalized annual deployment numbers range from 1,460 deploys per 365 days for the highest performers to seven deploys per year for low performers. Effectively, Elite performers deploy code 208 times more frequently than low performers, according to the DORA report.

    The report also finds Elite performers need less than a day of lead time to make a change to an application, compared to 2,555 hours for low performers, and Elite performers reported a change failure rate of 0% to 15%, compared to 46% to 60% for low performers. Finally, elite performers are able to recover from an incident 2,604 times faster than low performers.

    Nicole Forsgren, DORA Lead, Research and Strategy at Google Cloud, said the study makes it clear DevOps best practices are now crossing the proverbial chasm in IT. Organizations that are furthest along in making that transition tend to set up “communities of practice” within their organizations through which DevOps best practices are shared across teams, she noted. The DORA report also makes it clear elite performers automate and integrate tools more frequently into their toolchains on almost all dimensions.

    Forsgren said the study also makes it clear that the practice of slowing down the rate at which code is developed to achieve higher-quality application deployments is not nearly as effective as employing lighter-weight change processes to lower the amount of code getting deployed at any one time. Slowing down the rate at which code is developed and deployed is not a good strategy, she said, because as the amount of code that needs to get deployed at any time increases, reliance on heavyweight processes to deploy that code usually results in more errors being made. A lighter-weight approach provides the added benefit of reducing the amount of technical debt any organization is likely to incur at any stage of the DevOps process.

    The increased rate at which organizations are embracing best DevOps practices naturally coincides with the rise of more complex cloud-native applications. Most of those applications are being built using microservices that create a lot of dependencies within that application environment, with different development teams often working in isolation on specific microservices. The only way to manage that level of complexityeffectively is to embrace DevOps processes, noted Forsgren.

    In fact, the DORA report finds Elite performers are 24 times more likely to have met all cloud characteristics as defined by the National Institute for Standards and Technology (NIST) than low performers. Organizations that meet all essential cloud characteristics are 2.6 times more likely to be able to estimate the cost to operate software accurately. They also are twice as likely to be able to identify their most operationally expensive applications easily, and 1.65 times as likely to stay under their software operation budget, the study finds.

    Clearly, best DevOps practices is one of those rare IT gifts that simply keeps on giving.

    — Mike Vizard

  • Why DevOps Implementation is Often Unsuccessful – and How to Fix It

    Why DevOps Implementation is Often Unsuccessful – and How to Fix It

    Much like “blockchain” and “big data,” the term “DevOps” is another buzzword currently being thrown around the IT departments of large organizations.

    Many have identified the need for faster software development life cycles; a more precise process closely aligned with business objectives, allowing for clearer workflow and collaboration between the development and operations teams. DevOps is essentially agile, all grown up and ready to take on the constantly innovating and rapidly deploying needs of the modern business.

    For security professionals, it’s a fantastic initiative: We can inject security into the process far earlier, reducing the cost of fixing bugs and avoiding potential catastrophe down the track.

    The problem is, few companies are truly successful in their DevOps implementation. Without the right support, nurturing and understanding across the business, it can quickly become a white elephant, you know, one of those “don’t mention the war” projects.

    So, what’s the problem? There are a few ways to approach DevOps that I believe will make for much smoother sailing. An effective program goes beyond a few fancy new tools, titles and team meetings. It’s not always going to be easy but taking the time to fix a broken strategy (or implement it the right way from start) is going to be far less painful in the long run. Ultimately, it’s going to result in higher quality and more secure software.

    Let’s break it down.

    Let Go of the Agile Apron Strings

    There is somewhat of a misconception that an organization must choose between agile or DevOps, setting down one path or the other, never to look back.

    The thing is, the development process works best when both are being considered and implemented as one. DevOps is not a reinvention of agile development; rather, it is an extension of it. The wheels tend to fall off when there is an expectation the process will be exactly agile, or completely different from agile.

    Agile supports the principle of cross-functional teams, bringing designers, testers and developers together from the beginning and committing to open communication lines throughout a project. Its aim is to stop siloed delivery and reduce double-handling, both of which are benefits of the DevOps process as well. However, DevOps goes a step further, introducing systems, security and operations into the mix to offer a robust, end-to-end skillset that had the ultimate goal of full, functional software delivery to the customer.

    During the inevitable pain-points of moving to a more DevOps-centric process, the risk of siloed development can crop up again. You can often have the original agile team working together, with the security and operations additions still finding their way in the machine. No one is quite sure how to include them, what they should be doing and their overall objectives.

    DevOps does not work without clearly defined objectives, cross-functional onboarding and direct communication with all parties. There will be an adjustment period requiring careful change management but getting everyone on the same page with the enhancements DevOps functionality will bring is half the battle.

    Increasingly, DevOps is placing emphasis on security best practice as part of the process as well, demystifying that step and bridging the gap between the security team and everyone else. As I have said before, we still have a long way to go in empowering developers to code securely from the start, but the successful implementation of DevOps methodologies is an excellent foundation on which security skills can be built within the development team.

    Automation Isn’t Everything (and It’s Not the Most Secure)

    Another feature of DevOps methodology is, to a certain extent, the automation of the software development process. Continuous integration and continuous delivery (CI/CD) principles are the cornerstones of this concept, and as you can likely guess, very reliant on tools.

    Tools are awesome. They can bring unprecedented speed to the software delivery process, managing the code repository, testing, maintenance and storage elements with relatively seamless ease.

    However, while robots might take all our jobs and imprison us someday, they are definitely not there yet. Heavy reliance on tools and automation leaves a window wide open for errors. Scans and tests may not pick up everything, code may go unchecked and that presents enormous quality—not to mention security—issues down the track. An attacker only needs one back door to exploit to steal data, and forgoing the human element in quality and security control can have disastrous consequences.

    The happy medium is to ensure you have a balance of people and tools. Tools should serve as the assistants to a team you trust to deliver on project goals. You should:

    • Allocate enough time for people to become familiar with the chosen DevOps toolchain.
    • Focus on effective collaboration (and how the tools can support that).
    • Address any gaps in the process, whether they are skill/knowledge or tool-based.

    In short, don’t just tool up and hope for the best.

    DevOps Isn’t a Buzzword, It’s a Culture – Are you Growing Yours?

    Change management is tough at the best of times. Fear of the unknown can stop even the most brilliant team members from growing their skills and expanding their horizons.

    You see, merely saying “let’s do DevOps” and making the operations team move desks isn’t going to magically implement a successful process. Many will be confused, and long-serving members of the team will be left feeling disgruntled. Communication of expectations is crucial, as is walking the walk. DevOps represents a cultural movement just as much as a development methodology, and a team should live and breathe a cross-functional, collaborative mindset.

    What does a great DevOps culture look like?

    • Individuals are empowered to lend their expertise to a process, not just leaders.
    • Open, honest and respectful communication between teams.
    • Each person takes responsibility for the overall objective of building quality and security into the development process.
    • Everyone is on the same page with the definition of DevOps in the business, the roadmap and how/what/why of each person’s role.

    For years I have emphasized the importance of building positive security cultures in development teams, and DevOps is no different.

    The right tools, knowledge and support are imperative to achieving security best practice, seeing a downturn in discovered vulnerabilities and opening the team’s eyes to the importance of protecting our data. With DevOps, you must lay the cultural groundwork for positive change: Ensure everyone understands their role, value and expectations, the overall project goals and steps in the process.

    Have you mastered that? Great. Now, let’s shift the needle, dial up the security aspect and make DevSecOps the ultimate plan for software excellence.

    — Pieter Danhieux