Category: Blogs

  • Dev loves Open Source. Ops needs Scale. Now What?

    Dev loves Open Source. Ops needs Scale. Now What?

    Crossing the divide from Dev-Ops to DevOps:

    At the heart of the divide between Dev and Ops are the very different needs and constraints of each organization. Traditionally their day-to-day lives are very different. So are their war stories. And so are the metrics that are traditionally used to judge Dev and Ops. Predictably, the two organizations can end up internally competing with one another over (among other things) resources and IT automation tool selection. Part of the driving force behind the DevOps movement is to reduce this unproductive internal competition. Even with the increased levels of trust and communication that DevOps fosters, IT Operations teams will still have different criteria for IT automation than their colleagues in Dev.

    My company is considering implementing (or has just implemented) an open source configuration management tool. That’s great for Dev. But as far as I can tell my job, and my team’s job, is about to get a LOT harder

    ~ VP IT Operations

    Dev loves Open Source:

    Take configuration and release automation as example. Like so many other areas of enterprise software, many developers naturally gravitate to open source options. It’s no wonder that 90% of code in modern applications is open source – after all, open source provides developers with

    • Immediate gratification: Just Google it! Choose the right key words to describe your situation and you might find a good match.
    • Community: Don’t reinvent! Find out what have others done.  Opinions and suggestions might be plentiful across your favorite user groups. Maybe someone has solid sounding advice. Maybe someone even has specific settings or scripts that they have used. If so, you might be in luck.
    • Free: Enough said.

    But while Dev is drawn to prebuilt open source components that they can then modify,

    Ops has completely different needs including scale, stability, support, security and speed.

    Let’s look at each of these in turn:

    • Scale: It’s great that the code works in Dev and in Test. In Operations, I need it to work everywhere, all the time. And we need to add 10s of thousands of servers with no new resources.
    • Stability: Don’t force me to rebuild my infrastructure to be stable in a production environment.
    • Support: Someone, somewhere needs to be on the hook for this software, with enforceable SLAs. This cannot be left to chance. I need a phone number. Now.
    • Security: Failure is not an option. Our financial future and reputation is on the line. We cannot allow our customers to become vulnerable due to security issues. According to a study by Forrester Research, consider:
      • “One out of every 16 downloads of open source component requests are for a component with a known vulnerability.”*
      • “31% of companies have had or suspect a breach in an open source component, gaining control over open source risks is essential to improving security.”*
    • Speed: We need quick time to market and low total cost of ownership that comes from quick learning curves.

    In the context of configuration and release automation, can we satisfy both Dev and Ops?

    Yes. Here’s why:

    A new generation of application configuration automation solutions have been introduced in recent years. (To be transparent my company, OrcaConfig is one of these).  These solutions cater to Ops’ need for fully supported, central, secure control, ecosystem visibility, workflow automation and compliance enforcement – all at enterprise scale and without relying on open source, community driven scripts.

    But what about Dev’s needs?

    I will answer a question with two questions.

    1. Does Dev need open source?
    2. Or do they want the benefit that open source often brings?

    If those sound like product requirements document (PRD) type questions, they should. In an era with tightening constraints on budgets and headcount, selecting the wrong tool based on incorrect assumptions is a major self-inflicted wound.

    These next generation DevOps solutions provide Dev with application-centric modeling (after all it is all about the application), templated workflows (immediate gratification) and versioned full stack configurations (time and money savings) while providing accountable, knowledgeable support (community is great. Community and support is even better.)

    While there are no silver bullets in the drive to DevOps success, my hope is that we can dispense with the open source “requirement” and instead focus on needs and results.

  • Win – Win

    Win – Win

    Women in Tech

     

    Here are some other ROELBOB’s you might like

    RoelBob150x120

     

    A Unit Testing Dillema 

    The Pink Slip

    Another Pink Slip

     

    Hot off the Press – Other great DevOps.com content

    HotPress

    DevOpsSec: 1 in 16 Chances

    CIOs Must Fight for Relevance in Face of Tech Storms

     

    Upcoming DevOps.com Events

    Events

    Webinar: SecDevOps: The Marriage of SecOps and DevOps

    — ROELBOB

  • DevOpsSec: Survival is Not Mandatory

    DevOpsSec: Survival is Not Mandatory

    Deming, the patron saint of DevOps once advised, “It is not necessary to change.  Survival is not mandatory.”

    To survive, application development teams are constantly pressured to deliver software even faster.  But fast is not enough.  The best organizations realize that security, quality and integrity at velocity are mandatory for survival. Hence, DevOpsSec

    My aim here is to leave you uncomfortably amazed.  While the pace of development has changed significantly, our processes to secure our applications has not changed enough.  It is as if a wildfire has raged uncontained for years now but we have failed to take notice.

    Maybe that sounds a bit crazy, but once I share a little background on what is happening, you’ll understand why innovation in this arena is critical for survival (when it comes to your applications).  If you are aiming to ramp up your own Rugged DevOps or DevOpsSec practices, this is critical reading material.

    Skyrocketing Usage, Plummeting Visibility

    Open source component use in development is skyrocketing, and for good reason.  Over 17 billion open source and third-party components — across the major development languages — were downloaded last year helping development teams accelerate release timelines and deliver more innovative solutions to market.  To better imagine the impact of this download volume, you need to understand that there are an estimated 11 million developers responsible for the billions of downloads.

    While the magnitude of usage is amazing it has obscured a vast majority of the risks.  Of the billions of downloads recorded last year, 1 in 16 components downloaded had known security vulnerabilities.

    Screen Shot 2015-11-30 at 1.23.55 PM

    While we have seen 30x growth of download requests over the past seven years, we have also witnessed huge growth in the number of organizations improving the speed of consumption and efficiency of their downloads using repository managers.

    In the past 18 months since I joined Sonatype, we have seen active instances of repository managers like Nexus, Artifactory, and Archiva grow from 40,000 to over 70,000 installations, with users in the millions — also for good reason.  Development teams want to ensure faster, more reliable builds.  They also need a private and safe place to house and share their own proprietary components as well as assembled applications, images and other binary outputs.  The repository manager has established itself as a parts warehouse for software development.

    All is Not Moonlight and Roses

    1 in 16 may not sound like a lot until you recognize that many organizations are downloading over 250,000 components every year…some of the largest organizations consume millions of them.  If you have not calculated this in your head yet: 250,000 / 16 = 15,625.

    Screen Shot 2015-11-30 at 1.24.07 PM

    Couple this fact with the remarks in the 2015 Verizon Data Breach and Investigations Report stating that applications were the most often exploited attack vector by hackers.  As a developer community we are electively sourcing known vulnerable components for use in our applications and those applications are now more vulnerable to attack.  

    Your Repository Manager Should Serve and Protect

    If bad components are getting in, why not just stop them at the front door?

    Easier said than done.   Current approaches to preventing such behavior are ineffective.  For some, “golden repositories” are used to house approved components — but components approved once are rarely vetted again for newly discovered vulnerabilities.  For other organizations, OSS Review Boards mandate reviews and approval for all new components — but these organizations are poorly staffed to match the volume and velocity of consumption leading to workarounds by development teams.  And while developers themselves would much prefer to use the best quality, highest integrity components when designing an applications, they are never allocated sufficient time to investigate the vulnerability status of every component required for their latest build.

    Sparking Innovation

    When current approaches fail, inspiration often sparks innovation.  

    Enter, a new invention: a repository firewall.  Think of it as a repository manager with a guard at the front door.  Every component that gets downloaded by a proxy repository is automatically evaluated against the parameters development, governance and security teams establish.  Does it have an AGPL license, include a known security vulnerability, or is it incredibly outdated?  The repository firewall allows organizations to download “good” components while it blocks and quarantines “bad” component downloads.  Using a repository firewall can keep your repository manager and development lifecycle safe and secure – in an instant, automatically.

    The first repository firewall of its kind is called Nexus Firewall.  It couples software supply chain intelligence about component quality, security, and risks with automatic evaluations against personalized policies for approving or rejecting new downloads.  Evaluations can also be applied later in the development lifecycle where staging repositories are in use.

    Screen Shot 2015-11-30 at 1.12.58 PM

    Imagine the result: 16 out of 16 downloads, or 250,000 out of 250,000 downloads are now of the best quality.  Everything flowing into your application development lifecycle contains the highest quality components.  You are instantly compliant with established policies.  Your applications are less vulnerable to attacks.  You are automatically reducing risk.

    Next up in this series, I will share insights about Repository Health Check reports (free to use).  Used by over 15,000 organizations, they can offer organizations the first clue as to whether or not your team could benefit from a repository firewall.  

     

  • How do you identify gaps in your testing?

    How do you identify gaps in your testing?

    Every piece of software ships with some defects in it, but major gaps in your testing coverage can be disastrous, and they can occur for a variety of different reasons. Part of the problem with a typical root cause analysis is that it comes after the fact. Perhaps the customer has complained, there’s been a big outage, or the software quality simply isn’t where it should be. But reactive firefighting like this isn’t the most effective use of your resources.

    What if you could identify those gaps earlier in the testing process and dynamically shift strategy to close them before they cause major issues?

    The best possible start

    Lack of domain knowledge and an incomplete understanding of the purpose and intent of a piece of software is enemy number one. There are two ways you might consider mitigating this risk in order to get a good start:

    1. Automated Testing – Identify critical core functions and automate mundane repetitive tests in order to free up your testers to leverage their experience and domain knowledge to break the system.
    2. Exploratory Testing – Context driven testing encourages critical thinking and collaboration. Testers have to understand what the application is trying to do, they have to learn about the intent and direct their efforts at the most important areas.

    Making sure you build a solid foundation, understand the software, and define your scope at the outset can take time, but it will be time well spent.

    Communication and assessment

    The traditional approach with gap analysis is to start with a problem and trace it back. In theory, you should learn from your mistakes and avoid repeating them in the future, but it doesn’t always work that way. It’s also a great deal more time-consuming and expensive to identify and fix problems when they’re already released. There’s no reason you can’t apply the same logic from root cause analysis earlier in the process.

    The earlier testers are involved, the better. There should be wide-ranging discussions during the planning phase that include the development team, the business team, and the test team. This is an excellent opportunity to ensure that everyone understands the workflow of the new software, what it’s supposed to deliver for the end user, and where the priorities lie for validation and testing.

    By including testers from day one, you reduce the chance of misinterpretation and give yourself an opportunity to spot potential gaps or misunderstandings. But the communication and assessment has to be continuous throughout the project, the second it slips, you’re running the risk of a gap opening up. You need to make sure that communication, collaboration, and mitigation are an integral part of your process for each new sprint or cycle.

    Developing process oversight

    In order to ensure that your coverage is tight, and to immediately flag possible gaps, you need to have a good test data management strategy in place from the beginning. You need to be using analytical tools, like Jira, QMap, or VersionOne. Regardless of the tool in play, what you want is a complete record of all your manual testing activities. The ability to generate reports or visualizations of your coverage, and to analyze it from different business perspectives, is absolutely vital.

    Where are most of the defects coming from? How did you find them? How critical are they? Where are your efforts being concentrated? What topics are trending in tester’s comments? Are you seeing the same questions or recommendations popping up over and over again?

    There’s a good chance that you’re collecting this data anyway, but keeping an eye on all of it in real-time should enable you to strategize effectively about where to focus your resources. The best approach is never carved in stone, it should continually evolve throughout the development lifecycle. Rigorous and regular analysis presents an opportunity to identify gaps as soon as they begin to form, instead of waiting until they cause a problem and then tracing it back. It’s about taking a proactive approach instead of a reactive one.

     

    About the Author/Mush Honda

    fixed_Mush_Headshot-cropMush Honda is QA Director at KMS Technology, a provider of IT services across the software development lifecycle with offices in Atlanta and Ho Chi Minh City. He was previously a tester at Ernst & Young, Nexidia, Colibrium Partners and Connecture. KMS services include application management, testing, support, professional services and staff augmentation.

  • All Systems Fail*

    All Systems Fail*

    Vince Lombardi once said, “It’s not whether you get knocked down, it’s whether you get up.”  But in today’s world of high velocity development and release practices, it’s also about how fast you can get up.

    Today, we are seeing more news about sites from major online retailers and service providers like HP, Target, PayPal and Neiman Marcus going down.  High site traffic, poor configurations, scalable architectures, and well planned recovery practices all come into play.

    But the best organizations have been failing repeatedly for some time now…on purpose.  Organizations like Amazon, Google and Netflix practice regularly for application, system and site outages.  In fact, Netflix has baked continuous failures into its operations through an internally developed Simian Army.  While it might seem unconventional at first, failing all the time allows them to succeed.

    Our CTO here at Sonatype, Josh Corman, often reminds us that “All Systems Fail*”.  For those that take this to heart and prepare for the inevitable, they can be better prepared to recover.  In fact, for the best prepared, recovery can be so seamless, it is a continuous part of their operations.

  • DevOps Chat: 7 habits of successful DevOps

    DevOps Chat: 7 habits of successful DevOps

    I recently had a chance to speak again with Sam Guckenheimer of Microsoft about his experience in leading the transition for Microsoft Visual Studio to Visual Studio online. In doing so, Sam and his team developed the 7 habits of successful DevOps.  You can listen to my interview below or read along below that. Also if you want to download the Microsoft paper on the 7 habits of successful DevOps you can do so here.
    [soundcloud url=”https://api.soundcloud.com/tracks/234949072″ params=”color=ff5500&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false” width=”100%” height=”166″ iframe=”true” /]

    Hi, everyone—Alan Shimel, DevOps.com, here for another DevOps Leadership Chat, and I’m joined today by Sam Guckenheimer of Microsoft. Sam, welcome.

    Interviewee:                 Hey, Alan. How are you doing?

    Interviewer:                 I’m doing well. It’s good to speak to you again. The last time we spoke was at the DevOps Enterprise Summit out in San Francisco.

    Interviewee:                 Yep, that was a lot of fun. That was a great conference.

    Interviewer:                 Yes, and you know what? I think—well, you contributed to making it great, Sam. It was a great presentation you made, talking about, kind of documenting the journey of Visual Studio from a COTS, you know, traditional kind of software model to a SaaS based program, Visual Studio Online. And, you know, I think that’s something that a lot of our listeners may be interested in, and how do they turn their current software offerings into SaaS based. And along the way, of course, you’ve come up with a, I guess you call it the Seven Successful Habits of DevOps?

    Interviewee:                 Yeah, so we think about the seven habits that we’ve applied as we’ve done our transformation. We started around 2010, we were in the, if you will, the pinnacle or the leader’s quadrants on all the analyst assessments as a provider of software for on-prem use in what was then called ALM—application life cycle management. And we said, “Hey, we need to become a great SaaS provider as well.”

    So we think of things in terms of these seven habits that we need to provide. Three of them you can think of as sort of Agile on steroids or second decade Agile. That’s team autonomy and enterprise alignment, is number one. We work in scrum teams or feature crews, think about 8 to 10 engineers and a product owner. They autonomously pull items from a common product backlog, and at the same time, they align to enterprise goals on a six month planning cycle, we call this a semester or a season, where we know, in that time frame, what are the needles we’re trying to move for the business? What are the things we’re trying to do at the epic level that count, and Sprintly we measure, how are we doing against that, and the things that each feature crew is doing are counting against that. They may move forward, they may move backward, they may decide, based on the data they’re collecting to do more or do something else. But you know, that’s in their control based on the things we’ve agreed for the six months.

    The second habit we have is a rigorous management of technical debt. We’ve known about technical debt for a long time, but when you’re running a service, you really can’t afford to let any debt creep in, and you have to stay clean all the time. So we make sure that we’re constantly monitoring both what’s happening in the production service and what’s happening in the development process. So if, for example, there is anything on the live site going wrong, we attend to it immediately. If there’s anything happening in the development process, like a feature crew is letting its bug count start to ride up, they have to stop immediately, fix the bugs, and can’t do any new work until they get them down to zero, so we stay clean on tech debt as we’re going.

    The third habit is a focus on the flow of customer value. We’ve talked about this since early days of Agile. Now, with SaaS, we can measure it. So we have great telemetry in the service, and we look at how people use our software, both quantitatively as we’re going forward; that is, we actually observe what gets used, what doesn’t get used, what the scenarios are, and we reach out to customers qualitatively, where we engage with the high usage accounts and we say, you know, “Let’s talk to them.” And we encourage our engineers to buddy up and reach out and say, you know, what’s gone well, what’s gone not so well, what would you like us to do that you don’t see? Are there things you wish for that we could be doing for you, and so on.

    So we reach out to customers, we listen to them through things like UserVoice and we observe their behavior through telemetry on a continual basis. That’s all kind of Agile on steroids.

    Interviewer:                 Mm-hmm.

    Interviewee:                 You know, those are the first three. Then you get to the stuff that’s really new with devops. The first is, of those, number four is what I’d call hypothesis driven development or a backlog that gets groomed with learning. This is what Eric Ries, in Lean Startup, calls “build, measure, learn.” So, in other words, the idea is that the backlog, instead of being the just, you know, what an omniscient product owner things is right, it’s—we recognize that it’s a set of hypotheses or beliefs. We think that these things will improve our service, but we’re gonna treat them as hypotheses and we’re gonna turn those hypotheses into experiments, and we’re gonna collect data against those experiments so that we can substantiate or diminish the hypothesis, and that data will be evidence gathered in production. That’s the fifth practice—everything is evidence that we need in order to build up or draw down against those hypotheses. We look, we use instrumentation on everything, we use telemetry on everything, and we measure it against what’s important.

    So, for example, if we think something’s gonna be a better sign of experience, we will run the new against the old in parallel, and we may, if we have multiple front doors, like in our case we have a web experience and an experience through the IDE, the integrated development environment, we’ll run those in parallel. So that would be a four cell test, you know? New and old, web and IDE, and we’ll see what the evidence shows us about how much better the new is than the old, and hopefully the new is better; it might not be. Hopefully we’re right, but sometimes we’re wrong. In any event, it’s the data that will tell us, and it’s a “bring your data” world.

    So, evidence gathered in production is our fifth habit, and that is made possible by our sixth, which is what we call a production first mindset, or what Satya, our CEO, calls a live site culture. The idea of a live site culture is that the site status is always first priority, and with site status, you have two goals. If there is a live site incident, you want to, as quickly as possible, remediate so that customers aren’t affected, and you want to drive to a root cause analysis. Practice the 5 Whys like Toyota, get to the root cause, and identify the actions that you need to take in order to prevent a recurrence of such an incident or something similar, and those root cause actions that you take, you need to complete in one or two sprints so that you’re hardening the service as you go learning from the live site incidents so that you’re always getting better.

    That’s number six, and finally, number seven is that we manage infrastructure as a flexible resource. We can do this because we use the public cloud—of course, in our case, that’s Azure. We work as a customer of Azure just like our external customers would. We take things a little earlier, but otherwise, we’re a customer when we need more resources for development or for load testing or to spin up more labs, we just do it.

    And we continue to expand the number of data centers we run, and we now run our Visual Studio Team Services in eight data centers around the world; that’s out of 24 regions that are currently active in Azure, and we fully automate the deployment, but we start each Sprintly deployment with a canary instance, which is where we work. It’s our own one of those stamps, and the one where our closest early adopter customers are so that we know from the canary if there’s anything wrong with the deployment, and if there is, we then restart at the canary before we roll out to the subsequent deployment rings. And that practice of canary-ing, going big with load testing is part of the deployment pipeline, and then using the automation to roll out in subsequent rings is something that we’ve used to harden the service and let us get to a global scale on a regular basis.

    Interviewer:                 Got it. So, Sam, these are obviously lessons learned the hard way, right, [Laughter] by doing and paying the idiot tax and doing that.

    Interviewee:                 Yes.

    Interviewer:                 For our leaders who are listening to you now, where to begin? Where to start? Obviously you can’t do all seven at once. Some of them are dependent on others. Where do they begin?

    Interviewee:                 Well, I think that the first thing is to make sure you have Agility down. I think you cannot do this if you are a command and control organization that doesn’t really let teams learn, and to recognize that you do need to measure your time to learning along with your other measurements, you also need to totally automate your release pipeline.

    So, the notion that you can have manual steps somehow between a development pushing code or checking in and the release of that is a thing of the past. You know, start with continuous integration and then quickly go to continuous deployment and put the telemetry in place so that you can see the evidence from production that gives you the feedback on everything that’s getting deployed.

                                        If you don’t have those things in place, the rest will crumble.

    Interviewer:                 Yeah, agreed.

    Interviewee:                 Sam, we unfortunately are coming up near the end of our time. I want to ask one more question of you, though, and it’s along the same vein. So, you’ve laid out the steps here for us. How did you get your team’s buy-in on this—or did you?

    Interviewer:                 Well, we certainly did. I don’t think it was very hard. I think that we all wanted to move to this world. I think that there was a broad recognition that we needed to become a first class SaaS provider. I think that there were some additional quirks in our case of being a great SaaS provider while we continue to be a great provider on-prem software, and maintaining that engineering discipline.

    The teams were all for it. I think the leadership needed to recognize that we were investing in new practices and that we needed to maintain the investment in engineering systems and engineering practices so we have a rule of thumb that about 20 percent of our investment goes toward non-customer visible engineering, things like live site work, and we don’t quarrel about that. If we need to do live site improvements, we do them.

    So I would say there was a little bit more work on management to accept the change in practices than there was on the ground with the engineering teams who were sort of chomping at the bit to get going.

    Interviewer:                 Well, there often is in devops, right? You have that “from the bottom up” and getting true top down sponsorship and cover is a problem, right? Not a problem that cannot be overcome, but an issue that we’ve explored previously in our leadership suite here.

    Interviewee:                 Yeah. Yeah, it helps that our, right now, our CEO comes from this world, Satya Nadella, so he is pushing everyone in the company to make the change and to learn the new practices. There were some folks in the middle who were not comfortable, necessary, but you know, they’ve come around.

    Interviewer:                 As they often do.

     

    Interviewer:                 Sam, anyway, we are probably over our time and I apologize, but thank you very much for sharing your Seven Habits for Successful DevOps. Continued success with your Microsoft Visual Online and the rest of your endeavors at Microsoft, and we hope to have you on again some time in the future and we can talk more about leading the transformation at companies around the globe with these new ways of doing things.

    Interviewee:                 Thanks, Alan. I’ll do one commercial, which, which is that there’s a URL, microsoft.com/devops, where you can download an e-book about our journey and a devops self-assessment if you want to read more.

    Interviewer:                 You know what, we’ll include that link in the article, too, in the transcript so people can get that. Sam Guckenheimer, Microsoft—thank you so much for being our guest today.

    Interviewee:                 Thank you very much, Alan.

    Interviewer:                 Okay, this is Alan Shimel for DevOps.com. Thanks, and have a great day.

  • Culture, Behavior and Unconventional Strategy Plays a Major Role in Secure App Development

    Culture, Behavior and Unconventional Strategy Plays a Major Role in Secure App Development

    In today’s fast-paced environment, security often plays second fiddle to deadlines. That means software development doesn’t typically get considered when building secure applications, rather it’s the innovations that can be quickly implemented which take center stage. Unfortunately, ranking short term tactical gain over long term vision is undeniably flawed. Doing so ignores the fact that attacks are more sophisticated than ever before, and applications that have security holes have become a key focal point for those attackers because once a vulnerable application is discovered it becomes easier to compromise a wide set of users at once. But change requires more than drastic measures. It requires an unconventional strategy to adjust culture and behaviors throughout the organization.

    Although the tools and practices to build secure, defect-tested software are maturing, most organizations find internal hurdles to be more daunting. Organizational impediments including process, differing software development approaches, and short-term business drivers – like the need to update apps to reflect the latest must-have features and platform support – make it more difficult to effect meaningful change. Those interested in leading secure development initiatives within their organizations face myriad challenges.

    Step out of your comfort zone to influence culture, process and strategy change

    Often, folks who find themselves in the position to step up to the plate and change culture did not initially plan to do so. The developer who is chosen to lead the charge and establish a process that ensures applications are securely built is extraordinarily smart and devoutly technical. In order to begin changing the world, he or she will need to utilize approaches outside of their comfort zone. Success will rely on the acknowledgement that a full frontal assault on the status quo will not do. Instead, hearts and minds must be won. The skill sets that propel developers’ careers forward must take a back seat to the forces of leadership and persuasion, not coercion, which will ultimately affect the cultural shift in an organization’s application development mindset.

    To effectively change the way organizations build software, an enterprise-wide initiative is required – one that accounts for organizational culture at each step. By taking a step-by-step approach, implementing a successful software security initiative does not have to be so daunting. Five proven best practices include taking a disciplined approach by characterizing the landscape, securing champions, defining standards and strategy, executing, and then sustaining the effort. These steps, as outlined below, will help ensure that your corporate-wide efforts to secure applications are as productive as possible.

    Characterize the Landscape – Understand the task ahead and craft a realistic strategy for adoption within your organization. Whether that be identifying your organization’s compliance framework and cultural norms, to artifacts of the software security and what software development lifecycles you have in place. Being able to characterize your existing landscape allows you to fill the gap between policy and practice.

    Secure Champions – Focus explicitly on the fact that you will need clear support of executive sponsors and other key influencers in the organization in order to be successful. While senior leaders may not understand or care about the minutia of software vulnerabilities, they will appreciate the business impact of a data breach with far-reaching cost, reputation or legal repercussions.

    Define Standards and Strategy – You will only have one opportunity to successfully roll out a secure development initiative, meaning you cannot overlook this step. Conduct a risk assessment of applications owned by your organization to identify the most vulnerable applications to provide some qualitative ranking for decision-making. Having a baseline set of practices and procedures that are well thought out, realistically implemented, and reflect what is realistic in your organization is absolutely critical.

    Execution – So you’ve done your homework, secured supporters throughout the chain of command and in the field, and laid out your strategy and goals. Now comes the hard part – bringing the issue of software security to the forefront through innovative awareness campaigns. Remember, it will be important to show quick wins, highlight positive behaviors, and do it over and over again; ratcheting up expectations and software security with each iteration.

    Sustainment – This follows the successful execution of your software security initiative campaign, which can take between one and two years. To ensure your campaign stays fresh and does not lose momentum, a regular, disciplined update of the regulatory framework must occur. In addition, staying knowledgeable about what is occurring within your organization to determine whether there are new technology risk areas emerging in critical.

    Creating a software security initiative is difficult by any measure. From organizational culture or politics to the status quo bias towards meeting deadlines for new features and functionality, there is no limit to the amount of hurdles that need to be overcome. But by demonstrating the importance of looking long term from a security standpoint and winning the hearts and minds of everyone that plays a role, success can be achieved. Organizations that focus only on the tasks ahead of them do not change the world. Long term vision is critical for organizations that endeavor to strategically move, grow and change the status quo.

  • Bridging the gap between DevOps and Security

    Bridging the gap between DevOps and Security

    Security should be baked into the DevOps process, from tools to skills to collaboration. DevOps and security are not mutually exclusive.

    The problem with digital innovation is that considerations for compliance come later, after the product or service is on the market. From public cloud infrastructure to Internet of Things to mobile apps and even to DevOps, tough requirements like security aren’t built into innovators’ plans. Entrepreneurs are thinking primarily about shiny, new, fast and disruptive. Yet for the CIO and other chief executives accountable to customers, laws and financial markets, managing risk around sensitive data is top priority.

    DevOps processes are at the heart of business innovation: think Netflix, Facebook, Etsy and Nordstrom, all leaders in their sectors. Yet many of the popular DevOps tools and methodologies, whether commercial or open source, haven’t been optimized for the needs of enterprise security. An application running in a container, for instance, will still require attention around configuration to ensure application security.

    As well, many security professionals haven’t yet made the leap to understanding the changing best practices for security in this new world of cloud/agile/mobile IT. Some security experts have imposed barriers to DevOps, by resisting the switch to faster, more iterative development along with the public cloud.

    On the surface, the speed at which DevOps teams are approving and releasing code would suggest an increase in security risks to end users by eliminating rigorous security review phases. Yet managing security, as with testing, is in fact optimal when performed side-by-side with developers as code is being written. By integrating security, people and processes tightly within the continuous delivery cycle, DevOps can do a better job of eliminating loopholes and gaps in the code before production. DevOps tools emphasize the use of frequent and automated processes to improve software quality: also an ideal model for handling security testing and fixes. Determining the best way to merge security with DevOps is a work in progress. The following concepts can provide a framework for getting started:

    1. Use the best of DevOps for security: DevOps, with its focus on automation and continuous integration, provides a more holistic framework for security management. Start by considering security through every step of the development and production cycle. Security professionals can help developers root out design problems in the beginning – such as ensuring all data transport is encrypted. Integrate automated security checks into development, testing and deployment phases, and educate all team members about the importance of incorporating security thinking in their specific job roles. Security should no longer be the last process before committing the code to production.
    2. Investigate new DevOps and Cloud security tools: Fortunately, the security technology industry is ramping up quickly to the needs of DevOps security. Static Application Security (SAS) tools test for security when code is being written while Dynamic Application Security (DAS) tools test for interface risks. A few of the reputable systems include Checkmarx, Veracode and Parasoft. The third area of security automation tools covers penetration vulnerability testing, such as Nessus, developed by Tenable. Other contenders in this area include Qualys and OpenVAS. These tools can integrate smoothly into the software development lifecycle, such as by plugging into Jenkins. By adding automation, security is not only built-in, but doesn’t slow down the DevOps process.
    3. Getting buy-in from security teams: This might just be the hardest part. While developers are incentivized to go faster and do more, security professionals are incentivized to control, monitor and reduce risk. Meeting in the middle is definitely possible – but it will require some opinion shifting on both sides. Developers and product managers will need to understand the importance of working collaboratively with the security team, and in an accountable way. Security people can benefit from a more comprehensive understanding of security in the cloud. This should include continuous education on the new tools and services available today to manage risk and to deliver even higher levels of security than in the past – from better reporting, to API-based security and easier encryption at rest.
    1. Manage tool sprawl: The concept of self-organization is an important one in DevOps, because it fosters a spirit of flexibility and rapid collaboration. Yet this same principle can also lead to environments of dozens or even hundreds of different tools in use to manage deployment, configuration, QA and orchestration. That creates risks for visibility and monitoring as well as standardizing around security controls and access. Engineering leads should help strike a balance between too much and too little governance when it comes to tools and workflows by providing guidelines for tool selection. The DevOps automation infrastructure itself can introduce risks. If a hacker gains access to a tool like Puppet or Chef, he can modify any number of configurations and add new user accounts. Configuration and change management tools must be adequately secured and governed, lest they become a new attack plane.

    With the advent of DevOps, there’s an opportunity at last for security to become an integral and seamless aspect of innovation. We think it’s not only possible but critical to give security the attention it demands in the world of fast IT.

    About the Author/Kris Bliesner

    Kris BliesnerKris Bliesner is CTO and co-founder of 2nd Watch, where he oversees strategic and technical development of 2nd Watch’s cloud-based products and solutions. Prior to co-founding 2nd Watch in 2010, Kris held many top IT positions with companies including Microsoft and Ambassadors Group.

    Connect with Kris: LinkedIn, Twitter, 2nd Watch Blog.