Category: Sponsored Content

  • JFrog’s swampUP 2023: Ready for Next 

    JFrog’s swampUP 2023: Ready for Next 

    In the ever-changing landscape of technology and software development, staying ahead is essential. JFrog has led a pioneering effort to transform DevSecOps since its founding in 2008. Micheline Nijmeh has been chief marketing officer for the past three years, and in that time, she said JFrog has steadily tackled critical issues across the industry.

    “JFrog really started off addressing a pain point, which involved being a software supply chain platform that simplifies the DevSecOps processes by automating the entire software build and release process for large enterprises,” Nijmeh said. 

    On Sept. 13, JFrog will host its marquee event: swampUP. For those anticipating this year’s event, this is more than just a conference. The people heading to San Jose, California, are dedicated to advancing the DevSecOps landscape, and the event is designed to foster a holistic environment for collaboration and learning, Nijmeh said.

    “It really brings everyone together. Whether you’re a DevOps practitioner, security practitioner, as well as leaders and managers, all in one place,” Nijmeh said. 

    Image from swampUP 2022 courtesy of JFrog

    This year’s theme, “Ready for Next,” captures JFrog’s dedication to continuous growth, she added. Nijmeh explained that organizations are always evolving and transforming, and that they need a partner that can grow with them.

    Among the numerous topics that will be discussed at JFrog’s ninth swampUP event is security and DevSecOps, Nijmeh said, adding that “security is top of mind as always.” 

    Several keynote speakers will focus on security, including Bruce Schneier, a security guru and New York Times best-selling author of 14 books.  

    And although security will always be a hot topic, DevOps is expected to generate buzz as well. 

    “We have John Willis, who’s known as the godfather of DevOps. We’re also having folks from Riot Games, Fidelity, Netflix, CapitalOne and others representing their use cases on how they are addressing not just DevOps, but DevSecOps, in some cases,” Nijmeh said. 

    With a star-studded roster of speakers, expectations are sky-high. Furthermore, Nijmeh explained that the show has continued to evolve and has grown to be much more comprehensive. 

    “It’s not just about DevOps, it’s [also] about security. All the way from the left to the right. From development to deployment,” Nijmeh said. 

    For attendees, JFrog has placed focus on actionable insights, as it aims to provide information and tools that can actually be implemented within their organizations right away. SwampUP aims to provide attendees with practical know-how. Although the goal is to be ‘ready for next,’ it’s vital that practitioners and leaders understand what they can do today as well. 

    “Anything that we announce at swampUP will be available to our customers,” Nijmeh said. We’ll be sharing some partner announcements and some new innovations that no one has ever seen before.”

    Image from swampUP 2022 courtesy of JFrog

  • DevOps World: Time to Bring the Community Together Again

    DevOps World: Time to Bring the Community Together Again

    As a framework for building and deploying applications as fast as possible, DevOps has always been in a constant state of evolution. Over the past 10 years, there have been many seminal moments where major leaps forward have been made. As we near the end of 2023, it’s apparent we are collectively experiencing one of those times right now.

    During multiple in-person DevOps World events taking place over the next several months in New York, Chicago, Santa Clara, Singapore and London, we’ll be exploring these advances as we celebrate all things DevOps. It’s always been our great privilege to host the DevOps community, and bringing that community back together to share insights and see first-hand how the latest and greatest technologies are transforming DevOps is an experience that no virtual meeting can ever replace.

    DevOps is, above all else, a commitment to learning. The DevOps community is driving changes in the way applications are built and delivered that transform society. DevOps World creates an opportunity for the DevOps professionals at the forefront of those efforts to see for themselves how a raft of emerging innovations will take DevOps to the next level.

    DevOps World attendees, for example, will be discussing topics ranging from how generative AI will be applied to how changing compliance requirements will impact software delivery. In addition, there will be deep dives into the impact advanced analytics are having on breaking logjams. There will even be demos showing how digital twin technologies will be used to modernize DevOps workflows.

    Just as important, DevOps World provides an opportunity for attendees of all skill levels to network with their peers and advance their education. We all know that virtual training can be challenging. In many instances, there simply is no substitute for being in a classroom with an instructor and fellow students all focused on the same topic at the same time. Careers are made at our DevOps World events. In fact, several sessions will show how investments in the venerable Jenkins continuous integration/continuous delivery (CI/CD) platform will be carried forward into the next era of application development and deployment. 

    Naturally, many of us wonder what our future career paths will look like in the age of AI. It’s already been shown that natural language interfaces will make AI a lot more accessible to everyone in IT. More and more, the bottlenecks and associated manual effort that often conspire to adversely impact DevOps productivity are about to be eliminated. For example: 

    • The days when an engineer was required to create a simple script are coming to an end.
    • The average IT administrator should be able to automate a process using a few simple prompts.
    • Tools will become increasingly intelligent in their ability to detect the root cause of issues without causing alert storms.

    The challenge now is training the large language models (LLMs) needed to apply generative AI to the DevOps domain. CloudBees is proud to be at the forefront of an effort to enable organizations to safely apply AI to DevOps workflows at scale in a way that can be trusted.

    In the meantime, DevOps teams should be evaluating which tasks AI will be able to automate both today and tomorrow. Roles and job functions will evolve accordingly, but DevOps engineer roles are not going to be made obsolete any time soon. Instead, AI will free DevOps engineers to spend more time solving complex issues rather than performing rote tasks that are better handled by machines. A commitment to automation remains a foundational DevOps principle. Anything that can be automated should be.

    As always, luminaries from the global DevOps ecosystem will present at DevOps World. The best and brightest practitioners from across the DevOps spectrum, along with our premier technology vendor partners, will be readily accessible to attendees. The opportunity to learn from others is the whole reason DevOps World events exist in the first place. More than 40 speakers, including DevOps experts from Argonne National Labs, Autodesk, Fidelity Investments, GitHub, Gradle, M&T Bank, MFS, Postman, Software Engineering Institute/Carnegie Mellon, Sonatype and Veeam Technologies have already committed to sharing their insights, and we expect many more as the event approaches. 

    DevOps has never been more crucial for any organization that is dependent on software to modernize than it is right now. The pace at which applications will be built and deployed in the AI era is about to exponentially increase. There will always be a need for DevOps engineers to manage application development and deployment. The opportunity for attendees at DevOps World is to collectively define the next generation of DevOps best practices with AI in mind. Reserve your metro New York, Chicago, Santa Clara, Singapore or London spot at DevOps World today!

  • PlatformCon 2023: This Year’s Hottest Platform Engineering Event

    PlatformCon 2023: This Year’s Hottest Platform Engineering Event

    PlatformCon 2023 is just around the corner, and the hype is building. The biggest, brightest platform engineering conference of the year was born to celebrate the 15k+ platform engineering community and is set to be an incredible two days, packed with captivating talks from renowned industry speakers. Building on the success of last year, the free virtual event will welcome thousands of platform engineers and practitioners worldwide on June 8th and 9th, and dive deep into the latest trends, best practices, and innovative solutions in platform engineering.

    What to expect 

    PlatformCon 2023 aims to take platform engineering skills to new heights. Attendees will get the chance to connect with industry experts and join a vibrant community of platform engineers committed to pushing boundaries. Participants can look forward to joining live virtual kickoff events for their region and watching all talks at their own pace. In addition, the Platform Engineering Slack channel will provide exclusive access to  speaker Q&A sessions, where attendees can engage directly with experts during the conference. The full schedule is available here.

    The virtual event offers the opportunity to:

    • Engage with top industry speakers, including OpenCredo CEO/CTO Nicki Watt, Defense Unicorn Value Stream Architect Bryan Finster, and OpenSauced Founder and CEO Brian Douglas
    • Connect with like-minded professionals from around the world.
    • Gain fresh insights and innovative ideas for platform engineering projects
    • Explore a variety of tracks and hear top experts in the field share their knowledge and experiences

    Two days, five tracks, hundreds of captivating talks

    The two days will feature five key tracks covering a wide range of topics relevant to building and scaling platforms, including:

    Stories

    Practitioners will share their experience building platforms for real-life enterprise use cases. These talks showcase the platform journey, from initial steps to building and rolling platforms out across the engineering organization. For example, Adobe’s Rohan Kapoor will be we will sharing their journey towards building an Adobe IDP for over 5000 developers as well as current challenges, how they measured productivity, and key learnings from one of their recently launched CI/CD products.

    Tech

    This track features talks that will explore the technical backbone of developer platforms. Speakers such as Susa Tünker from Humanitec will share how to eliminate config drift between environments, while other sessions will discuss how platform teams solve specific problems with specific tools from Kubernetes to IaC, service catalogs to GitOps. 

    Blueprints

    Talks in this track will discuss tried and true platform blueprints. Speakers will showcase key design considerations and how to effectively combine developer platform tools, such as McKinseys Mike Gatto and Stephan Schneider, who will share how to simplify developer platform design with reference architectures. 

    Culture

    This track will be focused on how developer platforms are built by engineers for other engineers. Talks will discuss the cultural aspects of platform engineering, from product management to how it relates to DevOps and SRE. Nicki Watt from OpenCredo is one speaker who will explore the stumbling blocks preventing teams from creating a great Platform-as-a-Product, and what can be done to counteract this.

    Impact

    In this track, speakers will explore the impact and business value of platform engineering initiatives. Key analysts such as Gartner’s Manjunath Bhat will equip attendees with value stories to clearly demonstrate how platform engineering can help accelerate business outcomes, while practitioners will discuss how they secured executive buy-in. 

    Take advantage of this unique opportunity to learn, network, and take your platform engineering skills to the next level. Register today to secure your place and get updates on new speakers, how to get involved, and details for both in-person and virtual meetups. 

     

  • The Google Cloud DevOps Awards: Apply Now!

    DevOps continues to be a major business accelerator for our customers and we continually see success from customers applying DevOps Research and Assessment (DORA) principles and findings to their organization. The DevOps Awards are targeted to recognize customers shaping the future of DevOps with DORA. Share your inspirational story, supported by examples of business transformation and operational excellence, today! 

    With inputs from over 33,000 professionals worldwide and eight years of research, the Accelerate State of DevOps Report is the largest and longest running DevOps research of its kind. The different categories of DevOps Awards map closely to the practices and capabilities that drive high performance, as identified by the report. 

    Organizations, irrespective of their size, industry, and region are able to apply to one or all ten categories. Please find the categories and their descriptions below:

    • Leveraging loosely coupled architecture: This award recognizes one customer that successfully transitioned from a tightly coupled architecture to loosely coupled (service-oriented; microservice) architectures.
    • Designing tools of the future: This award recognizes one customer that has meaningfully contributed to an open source DevOps tool or open source security DevOps tool.
    • Securing the software supply chain: This award recognizes one customer that successfully demonstrates high levels of security implementation based on specific examples of how the organization has worked to secure every stage of the software supply chain. 
    • Growing DevOps throughout your organization: This award recognizes one customer that employed DevOps best practices on one team and were able to scale successfully to more teams throughout the organization over a period of time. 
    • DevOps communities of practice award: This award recognizes one customer that has created a community structure in the organization which makes it easier for teams to share DevOps best practices that work in their organization and make them more resilient to reorganizations and product changes.
    • Going beyond the four keys: This award recognizes one customer that not only shows how they have implemented the four key metrics throughout their teams, but also how they have gone beyond the four keys to demonstrate continuous iteration that drives business success. 
    • Nurturing team culture: This award recognizes one customer that implemented effective processes to improve work/life balance, foster a healthy DevOps culture, and ultimately prevent burnout. 
    • Unleashing the full power of the Cloud: This award recognizes one customer that is leveraging all five capabilities of cloud computing to improve software delivery and organizational performance.
      • On demand self-service
      • Broad network access
      • Measured service
      • Rapid elasticity
      • Resource pooling

    Read more about the five essential characteristics of cloud computing

    • Unlocking the secrets of DevOps: This award recognizes one customer that is able to demonstrate the outside benefits that come from adopting DevOps – aside from the operational and organizational performance improvements. This award recognizes one customer that:

    For example, set out to drive DevOps transformation and found increased DEI representation showing up more in their teams (increasing ppt of underrepresented groups) 

    -OR 

    Discuss how your organization creates unique solutions to help build a more diverse, inclusive, and accessible workplace for your customer, leading to higher levels of engagement, productivity, and innovation.

    • Continuous improvement with DORA: This award recognizes one previous DevOps Award winner that continues to integrate DORA practices and guidance into their workflow using Google Cloud Platform tools and who can deliver software with more speed and better stability to quickly meet end user needs. 

    This is your chance to show your innovation globally and become a role model for the industry to improve. Winners will receive invitations to roundtables and discussions, press materials, special announcements and even a trophy award!

    We are excited to see all your great submissions. Applications are open until January 31st, 2023 so apply for what best suits your company and stay tuned for our awards show in March 2022!

    For more information on the awards visit our webpage and check out The Google Cloud DevOps Awards Guidebook.  Feel free to check out the 2021 DevOps Award winner ebook to learn from the winners of the inaugural Google Cloud Awards!

  • Codenotary Extends Dynamic SBOM Reach to Serverless Computing Platforms

    Codenotary Extends Dynamic SBOM Reach to Serverless Computing Platforms

    Codenotary has extended the reach of its platform for automatically generating software bills of materials (SBOMs) to serverless computing platforms running software constructed using functions.

    Codenotary CTO Dennis Zimmer said because serverless apps are dynamically created, it’s not possible to generate SBOMs using traditional approaches. The TrueSBOM platform makes it possible to create an SBOM in real-time by adding one line to the source code of any application. The TrueSBOM for Serverless edition of the platform now extends that capability to the serverless computing frameworks made available in the cloud by Amazon Web Services (AWS), Microsoft and Google.

    That approach makes the SBOM a part of the application itself rather than a text file that is stored separately, he noted. Each time an application is updated or a scanner discovers a new vulnerability, a new SBOM is automatically generated, added Zimmer.

    Awareness of the need for SBOMs has skyrocketed since an executive order issued by the Biden administration made it clear that federal agencies would require them from software providers starting next year. Many enterprise IT organizations are likely to follow suit as part of a larger effort to better secure software supply chains in the wake of a series of high-profile cybersecurity breaches.

    Most internal DevOps teams already have a good handle on what software components are used within the applications they deploy. The issue is that the organizations that use that software can’t easily verify what components are being used, noted Zimmer. That’s problematic because an organization may prohibit deployment of a specific software component because of a known vulnerability. TrueSBOM allows organizations that use an application to maintain control over their software environment regardless of what software artifacts are used to build closed or open source components, Zimmer added.

    It’s unclear how most organizations will operationalize SBOMs now that more of them are being created. Ideally, organizations should be able to approve only software with components that have been verified as secure.

    As SBOM mandates become more stringent, the number of application providers that are anxious to comply with rules for securing software supply chains should increase. The issue now is finding a way for both the developer and consumer of that software to streamline a verification process that, in its current form, is too cumbersome to manage effectively. As a result, many organizations are now putting together dedicated teams made up of cybersecurity professionals and software developers to manage SBOM processes, said Zimmer.

    Of course, there is a massive amount of code that has already been deployed that today doesn’t show up in an SBOM. While many emerging applications—created using artifacts such as functions and containers—are likely to be increasingly instrumented to dynamically generate an SBOM, the number of legacy applications that might need to be similarly instrumented is several orders of magnitude greater. As a consequence, the amount of effort required to generate SBOMs for every application in use might be greater than teams first anticipated.

  • Why a Low-Code Platform Should Have Pro-Code Capabilities

    Why a Low-Code Platform Should Have Pro-Code Capabilities

    If you want to build a house, you could get a lot done yourself. You could sketch out a simple design, start assembling materials, maybe even nail down some floorboards and install drywall. But to make it truly functional, and to respond to all the unknown fixes — big and small — that would surely arise, you want professional support to enhance and reinforce the job you’re doing. Plus, not everyone is an expert in plumbing and electric.

    The same is true of app development.

    Low-code platforms are available for both professional and less-experienced developers to build apps more quickly than ever. The speed and practicality of low-code has injected a newfound approachability to the coding process, yet can’t account for the full range of user experiences at work within the modern enterprise company of today.

    If this sounds like a takedown of low-code, it’s far from it. As an approach, low-code is transformative. And here to stay. By empowering non-coders (citizen developers), you enable development of responsive web apps using visual tools and pre-built components and save precious development and IT resources.

    Low-code can free IT departments from a constant onslaught of demands and requests for support and create new ways to digitally advance products and services. Plus, IT leadership can be freed up to focus on the strategic needs of the business and maintaining momentum within major digital transformation initiatives. Therefore, it’s worth understanding why not all low-code platforms are the same, and how they’re viewed through the lens of the professional developer and enterprise architect.

    Using Only Low-Code Means You Can Fall Short

    The simple, unvarnished truth is that, when it comes to coding, there is no one-size-fits-all solution. Things are never that simple, or easy.

    There are many crucial components to the app development process that require time, attention and expertise to succeed. The best low-code platforms support the specification of automated workflows and — this is very important — can integrate with various enterprise systems, applications and sources of data. Enterprise systems can be incredibly complex and manage multiple data sets and processes, and some can be outdated. To build enterprise apps with a low-code platform, you need to be able to connect to these systems and customize with the same nuance and security that a pro-code platform provides.

    Take, for example, the Facebook app. While it’s simple and easy to use even on a mobile phone, just imagine all the complexity that makes up the backend: data, algorithms, ad networks, moderation, reporting, etc. — all updating in real-time for billions of users. The same goes for other apps with complex backends but simple front ends, such as those used to manage health insurance companies, retailers, government agency portals, wayfinding apps for big box stores … These are just a few examples that customers of ours offer solutions for built using HCL Volt MX. HCL Volt MX allows organizations to build applications for any audience — consumers, partners and employees, across any device — native mobile, web and wearables. It also provides improved efficiency and higher developer productivity. The platform has robust services for identity, integration, orchestration, business-process automation and rules management. Paired with its low-code design environment, you can create consumer-grade apps across multiple touchpoints — fast.

    Learn more about HCL Volt MX

    Giving developers — and thus, the full enterprise app dev operation — a connected arsenal of front- and back-end tools to design and maintain a dynamic framework includes combining low-code accessibility with power tools that pro-coders expect. Hence, companies can ensure they’re not sacrificing customization, scalability and sustainability, even with the need for design velocity and speed-to-market.

    Bridge Front-End and Back-End Capabilities

    When you are deciding on your approach for delivering your next digital experience, you should have the best of low-code with a pro-code foundation that manages the complete software development life cycle on the terms that a full-stack developer expects. Meaning, you expect the platform to increase your velocity, offer rock-solid security and give you integrated DevOps and automated testing, simplified backend integration and the ability to use advanced technologies such as blockchain, augmented reality (AR) and conversational apps and more, with ease.

    Also, what happens when the application needs features or functionality not included in the pre-built building blocks? How do teams fill in the gaps that inevitably occur when connecting to existing enterprise systems? How will low-code provide the highest level of security over a full range of unique workflows and handle enterprise systems of dizzying complexity?

    In our experience, there is always a time when a full-stack developer experience can get the very most out of the low-code platform, especially when the app demands complexity in the integration and orchestration, needs to scale to millions of users and have a sticky, “pixel perfect” user experience.

    As Simple As You Want, As Expert As You Need

    Professional developers are looking for software that can boost productivity without sacrificing features that allow them to poke around and see what adjustments a given app needs to deliver a full-native mobile, web or wearable app experience. A low-code platform with pro-code support, such as HCL Volt MX, bridges gaps in the entire software development life cycle and brings the business stakeholders, digital innovators, designers and professional developers together to achieve their digital vision.

    You Get the Best of Both Development Options

    • Lightning-fast capabilities for implementing front-end experience, workflows and functions that enable the business to see how their vision comes alive.
    • A professional-grade infrastructure that can respond to the needs of the front-end features and handle the more complex integration and coding demanded by any enterprise business requirements.

    If you’re solely investing in a low-code platform to build web apps, your operation can quickly run out of steam. Being pro-developer grade means you can respond immediately to the intention of the app’s development concept, no matter the complexity and scale required — native mobile, web and wearables. After all, creating apps is never a “one-and-done” pastime; we all know it’s an iterative approach that wins the day. Make sure your low-code platform choice is pro-developer grade.

    Learn how HCL’s Volt MX provides a low-code approach that includes back-end support.

  • AWS Well-Architected Framework Elevates Agility

    AWS Well-Architected Framework Elevates Agility

    What started as a white paper from AWS, the Well-Architected Framework has evolved into a large ecosystem of partners and more

    In the past year, agility has become one of the most prized IT attributes as organizations race to deploy more workloads in the cloud. There is a paradox, however: The faster organizations deploy applications, the more likely mistakes will be made. Cloud computing deployments are rife with misconfigurations that are the direct result of developers provisioning cloud infrastructure rapidly and incorrectly. Application environments are almost never as efficient as they could be.

    The challenge and the opportunity IT teams now face is defining a set of best practices for securely and consistently deploying application workloads on cloud infrastructures that complement and extend agile development methodologies. IT organizations should not have to slow down application development and deployment because of security concerns. Identifying high-risk issues (HRIs) and being able to consistently achieve and maintain security without sacrificing agility is an absolute requirement.

    It seems that Amazon Web Services (AWS) couldn’t agree more. The cloud leader has defined the AWS Well-Architected Framework to help organizations build workloads on AWS that are secure, efficient, reliable, cost-optimized and operationally excellent.

    Through this effort, AWS hopes IT organizations benefit from removing the guesswork for building workloads on cloud. Cloud misconfiguration mistakes that conspire to make organizations question their commitment to agile development methodologies are eliminated. The only remaining issue is finding a set of tools that turn those AWS guidelines into a set of policies that can be achieved and enforced easily.

    Agile Meets Well-Architected

    In addition to making it possible to build and deploy applications faster, agile development methodologies make it possible to test the application code. IT teams gain unprecedented visibility into how applications behave. The equivalent of an application development methodology for managing cloud infrastructure is the AWS Well-Architected Framework.

    The Well-Architected Framework is battle-tested, based on best practices AWS has observed over its 14-year history. The pillars of the Well-Architected Framework are:

    1. Operational Excellence: Under this pillar, operations teams need to understand their business and customer needs so they can support business outcomes. Operations teams create and use procedures to respond to operational events and then validate their effectiveness to support business needs. Those teams also collect metrics that are used to measure the achievement of desired business outcomes. It’s important to design operations to support evolution in response to change and to incorporate lessons learned through their performance.
    2. Security: This pillar focuses on the importance of putting in place practices that influence security before any workload is architected. IT teams need to control who can do what. In addition, they need to be able to identify security incidents, protect systems and services, and maintain the confidentiality and integrity of data through data protection.
    3. Reliability: This pillar encompasses the ability of a workload to perform its intended function correctly and consistently when it’s expected to. This includes the ability to operate and test the workload through its total life cycle. The workload architecture of the distributed system must be designed to prevent and mitigate failures, handle changes in demand or requirements and be able to detect failures and automatically heal itself.
    4. Performance Efficiency: This pillar addresses the need to use computing resources efficiently to meet system requirements and to maintain that efficiency as demand changes and technologies evolve. Teams must gather data on all aspects of the architecture, from the high-level design to the selection and configuration of resource types and make trade-offs in their architecture to improve performance, such as using compression or caching or relaxing consistency requirements.
    5. Cost Optimization: This pillar focuses on how to run systems to deliver business value at the lowest price point. Design decisions are sometimes directed by haste rather than data, and it can be tempting to overcompensate rather than spend time performing benchmarking to determine the most cost-optimal deployment. As a result, deployments can be both overprovisioned and underutilized. Using the appropriate services, resources and configurations for workloads is key to cost savings.

    Each of these pillars requires tools to enable DevOps teams to proactively manage their cloud environments—not only by provisioning and deploying applications faster but also by making more informed decisions when considering trade-offs between performance, reliability, cost and security. It’s a balance as rarely are these decisions independent of each other.

    The COVID-19 Imperative

    The COVID-19 pandemic has made the Well-Architected Framework essential. The number of workloads being deployed on AWS has increased sharply as organizations of all sizes accelerate digital business transformation initiatives. IT projects that once were expected to take months to complete now are expected to be up and running in a matter of weeks.

  • Practical Approaches to Long-Term Cloud-Native Security

    Practical Approaches to Long-Term Cloud-Native Security

    There is no shortage of advice out there about how to secure modern, cloud-native workloads. By now, most developers and IT engineers who work with cloud-native deployments have heard all of the mantras about DevSecOps, shift-left security, multi-layer defenses and dynamic baselining (to name just some of the key concepts that are driving IT security conversations these days).

    One thing is to talk about security best practices and another is to design a cloud strategy that makes it not only possible but also easy to implement them. Even more challenging is planning a strategy that facilitates security best practices over the long term.

    Keep reading for tips on meeting these challenges and devising a long-term security strategy.

    Security Is a Long Game

    It’s easy to think of security as something you have to do in real time. After all, threats and attacks usually happen suddenly, and reacting to them quickly is key to preventing serious damage.

    If your security strategy centers on finding and remediating threats as they appear, you end up stuck in what is essentially a break/fix mode. You’re constantly reacting, rather than being proactive.

    A much more effective security strategy is one that minimizes the threats you face in the first place. That type of strategy requires long-term planning.

    Sure, you will always need to be prepared to detect some threats that you didn’t anticipate, and react quickly in the event a breach occurs. No security plan is perfect, and the unexpected will sometimes still happen. But by focusing as much as possible on long-term security solutions that stop most threats from materializing, you end up with a much safer and more reliable security posture.

    Building a Long-Term Security Strategy

    What does it actually take to implement a security strategy that protects you over the long term? It all boils down to four elements: data, infrastructure, processes and culture.

    Data

    For many organizations, data stored in the cloud is the workload that poses the greatest risk. It’s the reason why there is a seemingly never-ending stream of headlines about major security breaches that involve the theft of sensitive data stored in the cloud.

    Therefore, mitigating threats to data in the cloud is a critical requirement for long-term security. Some best practices in this regard include:

    • Assess your data: Data security starts with knowing what is in your data, and how sensitive the data is. Data cataloging can help with this process, but so can tools such as Amazon Macie, which helps identify personally identifiable information with cloud-based data.
    • Access control: Access control frameworks are another crucial line of defense against cloud-based data breaches. Just remember that simply enabling IAM is not enough; you must also audit IAM policies to avoid misconfigurations that could lead to a breach (which was the lesson learned by Capital One, among others).

    Infrastructure

    These days, we tend to treat infrastructure–meaning the cloud-based and/or on-premise data centers that host workloads–as a relatively generic and interchangeable part of the solution stack. But while it is true that, generally speaking, no one cloud or data center is inherently more secure than another, the way you design your infrastructure plays a key role in your ability to secure modern workloads over the long term.

    Best practices on the infrastructure front, for long-term security include:

    • Immutable infrastructure: Embrace infrastructure platforms, such as ECS or EKS, that make it easy to deploy and update applications in an immutable way. Immutable building-blocks may not work for all use cases, but where possible, they reduce the number of variables and handoffs you have to contend with in order to deploy or update an application (and the more variables and handoffs, the greater the chance of an oversight that will create a security vulnerability).
    • Access control: While IAM frameworks can help prevent some types of unauthorized access, you can also increase the security of your infrastructure using Access Control Lists. A best practice is to adopt a whitelisting approach that blocks all traffic by default, and allows only explicitly trusted hosts.
    • Avoiding bloat: Cloud-native infrastructure makes it easy to spin up virtual machines, databases or other infrastructure components that you don’t truly need, and keep them running. Doing so increases your attack surface. For that reason, identifying and shutting down unused infrastructure is critical for ensuring long-term security. It also helps cut cloud costs, but that is another topic.
    • Parity: In order for developers, ITOps and security teams to be able to communicate and coordinate effectively, they should all be working with the same types of infrastructure environments. Collaboration becomes much more difficult if, for example, you use an on-premise data center for development, then deploy production workloads to the cloud. Avoid this by striving to create parity across your infrastructure whenever possible.

    Processes

    Processes are the second key ingredient in creating a long-term security plan for cloud-native workloads. Obviously, the processes you use will reflect, in part, your particular workloads and tools. But no matter your situation, your processes should be designed with the following security goals in mind:

    • Consistency: Your IT organization may consist of different teams, each with different responsibilities and agendas. Nonetheless, to the extent possible, all teams should follow the same procedures when developing, testing, staging and deploying applications. Doing so reduces the chances of variables or oversights that can undermine security. You can help achieve this consistency by creating and enforcing IT governance procedures across the organization.
    • Shift-left: Processes are the part of your IT operation where shift-left security can have the greatest effect. Shift-left security means making security a priority from the start of the application delivery pipeline. Importantly, however (and this is a point that some organizations overlook), doing shift-left security correctly also means bolstering security operations at later stages of the pipeline, too. Don’t just shift security left and call it a day; aim to make security a primary consideration at all stages of your delivery chain.

    Culture

    Culture is something that can be difficult to formalize; indeed, if you try to stuff cultural values down your employees’ throats, you risk compromising the whole point of having an organic culture in place. Instead, you want to encourage your team members to naturally embrace values that promote a culture of security. Strategies that can help achieve that include:

    • Bug bounties: Incentivize your team to look for and address security issues by hosting bug bounties for your organization’s workloads. For this purpose, “bug” should be defined broadly to include not just security bugs within code, but any kind of configuration issue in your infrastructure, tools or applications that could lead to security vulnerabilities. That way, your bug bounties can include not just developers, but all members of the IT organization.
    • Encourage shared ownership: A culture in which each engineer owns a specific application, infrastructure or process is one that limits transparency and opportunities to address security risks. Strive instead to promote shared ownership of IT assets so each team member knows his or her work may be reviewed by others, which helps to encourage best practices and reduce security issues. In essence, these are part of the values that DevOps and DevSecOps prioritize.

    Conclusion

    By designing infrastructure, processes and cultural practices that promote security, you put your organization in a position to optimize security over the long term. Planning ahead for security is the only way to escape the break/fix cycle of responding to vulnerabilities as they are discovered, which leaves you always treading water and never pushing the needle. You won’t be able to prevent all security issues, but you can greatly reduce the number that crop up by baking security into your infrastructure, processes and culture.

    This sponsored article was written on behalf of Eplexity.

    — Chris Tozzi