devopsy.kinsta.cloud

Category: DevOps Chats

  • DevOps Chats: Shadow Code Security with PerimeterX

    DevOps Chats: Shadow Code Security with PerimeterX

    When the cloud first caught on, there was a problem with Shadow IT—developers spinning up instances in AWS without the IT team knowing they existed. Now with the ease of CI/DC automated deployments, the problem of Shadow Code—code being added to apps that did not go through the entire team process—has arisen.

    In this DevOps Chats we speak with Elad Koren, VP of product at PerimeterX, about the Shadow Code issue and how his company can help.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    Transcript

    Alan Shimel: Hey, everyone, this is Alan Shimel, and you’re listening to DevOps Chats. Today’s DevOps Chats features Elad Koren, who is VP of product at PerimeterX, and Elad, welcome to DevOps Chats.

    Elad Koren: Thanks, Alan. It’s an honor being here. Happy to join you.

    Shimel: I appreciate you being here, and it’s our honor to have you. So, Elad, we’ve never—I don’t believe so—we’ve never interviewed or covered PerimeterX before on Security Boulevard or DevOps. And why don’t we start with, why don’t you give our audience a little background—what’s PerimeterX about?

    Koren: Cool. I believe you’re right. PerimeterX has been around for a bit more than five years, and its main goal is to secure businesses, digital businesses across the web. It can be e-commerce, SaaS, and other online businesses, essentially providing solutions to the online digital challenges they have.

    We started with our Bot Defender solution about four years ago, and this targets the bot problem around the web. I’m sure you’re well aware of it, being the security professional you are. About a year ago, we’ve also launched our Code Defender product, which looks at the client-side code and highlights vulnerabilities and issues around that. And we will, of course, develop some more in the future as part of our growth plans to continue in securing digital businesses around the world.

    Shimel: Excellent. So, we’re gonna dive into that in just a second, but Elad, I also always like to ask people about their own personal journey. How did you come to be VP of Products at PerimeterX?

    Koren: Wow. [Laughter] It was a long journey. I’m actually, I’ve actually been in security for more than 15 years. I started with the Israeli Intelligence and the IDF. Then moved to my startup where I took all the security and kind of compliance and fraud areas. From there, I moved on to RSA Security, so you’re probably familiar with RSA Security, now part of Dell. And after a short period in Payoneer as their Head of Compliance and Security, I found myself in PerimeterX, leading the product group and now the VP of Product. I’m very proud of what we do with really, a sense of accomplishment with what we’ve been doing so far.

    Shimel: Excellent. Well, RSA Security was spun out of Dell now, right? Didn’t they do a PE deal a couple months ago, I thought?

    Koren: Yeah, yeah, they had a discussion around that. It was actually interesting because RSA was one of the biggest assets EMC had before Dell acquired them. And once Dell stepped in, I think RSA wasn’t that interesting for them, so it was only a matter of time.

    Shimel: Yeah, no, Dell seems to have a love/hate relationship with the security companies they acquire, but that’s for another podcast. Let’s stick to PerimeterX. [Laughter]

    So, client-side code inspections and security—talk to us a little bit about what you’re doing there and then I wanna jump into this concept of shadow code that we spoke about off-mic.

    Koren: Yeah. So, first of all, very important to understand, you know, the first question that comes to mind is, why are we talking about it on devopsy.kinsta.cloud. So, one of PerimeterX’s top targets is to assist DevOps teams to do their job better. And the fact of the matter is that, after we’ve had our bot mitigation solution for quite a while and DevOps was one of our personas, we went out and asked our customers, what’s their next major problem.

    And one of the things that came up for many, many customers was the fact that they have a challenge around their client side, okay? Developers are adding libraries—well, you know, it’s a common practice. However, some of these libraries, JavaScript or others, they’re not that secure, and they’re not that trustworthy. What we did at that point is kind of think of that problem and what it reminded of. And it kind of reminded us of the problem of the shadow IT that we’ve seen about 10 years ago or so, where employees would just come with their devices or do whatever they want with their bring your own device kind of concept, and companies started fighting that. But at the end of the day, they understood that they have no weight.

    It’s kind of similar with code. Developers will find the best weight to add code, even if it’s a library that they can just take and adjust slightly, and even if it’s a GitHub repository that no one maintains, and these introduce significant risk.

    Shimel: Yeah. Absolutely. You know, it’s interesting, I think no one in DevOps questions anymore when we talk about adding security to the mix. I mean, thank God. You know, a little bit of my own personal journey, right? The reason I got into DevOps is because I thought it was the greatest thing for security. I thought this, the way it came down that this whole DevSecOps movement and shifting left and making developers more aware of security—I envisioned that when I first found out about DevOps. And I was hoping it would give us another chance to do it right, to correct some of the mistakes that were kind of inherent in our whole model.

    And I’m not saying it’s a panacea or it’s perfect now, but certainly, we can acknowledge that developers do care about—no one wants to develop insecure or crappy code. People have pride in what code they develop. Now, when they didn’t know—the more they know about security and the more tools we can give them that allow them to kind of do better, develop more secure code, the better off we are, I think.

    But this issue of, as you’re calling it, shadow code, right, kinda growing ________ with shadow IT when the cloud first came.

    Koren: Yeah.

    Shimel: It’s a problem. And the thing about it is, again, developers don’t raise their hand and say, “I wanna sneak around. I wanna sneak a little code in the back door.”

    Koren: Exactly.

    Shimel: Right? They do it because they have time constraints, they wanna get it done, they want it to work faster, right?

    Koren: They’re exactly the reasons that we’ve understood when we looked into it.

    Shimel: Yeah.

    Koren: And it makes sense. If you think about it, developers should be able to add whatever it is that they think can help them develop faster. I mean, it’s the business goal.

    Shimel: Mm-hmm.

    Koren: The main question that we asked is—well, how can you make it more streamlined, okay? How can you—and now, going one step backwards or sideways, there’s a disconnect, okay? The developers, as you said, they wanna make it a secure code, but the business owner or the person who manages the security posture of the application doesn’t necessarily know that somebody introduced a new vulnerability, because the developer thinks that this repository is safe. I mean, it should be, it’s in GitHub. [Laughter]

    Shimel: Oh, no—agreed.

    Koren: So, the thing is—and this is where we asked around, our customers, what are they doing to mitigate this type of risk and what are they finding out. And what we found out is, interestingly enough, you have a lot of performance monitoring tools, but you have zero security monitoring tools on client side in real time. You have static code analysis, you have a lot of other solutions trying to find the vulnerability before it goes out to production. But once it’s out there, nobody monitors.

    And you have to keep in mind—I know you are keeping in mind, but our listeners—the fact that, well, when in run time, you can inject dynamic code, that changes. And if somebody else gets control over it, this is a problem.

    Shimel: Yeah, yeah. Well, and there’s a couple, I think, other complicating factors, Elad, that I’d like you to address. And that is, you know, today, where does that client side code live? Is it in the container somewhere with the whole Kubernetes microservices mesh thing goin’ on?

    Koren: Mm-hmm.

    Shimel: Is it in the traditional hypervisor kind of environment, or maybe something like that or is it on bare metal and serverless or—you know, it’s a great time to be a developer, but it’s a very hard time to be a security person who’s trying to keep guardrails there for these people to do it as safely as possible, as securely as possible. How do you do that?

    Koren: This is correct. You’re spot on. You’d expect that when a new code is introduced, the company or the developers would adopt it and manage it or maintain on their servers or on their microservers or their mesh. However, because they want to keep it updated, because they want to keep it as capable as possible, they sometimes take the dynamic library from their repository and, whenever there’s a CI/CD process going on, it pulls the library from there.

    And that is where the shadow code becomes a problem. Because, unless you have the right processes around, how to make sure that this library is safe? How to make sure that this is, you’re not introducing anything malicious—and we have seen it happening in the past—this is where you have to address the problem. And you know, I can share some of the things that we’ve seen when we had the validation of the product before we launched it. We had a design partner, and they asked for something like this because their developers asked for the security team to allow them visibility into what’s happening on the client side. And we’ve actually—and it’s a big customer. I don’t want to name names, naturally, here, but—and you will share my surprise—when we found out, when we run on their client side that a very, very big vendor of there is using a jQuery from a non-trustworthy source.

    Now, you’d expect something like this would never happen for a well-established company, but it does. And it’s surprising, but it does. And they weren’t the only ones.

    Shimel: Hmm. Interesting. So, let’s now talk—so, I think we’ve defined the issue and the problem, right? How is PerimeterX helping this?

    Koren: So, our approach when looking at this issue or this problem, naturally, we are a Dev first company. So, we came and asked the developers that we were working with—the DevOps, DevSecOps, and some of the risk analysts, some of the personas—what would be most beneficial. And what they said, and this is how, you know, I’m the VP of Products. I’m a Product Manager at heart. And customer input is the number one thing that I’m looking into when I’m building the products.

    They said very clearly, if they can see, before moving from staging to dev to prod, what the code itself, when it’s pulled dynamically, is doing and have the visibility of what’s happening there in real-time on users—this is something that they don’t have today. Because that will introduce that level of visibility whenever something bad happens.

    I don’t know if you’ve seen some of the Magecart attacks that have happened from third-party libraries. Again, don’t wanna name names, but if somebody looks online, they can find out. When we come in and we analyze in real-time on the client side, on every user going into the website, what the scripts are doing there, whether they send information to a bad domain, whether they try to take the information and store it in a cookie and then use it later on—we can quickly highlight the main risks and main problems and vulnerabilities, like I mentioned earlier with jQuery, so that the DevOps or DevSecOps can quickly raise a flag and say to the developer, “Listen, this script you’ve added introduces new vulnerability.” You can’t see that in the static code analysis, but you will see that on run time on the client side. And that is something revolutionary. We don’t have that today in anyone else’s solution out there.

    Shimel: Hmm. Interesting. What—so, I always ask, and you’re the perfect person, VP of Product—now you’ve got a conundrum. You’ve got a really great security product here that’s gonna help developers with secure code. How do you—how do you sell it? How do you bring it into the organization? Do you talk to the security guy and say, “Hey, go talk to your developer team and tell them to use this?” Do you talk to your developers and say, “Tell your security team you wanna do this?” Do you gotta talk to the security team and the developer team? Whose budget does this come out of? Who ultimately is responsible for setting the policies and processes?

    Koren: And this is—

    Shimel: Is the solution hard to sell, maybe, though?

    Koren: You’re correct. So, theoretically, it’s hard to sell. However, the main key here or the key differentiator is the fact that when we went in to look how we wanna sell this solution, before we even built it, we established the fact that it should fit into their processes. If it’s not fitting into their processes, if they have to start defining things like content security policy, if they have to start maintaining this on a day to day basis, it’s not going to work.

    Solutions for DevOps or DevSecOps today are one, two, three. You have to have it in and you have to do it quickly and you have to have minimum manual effort, unless you definitely prove why it’s needed. And so, this is why we’ve added the fact that nobody needs to do the baselining on their own, we are doing that automatically with machine learning capabilities, what every script does, whether it’s ________ or not, and the fact that they can just have a small snippet on their client side and we’ll analyze whatever and flag in our portal or alerting system that they have, it actually fits into their CI/CD process, it fits into their day-to-day process. They can even have it as part of their regular security processes and have it fit into their SIM.

    And this is where it really makes the difference, because you don’t have to do anything manually and you solve a problem and you fit into their processes, and security people are very happy about it. I can tell you that one of the customers that actually already bought this product was very happy with the fact that they have visibility to this area and they don’t have to maintain it on their own, because we are doing that, the product does that out of the box. So, this was a key component in our product.

    Shimel: Huh. Excellent. Excellent, excellent. So—I told you, the time goes very fast. [Laughter]

    Koren: [Laughter]

    Shimel: We’re coming up on time, here. For people who are interested—let’s use our time wisely—how could they find out more information? What path do you suggest for them?

    Koren: So, first of all, they can go out to our website and check out our solutions, both for bot mitigation as well as the Code Defender and other solutions that we have. I think reaching out to our team if you have any questions, if you have any concerns around the client side, I can tell you that even companies that thought everything’s fine were completely oblivious to threats and concerns around the client side that are out there and many people are not aware of. You can also reach out to me directly via LinkedIn or what have you and we can discuss.

    I think in general, for DevOps and DevSecOps to be more aware of the dynamic nature of the code that is added to the client side and what to do. We actually have a blog post listing the things that are best to do if you want to make sure that it’s secure and you’re on top of things. So, it’s a good read as well. And that’s about it. So, we are here. We’re ready to help.

    Shimel: Cool. Last question, just because you have to ask it because it’s out there—with everything going on in the world with the COVID and everything else, how is it affecting you guys and what are you seeing?

    Koren: It’s actually amazing. We’ve seen some trends around the e-commerce landscape that we’ve actually had some blog posts on. And I think, you know, one of the things that kind of symbolizes these times, a few of the e-commerce sites that we are working with said that the traffic they experienced outgrows the Black Friday/Cyber Monday level of traffic.

    I think it symbolizes kind of the boom of online life that we have. I’m sure you’re experiencing it as well. And I think the shift there is not going to go back to the previous levels. It’s definitely going to go down, but we are seeing so many trends, very interesting trends, and we are naturally adjusting what we are doing, but luckily and happily, we’re doing great these times and it’s—we’re very happy with what we have now.

    Shimel: Well, I will tell you, for whatever reason, you know, and it may not all be good, because there is this whole, with the virus pandemic there’s a cyber pandemic of people trying to exploit. I mean, so, for instance, even here MediaOps where DevOps and Security Boulevard, our security site, used to be pretty even in terms of how many visitors—they both get 350 to 400,000 visitors, unique visitors.

    Koren: Mm-hmm.

    Shimel: All of a sudden, you know, Security Boulevard now this month is gonna be at 600,000.

    Koren: Wow.

    Shimel: Last month was 530,000. So, in the last two months since this COVID thing, you know, we’ve seen traffic on the Boulevard site—DevOps has stayed relatively steady. It hasn’t gone up, necessarily, it hasn’t gone down.

    Koren: You know, one thing we’ve noticed, and I think it can also explain, I think it’s wider than that—attacks and in general fraud and security challenges became much more complicated, because the adversaries are out there and they are targeting a whole lot of other new sites that previously didn’t experience. We are seeing much higher levels of complexity in the attacks that we’ve previously seen on giants, now on even medium small—small- to medium-sized sites.

    Shimel: Agreed. Crazy. Just crazy, right?

    Koren: Yeah, indeed.

    Shimel: You know, because that’s what you need when you have a virus pandemic, we need to have more cybercrime and that stuff to worry about.

    Koren: Yeah. [Laughter]

    Shimel: So, Elad, I want to thank you for joining us today on DevOps Chats. It’s been a pleasure.

    Koren: Thanks, Alan.

    Shimel: Be back on soon. Elad Koren from PerimeterX here on DevOps Chats, this is Alan Shimel and you’ve just listened to another DevOps Chats.

  • DevOps Chats: Software Delivery Leadership Forum and DevOps World 2020, CloudBees

    DevOps Chats: Software Delivery Leadership Forum and DevOps World 2020, CloudBees

    DevOps World | Jenkins World has long established itself as a leading venue for DevOps practitioners to learn, share their knowledge and build a top-notch community. But, what about leaders, the people in leadership roles at companies who utilize DevOps as a vital part of their business and technology strategies?

    Sam Fell, CloudBees area VP enterprise markets, joins DevOps Chats to discuss the newly announced Software Delivery Leadership Forum. DevOps World 2020 is expanding its focus and content by bringing leaders together with content specifically tailored for business and technology leaders. Accelerated Strategies Group, where Mitch Ashley is CEO, is leading the programming of the DevOps World 2020 Software Delivery Leadership Forum.

    As usual, the streaming audio is immediately below, followed by the transcript of the conversation.

    Transcript

    Mitch Ashley: Hi, everyone, this is Mitch Ashley with devopsy.kinsta.cloud, and you’re listening to another DevOps Chat podcast. Today, I’m joined by Sam Fell, area vice president, enterprise marketing at CloudBees. And we’re talking about, actually, a subject of interest to both of us. It’s the new Software Delivery Leadership Forum, and we’ll get into that.

    Welcome to DevOps Chat, Sam.

    Sam Fell: Thank you, Mitch. Pleasure to be here, as always—great speaking with you.

    Ashley: Absolutely. I always enjoy talking with you. For folks who don’t know you, I know you’ve been in the industry around DevOps for a while. [Laughter] So, a lot of folks know you, but—

    Fell: Are you calling me old? Is that it?

    Ashley: Actually, I didn’t say that. I’ve got the gray hair; you’re still young, so.

    Fell: [Laughter]

    Ashley: Just to introduce yourself, for folks that may not know you.

    Fell: Alright, wonderful. So, I am Sam Fell. I am area vice president at CloudBees, where I’ve been for the past year. We were acquired in, as part of the Electric Cloud acquisition where I ran marketing at Electric Cloud.

    Ashley: Yeah, a lot of folks know Electric Cloud, so probably know you from that as well as CloudBees, of course.

    Fell: Yeah. That’s right.

    Ashley: How long ago did that acquisition happen?

    Fell: That was literally a year ago in May.

    Ashley: Okay.

    Fell: So, we are just a year, really just coming up on a year. So, all the exciting stuff was happening, all the stuff that made me lose my hair and all that was happening right now. And we were just so thrilled with the outcome to be, you know, the company that Electric Cloud was. We had a pretty nice name in the space. But when you look at CloudBees and you look at the community that they’ve created and you look at the access to the brains that they have, it’s a tremendous opportunity. You know, obviously, I’m really excited to be able to be here. And I’m excited about sharing this journey with the Accelerated Strategies Group, right?

    Ashley: Well, thank you. I’m excited about that, too. Yeah, CloudBees is a great organization, as was Electric Cloud.

    So, let’s get into the—we made an announcement, or actually, you did a press release about the Software Delivery Leadership Forum, and there’s a connection to DevOps World and some other things. Maybe we start with that and then we can talk about Accelerated Strategies’ involvement in it.

    Fell: Lovely. Awesome. Okay, so, you know, we’ve been running probably, people would say, the most successful DevOps conference for years now, DevOps World/Jenkins World. Almost 2,000 people show up to learn more about what’s happening in the space, there’s hands on practitioner based workshops and training for people to really get their hands on and get them dirty about how to implement these changes that have to happen as you’re digitally transforming your organization.

    One of the things that we took a step back and we were thinking about is, what we don’t really have is a place for the leadership to be able to participate. And, you know, we’ve done leadership seminars and workshops before, but we’ve never said that DevOps World needs to be a place where not only the practitioners are coming, but where the leaders are coming to learn not the practitioner level information, but how to lead the practitioners. What are the processes, what are the methods that people are learning and using and trying and failing with and learning from?

    And so, we thought we would add that to the program. And as we were thinking about adding it to the program, we also thought, because of the way that the DevOps World/Jenkins World show has evolved, I as a vendor looked back at DevOps World/Jenkins World and I was always very willing to sponsor that event when I was at Electric Cloud, because it was an open event. There was not a ton of bias towards CloudBees products, necessarily. It was really about the community, and it was about educating people.

    And so, in that same spirit, when we were thinking about how do we make sure that there’s some objective independence in the way that we’re putting out the ideas around, “How do you lead? How do you lead this transformation? How do you make sure that your teams are all on the same page?” We felt that it was really helpful to have a third party help us with that programming. And so, that’s, of course, this is the cue to Accelerated Strategies, this is why we sort of reached out to you. There’s obviously great synergy between the work that we’re doing, and we thought, who better to help us craft this program, the programming for this conference than the fine people over at Accelerated Strategies?

    Ashley: Good.

    Fell: So, that’s pretty much where we’re going, and then you and I have had lots of conversations about what that Software Delivery Leadership Forum should look like at the event, and so maybe I would pitch it back to you and you could talk a little bit about what we’re thinking about for DevOps World Software Delivery Leadership Forum.

    Ashley: Absolutely. And thanks so much, we appreciate you approaching us, and it was exciting to work with you on this. And I agree—you know, DevOps World, yes, it’s CloudBees behind it, Jenkins World, but the community that you talk about really elevates it above any one vendor, to use that word.

    Fell: Yeah.

    Ashley: And just the fact that Electric Cloud, you know, would—and many others would sponsor a conference that’s put on by another vendor.

    Fell: Yep, yep, coopetition. The competitors were there and happy about it because the audience is the right audience. These are the people that are in the weeds making it happen with their fingers, and now what we’re saying is, “Hey, these people over in the weeds that are using their fingers, they need other people to help on the top that can help support and pave the road for them.”

    Ashley: They do.

    Fell: And so, we’ve been trying to do that.

    Ashley: Well, and I would imagine, too, that, you know, one of the drivers behind leadership as a topic is organization scale. You know, trying to do DevOps on more than two or three or four independent projects, that’s when you get into the heavy lifting. That’s when you’ve got to have management support. And now I see—I know you do, too—leaders reaching out and trying to find resources for themselves, educate themselves, lessons learned, pitfalls, community that they can be part of as well as the technical folks be part of their community and that’s in large part from what we’ve talked to why to go after this Software Delivery Leadership Forum.

    Fell: That’s right, exactly. Do you wanna talk a little bit about what the proposed format would be at the—

    Ashley: Yeah.

    Fell: —Software Delivery Leadership Forum? Wonderful, okay.

    Ashley: Yeah, I’m happy to. We have some research that we’re gonna be launching, and talking about around software delivery that we’ll be discussing and presenting some of the findings from.

    But the main point of how we’ve crafted this to be, it’s a parallel track. It’s not a separate venue, separate place, it’s just a set of content that’s specifically directed at leaders, people in SE or VP director software leader kind of role, but it’s also product leaders as well as transformational leaders. And those are the folks that we really would like to attract to attend to this, because that combination is always what needs to come together to achieve some business strategy, disruptive strategy product delivery, some kind of financial effect that we’re trying to have on the organization.

    So, it’s a track of about 22 different sessions, but we’re gonna have a number of things that will be highly interactive. So, we’re gonna have some panels, we’ll have some audience participation, kinda open forum for questions and answers with different experts, and we’ll have people that—yes, there’ll be some folks who are product company, there’ll be folks who are analysts like from Accelerated, but not only Accelerated; we’ll have other analysts there. And then, we’d like to have as many practitioners in a business role technical leadership role as well to get that perspective.

    Fell: Right.

    Ashley: And we’ve planned some workshops and some things like that. So, my goal is that everybody take three things away from this conference. Whatever those three things are, come back to your company, to your team, to your organization and say, “You know? I picked up some really good stuff. This one, I had no idea somebody was facing the same issue and they actually solved it—”

    Fell: And they fixed it, right.

    Ashley: “—a way I was thinking about, so it validated our thinking.” Or,  you know, “Threw it out the window and we’ve got a whole other approach, but I’m sure glad I didn’t march down that Bataan death march.” [Laughter]

    Fell: Waste my time—failing fast is winning, exactly.

    Ashley: Exactly, exactly. So, the call for presentations is open right now.

    Fell: Yep.

    Ashley: You can go to DevOpsWorld.com, and there’s a button there that is a call for presentations, fill out information, we’d love to have folks, and we are reviewing submissions actively right now, so it’s a good time to get this out.

    Fell: Yeah. We’re getting—actually, from that release, we’re getting quite a few submissions, which is really nice. There’s some suggestions around some of the topics that we’re looking to have people talk about—governance, security, those are big topics. So, yeah, definitely interesting to get people’s perspectives and to see what they have to say. We’re excited about that.

    Ashley: It is. So, full disclosure, we both have an interest in this and participating, but it’s good to be on with you to talk about it.

    Fell: Yeah, for sure.

    Ashley: You know, I’m curious, too, because you’re doing this—well, let me ask you, why did you decide to name it the Software Delivery Leadership Forum? Because I know we went around a couple names, a couple of ideas.

    Fell: Yeah. So, well, when you think about the work that the fine people are doing, whether they’re doing it from a DevOps perspective or they’re just in dev or they’re just in ops or they’re part of the executive team who’s not part of development or operations, but they have a vested interest in development and operations getting their stuff done, right?

    Every—this is such a hackneyed expression, it’s very overused, but every business is a software business. And now, in this age we find ourselves in, the digital connection with your customers is more important than ever.

    Ashley: Mm-hmm, mm-hmm.

    Fell: And so, there are other people beyond just dev and ops. And so, originally, it was going to be the DevOps Leadership Forum, but it’s really, we think it’s more about that, delivering that software or delivering those services that are foundationally built on top of software, and you can call it whatever you want, but down at the base layer, somebody’s written code, somebody’s built that code, somebody had to deploy it to a server so that people could get any value from it.

    And so, the software delivery life cycle, the SDLC, is something that we think a lot about in the SDLF, like, the Software Delivery Leadership Forum. Because the SDLC is still alive, it’s still kicking, and application life cycle management matters, even in the age of DevOps. And so, we thought that this would be an appropriate name for what we’re trying to put together with you is a place for people, a community to come together that’s built on the community that we already have of all these practitioners who already understand how a lot of this stuff works, but now, they’re just looking for some guidance and some, “Hey, I don’t wanna go down that road again, because that guy already failed,” right? Failing fast and learning from it is not a failure.

    Ashley: Exactly. There’s so much sharing that happens in the technical community, I’m confident we can build that with the business product and technology leadership.

    Fell: Yep.

    Ashley: It’s interesting. We’re in the midst of, maybe we’re still in the early part of this, I don’t know the whole COVID-19 and being in lockdown and, of course, there’s the health and, in some cases, even losing people that we know in our family, or friends. So, in all due respect to that, you know, I’ve talked—some of the things I’ve talked about on another venue, which is TechStrong TV, is, it’s interesting to see this—

    Fell: Congratulations on that launch, by the way.

    Ashley: Thank you. It’s a lot of fun to do.

    Fell: Yeah, I love it. Yeah, that’s great.

    Ashley: It’s a lot of fun to do. Some great content on there. If you haven’t checked it out, go to TechStrong.tv.

    Fell: Yes.

    Ashley: Two to four hours a day, Monday through Friday, so—keep you company. I call it “the view” for technology people. [Laughter]

    Fell: Nice. Very nice.

    Ashley: So, even in this situation, you know, we’re locked down, right? Everybody’s working from home. Most people are. I’ve noted, you know, restaurants have all gone to delivery. They’ve gone to curbside delivery. Even restaurants around here have now started to come up with new offerings to essentially take home packaged meals, kinda like you would from one of those box delivery services.

    And even places like Best Buy has curbside delivery. I had to build a computer, and the delays of shipping something from a manufacturer were so long, you know, and they had to change their apps. They rebuilt their app or added to their app and their web notifications to have, you know, a button to push to say, “I’m in the parking lot and I’m in a white this car and here I am, and by the way, here’s my QR code or scan code,” or not even have to do that.

    Fell: To validate—yeah, exactly.

    Ashley: And that happened in weeks. That wasn’t—you know, that’s a few weeks that those two examples happened. Now think about—

    Fell: Life finds a way. Commerce finds a way, maybe that’s [Cross talk].

    Ashley: It does, it does. And kudos to those folks and many others who were looking for—maybe we didn’t disrupt it, but disruptive business strategies. [Laughter]

    Fell: Yeah. I mean, they have to respond.

    Ashley: Delivery through software.

    Fell: Yeah. They need to respond. Life finds a way, I love it—DevOps finds a way.

    Ashley: It’ll be interesting, I think, you know, given the time frame, the dates are September 21st through the 24th in Las Vegas. And, you know, we’ll have several months behind us, hopefully not too bad, but several months of experience. I bet there is gonna be a lot of stories, many stories of folks who have reacted and responded and some successes, and—

    Fell: Led through that change, right, exactly. Led through that change.

    Ashley: So, talk about a good test—well, not good, but talk about a test situation for the flexibility and agility of our businesses.

    Fell: Yeah. This is the crucible. That’s really the crucible, right here.

    Ashley: Yeah. It truly is.

    Fell: And so, one of the other things, you know, that we’re doing—and Mitch, you’re part of this as well—is that we’re so excited about the Software Delivery Leadership Forum that we actually don’t wanna wait for the September event to get started.

    And so, what we’re actually doing is, we’re creating an online virtual series of Software Delivery Leadership Forums, with our first one coming up at the end of this month in April. Episode one of this series is gonna be on upskilling. It’s on adapting humans at the speed of DevOps and we’re gonna be joined by our friend, Jayne Groll—our mutual friend Jayne Groll—and Eveline Oehrlich, who is her head of research.

    Ashley: Both are mutual friends, yeah.

    Fell: Right, and Eveline—

    Ashley: Both are analysts with Accelerated, too.

    Fell: She’s with you over at Accelerated Strategies, right. And we’ll be joined even further after they’ve given their little talk about the survey results, and we’re actually gonna get an interesting cut of data for the European, because we’re doing two versions of that, event—one for the U.S. time zone friendly and one for EMEA time zone friendly.

    Ashley: Mm-hmm.

    Fell: And so, for the EMEA one, there’s gonna be a different cut of the data that’s gonna be much more focused on that geography, which we’re really excited about. But we’re having a whole bunch of other folks join us as well to be able to have that conversation, because we’re really wanting to try and create, again, a community where there’s interaction between the attendees and the folks who are on the webinar or on this virtual event. Because so many events, people parade out folks that are saying, “Yeah, here’s how we’re successful” and then maybe you get five or 10 minutes at the end for questions and answers.

    And so, we’re kinda gonna flip that on its head and we’re gonna have 30 minutes up front for the Software Delivery Leadership Forum—30 minutes up front for Jayne and Eveline to go through their findings to talk as subject matter experts about this topic that they certainly know a lot about. And at that point, we’re going to introduce a couple of other panelists to join us on camera and start fielding questions directly from the audience.

    And so, the folks who are going to be joining us this time around, we’ve got Ellen Thorne, who is the head of HR here at CloudBees, so who better than a person who’s in HR to talk about what’s—that’s an interesting perspective. What’s unique about that from a—

    Ashley: Skills and training of their people, yeah.

    Fell: Yeah, training. Robert Reeves, who’s the CTO at Datical, right? So, how is the technical person who used to hire technical people, what is that like? What kind of people are you looking for? What skills do you find deficient? What skills do you find lacking that you’d like to see? Of course, you’re joining us.

    And so, really, really excited about that. And then over in Europe, we’ve got a couple of other people joining as well—Eveline Oehrlich will be on that one as well as Cheryl Razzell, who is over at, I think, PolyCom right now, and she used to be at HSBC. She’s not a customer, I think, any more, but she was a customer ad she definitely has an opinion about this.

    So, we’re really looking for people with different perspectives to have a conversation. I’m gonna be on there, you’re gonna be on there. I’ll be moderating, I’m gonna be looking at the chat window the entire time. All the panelists will be able to respond to the questions that are posed in the chat. There’s gonna be a mechanism for people to vote the different answers up or down, which is pretty cool.

    Ashley: Mm-hmm.

    Fell: And my role is really gonna just be to interject and speak on behalf of the people on the chat and say, “Hey, Bill brings up a good point,” “Hey, Debbie just brought up a really good point, she disagrees with you,” “He thinks that that is wrong,” whatever. I’m gonna try and be a conduit to make sure that the audience feels like they’re part of that conversation.

    So, we’re gonna have 30 minutes of up front, set the table subject matter expert speaking stuff, and then we’re gonna have an hour of live Q&A or as long as that audience has questions, we’re gonna work on trying to get to them.

    Ashley: Wow, an hour. That’s great, that’s fantastic. I mean, you know, community in some ways starts with conversation. That’s what draws people in and say, “What’s happening? What are those folks talking about? What is that? Oh, I have a question, I have a thought.” And I’m sure we’ll get some opinions coming in on those questions. [Laughter]

    Fell: That’s right.

    Ashley: Sometimes, they’re sort of written that way, that, “Hey, don’t you think this is true, instead of the way you said it?”

    Fell: Yeah, exactly.

    Ashley: Which is actually, it’s some of the challenge as well as seeking information that helps advance it for all of us, and—you know, there’s more than one way to skin a cat, if you will.

    Fell: I was on a crowd chat with DevOps Institute, I think it was about a week ago, and we had folks from all over the world chiming in and giving their, some prompts that we were asked. It’s fantastic to see people, like you said, to challenge the status quo, to give their opinion of what’s worked for them to understand. Because that—you know, you get an understanding of how some people’s situations are just different. And you can’t—there is no best practice. I think Manuel Pais and Matthew Skelton, they talk about this all the time. There’s no best practice, there’s just lots of good practices—

    Ashley: Good practices.

    Fell: —that you can apply to various different, apply to different areas, but you can’t just say that there is one best practice.

    Ashley: So, kind of a variation on the best practice theme, I’ll just ask you your—neither one of us can predict the future that accurately. [Laughter] But what are your thoughts about this virtual event, virtual conferences? Is that something you think will stay with us in a meaningful form post COVID and whatever, how we’re working, all that environment?

    Fell: I do. You know, you saw O’Reilly has canceled all of their physical conferences.

    Ashley: Yeah, yeah.

    Fell: And so, regardless of what ends up happening, I think the same way that the businesses like Best Buy and the other folks that you talked about are transitioning and they’re shifting.

    Ashley: Mm-hmm.

    Fell: I mean, I’m seeing—this week, I’m starting to see all the activities that my children were involved in are now, they’re finally acquiescing and saying, “Okay, we’re transitioning, and now, here’s the Zoom link for you to join for the kung fu class and you’re just gonna do it in your living room, but you have to still wear all of your things and you still have to show up and be polite.”

    So, they’re also transitioning, and businesses are transitioning. They’re learning how to work more remote. I’m very lucky to be working at a company that’s, you know, we’re 99, 90% remote already, so it’s not a huge change for us, but it is a huge change for the folks that are working remotely in my company who have, now, children at home.

    Ashley: Mm-hmm.

    Fell: And so, education is gonna be impacted and I’m talking with Charlie Betz, who’s an analyst over at Forrester, he’s a teacher over at the University of St. Paul—or St. Thomas, excuse me. And he’s talking, he and I talk all the time about how is education gonna be impacted by this? What are—as a parent, I’m sitting at home and I’m working, but my children are here, and they should be doing some school things, but it’s very hard for me to keep up with that and keep track of it. And I think it’s hard for a lot of the educators, because they haven’t had the experience in the virtual meeting space that we’ve all been sort of used to for a while.

    And so, I think there’s a lot of learning that needs to come out of this, but I see—and one of the things that Charlie says is, when people have no jobs, they can do a couple different things, but one of the things a lot of different people do is they go back to school, which is a fantastic thing to do.

    Ashley: Mm-hmm. Oh, yeah, absolutely.

    Fell: And if you give people viable options to educate themselves and make themselves—again, all about the upskilling conversation that we were just having. How do we enable these people to be able to make sure that they’re gonna stay relevant, and how do we help them get jobs for the folks that are right now, that they don’t have a job because they’re forced to be in an office that’s closed?

    Ashley: Right.

    Fell: So, I think that there will be quite a bit of focus on how do we educate at a distance, how do we make the collaboration work better. And I think it’s happening already naturally. People are getting more accustomed to being on video calls, right? People who used to never want to be on a video call, now they’re flipping on their video, because it’s like—you know what? We’re all in this together, and one of the things that I really appreciate, before we started scheduling this, I ran around to everyone in my house and I said, “Hey, guys, please don’t scream for the next 30 minutes, because I’m gonna be recording something.”

    Ashley: [Laughter]

    Fell: But the fact is, is that I’m on meetings with people and, you know, my kid or my wife will walk by and we’ll speak. And now, it’s—it used to be where I was embarrassed by that, because it was an intrusion into my workday. And sort of the mind shift that I think is happening is that now, what’s happened is that I’m allowing work into my home.

    Ashley: Yep. And you’re entering into other people’s homes at the same time.

    Fell: And I’m also entering—yeah, absolutely, I’m entering into other people’s homes. But I think there’s a much more understanding and a much more—I’m more comfortable, anyways, with there being life happening outside of me. It’s like the classic BBC video of the girl, the 2-year-old girl who runs in the room. He was—he was, like, appalled that that would happen. And now, if that happened, hopefully, he wouldn’t be, right?

    Ashley: It’s called life.

    Fell: So, I think, as an organization—it’s life, right? And hopefully, as a humanity, we’re getting better about that, and I think we will.

    Ashley: You know, to give you some, a little bit of data to back up part of what you were saying is, we’ve launched—we started an IT, health emergency IT preparedness survey back in February, and things happened so fast that just a traditional survey couldn’t keep up with the changes that are happening with work at home and how this has evolved.

    So, we’ve also launched a flash poll survey, and I’ll be talking about it on TechStrong TV this week. But one of the initial ones before we announced this flash poll, one of the initial ones was, “What is the most critical—you’ve only got one choice—between kinds of services that you use to support your work at home staff? There’s e-mail, collaboration services, meeting, file sharing, phone—all kinds of things.

    Fell: And which ones had degradations, yeah.

    Ashley: Well, yeah. And it’s, surprisingly, collaboration and online meeting services were equal. Those are the top two, within 1% of each other.

    Fell: The top two worst performing?

    Ashley: No, this is of our most critical to my business.

    Fell: Most critical—okay, got it.

    Ashley: Supporting it. We’re gonna do another survey on what have you had issues with that’s actually launched this week.

    Fell: Yeah, I just—that’s why I saw it, because I just saw that one. I was like, “What?”

    Ashley: You just saw it. [Laughter] So, 37 and 36%, I think, online meetings was 37. And so—and email was, like, 20. So, that tells me people have already made this shift into Slack and Microsoft Teams and Hangout and Google and whatever other forms they have for kinda their corporate chat.

    So, I think that skill of collaborating that way is something that will be a natural outcome of the situation we’re in.

    Fell: Yeah, I think so. I mean—yeah, hard times force people to think differently.

    Ashley: Mm-hmm.

    Fell: And we’re a very resilient species. We’ve been around for a while, and we’ll figure this out, but it’s terrible to have to go through it.

    Ashley: It is, it is. We just hope everybody gets through okay.

    Fell: Yeah, exactly.

    Ashley: That’s what we’re hoping for. Well, Sam, it’s a great pleasure, a lot of fun, always, to talk with you. Thanks for being on the podcast and for joining us today, sharing and also sharing with Accelerated Strategies the Software Delivery Leadership Forum. Excited to do all of those events with you and take that dialogue to the next level and really build the community amongst the leadership side.

    Fell: Me, too—wonderful. Thank you, Mitch. I appreciate your invitation and stay safe.

    Ashley: You bet. So, you’ve listened to another DevOps Chat podcast. This is Mitch Ashley thanking everyone for joining us today. Be safe, be careful out there.

  • DevOps Chats: DevSecOps and OpenShift, with Red Hat

    DevOps Chats: DevSecOps and OpenShift, with Red Hat

    In this DevOps Chats, we had a talk with Kirsten Newcomer, senior principal product manager at Red Hat. It is a great discussion on the state of DevSecOps and how the Red Hat OpenShift team is trying to make it easier for developers, DevOps and cyber folks to work together to create more secure applications.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    Transcript

    Alan Shimel: Hey, everyone, it’s Alan Shimel, devopsy.kinsta.cloud, Container Journal, Security Boulevard—you’re listening to another DevOps Chat. Welcome, and I’d like to welcome to our DevOps Chat Kirsten Newcomer of Red Hat. Kirsten, welcome.

    Kirsten Newcomer: Thank you, Alan. Great to be here. So, I’m Kirsten Newcomer as you said, Red Hat. My focus at Red Hat is DevSecOps for cloud-native applications, been working at Red Hat for about four years now. It’s really kind of fun. I’ve managed to leverage kind of my—all sorts of different elements of my background over the years. I spent time at Rational Software, nine years, working on developer tools.

    Shimel: Sure.

    Newcomer: Yeah. Spent some time with BMC BladeLogic on the operations side of the world, seven years at Black Duck Software focusing on solutions that help companies manage vulnerabilities in open source software, and that led to the move to Red Hat where I get to focus on OpenShift security and DevSecOps and sort of everything comes together. So, DevOps—

    Shimel: It really does.

    Newcomer: Yeah.

    Shimel: I mean, following your career, I think I know just about all of those companies intimately and know a lot of people—I’m sure we even have a lot of people in common that we’ve worked with.

    Newcomer: I bet we do.

    Shimel: It’s funny. So, you were at Rational, left Rational only to return to IBM Rational.

    Newcomer: I know! [Laughter] That is true.

    Shimel: You know, it’s the circle of life right there, man. [Laughter]

    Newcomer: It is the circle of life, yep.

    Shimel: Welcome. So, Kirsten, look, DevSecOps is of course something near and dear to us. We put on every year at the RSA conference our DevSecOps Days or DevOps Connect/DevSecOps Days.

    Newcomer: Uh-huh.

    Shimel: We actually have the virtual event of that live on Thursday, I think it’s the 26th, March 26th.

    Newcomer: Nice.

    Shimel: So, you know, it’s something, quite frankly, this whole security thing is the reason I got into DevOps is, I thought—what a great opportunity for security to cure a lot of original sin.

    Newcomer: Absolutely. [Laughter]

    Shimel: But anyway, you know, when we look at the DevSecOps and the DevOps world, Kirsten, you can’t help—you must take notice of the impact that Kubernetes and the whole cloud-native kind of movement has had on this.

    Newcomer: Okay.

    Shimel: And a great—

    Newcomer: Absolutely, no—big changes, yeah.

    Shimel: And, you know—and it’s really at the core of so much of what is being done right now from an infrastructure point of view. And oftentimes, I don’t know if people—like everything else, right? I remember when the cloud came out and we moved from client-server and all this. Security, there’s always that lag, right, where, “Oh, yeah, we gotta do security with this.”

    Newcomer: Yep.

    Shimel: And we had a little bit of that with Kubernetes, I think, where—

    Newcomer: No, I think that’s fair.

    Shimel: Yeah? You know, people were rushing to do Kubernetes and experiment with it, deploy it, and then someone started saying, “Wait a second, what about security, here? What about compliance? What about this or that?”

    Newcomer: Yeah.

    Shimel: And now, I will tell you, and I’m interested in your opinion—I thought the lag time was much shorter this time than what we’ve seen in the past.

    Newcomer: Oh, I absolutely think so. And I think it’s really interesting. A couple of things that I’ve observed. One is that I really think containers and Kubernetes have created a terrific opportunity to shift security left, and I’ll kinda be more explicit about that in a couple ways. But I, in fact, have worked with a chief of cyber defense in the public sector who believes and evangelizes that containers improve security, and I’ve stolen his line, because I just actually think that that’s really valid.

    Because of the changes in the model, with the OS dependencies and the run time, everything’s kinda packaged together and you have that immutable container image that you’re always deploying from, you really can manage things in a new way and not every team is ready for this, and not every team, not every security vendor is ready for this, either.

    So, I think the opportunity has been twofold. One is to kind of adjust the thinking about security so that it no longer becomes something that happens at the end, but that’s still a process, that’s still a lot of work. And the other thing is, the security tooling space itself has historically been pretty siloed, right? There’s been, you know, the OS layer security, the network layer, there’s been kinda—you know, my SIEM and my SOC that I’m working with, and my cert management and my vaults.

    And none of them really were designed to work with the level of automation that Kubernetes and containers enable, which led to this really interesting opening for smaller companies, a lot of startups that now have been around for a little while, actually, to start breaking down those silos and delivering security capabilities in a new way that kind of really do fit the DevSecOps model, because you get kinda one vendor bringing a set of capabilities that ranges from CI/CD integration to run time security to network security, really fascinating space to see how it’s been evolving.

    Shimel: It really has. The other thing that I will tell you, Kirsten, that I was again encouraged by was when I first started seeing people talk about security through containers and Kubernetes, it really was like—let me scan your container for vulnerabilities, right?

    Newcomer:  Yeah. [Laughter]

    Shimel: And I’m thinking to myself—I don’t care whether my code’s in a container or in a hypervisor or on bare metal. A vulnerability scan is a vulnerability scan. There’s gotta be more to this than just a more vulnerability scan kind of a thing.

    Newcomer: Absolutely. And that’s, I think, where, as you mentioned earlier, that, you know, Kubernetes really has come a long way in that space. So, there are things like, if we think about—so, absolutely. Vulnerability scans are fundamental and kinda, people always understood those. They tended—historically, they’ve happened a little too late in the life cycle, making challenges for the AppDev team and such.

    We’re seeing that shift left a lot, but then there’s all these other range of things that you should be doing and can be doing to build security into the platform. And so, when we saw pod security policies in Kubernetes, for example, that’s a way that the Kube admin can take advantage of the Linux features that enable container isolation at the Kubernetes layer and enforce things like ensure that a container doesn’t run with unnecessary privileges.

    Shimel: Sure.

    Newcomer:  And so, we are seeing more capabilities—now, that’s still beta, so the community still has some work to do there. But as you say, we’re seeing more emphasis and, you know, the open source Kubernetes security audit sponsored by the CNCF is a great example of that.

    Shimel: Oh, absolutely. And look, CNCF has done yeoman’s work here. They’ve really, really done a nice job with the whole Kubernetes project, specifically security.

    You know, but one of the reasons, like—we did a webinar yesterday for instance and it was on, you know, the different cloud providers versions of Kubernetes and—

    Newcomer: Uh-huh.

    Shimel: [Cross talk] environments. And, you know—fantastic, we had 700 and something people sign up for this webinar.

    Newcomer: Great.

    Shimel: A lot of great questions, even on the YouTube afterwards, a lot of great questions. One of the things that became clear to me in listening to people talk is that—you know what? Just going to, whether it’s AWS or Azure or GCP or whatever and setting up my Kube environment may not be the best thing for me because I’d rather get one of the package distributions, if you will, or a more complete solution, of which Kubernetes is a piece, like an OpenShift, but some others were mentioned—Rancher and so forth.

    Newcomer: Sure.

    Shimel: But OpenShift was the most popular one mentioned. And I think one of the reasons is, people want to know that security has been kinda built into it.

    Newcomer: Yeah.

    Shimel: Beyond just the Kube release, whether it’s 1.4, 1.5, what have you, 1.6—you know, what else has been wrapped around that just K8—

    Newcomer: Yeah.

    Shimel: —to make it easier?

    Newcomer: Absolutely, and that’s been a big focus for us at Red Hat, really, from the beginning. You know, an enterprise solution—and this is a place where, so, we’ve talked about changes in the security tooling that needed to be made to adjust to the technology, but by and large, the principles still apply. You know, you still need audit logs, right? You still need, you know, to log data from the cluster itself. You need log data from the applications. You need monitoring tools. And so—and you need to think about host arrest security as well.

    And so, we’ve kind of really looked at the stack as kind of spanning all of those things, and we want to make it as easy as possible to manage that solution as a solution, right? And so, that if you—and plenty of folks do this, you know, and get value from it. But if you’re in a situation where you can afford to kind of do a DIY Kubernetes and add in a logging stack and add in kind of all the different pieces that you really need for the enterprise solution, then you have to maintain them each separately and you’re maintaining the host OS separately as well.

    And so, we’ve really focused recently, especially with OpenShift 4, on automating everything, which includes the host operating system. So, Rel CoreOS, Fedora CoreOS available as an open source project. It’s a container optimized operating system that we manage as part of the full platform. It makes it much easier to apply OS updates across your cluster. You can do that in a way that has zero downtime for your well-behaving apps. You can take a node out of service in the way you would, you know, that Kubernetes manages it. Update that with a patch to OpenShift or its components or the operating system itself, put it back in service.

    And so, kind of a combination of looking at the whole stack holistically, what is an enterprise need in order to ensure that they have a secure environment, a stable environment, a highly available environment and making sure that we kind of leverage the terrific declarative and automation capabilities of Kubernetes kind of throughout the whole stack.

    Shimel: Absolutely. You know, I didn’t realize just really all of—you know, until you just said it, I never kinda put together all the pieces of what you guys are doing with that. It’s pretty amazing, isn’t it?

    Newcomer: It’s really cool. And one of the other fun things that we get to do is, we actually—so, back to, if we think about the host OS layer for a bit, right? If you need to scale your clusters, that means adding a new host and you’ve got the work involved to be sure that you deploy that infrastructure and that you secure that infrastructure according to your standards and then you put Kubernetes on top of it and add it to the cluster and you’re ready to put workloads on it.

    And we’re using the concept of Kubernetes operators to automate the components of OpenShift, including the host OS. So, we have a machine config operator, so if you’re deploying OpenShift in a cloud where you can automate the addition of infrastructure easily, you can use the machine config operator and the declarative nature of Kubernetes, right? It’s a container optimized OS, it’s delivered primarily as container images, the user space is read-only, you’ve got that declaration of what a host should look like and you can just use the machine config operator to spin up new hosts and add them to your cluster.

    Shimel: Excellent. You know, we would be derelict in our duties, I guess, if we didn’t mention the whole COVID-19 and how that’s affecting things.

    Newcomer: Fair enough, yes.

    Shimel: In my mind—so, first of all, I don’t think a lot of what we’re seeing right now and its effects are necessarily three-week or six-week or, you know, a lot of this stuff is gonna stick.

    Newcomer:  Yeah.

    Shimel: I think one of the things that are gonna stick are, people are gonna want more automation, right?

    Newcomer: Absolutely.

    Shimel: In their deployments, in their operations, in their infrastructure.

    Newcomer: Yep.

    Shimel: And automation, from a security point of view, is kind of a double-edged sword, right? At least we, from—when things are automated from a security point of view, we think we know exactly what’s gonna happen, and so we can plan around that. On the other hand, security people tend to get a little fritzy, you know, when things come out of our cold, dead hands, here.

    Newcomer: Yeah.

    Shimel: What do you think? How—what do you think?

    Newcomer: I know; I agree with you. And I think one of the things that, one of the ways that Kubernetes is kinda pushing the boundaries with security teams. And I talk to a lot of different security teams over time. So, it’s kinda like—you know, they’re a little bit more comfortable with the idea of DevOps for the application layer at this point, right? For those containerized apps that are gonna be deployed, it’s like—okay, they kinda have an idea of, “Yep, security static analysis tools, integrated vulnerability scanners integrated.” There’s some cool new stuff coming out that I’m seeing on the market, they’re tools that are starting to evaluate the configs and the Dockerfiles, too, that’s really great.

    But—and then as we continue to move into the ops space, right, with Kubernetes and the SDN, which is required for any Kubernetes cluster, and now we have service mesh added into the mix, or Istio for microservice based communications. The network security teams are uncomfortable with who’s gonna manage network policies at the Kubernetes layer and now, I’ve got service mesh or Istio policies as well, and who’s responsible for those?

    And in the end, it’s really about visibility. So, if we circle back to automation, we’re really looking at infrastructure as code, you know, GitHub’s model that applies again to the Kubernetes layer, to the configuration of the Kube cluster as well, and we need to put in place, you need the automation to get the best results, but you need to do it in a way that gives the security team visibility into the kinds of things they’re used to seeing.

    And so, I think this is another way where we’re starting to shift left in new ways, and I’m also seeing solutions that help automatically generate network policies based on evaluating an environment or an automatic generating service mesh policies based on evaluating the config for the apps.

    But all of that, you know, the network security guys aren’t necessarily gonna log into the cluster to look at that. So, how do they get the view they need to get, and how do they help the AppDev teams understand that whole risk management and their security perspective? And so, this is where it’s not just about tools, it’s about people and processes, right? And I think there’s so much richness here, but you’re absolutely right—we can’t do it without automation. And so, we’re gonna have to help these people become comfortable with this shift while ensuring that they get the visibility they need to know that things are being done in a way that meets their risk guidelines, their regulatory requirements, and the security posture they want.

    Shimel: So, to me, one of the fundamental things with DevSecOps, one of the fundamental shifts in DevSecOps is, first of all, security people recognizing that they’re not the only ones who care about security.

    Newcomer: Mm-hmm.

    Shimel: Believe it or not, the developers and the DevOps folks, they do care about security. They may not be security trained people, but they care about security.

    I think the second thing with that is, the developer people have to realize, and the DevOps teams have to realize that the security people aren’t there just to be the roadblock.

    Newcomer: Right.

    Shimel: And they aren’t always gonna be the people who say no.

    Newcomer: Right.

    Shimel: And what we’re—so, this has nothing to do with technology, per se. This is a people to people issue.

    Newcomer: Absolutely.

    Shimel: And I think we’re making real progress in that, and as a result, what we’re seeing is security people paying for and approving security tools that developers in DevOps teams are using—

    Newcomer: Yeah.

    Shimel: —on the Kubernetes platform—

    Newcomer: Yep.

    Shimel: —you know, because that’s kinda the platform of choice now, and that, to me, that’s what keeps me optimistic about this.

    Newcomer: Yeah. No, I’d agree, and also, when we think about the broader landscape, I mean, there’s, the security threats are just ever-evolving, ever-changing. And there aren’t enough security trained professionals to go round, right? There aren’t enough cybersecurity folks, et cetera.

    And so, we have to figure out, how do we help teams scale, and collaboration is the way to do that. And you’re right, I see the same thing you do, right, that the security team is approving those tools that are container native, Kube native tools that help to ensure. And in some ways, I don’t mean this in a negative way, but in some ways they kind of are pushed into that because they’re traditional tools that used to be used kinda at the back end of things aren’t effective in the container and Kubernetes world.

    And so, they really do have to go with this shift that we’re seeing in the vendor landscape, and it just opens up this terrific opportunity, though, for that collaboration and that shared knowledge which, you know, is an adjustment for people sometimes.

    Shimel: Yeah, agreed, agreed. Kirsten, when we first started, I said, you know, the time goes really quick, I’m only gonna keep you here 15 minutes—well, that was 21 minutes ago.

    Newcomer: [Laughter] Okay.

    Shimel: We—yeah, we did it. Alright. We’re gonna have to call a wrap on this one. Maybe we’ll have you come back another time and we—

    Newcomer: It’s a plan!

    Shimel: —can continue the conversation there, good?

    Newcomer: Great. It was great fun—thank you so much, Alan.

    Shimel: Thank you.

    Newcomer: Alright.

    Shimel: Kirsten Newcomer, Red Hat, our guest here. This is Alan Shimel for devopsy.kinsta.cloud, Container Journal and Security Boulevard. You’ve just listened to another DevOps Chat. Stay well, everyone.

    — Alan Shimel

  • DevOps Chats: Swiss, Simple Secure Collaboration with Adeya

    DevOps Chats: Swiss, Simple Secure Collaboration with Adeya

    The current situation with so many working from home has shined a spotlight on potential security issues with many of our collaboration solutions. Adeya, says they have the answer, offering Swiss, simple collaboration on a military grade scale.

    I sat down with Francois Rodriguez of Adeya’s executive team to discuss what makes Adeya both simple and secure, as well as what the offering is all about. This is more than video conferencing by the way. This is a well developed and tested collaboration suite that has been in use by the Swiss military and others for years. Have a listen and check out Adeya.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    Transcript

    Alan Shimel: Hey, everyone, it’s Alan Shimel for devopsy.kinsta.cloud. You’re listening to another DevOps Chat. We’ve got a new company to introduce you to on today’s DevOps Chat, and the name of the company is Adeya. I hope I didn’t mispronounce that, but my guest will give us the proper pronunciation. I’d like to introduce you to Francois Rodriguez, he’s the chief growth officer at Adeya. Francois, welcome.

    Francois Rodriguez: Thank you for hosting us.

    Shimel: Thank you. So, Francois, did I get the name right?

    Rodriguez: Yeah, correct. The pronunciation is correct. Americans tend to say Adeya, but yes, Adeya is correct. [Laughter]

    Shimel: Okay. Well, you know, I always thought I had a little bit of a French accent. [Laughter] But I’m glad I got it right, then. So, let’s start with the obvious, Francois. Our audience may not be familiar with Adeya. Why don’t you, if you don’t mind, give us a little background?

    Rodriguez: Yeah, the background of the company is the following. So, it is a spinoff from EPFL. EPFL is one of the top five universities in technology in the world, based in Lausanne, so next door. So, for those that don’t know where Lausanne is, it’s next door to Geneva. And from that spinoff, the ask was for encrypting voice communication for the Swiss Army at that time, using a Symbian Operating System. At that time, Nokia was the leading mobile phone operating system, and that was the foundation of the company.

    With the advent of the smartphones, the application has been enriched with messaging and then the mobile application becomes, as well, a desktop application, a tablet application, enabling as well file sharing, instant messaging and we’re introducing as well video conference calling, end to end encrypted. So, that’s the most important element of the suite is the encryption layer, initially deployed and developed for the Swiss Army, so we are using the highest grade of encryption, so called military grade. And we are bringing that technology to companies and small organizations as well.

    Shimel: Excellent. So, the Swiss Army is already a customer, is that correct?

    Rodriguez: It’s the historical customer.

    Shimel: Okay. And then, at this point, has the company raised venture capital? Is it self-funded? What is the situation?

    Rodriguez: Yeah, it’s a venture capital, which is important in this type of business. You certainly have heard the news of cryptogate that was having some links with governments. So, these days, it’s very important when you provide this type of technology that you don’t have strings with any organization state owned or having any back door.

    Shimel: Sure. Sure, I mean, everyone’s worried about that. And, you know, as—well, before we jump more into that, Francois, what about your personal background, your journey? How did you come to be chief revenue officer—excuse me, chief growth officer at Adeya?

    Rodriguez: So, I started my career in telecom. At that time, I was in charge of developing the multimedia content for the youth and student populations. Before the advent of the smartphones, multimedia was games, ring tones. I don’t know if you remember these days.

    Shimel: Sure, I do.

    Rodriguez: And then we developed the music content, the early days of .mp3s. And moving forward, I professionalized my expertise in multimedia, transforming application into more professional applications. With the arrival of the tablets, we develop more and more professional application for enterprise, and then I joined a brand new spinoff from Airbus Enceda to bring connectivity on airplanes. The company used to be called OnAir.

    Shimel: Mm-hmm.

    Rodriguez: You’ve got Gogo in the U.S., so it’s a similar company, providing connectivity to passengers, multimedia and content to passengers, but as well, professional application for the cabin crew, electronic flag backs for the pilots, and more recently, IUTs connecting landing gear, engines, and any data that the airplane was generating.

    Shimel: Sure. Fantastic.

    Rodriguez: I joined Adeya in 2016.

    Shimel: Also, how long has Adeya been around for? I didn’t realize. When was Adeya founded?

    Rodriguez: 2007.

    Shimel: Oh, really? So, it’s been—so, this is not some fly by night, started yesterday company. You guys have been at this a while.

    Rodriguez: Yeah, exactly. Yeah, the brand awareness is really recent, because the typical client of Adeya used to be governments that are quite shy to do any marketing around, and it’s really when I joined the company that we started the blocking and enterprise product.

    Shimel: You know, in some ways this reminds me of—so, I’m a little older than you. [Laughter] But, you know, back when we had the AOL message rooms or chatrooms, whatever—they called them meeting rooms, maybe, before then. It was a rather innocent time on the internet where people didn’t realize you can’t let your children go online and just go into some chatroom with people you don’t know and what can go on there. And of course, we saw horror stories of what people were writing in chatrooms being made public or used the wrong way or predators, you know, preying on women and children and stuff. And because—well, it’s the reason why we can’t have nice things, right? There’s always bad people trying to take advantage of things.

    And then, as a result of that, you know, we saw a locking down, if you will, somewhat, of a lot of that kind of technology. But then, I guess it’s just human nature, people want to communicate, right? People want to communicate—even, God knows now, when we’re all locked in our houses, right, people want to still communicate. Being alone and isolated is just kinda foreign to the human condition.

    Rodriguez: Yeah, you’re right. So, I used to put an application on my daughter’s phone to lock the phone after an hour. These days, we’re up to three hours, because, you know, they need to communicate. They don’t go to school any more, so they need to be connected to friends, they need to chat, they need to send pictures, to send videos, to do video calling. These days, video calling is very important for the youngsters. I’m usually not a very big fan of video calling, but they are, so those are—

    Shimel: No, they’re native. They’re native to this, right? To us, we look at it and—actually, I was having this conversation with my COO this morning, talking about, we both  have children who are in high school, college now and in university.

    Rodriguez: Yes.

    Shimel: And, you know, they’re net native people who, the idea of doing video calling, the idea of listening to podcasts and so forth, this is how they’re used to consuming, right? And [Cross talk].

    Rodriguez: They’re used to the technology, they’re used to the technology and they’re also very tech savvy in terms of what features and functions those tools can bring, and they are very, very, I would say, picky on which tools they’re gonna use. And we’ve seen that in certain companies that there is a kind of step back when they propose traditional tools that are quite clunky, quite difficult to use, very slow that you need to put the VPN around and all these old fashioned or traditional tools have been rejected by the young population of workers.

    Shimel: Yeah.

    Rodriguez: And more so now with these days of remote workers where you have, you know, a layer of Bring Your Own Device on top of it where people are installing their own favorite applications, too. It’s very difficult to control. It’s very difficult to put security around when you don’t have a clear policy on what is allowed, what is not allowed, and more so when you don’t bring options. People are starting to download their favorite tools online. Obviously, security is not their top priority, it’s to make their work easy and fast and provide agility to the organization. So, that’s a real issue.

    Shimel: I agree. And you know, I mean, but this is a classic security conundrum, which is, if we just think we’re gonna lay down on the tracks and say, “Stop!” the train runs us over, right? We can’t stop that, so what we need to do is, instead of being the people who say no, we need to be the people to say, “Yes, you can, but here’s a secure way of doing it that maybe isn’t too cumbersome, too expensive, and still allows them to do what they need and want to do from a communications perspective.”

    And I guess, really, that’s what the whole Adeya thing is about, right, is—hey, you wanna video or do voice calls or, you know, messaging, you can still do that, and we understand it’s important. But here’s a way of doing it in a more secure fashion.

    Rodriguez: Yes, security is important, but what we’ve been putting at the heart of the development is the user experience. Because there is a lot of tools in the security space in the market, but very few of them are really providing a seamless experience for the users, and more so when they’re not IT people. Because IT people will always tell you, “That’s very easy, you go in Settings, you configure that, and you put the VPN around and it’s working,” when in fact, nobody knows how to do it.

    So, what we’ve been doing is to bring in one unique application, I’m calling the Adeya like a Swiss Army knife. In one tool, you have got different features. You don’t need to have, you know, upswinging. You don’t need to have configuration. The security layers are ___, you instill it in your device, and you start triggering the feature that you want to use.

    Shimel: Absolutely. Francois, if you could share with our audience, you know, how easy and how much does it cost if you wanted to use the Adeya solution? Let’s say—look, I’m a little worried about our use of Slack and/or Zoom for corporate communications; you wanna use what you wanna use with your kids or whatever, that’s one thing. What does it take to stand Adeya up?

    Rodriguez: So, we’ve got four packages, depending on the security layer that you want to activate. So, the starting price point is $4, the $4 is already, you know, the starter package that provides you one to one video calls, security voice over IP, instant messaging, and as well, you know, all the Dropbox and Lockbox where you can store some documents.

    If you want to have the video conferencing with multiple users, you have an extra option, and if you want to install everything on premise on your own data center, and this is what we do for governments, there is an extra cost to deploy the system, but it’s your entire system, okay? You have no backdoors, no cloud act to open up your data center to foreigners, and you have everything in your house. So, that’s the model that we do.

    So, we’re starting with a very easy to set up cloud solution based in Switzerland and we use the strength of the cloud infrastructure in Switzerland with the data sovereignty, and we go up to deploy your own system on prem.

    Shimel: Really, okay. So, there’s sort of a cloud-based system, if you will, SaaS or cloud-based, and then you have a choice of on-prem. Because I know in many government situations, as you mentioned, they don’t want to share public infrastructure, right?

    Rodriguez: Yeah.

    Shimel: And so, that’s a real requirement. So, Francois, I’ve got to ask you, I mean, it seems like the Adeya system would find a very fertile ground in today’s environment with what’s going on with COVID, with people working from home and everything else—how has this affected, or how has Adeya responding? What are you seeing in the market recently now, just in the last couple weeks, as a result of the pandemic?

    Rodriguez: So, what we see is a variety of demands coming from the historical clients which are government administrations that are really expanding the fleet. It’s not, you know, just to secure a certain special project, but it’s really to provide everyone the tool to work from home, and in the most important security layers. Because, as soon as you leave the government institutions, you need to be connected from whom, with high level security, because then you bring the formation outside the typical firewalls, and this is what the governments are fearing.

    Now, the diversity that we’re seeing is that we start having—hello?

    Shimel: No, no, it’s okay. People are blogging, I have a meeting coming on.

    Rodriguez: Okay, understandable. What we see is, enterprises now coming to equipping their entire organization and not just the top executives that used to travel a lot or go to countries where they need to shield their communication, but as well to protect their messaging, to protect their messaging, to protect the documents that they’re sending, avoiding sending them over e-mail because even though e-mail has been encrypted for several years, it’s very difficult to have the IPs working because the systems are not interworking together, depending on the operator that you use. If one side is using Gmail, the other side is using Microsoft, you don’t have interworking with encryption, for instance.

    Shimel: Sure.

    Rodriguez: This is the—we try to ease the experience with this type of situation. What we see now is the remote workers as well, the employees themselves are contacting us to, “Hey, I heard about your solution. Give me some documentation that I can bring to my IT people.”

    Shimel: Well, that’s the way it always comes in. You know, it’s almost that open source mentality, but very good.

    Rodriguez: Exactly. So, that’s the number—

    Shimel: Francois, as I mentioned to you when we started, the time goes really quick, here. I apologize, but we’re way past 15 minutes.

    Rodriguez: Okay.

    Shimel: I wanna thank you for introducing Adeya to our audience. I wish you will in these uncertain times, both personally and with the company. And as I mentioned to you, maybe we could do a video interview for our TechStrong TV—

    Rodriguez: Yeah, sure.

    Shimel: And have you join us. Maybe we even could use a day or we could record the video through there or something, show people it in action.

    Rodriguez: Yeah. Okay.

    Shimel: Sounds good?

    Rodriguez: Yeah, perfect. Looking forward.

    Shimel: We’ll work on that. Alright.

    Rodriguez: Thank you, Alan.

    Shimel: Thank you.

    Rodriguez: Pleased to meet you. [Cross talk]

    Shimel: Chief growth officer for Adeya, Francois Rodriguez, here on DevOps Chat, this is Alan Shimel, and you just listened to another DevOps Chat.

    — Alan Shimel

  • DevOps Chats: What Is Your Data Really Worth? with Splunk

    DevOps Chats: What Is Your Data Really Worth? with Splunk

    Gaining real insights can catapult companies ahead of the competition, but that’s easier said than done. Splunk recently released its new report What Is Your Data Really Worth? which produced some very compelling results.

    Leading-edge data innovators use data to raise gross profits by 12.5%. Ninety-seven percent of this top tier meet or beat their customer retention targets. Mature organizations are almost 10 times more likely to draw more than 20% of their revenue from new, innovative products and services. A select group of companies, categorized as data innovators, achieved impressive and measurable results.

    Andi Mann, Splunk chief technology advocate, joins Mitch Ashley on DevOps Chats to share some of the key insights in the report and discuss how companies are utilizing their data to achieve higher revenue growth, improved customer experiences and gain cost savings.

    As usual, the streaming audio is immediately below, followed by the transcript of the conversation.

    Transcript

    Mitch Ashley: Hi, everyone, this is Mitch Ashley with devopsy.kinsta.cloud, and you’re listening to another DevOps Chat podcast. Today, I’m joined by Andi Mann, chief technology advocate with Splunk, and our topic is a report that just recently released called, “What Is Your Data Really Worth?” The ultimate question, you know? It’s kind of, from, do you remember—what’s the, 42? Is that the answer? Okay, anyway, another topic. [Laughter]

    So, welcome, Andi—good to have you on DevOps Chat.

    Andi Mann: Hi, Mitch. It’s so good to be with you again.

    Ashley: Absolutely. Andi and I are friends from way back, so we’ve known each other for quite some time now. [Laughter]

    Mann: Yeah, this could get a bit squirrelly, mate. Let’s see how we go. [Laughter]

    Ashley: I made sure I didn’t have too much caffeine before we recorded, so hopefully that will kinda keep me in check, anyway, we’ll see. [Laughter]

    Mann: [Laughter]

    Ashley: So, for folks who don’t know you, tell us a little bit about what you do and what you do at Splunk and a little bit of your background.

    Mann: Sure. So, Mitch, I’m chief technology advocate at Splunk for our IT Markets Group. What that means, as an advocate, I spend my time explaining stuff to other people and advocating for technology mostly. So, I talk a lot. A lot of people will see me doing podcasts like this, they’ll see me at conferences and keynotes, writing, and other things. A lot of outbound talking about Splunk and our data delivery platform and all the great solutions we’ve got to bring data to everything.

    But a lot of people don’t see the other side of it, which is me advocating for my customers. It’s one of Splunk’s core values that we have two ears and one mouth, and we should try and use them at least in that proportion. So, I try to listen a lot to experts like yourself, like other analysts and pundits, customers, market makers, and try and help Splunk create the best possible products and solutions to make our customers successful.

    Ashley: Sounds like when I was a kid, the saying was, “God gave you two ears for a reason, Mitch.” [Laughter]

    Mann: [Laughter] Exactly, right? Oh, you weren’t the only one who got told that as a kid, huh?

    Ashley: No, I’m guilty as charged. [Laughter] So, let’s just jump to the report. Tell us a little bit about, obviously, you’re in the data aggregation analysis collection, all kinds of interesting parts of the data world and lots of different sources. How did you decide to try to answer the question of what’s your data really worth? What was the genesis of this report?

    Mann: Well, the first thing we did was, we decided to find an independent expert to help us. So, we went to Enterprise Strategy Group. Now, you know them, they’re an analyst firm out of Boston.

    Ashley: Yeah. Good folks, good folks, yeah.

    Mann: Really good folks. Their key areas where they focus on is data and security. And so, for the data part of this survey, that was a very obvious choice. So, they hope to figure out a bunch of questions to ask to see if companies were using their data in advanced ways or not. So, we were looking at things like how much data they use, where do they get their data sources from, which business departments use data in their decision making and a whole bunch of other outcomes.

    And we were able to figure out from that with working with ESG, within Enterprise Strategy Group, we were able to figure out a certain percentage, around about 10% of the survey respondents out of 1,300 respondents were what we call data innovators. So, they were taking more data, they were using it in more deliberate ways, they were using it in more business departments and more business decisions.

    And so, we were able to figure out, well, if they’re using data in better ways, what are the good things that happen when you do that, and comparatively, for the companies that are using data in sophisticated ways, what are the down sides for them?

    So, it’s a really interesting set of questions and answers that we managed to find some really interesting data on.

    Ashley: Great question to ask. So, tell us, what was the number one thing that jumped out to you? What was the learning you didn’t expect to get from this study?

    Mann: So, I think the, one of the learnings that I think we did expect to get was that using data better helps you in your business, in all sorts of ways. So, the one big area I think I was a little bit surprised at was that using data better is not just gonna help you save money, it’s gonna help you make money. So, for these data innovators, on average, they had a profitability of around 12% gross, across different sizes of businesses as well. That meant about $38 million average total gross profit for these innovative organizations who are collecting, managing, and analyzing data to improve their business.

    I think the second thing that surprised me was that this wasn’t even split between top line and bottom line. You know, in IT especially, we often look at ourselves as a cost center. We’re often told to do more with less. We’re often told to find ways to save. What we don’t hear a lot about IT is how important it is to making money, to adding revenue, but that’s what we’ve found from this research. Data innovators added on average over 5% to their annual revenue because they were using data better, and that added to reduction of cost of around 5% as well.

    So that’s how we get up to that 10 to 12% on the bottom line, but it’s a combo of making more money and saving money, which is—you know, there’s not a lot of technologies which you can point to for that.

    Ashley: Definitely both sides of the line, now. There was 5.32% over 12 months as a result of their data use. Talk about—how do you define a data innovator?

    Mann: So, some of the things we looked at for the data innovators—are they more or less sophisticated in their strategy? So, do they have a data strategy, do they have a chief data officer? Do they have specific plans over a 12 to 24 month period of how they’re gonna get more data in and use that data? Do they have analytics programs in place? Do they have a data science program in place? You know, these are some of the signals that we looked at to see what they were able to do with data.

    And then in terms of the outcomes, we looked at things like revenue growth, we looked at operational cost reduction, the ability to innovate. How long does it take to get new products or new ideas to market? We looked at outcomes as well, like customer satisfaction, customer retention, ability to make faster decisions.

    So, all of this sort of gave us this picture of what does a data innovator look like?

    Ashley: Now, just to give folks an idea here, this isn’t like baseball, everybody gets an award and gets to be called a data innovator. This is 11% of global organizations was your measurement. So, it is kinda top 11% kinda cream of the crop of folks.

    I found another interesting stat that I read in the report that said one in five data innovators generated more than 20% of their annual revenue from products and services developed in the past 24 months, compared to just 2% of data innovators. So, if you have really invested in analyzing, assessing, using, and applying data, that number is backing up what you said about—yes, it does add to topline growth.

    Mann: Yeah. Because, I mean, when you’ve got data to go on, you can make these rapid decisions. If you’re talking about innovation in life, you obviously have written about innovation quite a lot and we’ve talked about it directly a couple of times and, you know, to innovate, you’ve got to be able to make fast decisions. You don’t try things out.

    You know, typically, 95% of innovation will fail. That’s okay, as long as you fail fast, fail small, fail cheap, and fail forward. But if you don’t have the right data to make decisions, then all of a sudden, you’re in a data paralysis. You’re in a decision paralysis. You can’t make those rapid decisions. You end up having to get more information. You end up going with the loudest voice in the room, or you end up going with the loudest person in the room which, by the way, tends to work against some of the greatness of diversity and inclusion about getting different opinions, about getting different, diverse opinions and viewpoints.

    Ashley: Mm-hmm.

    Mann: So, if you—but if you have data, the data speaks for itself, and you can set gates for innovation. There’s a classic innovation theory—you try stuff out, you do it small, you set gates, you pass the gate.

    One example, for example, and directly for this audience as well, is thinking about what is a high quality release? Is it a release that has no bugs? Well, that might be too high a bar to get over, but to understand what level testing has it gone through, what is the pass/fail rate? What is the code quality? What is the compliance quality in your code? These sorts of things, they’re data points that you can then make decisions on.

    Even more so, you can automate decisions based on data points. If I’ve passed 99.92% of my tests and I’ve run 100% of the tests that I expect, that’s a really good mark and I’m probably gonna go straight into production with it.

    Ashley: Mm-hmm.

    Mann: So, I can iterate faster, I can do new things in new ways, because I have surety that the decisions I’m making are real and based on substantive information that will matter when I get to prod.

    So, innovation is absolutely a strong outcome that we see in this research as well, coming from these data innovators.

    Ashley: Now, I kind of threw the trick question at you first. What didn’t you expect to learn from this? I mean, let me toss that one out there again, since we talked about some things you did expect to learn. Were there any small, medium, large surprises that you walked away from some of the answers that came out of the research?

    Mann: Yeah, look, I think some of the surprising stuff was just sort of around the vertical side in the industries that were good and industries that were bad. I would’ve expected some other, some industries who are lower on the ability to get data insights, I would’ve expected them to be higher. Specifically, higher ed and public sector. They have a lot of access to data, they don’t necessarily have the same issues with data analytics and aggregation that private sector do. You know, they’ve got things in place around privacy and protection of data.

    So, there’s some really positive things. Higher education especially, I would’ve thought, well, they have investigative units. Research is something they do. I was a little surprised by that. What we saw was that technology organizations do really well by using data better. I sort of got that, that makes sense. They’re involved in machine learning programs and AI programs and things like that. They’re on the cutting edge. Somewhere around two-thirds of financial organizations had really good results in terms of higher revenue through better utilization of data assets.

    Ashley: Mm-hmm.

    Mann: And again, financial organizations are often on the cutting edge of technology and so forth, so that made sense. But for me? Higher education and public sector were only down around 50% at this ability to use data in operational ways. And honestly, that surprised me. I think they could do a lot better. I think they’ve got the fundamentals, the people, the technology, the inquisitiveness and the opportunity, certainly, to be able to use data in better ways. So, yeah, I’d love to see those numbers come out better.

    Ashley: Now, I wonder if, do you think there’s a correlation or a connection to this idea that those folks that were data innovators, their culture is, what you termed in this report, quote-unquote data obsessed. It was just data driven company, everything is—you know, decisions are driven by data, you know, collecting and using, it’s not just the loudest voices in your room. It seems like that’s a pretty high correlation there to the folks that are really in a place and are leveraging data in a very successful way.

    Mann: Yeah, the cultural aspect is really interesting. You know, we’ve talked about culture in the DevOps community for a decade or more, and how important the cultural change is. And, you know, we know from DevOps you can throw all the tools at the problem. If you don’t have a culture of collaboration and sharing, then you won’t have a collaborative environment to work in regardless of what tools you throw out there.

    Data is the same. The data’s there. The big difference between the data innovators and companies that aren’t necessarily as innovative with data, you know, the companies we call the data detractors and so on. One big difference is if they’re inquisitive about the data that exists and go looking for it and look for ways to use it. It’s not necessarily that they have more data, it’s not necessarily that they have different data, it’s not even necessarily that they have data that people don’t understand or understand better or worse. It’s that they have a culture that values data driven decisions.

    And so, when the decision comes to the—you know, the meeting comes to a decision factor, they have people in that room who deliberately put their hand up and go, “What is the data saying?” Rather than having the people in that room go, “Okay, I think we’ve got everything we need. What do we all think?”

    Ashley: Mm-hmm.

    Mann: Right? And that’s a cultural change, Mitch. That’s a cultural difference. Having that data obsession as we’ve termed it in the report means that your culture is looking for data, actively looking to make those data driven decisions. Actively looking to get data from everywhere and bring it to every decision. Not just the important or less important or whatever, every decision. And that absolutely is a cultural difference.

    Ashley: So, don’t take this—this is not a trick question at all. I’m interested or curious about your thoughts on data, data, data—extremely important, this report showed the value and the impact that can have. I’m thinking in an analysis standpoint, sometimes you can get into analysis paralysis or maybe the insights aren’t always just in the data, but from other factors and things.

    How do you blend both the tools, the experience, the knowledge, the capabilities of the organization and infuse that with data in a really healthy way? What are your thoughts about that?

    Mann: Yeah, look, that’s a super question, Mitch, because you know, there are lies, damned lies, and statistics, right?

    Ashley: Wow. Yeah, we—

    Mann: You can make data say whatever you want. [Laughter]

    Ashley: Yes, we can make it say whatever we want—true.

    Mann: So, you’ve gotta be careful about stuff, right? You’ve gotta be careful about bias, you know? I talked about diversity and inclusion a little bit. If all your algorithms are written by people that look and sound exactly like you, then they’re certainly gonna reflect who you are and what [Cross talk].

    Ashley: Mm-hmm.

    Mann: So, having a variety of data, but having a variety of algorithms created by a variety of people from different backgrounds—so, you’ve gotta have diversity in your teams. Again, it’s a cultural thing, right?

    Ashley: Mm-hmm.

    Mann: Your data will tell you what you want it to if you ask it. So, you’ve gotta have the ability to get more data, you’ve gotta have the ability to ask data, ask continual questions of your data. So, it’s not just the first answer. Typically, when you’re doing data analytics and inquisition, the first answer just pops up more questions for you. So, you’ve gotta be able to go through that iterative cycle of asking more questions. That’s a very fundamental and practical thing to do with how do you structure your data, what tools do you use to inquire after your data. You’ve also gotta have the understanding that some things are not necessarily a data decision. Some things actually don’t have data, and you do need to have personal experience.

    I’m a big believer, Mitch, in letting the machines make the right call on stuff they’re good at. Complex data, time series data, high cardinality data, long periodic data—you know, humans are awful at things like pattern matching, we’re awful at looking at long term data about patterns. Machines are really good at that stuff. So, let machines—

    Ashley: Also really good at large volumes of data where we, as humans, love a data point of one. You know, my kids—

    Mann: Exactly. [Laughter]

    Ashley: Those millennials … I have two data points at home, so I’m super set. [Laughter]

    Mann: Oh, yeah. anecdata, yeah, it’s the bane of our existence, I think. But it’s important to understand that machines can’t make intuitive leaps, either.

    Ashley: Mm-hmm.

    Mann: Machines have no imagination whatsoever. Have you ever seen some of the Harry Potter scripts that have been written by machine learning engines?

    Ashley: I have not.

    Mann: Oh, my goodness—it’s so awful, Mitch. It’s so bad. [Laughter] Because machines have no imagination. So, there is a cutoff point, and it’s a fair question to ask, and I don’t think there’s any definitive answer of where that cut point is. But at some point, you need to have a human to interpret and bring imagination, bring intuition, bring experience to that data driven decision.

    But I would certainly posit that you bring that human experience to the data, you don’t just go with a human gut feeling.

    Ashley: Mm-hmm.

    Mann: The data will tell you what to do.

    Ashley: I don’t recall this as looked at or at least talked about in the report—I would imagine those data innovators have figured out where that balance is, it’s not just about having the most data or the data, the answer is always in the data, right? It’s that balance of, you know, it’s the right sources, it’s the negative validation as well as the positive validation, the correlation, the analytics, how statistically valid is the information. So, all kinds of things that data scientists know how to do that help you be really good about how to use that data, and of course, that’s probably a maturity curve that you work up to.

    Mann: Yeah, exactly right. I mean, we see—and it’s not necessarily specifically in the data, but we absolutely looked at that maturity curve and what it means to be a data innovator versus a data adopter versus a data deliberator, someone who’s in the early phase, for example. We deliberately looked at what it was like as a company, what patterns. And again, in the DevOps community, they’re very familiar with this concept of patterns and anti-patterns.

    Ashley: Mm-hmm.

    Mann: And the patterns that the data innovators took gave us a sense for what is a mature business. You know, we’re not necessarily gonna be able to tell you exactly what those gates are that define good innovation or define a good test outcome, or define a good marketing campaign or whatever it is, a product that will be successful.

    But what we can do is help you understand what the data told us about data maturity. And so, that’s why we’re actually working on, we actually loaded up onto the Splunk.com website a data maturity calculator. So, it’s a free—it’s a web based assessment tool, it’s free, obviously, so you can actually compare yourself against some of these data innovators.

    You know, a really easy way to assess what’s your data use, what tools you need to get the most out of your data, what data you’re missing and how do you compare on this data maturity curve to be able to make those decisions between smart, experienced individuals and definitive or maybe not so definitive data and data driven decisions.

    Ashley: Mm-hmm. Interesting. Great. Well, we’ve used our time pretty well here. Let’s certainly find out how do folks get this information? You talked about this assessment tool of kinda where are you on the data innovator curve—how about getting the report, information about it?

    Mann: Yeah, absolutely. So, it’s all available up on Splunk.com. In fact, if you go there on the homepage right now, you will see the data-to-everything platform, and you’ll see links there to be able to get that video. You’ll be able to get, also, stories from some of our customers who have used data and turned data into delivery. And, you know, household names like Domino’s and others are really using data to create an impact, to be a data driven organization.

    So, yeah, jump onto Splunk.com, you’ll be able to see the report there, you’ll be able to jump on, read the report. You can also take that assessment for yourself. It’s gonna be really fascinating to understand how you line up with those data innovators and where you can go to try and get a slice of that extra money that those innovators are getting.

    Ashley: Great. Splunk.com, great place to go for lots of other information as well as this report. Say, by the way, before we end things, I hope you come back. I’d love to have a conversation with you about data in the DevOps world. One of the challenges—data has such a different nature, right, than—

    Mann: Yeah.

    Ashley: What we can do, you know, more flexibly with software and configuration automation and things around software, oftentimes developers sort of struggle with this amorphous, large piece of data or collections of data and how that’s evolving along with things like DevOps. So, I’d love to have a conversation about that.

    Mann: Yeah, that would be a great conversation. Yeah, I would love that, Mitch. That’d be cool.

    Ashley: Awesome! Well, hey, thanks a lot, Andi, for joining us today.

    Mann: Thank you, Mitch. It’s a pleasure. Always great to talk to you, mate.

    Ashley: Always great to talk with you. And I won’t talk about where Australia fell on the list of data innovators, but that’s another topic, so.

    Mann: [Laughter] I know! Don’t—please, don’t! Thank you!

    Ashley: Okay, alright. [Laughter] Well, you’ve listened to another DevOps Chat podcast. I’d like to thank my friend, colleague, someone I’ve known for quite a while, Andi Mann, chief technology advocate with Splunk for joining us. And thank you, of course—you, our listeners. This is Mitch Ashley with devopsy.kinsta.cloud. You’ve listened to another DevOps Chat podcast. Be careful out there.

    — Mitchell Ashley

  • DevOps Chats: Mobile, Monoliths & Microservices, With LightStep

    DevOps Chats: Mobile, Monoliths & Microservices, With LightStep

    Daniel “Spoons” Spoonhower made a bit of a name for himself while he was at Google, as did his two co-founders of their latest company, LightStep. All three were there at the birth of the microservices wave that has swept through the software world.

    They left Google and started LightStep to help all developers build better, more scalable applications.

    With its new release, LightStep has pushed the bar higher. In this DevOps Chats podcast, Spoons tells us what they are doing and where he sees things moving.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    Transcript

    Alan Shimel: Hey, everyone, it’s Alan Shimel for devopsy.kinsta.cloud and Container Journal. You’re listening to another DevOps Chats. I’ve got a great guest to talk with today, I hope you’re going to enjoy it. I’d like to introduce you to Daniel Spoonhower, better known as Spoons. Spoons, welcome to DevOps Chats.

    Daniel Spoonhower: Hi, great to be here.

    Shimel: So, Spoons, you are CTO and Co-founder of LightStep, and though some in our audience are probably familiar with LightStep, being that this is the first time we’ve had someone from LightStep on our podcast, I’m gonna ask you to kinda do some of the heavy lifting here and kinda—

    Spoonhower: Sure.

    Shimel: – tell our audience a little bit about LightStep and what you guys do.

    Spoonhower: Sure—sure, sure. So, LightStep provides simple observability for deep systems. We think observability is more than just metrics, logs, and traces, it’s really about being able to navigate from effect to cause. So, whether you’re pushing into deployment, you’re on call and you got paged or you’re just trying to improve performance, observability tools like LightStep should be able to give you the insights that you need to understand what’s happening in your services and across your system.

    Shimel: Excellent. And just by way of, again, giving the audience the background—Spoons, why don’t you tell them a little bit about your own personal journey? You are a Co-founder and CTO, but there was life before LightStep.

    Spoonhower: True, yeah. So, yeah, I’m Co-founder and CTO and LightStep, but we have three—all three of the Co-founders are technical, and so, we all have done technical things and we all have done a lot of non-technical things, too, which has been pretty fun for me just to learn about finance and about commercial real estate—who knows what.

    Shimel: Yeah.

    Spoonhower: But yeah, I’m an engineer by training. Before this, I was at Google for a while. I worked both on their internal infrastructure team, which was super interesting, as well as on the cloud platform. And I have various other experiences at big and small companies. I was at grad school for a while doing academic stuff, so—yeah, a lot of different things.

    Shimel: Excellent. Alright. So, before we—I know you guys have some new product announcements coming up, but you know, LightStep is, as I mentioned, new to our audience here on the podcast, but it’s been around five years, right? And I think you gave everyone kind of the—you know, the brief elevator pitch about it. But it really, you know, in an age where even just since I’m doing devopsy.kinsta.cloud, right, Spoon, we’ve seen APM turn into AIOps and companies go public in this space and everything, several. But yet, you know, the need to kinda monitor, manage, see what’s happening is still here and I don’t wanna say it’s getting easier or—you know?

    Spoonhower:  [Laughter]

    Shimel: Because I think it’s just, you know, natural. Things get more complex as we continue to build and so forth, and I guess that makes the monitoring easier, but when does it get simpler?

    Spoonhower: Well, yeah, so I think the situation has gotten a lot more complex. That might be because of things like microservices or serverless or things like that. I actually think a lot of complexity comes from the fact that we no longer run our whole applications. Like, we use DynamoDB, we use third party fraud detection service, right? There’s a lot of pieces of our software that are not even ours any more, so that adds a lot to the complexity.

    Shimel: Yeah.

    Spoonhower: I think the simplicity has to come from focusing more on the use cases. Like, what are you as a developer actually trying to get done? And then, I mean—I think this is where people kind of get into things like AIOps is, like, using software to sort of harness the data that we have to help you in that task. I think that can be a real-really nice as a developer, right, to not have to understand all of the depths of what’s going on underneath the hood.

    Shimel: Sure. I mean, I just find it somewhat ironic that, you know, we’re gonna break down silos, we’re gonna break up this monolith and go to microservices so that we can deal with smaller, more easily digestible threads, and then we’re gonna orchestrate all of this with a great tool like Kubernetes. And then I look at it, and I’m not the developer you are—I’m not claiming to be, or the technical person—but damn, it gets…it’s just the nature of the universe, at some level.

    But anyway, you guys are well aware of this. It’s acute. This is the world you play in. You’ve got some new product announcements. Let’s talk about ‘em.

    Spoonhower: Yeah. That’s right, yeah. So, I mean, the history of LightStep a little bit is that we started as a tracing tool, collecting data sort of—exactly to address the situation you’re talking about. You’ve broken your application into some pieces and you want to be able to understand the big picture, right, and put them back together.

    And what we’ve done actually is to continue to integrate additional data sources into that, so that we can provide sort of more user-centric things. So, what we’re rolling out right now is a couple different pieces. One is error analysis, so being able to understand, you know, you have a spike in errors in your service, harnessing that data, whether it’s traces or logs or metrics, to understand what the cause of those errors are. We have a detailed rollout analysis, so even if you’re in the middle of a rollout, so you’re saying you’re gonna canary or blue-green or something like that and you wanna understand what’s happening, we’ll do that analysis for you and do a side by side to tell you what’s different about the new release.

    And one thing that’s pretty exciting is that part of this is integrating metrics into the platform. Metrics are a tool that everyone has been using forever and ever and ever, but you know, there’s a lot of metrics out there, and part of what we think is important is that we’re able to focus on the right metrics, the metrics that are actually able to explain what’s happening right now.

    Shimel: Absolutely. So, this new release, April 2nd, is the key day?

    Spoonhower: Yeah.

    Shimel: So, people listening to this can go check it out right now at LightStep.com.

    Spoonhower: That’s right. We’ve got a free developer tier that you can try. We also have a really cool sandbox that’s sort of, it’s a sort of interactive playground where you can check out features and you can basically walk through one of these scenarios. So, say you’re doing a release, say you’re trying to debug an error or something like that. It’s not—you know, it’s not totally constrained, but will kind of show you along and give you a bit of a guide that you can still explore the rest of the product while you’re there, but really trying to help people kind of put two and two together and understand what’s happening.

    Shimel: Yeah, no, I love that, man. Because I gotta tell ya, we’ve been experimenting with something like that for a project we’re doing on devopsy.kinsta.cloud where, you know, we want to have web people do a little bit more hands-on playing with different vendors’ tools and so, we’re trying to give them a sandbox, right, where they can go in and do these things.

    Because, you know, we were talking off mic, right? Originally, this was gonna be an announcement around KubeCon which, unfortunately, you know, got pushed. And, you know, not getting into the whole politics and the whole thing around Coronavirus and all this stuff, but certainly, we need—we need more ways, we need more diverse ways of allowing people to see what kind of new products, what new technologies, how can they get it under their nails a little bit and really—

    Spoonhower: Yeah.

    Shimel: – kind of see if it’s for them?

    Spoonhower: Yeah, absolutely. I mean, I think people learn in lots of different ways, right? Some people wanna read, some people wanna watch a video. I personally really like doing this stuff. Like, until I’ve made it, coded it, whatever, I never remember it, so.

    Shimel: Absolutely. And you’re not alone. I do think specifically for technology vendors, having those kinda hands on that people can actually go in and we see it even on our webinars, man. If we do a webinar where the vendor’s doing a real live demo that people can follow along, we get insane numbers of people signing onto that, versus someone just talking, you know, and that doesn’t work.

    So, let’s talk a little bit about what was driving this, for you guys.

    Spoonhower: Yeah. I think, you know, we—so, I should say, when I say “we,” it’s me and one of the other Co-founders. Ben and I spent a while at Google, and Google—it’s a weird place, in a lot of ways, but there are some advantages. Like, there were ways in which being at Google is a little bit like seeing the future, and they weren’t called microservices at the time, but there were a lot of teams that built software that all had to stack together.

    And we saw, you know, sort of firsthand the problems that they had in terms of like, okay, I’ve broken this thing into pieces and now how do I understand that bigger picture? We saw a lot of arguments among those teams, like, you know—“Oh, no, it’s your fault,” “No, no, it’s your fault”—and needing some data to actually kinda resolve that.

    And so, I think, for us, you know, we saw the rest of the industry starting to adopt these things through different technology, maybe, but the same idea that you can have teams work independently and deploy independently yet still build a single application. And so, the motivation was really to try to help those folks to understand what’s happening and, you know, we see LightStep being used by individuals, but actually more and more by teams. We see it used in operational review so, you know, you’re doing a post mortem, you wanna show people what happened. LightStep is a great tool to help facilitate that conversation.

    And for us, this is really about being able to help those folks deliver software more confidently and then, you know, get back to building new features and doing all the fun stuff that they’re doing.

    Shimel: Yeah, yeah. I mean, wouldn’t it be great if we just, all we did was the fun stuff all the time? [Laughter] Some of us are lucky enough to do that, me included. But this thing, these are important things that need to get done and, you know, and LightStep is following that up.

    I wanted to return to the KubeCon thing if we can, for a second, Spoons. Not KubeCon itself, but rather the Kube community, right? And you know, look, Kubernetes itself comes out of Google, right? I’m not gonna say the Google people invented microservices, but certainly a lot of very foundational work was done there, right?

    When you are out and about or you see how this community has grown and the enthusiasm for things like LightStep, right—I mean, how does that, you know, kinda give you a warm fuzzy inside to say, hey, man, this is a whole—there’s this humongous community of people who kinda share our visions or our outlooks, and it’s a lot easier to sell to, and I don’t mean that you’re a salesperson, but it’s a lot easier to sell those solutions, right, than it is—you know, it’s not like pushing rope uphill.

    Spoonhower: Yeah, yeah. I mean, I think [Laughter]—yeah, I mean, Kubernetes is a result of a lot of mistakes that were made the first time around. [Laughter]

    Shimel: Yeah. [Cross talk]

    Spoonhower: So, I think a lot of people would admit that. No, but I think the community is really great. I think the thing that’s pretty exciting to me about it is really thinking about things like infrastructure as code, about, thinking about automation, about—and, you know, these things which we kind of think of historically as, you know, maybe more of a craft actually can be an engineering discipline, and I think that’s a lot of that community. It’s actually really great whenever I’ve been to KubeCon to see the range of folks there from, you know, sort of platform folks all the way up to people that are just building features and shipping code, that they’re also excited about those tools. That’s really, for me, makes a big difference, just to see that it’s not a niche thing so much, right, that it’s really a broad community that’s excited about it.

    Shimel: Oh, yeah, no, it’s broad. Me personally, I have 20 years in the security InfoSec space. I get excited when I see all the security people there about it, because I really feel like maybe this time we’ll do better, right? [Laughter]

    Spoonhower: [Laughter]

    Shimel: And we got out in front of this and where, you know, security is really kinda—it’s not the caboose on the engine, per se, it’s like, people care, and not just the security people care, the community cares.

    Spoonhower: Yeah, yeah.

    Shimel: And that’s important. So, you know, in today’s world, right, this isn’t this year’s release, this is just the April 2nd sort of new feature. So, what—and one builds on the next, right? So, what’s next here?

    Spoonhower: Yeah, so, I think we’re continuing to think about how we can do automated analysis. So, we have a future in the product already called correlations which, essentially, you know, you pick out some effect you think is important, you know? Errors went up, speed went down, whatever it is, and LightStep will find the things that correlate with that within sort of the set of requests that you’re looking at. So, we have a bunch more features related to that coming out later this year.

    So, this is kind of how I—I don’t know. When people say AIOps, I always gotta roll my eyes a little bit, but this is kinda how we think about, you know, bringing artificial intelligence to DevOps, right, is that it’s really through sort of putting the right clues in front of you, right? It’s not about providing 10,000 clues to solve a mystery, it’s about 5, right?

    Shimel: Right.

    Spoonhower: So, a bunch of stuff around that, and then—I mean, the other place that we’re thinking about is how do we get more proactive, right? How do we get in front of you and help you anticipate when these things are gonna be happening as well?

    Shimel: Absolutely. So, I suppose one day you’re gonna grow old and you’ll be on this side when—so, I’m no longer building products or founding companies that are building products, and I hear public lands come up with all these…and I don’t wanna say it’s just some marketing term, but—

    Spoonhower:[Laughter] You can definitely say that, that’s fine.

    Shimel: You know, I will tell you, the first time I heard AIOps, too, I said, “What?” You know? But, you know, I’ve been in technology long enough where—look, just don’t call me late for dinner, right? I don’t really care any more what you call it. And also on the media side of it versus on your side of it, I just report the news, you know, theoretically, right? We don’t—if you wanna call it, you know, if it quacks like a duck and it walks like a duck, it’s a duck.

    But in any event, I do hear you about that. And, you know, you wanna talk about an overhyped term? AI?

    Spoonhower: Yeah. I think in the world of—in DevOps, I think it’s actually, there’s some—

    Shimel: It’s overhyped, itself.

    Spoonhower: Yeah, there’s some [Cross talk] though, I think, because you know, if you’re talking about, like, I don’t know, ad placement or something like that, no one really cares about why, right? Like, you put the ad and someone clicks—nice job, right? Like, good job, robots.

    But like, you get paged and something’s like, “It’s that service over there, you should definitely roll it back.” And you’re like, “Yeah, but why?” Like, I’m not just gonna start rolling back things because robots tell me to.

    Shimel: Yeah, “I said so, that’s why.”

    Spoonhower: Right. [Laughter]

    Shimel: [Laughter] But I hear you, man, it’s out there. Well, listen, I told you, the time goes really quick here, and I think we’re about out, man. But Spoons, it was great having you on here. Good luck with this new release. I would say I look forward to seeing you at the next KubeCon. Let’s hope there is a next—

    Spoonhower: That’s right. I’ll see you somewhere, and if not, online.

    Shimel: Yeah. Otherwise, we’ll have you back here on the podcast, man.

    Spoonhower: Cool.

    Shimel: Alright? Hey, that was Daniel Spoonhower, Spoons, CTO and Co-founder at LightStep. He was just our guest on DevOps Chats. This is Alan Shimel for Container Journal, devopsy.kinsta.cloud, Security Boulevard. You’ve just listened to another DevOps Chats. Have a great day.

    — Alan Shimel

  • DevOps Chats: CloudBees Remains at Top of DevOps Market

    DevOps Chats: CloudBees Remains at Top of DevOps Market

    In this special DevOps Chats video edition, we speak with Sacha Labourey, CEO of CloudBees. From the very beginning of the DevOps movement, CloudBees has been one of the companies at the top of the DevOps market and, based on its latest business metrics, the company remains there.

    Being the enterprise Jenkins company helped CloudBees early on to be a leader at the top of the DevOps market. But with Jenkins and Jenkins X handed over to the Continuous Delivery Foundation (CDF), CloudBees can no longer count on its Jenkins connection to stay on top.

    Sacha, like any good CEO, did not allow CloudBees to rest on its laurels. An aggressive acquisition strategy including acquiring Electric Cloud, Rollout.io and others, has kept CloudBees on top. At the same time, Sacha has led the product and engineering teams as they roll out a new generation of DevOps products and services including the upcoming Software Delivery Management (SDM) and Software Delivery Automation (SDA).

    In this video, Labourey lays out what the past year has seen for CloudBees and what the coming year could bring. Of course, with Covid19 everyone is sailing into unchartered waters. But Sacha has the course in mind for CloudBees to follow.

    Have a listen to our conversation with Sacha to understand CloudBees’ plan to stay at the top of the DevOps market.

    [video src="https://videos.files.wordpress.com/TNgFIQ9x/2020-03-19-interview-with-sacha-labourey-1_hd.mp4" /]

    — Alan Shimel

  • DevOps Chats: Liquibase, Open Source and Databases, with Datical

    DevOps Chats: Liquibase, Open Source and Databases, with Datical

    Datical has been a leader in DevOps for databases since even before the term was used. What many may not realize was that the open source Liquibase project was a major contributor to Datical’s success. So it should be no surprise that in filling the open president’s seat, they would tap an open source veteran.

    Dion Cornett, has open source credibility from his time at Red Hat and MariaDB. In his new role, he is responsible for marketing, sales and product. He is determined to see the same kind of success with open source business models he has been part of before, succeed at Datical.

    In this discussion we hear from Dion on his plans and views.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    [soundcloud url=”https://api.soundcloud.com/tracks/771223528″ params=”color=#ff5500&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false&show_teaser=true” width=”100%” height=”166″ iframe=”true” /]

    Transcript

    Alan Shimel: Hey, everyone, this is Alan Shimel for devopsy.kinsta.cloud. You’re listening to another DevOps Chat. We’ve got a nice DevOps Chat for you today, happy to introduce you to the newly minted president at Datical, Dion Cornett. Dion, I didn’t mess that up, did I?

    Dion Cornett: You didn’t, and thank you very much for the introduction, and I’m very happy to be on your podcast today.

    Shimel: Thank you, Dion. So, listeners of our podcast are no strangers to Datical. You know CTO Rob Reeves is a frequent guest here, and you know, we make fun of him and his Big Lebowski sweaters, but it’s always refreshing to hear Robert’s take on DevOps and databases, the DevOps market in general, and pontificating on anything Robert likes to pontificate about.

    But it’s also nice to have a fresh face from Datical. So, first of all, welcome aboard.

    Cornett: Thank you.

    Shimel: And I always like to give my audience a flavor for who’s talking. Dion, would you mind—I’m not asking you to read your bio, but would you share a little bit of your background for the audience?

    Cornett: Yeah, you know, I think what is more pertinent to Datical, I’d say if I had to characterize myself as that, I’m an open source guy. I bleed open source, I believe it’s a better production model for software, you know, this combination of a meritocracy of ideas and transparency leads to more elegant code.

    And so, you know, my background has been one of sort of having a career that aligns with this philosophy. So, I spent nine years at Red Hat in a couple different executive roles, run North American non-named account sales, and then ran global strategic alliances. I moved from there to take over sales at MariaDB, an open source database company that was—

    Shimel: Sure, [Cross talk] well.

    Cornett: Yeah. [Laughter] It wasn’t quite so popular in 2013, but we literally grew that business sevenfold in three years. That set me up for a CEO job. I did do something outside open source, but it was sort of a big data challenge, a company called ReachForce, that we successfully sold to another company in this space called Leadspace.

    And then, I was actually taking some time off, and introduction through a board member, spent some time with Datical, and just sort of fell in love with the concept. So, you know, my work at Red Hat, which obviously covers the very foundations of sort of IT into all the challenges as it relates to data at MariaDB and really sort of seeing the struggles that go on in building and maintaining a big, powerful database and how central that is to virtually any application. And you look at some of the top banking or telecom type customers we have, you know, data is the core of some of the value that many of these companies create.

    And then, even at ReachForce, right, big data company in the martech space, data is just paramount. It’s all maintained in databases and trying to update, upgrade, you know, maintain those databases in the context of fast changing application requirements is a non-trivial exercise.

    And so, when a company came along that had this combination of the open source that’s sort of in my DNA, and then solving this challenge around database change management, it just seemed like a great fit.

    Shimel: Absolutely. So, you know, another thing let us get out of the way early on, Dion, is—in today’s world, when we appoint a president, you know, there was a time, as we were talking, CEO and president were one person. And then, from a governance point of view, that’s a bad model. We have, for the most part, split off CEO from president. And presidents have various responsibilities. Some are more of a COO, some are more of a CRO, you know, meaning responsible for all revenue kind of activities.

    Just, what—where is your, you know, what are you responsible for at Datical?

    Cornett: Yeah, so, formally, my responsibilities are sales, marketing and product. And sort of the genesis here, and I have a great relationship with Derek, the CEO of the company. We’ve been on the job for a month now and I think we’ve teamed well, even through my recruitment process and through that.

    But Derek has built an amazing culture here. And this is one of the things you never know when you start a new job is just sorta, you know, what is the synergies between the team, and Derek’s a very effective leader, he’s built a great culture. In terms of the depth and the value of the solution that Datical has, it’s sort of undisputed, right? We’ve got multiple high six figure customers and even a seven figure customer. I mean, these are solving demanding problems in big enterprises, and the company’s been very good at that.

    I was brought on for a very specific charter, right? How do we better engage and collaborate with our community to push innovation out to the market faster? And as your listeners may know, Alan, the real foundation for Datical is an open source project called Liquibase. Liquibase is—and one of the things I also did at Red Hat was, I ran the venture portfolio there. I’ve looked at literally hundreds of open source business plans, made a dozen plus investments and sat on a few boards of companies that Red Hat invested in. And Datical was sort of a top 10—or Liquibase was sort of a top 10 project as you look at the thousands and thousands of open source projects.

    And so, how do we work with that community, again, in a collaborative fashion that we’re really pulling innovation, pushing it back, and driving as much value into this challenging database problem as we can?

    Shimel: Absolutely. So, you said a lot, there. Let’s pick ‘em off one by one.

    So, first of all Liquibase. It’s something we’ve mentioned in past podcasts and in past content type webinars and stuff that we’ve done with Datical. But—and maybe you’re gonna change this, and I hope you will, Dion. I know in my mind, when I think of Datical, I don’t think Liquibase. And though Liquibase has a tremendous following, I just don’t—it seems like, and I’m not blaming anyone or anything like that, but I just, I don’t connect the two. And maybe that’s part of what your mission needs to be.

    Cornett: Absolutely. We want this connection to not only exist, but be robust. Again, we’ve got a great team here, great culture, great people. We wanna use that to be excellent stewards of the community.

    You know, part of what motivates people here is, this is a big challenge to solve. You sort of commented earlier about sort of the maverick kinda style that Robert has, and I think it’s properly so, right? We’re breaking some glass. We’re trying to create a new mold, a new direction for how and a very important development of how IT operates.

    And so, that’s Liquibase. And, you know, Datical is a set of capabilities built on top of that. We need to make it clear, though, that that core is our foundation, and that, you know, we wanna be, again, as good of stewards as we can of that Liquibase community, 15 million plus users, and you will see this become much more of our identity, in everything we do, how we act, behave, where we invest and what we do to try to push value forward into our customers.

    Shimel: Excellent. So, Dion, let me throw another thing along the open source stuff out at you. You know, as I spoke to you earlier, I have my own views of where the market is, you know, builders, the democratization of IT, as I call it.

    I also have a view of where the open source movement, you know, the whole open source community is. And that is, you know, we’ve moved from the cathedral and the bazaar to what I call the big brother stage of open source where, seemingly, every open source project was kinda sponsored or in fact owned by a single vendor. And that kind of inhibits collaboration on an industry basis, right? It’s like, Oracle wasn’t gonna contribute to MS SQL. I mean, MS SQL was far from open. [Laughter]

    But let’s say, once Oracle bought—

    Cornett: MySQL.

    Shimel: MySQL. Look, that was the reason Maria and a host of others popped up, right? Because people weren’t sure that Oracle was gonna play nice, frankly.

    But that’s old. The model is what I call the foundational era of open source, where we have, like, the Linux Foundation or the Eclipse Foundation or the Cloud Foundry Foundation. You know, they’re these not-for-profits that are, they quote-unquote own the open source project to the community’s benefit.

    I’m not aware of a foundation in, like, the Liquibase kind of playing field. Are you, or is that—

    Cornett: No, you know, and I’m very familiar with the foundation model. Yeah, obviously, Red Hat was sort of a pioneer in this with Fedora.

    Shimel: Sure, yeah.

    Cornett: And we actually implemented a foundation model at MariaDB as well. And so, even if you look today, MariaDB.org is a separate legal entity—

    Shimel: Yep.

    Cornett: Separate president and set of engineers. And the real purpose there is to provide confidence to the users that, regardless of vendor acquisitions as you discussed, that the capabilities of that project will go forward.

    And we don’t—again, I’m a month on the job here—we don’t have a foundation today with Liquibase.

    Shimel: Right, I’m not asking you to—don’t say anything you can’t [Cross talk]. [Laughter]

    Cornett: Yeah. [Laughter] It’s certainly a consideration. [Cross talk] But it’s, you know, it’s a measured one, right? So, what are the trade-offs, what are the value? And as you talked about the different phases of open source, I think it’s—it’s unfortunate that there was a point where open source was sort of a, you used the phrase democratization of technology; that was a phrase also used by Matthew Szulik, the former CEO of Red Hat.

    Shimel: Uh huh.

    Cornett: And he also talked about this fashion statement thing where people, open source is a success. I mean, everything you use on the Internet, IT today is open source for the most part. So, it’s clearly won, right? That battle’s sort of over, and people said, “Hey, I wanna glom onto this.”

    And so, there was sort of a group of companies that attempted to co-opt the branding around open source without really understanding the nuance of what it meant to be a steward of the community and collaborate well. And in some ways, I think that sort of provided a skewed vision. And we’ll avoid that at Datical. You know, again, we’re gonna be good stewards of the community. We recognize that it’s gotta be participatory. Most of the community members are people that have jobs at companies you would recognize in IBM or SAP or other places like that. And they’re taking time to be part of this community, because it provides some value to what they’re doing and their professional life.

    And so, we’ve gotta recognize that we have to contribute to that value, attempt to sort of usurp what they’ve done, and go off and monetize it without the, never work, because if it really is important functionality, someone will just do a fork and monetize that around.

    It’s really about providing these synergies—and I used this phrase earlier where you have a meritocracy of ideas and that sorta lifts everyone up, right? So, we can provide higher value to customers that need the specifics of an enterprise offering or as we have brands, as you say, Liquibase Pro. And then the people that are, they’re part of the community for their specific needs that they’re getting multiples of return also on that investment for the problems they’re trying to solve.

    And it really is sort of this, community is the perfect word for it, because it really is this joint effort to make everyone better off.

    Shimel: Great. Dion, we’re running out of time. I wanted to give you one more thing to chew on. I want you, in your mind, to fast forward six months, 12 months, take your pick—what effect have you had on Datical?

    Cornett: You know, I think that we have to look at—so, part of what we’re doing is, we’re taking a blank sheet and we’re saying, hey, if we were gonna start today and look at the trends in the market, cloud, microservices, NoSQL, NewSQL, you know, these are all things that weren’t necessarily the case when Liquibase was originally founded by Nathan 10 years ago, what would it look like today versus where we are? And where are the gaps between the perfect DevOps solution for database and what we have in the community today, and sort of how do we help guide and steward that into a place that really solves the problem that we’re facing and we’re going to face as the IT infrastructure continues to evolve?

    And so, I think, if we can look back in a couple years and say, “Look, this has been the evolution of the product, and it’s much easier to use, it’s much easier to implement, the time to value is relatively quick,” and it’s really allowing, at the end of the day here, we’re trying to let database keep up with all of the DevOps advances that have been made around the application. If we see the database not being the drag on application, timeliness, speed, effectiveness that it can be today, then I know we’ve been successful in sort of this re-instillment, re-engagement in the community, and pushing that innovation into the product.

    Shimel: Yep. I agree with you. Dion, I promised I’d get you out of here in 15 minutes. I know you have another appointment. But I want to invite you back. Maybe we’ll do a video next time and we can dig in a little deeper. And, you know, I love talking about open source, as do you, it appears, and our audience does, too.

    Cornett: [Laughter]

    Shimel: So, I think it’s a great topic for us to continue. I wanted to wish you all the success in the world, though, with Datical. It’s a great bunch of folks over there, and you’re a great addition to the team.

    Cornett: Oh, thank you very much. I appreciate the kind words, Alan. And yeah, I look forward to future conversations. It’d be great.

    Shimel: It certainly well. Alright, Dion Cornett, new president at Datical, joining us here on DevOps Chat. This is Alan Shimel, and you’ve just listened to another DevOps Chat. Have a good day, everyone.

    — Alan Shimel

  • DevOps Chats: Solving Complexity in Continuous Testing, with Sauce Labs

    DevOps Chats: Solving Complexity in Continuous Testing, with Sauce Labs

    SauceCon 2020 by the good folks at Sauce Labs is just about a month and half away (April 27). As part of our lead-up to the show and our coverage including live broadcasting on Digital Anarchist, we caught up with newly minted Chief Product Officer, Matt Wyman.

    Matt discusses how continuous testing, automation and DevOps has led to better testing. With that though, we are more complex and sophisticated than ever in how, what and when we test. Can’t we just keep it simple? Do we want to keep it simple? Have a listen to what Matt has to say, as well as why he is so excited about this coming event.

    If you are interested in testing at all, do check out the great lineup for SauceCon. Hope to see you there.

    [soundcloud url=”https://api.soundcloud.com/tracks/770790922″ params=”color=#ff5500&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false&show_teaser=true” width=”100%” height=”166″ iframe=”true” /]

    Transcript

    Alan Shimel: Hey, everyone, it’s Alan Shimel for devopsy.kinsta.cloud, and you’re listening to another DevOps Chat. Today’s DevOps Chat is meant to give you a little bit of a flavor, a preview for the upcoming SauceCon put on by Sauce Labs, which will be at the end of April. So, about a month and a half away, almost two months—well, a little less than two months away. It promises to be another great event from the folks at Sauce, and they have, really, just a packed lineup of speakers from a wide range of enterprises and startups and tech companies, manufacturing companies. I mean, just a whole gamut.

    Anyway, speaking with me today about SauceCon, about maybe some new developments and trends in the testing market is Matt Wyman. Matt is chief product officer at Sauce. And Matt, welcome.

    Matt Wyman: Thank you. Glad to be here.

    Shimel: My pleasure. So, Matt, let’s get this out of the way first. You recently joined Sauce in, like, January, correct?

    Wyman: I did, January 6th. I am a recent addition to Sauce Labs, and very excited to be here. I’ve been in the DevOps community for some time, worked as the head of product for CircleCI, so definitely a space that I know well.

    Shimel: Sure

    Wyman: But I see this massive opportunity and impact around test, and this fragmented space, and hopefully, we’ll get into this and talk about complexity a little bit. But it just really seems like a huge opportunity and a company that I love and a great reputation, so I’m excited to be here.

    Shimel: Very cool. You know what’s interesting? I mean, of course, CircleCI is in and of itself a great company, too. We’ve—you know, I’ve done a couple podcasts with Rob, the CTO over there.

    Wyman: Yep.

    Shimel: And, you know, they recently, they raised a bunch of money, they’re really becoming a player in the CI/CD space. But it’s interesting that you moved from CI and CD to testing here, and you know, when we look at, let’s say, CloudBees, right, and Jenkins, the Jenkins founder, KK, you know—I’m not even try to pronounce his name; let’s just call him KK. But anyway, KK recently left CloudBees and the Jenkins community to start a new company also focused in the testing space.

    So, I think your move here, KK’s move—I think it shows that, as the whole CI/CD, you know, software delivery pipeline type of industry and community matures, people are recognizing that testing is kinda where it’s at right now, right? That’s the new battleground. And maybe it is, as you mentioned, Matt, because you know, the mission has grown so much more complex than, you know, let’s say pre-DevOps, right?

    Wyman: Absolutely.

    Shimel: So, why don’t you—if you don’t mind, give me or give our audience an idea of where you see or how you see testing has become, you know, more complex.

    Wyman: Absolutely. So, speaking to the CI/CD platforms just for a moment, orchestration in CI/CD has become a very complex problem, and that’s reflective of changes in the software landscape and how people build software, which itself is a reaction to where we started.

    So, we had all these monoliths, these, you know, large systems, we’ve all talked about it, they still exist out there in the world. Most every system that says that they do microservices actually has a monolith somewhere, like, micro-monoliths all around.

    When you’re in the monolith world, testing is all about end-to-end testing. You’re trying to put all the pieces together, validate that everything works top to bottom, and that’s really where quality and test have their roots. And as much as possible, it’s all about trying to automate those difficult processes and make it easier and more efficient to move through all your different test cases.

    But as those entities split up, and as we started to recognize that each component of a larger application needed different types of tests, testing itself became more complicated. And furthermore, it became more than just clicking buttons. At one point, testing was about validation, that if you click a button, you go to the correct page. If you click a button, the right business logic executed.

    But these days, it’s a lot more than that. It’s also validating that the CSS is correct, that the experience is performant and is wonderful and delightful. Companies that have bad user interfaces and bad user experiences don’t win.

    And so, you have this testing world that, on the one hand, is trying to move faster, dealing with a more complex software landscape, and on the other hand, is now broadening in the types of tests that are being run, not just functional testing, but also, if you will, delight testing and trying to validate that the user experience, the customer experience is going to be an excellent experience at the end of the day

    Shimel: Yeah.

    Wyman: And so, that’s how I see this space splitting up.

    Shimel: Absolutely. I don’t disagree with you there. You know, Matt, I almost wanna put myself in the shoes of the test professional and the QA person who, you know, maybe six or seven years ago was hearing that DevOps and this move, you know, agile to DevOps and beyond was gonna somehow make them obsolete. And then other people were saying, “Oh, no, it’s not gonna make you obsolete, it’s gonna free you up to do higher level kind of tasks that are more worthy of your talent and skill set.”

    And I think that has come true, certainly. I think what we’ve seen with test automation has freed up testers to do higher level stuff, but I also think it shifted the—not the burden, but the emphasis on people who know how to set up automated testing, right? You’ve gotta know maybe a little bit of coding, a little bit of scripting, you gotta know some of these open source tests.

    Wyman: There’s a bit of all of the above, don’t you think?

    Shimel: Yeah, it is. That’s exactly it.

    Wyman: The—and it’s further complicated by the fact that the number of devices and environments we’re testing on has also fragmented and increased. And you can’t run the same type of test in every environment, so most software applications have some sort of mobile component to them.

    Shimel: Yeah.

    Wyman: And yet, mobile testing is not automated in the same way that you would automate browser testing. And in fact, in some cases with mobile testing, it’s more effective to be manual and to go through it piece by piece, or to use visual testing to go through it.

    And so, you have to pull together all these different techniques. I think there’s often this perception that, with any new technology or any new change, that it’s going to somehow upset the apple cart and suddenly everyone who has a job doesn’t. And it just doesn’t typically work out that way. I think what we’ve seen is just this increasing complexity, and then also the opportunity to use the right type of testing in the right place. Meanwhile, a lot of the people out there doing quality testing continue to do so, because the number of applications has only multiplied.

    You know, the fact this whole digital transformation and all the buzz words that you hear about that—fundamentally, it’s true. Every business is now a software business, and one of my favorite examples recently is, where I live, there’s a highway called 101, a pretty big highway, and there’s a big billboard on the side that has a, it’s from Wells Fargo, and it has a mobile app on it. And the billboard is not advocating or talking about Wells Fargo’s core business, they’re not talking about loans or lending or savings accounts, it’s talking about their mobile app and the experience of their mobile app. And you better believe that they care about testing it, right?

    And so, it’s more than just—again, I covered this earlier, it’s more than just feature function right now. You have—you need more people who need to look across all the different touch points and then utilize the right type of testing in each area. And so, there isn’t one test solution that solves all of it. You have to use different techniques, because ultimately, you’re managing business risk, and you have to do it all the way from the moment a developer checks in code all the way through to production and validate, if you will, a virtual user. Someone has to go validate that it’s actually working as expected when a customer reaches out to interact with the tool.

    Shimel: Yeah, yeah. And, you know, Matt, you hit on a couple—you hit on web testing, mobile testing. I think one of the things, you know, thinking back to when I was running software companies, testing was always something that meant that we were a day late and a dollar short with, you know?

    Wyman: Absolutely.

    Shimel: It seemed like we never had enough budget to do all the testing we thought we should do, and we never had enough time to finish the testing at least we were going to do. But when I look at the kinds of testing and the amount of testing that goes in today, and all of it pre-deployment and everything—yeah, it’s grown more complex, but I think just beyond pure complexity, I mean, would you say we’re testing more now than we did before.

    Wyman: Well, I think part of the answer there is to dig in on what does it mean to test. So, these days, it’s about risk management. And so, if we’re going to have developers able to check in code and 10 minutes later update production, then we’ll need mechanisms to ensure the production is safe. And typically, that’s done with feature flagging, it’s done with canaries. There’s all sorts of ways to ensure that each change doesn’t blow out production.

    But along that path, it’s also about automating as many of the different possible negative outcomes as you can. And that is what we would typically call testing. So, there’s visual testing, there’s browser testing, there’s unit testing, there’s end to end testing, integration testing. All these are necessary, and you’re trying to compress them all into that 10 minute window, which—you know, most organizations can’t hit that kind of number, but that’s the gold mark if you can hit that 10 minutes from change to production.

    And so, I believe that it’s a matter of thinking about risk and saying it’s not about quote-unquote test coverage with a go/no go meeting where you look at the test coverage—and frankly, there’s so much peer pressure to go that typically organizations do. It’s more about saying, “What is the possible negative outcome, and how do I ensure that I have appropriate coverage for each of those negative possibilities?” And in some cases, you’re going to build tests to simply block and fail that particular change, and in other cases, you’re going to provide monitoring and observability to ensure that, if something negative happens, you can pull it back quickly.

    And if I go very meta for a moment and go well above even what Sauce Labs is doing as a platform, I would suggest that all of that is a part of the overall test or risk management perspective. And ultimately, I think our goal is to then create visibility across the whole thing, so you can manage your risk, manage your test all from one place.

    Shimel: Got it. Makes sense. Now, Scott—Matt, excuse me—let’s talk a little bit about SauceCon. How is all of this manifesting itself, you think, at SauceCon?

    Wyman: Well, one of the fun things for me is, this is gonna be my first SauceCon. So, I haven’t had the opportunity to see—

    Shimel: Oh, you never went? Okay.

    Wyman: I’ve never been, so, this is gonna be my first one. I mean, I’ve seen the lineup, it looks fantastic. I’m hoping to see not only a whole series of really good conversations within our existing community, but also, there are quite a few people that are coming who are Selenium, who are Appium users, developers and whatnot, to share in some of their experiences.

    I know, as a product person, one of the conversations I’m very eager to have is in how we help people shift left. And so, it’s more than just running Selenium tests, it’s about the headless tests, it’s about getting earlier upstream so that we can provide a little bit more of a developer oriented experience. And so, I’m very excited to go have those conversations, and I think the lineup looks good to have it.

    Shimel: I agree as well. So, I’ll tell you, my experience is, you know, if you’re looking for conferences around testing and how—like, what’s pushing the frontiers there, right, and also pulling in the open source testing community, SauceCon is one of the best. And I’ll tell you what I like about what Sauce Labs has done there is, you will see other testing companies represented, mentioned, participating, right? I remember, you know, CA who had bought BlazeMeter, for instance, was involved in SauceCon. I don’t know if BlazeMeter will be there this year or not, but they were there. I know the Tricentis folks also like to participate.

    And part of the reason is because testing is such a big world with so many different facets today, you know, everyone kinda does—you know, they’re not necessarily head on competitors. A lot of this is sort of complementary. And so, it’s really nice to see the community come together. You see it a lot—and maybe this is something that is specific to DevOps in general, I don’t know, but you see it a lot at these DevOps events where, yeah, it’s Sauce Labs throwing the party, but the whole testing community partakes. And that, I think, to me is one of the things that makes SauceCon really special.

    The other thing is, is just the speakers. I mean, you know, like in any vendor/user type conference, you’re gonna get the CEO, the CTO, and I’m sure Matt, you’ll do some presentation. But when you look at the speaker lineup here, you know, you have everything from, like, Google kind of engineers to startups to large enterprises, you’re really getting a good 360 degree view.

    Wyman: What excites me is that the way in which we think about this event, we don’t see it as a sales event. We’re not sending salespeople there.

    Shimel: Right.

    Wyman: A number of my product folks will go, because we’re interested in having conversations. The test market overall is fragmented, but it’s fragmented for a good reason, which is, there are a lot of different use cases, a lot of different problems that people are trying to solve, and quite a few of those folks are going to be there, and so, it’s a good chance to have a conversation if you wanna do, if you wanna know more about visual testing, if you wanna know more about how to use headless effectively or deal with the grid.

    So, there’s this opportunity to share that information and share that knowledge, and I think that’s really what we’re aiming for is an environment that’s a practitioner’s environment. It’s [Cross talk].

    Shimel: Yeah, definitely, in years past—in years past, you know, SauceCon, that’s exactly what it’s been, and I think Sauce Labs has done a great job fostering that, right? It’s good stuff, all around.

    We don’t have a lot of time left, but you know, you just joined in January, you’re fairly new, your first SauceCon, you’re getting a handle around product. But do you feel up to giving us a little projection, maybe, of what we’ll see coming out from Sauce Labs over the next, you know, six months?

    Wyman: Well, I don’t wanna give away too much, but we will have something that I expect to be quite exciting, a new beta labs experience that I think people will be able to go get their hands on and play with, something that moves, let’s call it shift left, a bit.

    And we’ll continue to talk a bit about our analytics and in particular, there’s a new report that we are going to be showing. I think some folks may be aware of it already, but it’s relatively new, it’s called Failure Analytics, where we’re able to aggregate all of the different log outputs and provide intelligence and cohorting of different common errors so that, instead of having to hunt through hundreds, potentially, of failures, we will highlight the common problems, which gives developers an easier time of going and fixing things. Also, it makes it a lot easier to debug across large automated test suites.

    So, we’ve got quite a bit that we’ll be showing from a product standpoint, and like I said, there is gonna be a pretty exciting unveil around a beta project that we’re moving forward with.

    Shimel: I think that’s enough of a tease right there. Hey, Matt, you may not know this, but I’ll mention it for our audience—anyone interested in going to SauceCon, it’s actually SauceCon, S-A-U-C-E-C-O-N dot com, and you can go on there and you can still register to attend. I should also mention that our MediaOps, devopsy.kinsta.cloud team will be there under our Digital Anarchist platform. We will be broadcasting live interviews from SauceCon.

    So, if anyone listening is going to be in Austin for the event—hey, come find the Digital Anarchist broadcast booth or me, and we’d love to hear what you have to say and maybe interview you. You never know. So, yeah, please do that, but check out SauceCon.com for more information.

    Matt, before we wrap up, anything else you wanna add?

    Wyman: I think this is great. I appreciate the opportunity to have the conversation.

    Shimel: Well, now that you’re part of Sauce, you know, we’d like—we do these DevOps Chats pretty regularly, so maybe we can have, maybe we’ll do another one even before SauceCon itself.

    I’d like to—you know, I didn’t wanna put you on the spot today, [Laughter] but maybe in the future, I’d like to hear, what are your top three sessions at SauceCon that you’re looking forward to. You don’t have to answer now, though, but I’m gonna give you a chance to do a little digging, but I’m gonna invite you back on in about two weeks and let’s talk about it.

    Wyman: That sounds great. I think it’d be a good idea to, I assume that we’re at the end, here?

    Shimel: Yeah, we’re wrapping up, and you know what, for our next one, Matt, I’m gonna pick three, too. So, folks, there you have it—stay tuned for our next chat with Matt where, between us, we’re gonna highlight his three and my three—

    Wyman: That sounds like fun.

    Shimel: Favorite talks for SauceCon that we’re looking forward to. Sound good?

    Wyman: Alright, sounds great. I look forward to it.

    Shimel: Alright! Hey, Matt, welcome aboard to Sauce Labs, I think—and you already know it, but you joined a great outfit, a great bunch of people there, and looking forward to seeing you in person at SauceCon.

    Wyman: And likewise—thank you.

    Shimel: Okay, and we’re looking forward to seeing you, our listeners, there at SauceCon, but if you can’t make it, do log onto digitalanarchist.live and you can follow along with us from there.

    Until then, this is Alan Shimel for devopsy.kinsta.cloud, and you’ve just listened to another DevOps Chats. Have a great day, everyone.

    — Alan Shimel

  • DevOps Chats: Sumo Logic Continuous Intelligence, with Bruno Kurtic

    DevOps Chats: Sumo Logic Continuous Intelligence, with Bruno Kurtic

    Sumo Logic has been one of the pioneers in DevSecOps and log analysis for many years now. In this DevOps Chats, we speak with Founding VP of Product and Strategy, Bruno Kurtic, about the Sumo Continuous Intelligence Platform and how it is taking security into the next era.

    Have a listen to this DevOps Chats as Bruno explains how Sumo is trying to meet the challenges of keeping up with the speed of business, today.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    [soundcloud url=”https://api.soundcloud.com/tracks/764360107″ params=”color=#ff5500&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false&show_teaser=true” width=”100%” height=”166″ iframe=”true” /]

    Transcript

    Alan Shimel: Hi, everyone, it’s Alan Shimel, devopsy.kinsta.cloud. You’re listening to another DevOps Chat. Today’s DevOps Chat features Bruno Kurtic, Founding VP of Product Management and Strategy over at Sumo Logic. Bruno, welcome to DevOps Chat.

    Bruno Kurtic: Thank you, Alan.

    Shimel: It’s a pleasure to have you here. Bruno, as we were talking off mic, I think our audience is plenty familiar with Sumo Logic, you know, they’ve been one of the—not founding, but one of the building block vendors within the DevOps and DevSecOps kind of movements. But just in case, maybe there are some people who aren’t, do you wanna give us just a quick background?

    Kurtic: Sure. So, Sumo Logic is a cloud based machine data analytics platform. We help customers collect data, telemetry, machine data, infrastructure data, application data from all of their mission critical applications and infrastructure. We process that data and provide them with a scalable and secure technology to deliver operational intelligence, use cases such as monitoring, troubleshooting, root cause analysis, security intelligence use cases such as SIM compliance, threat detection and resolution, and also business intelligence use cases for sort of understanding how their customers are using their digital services, how their products are being adopted and so on and so forth.

    So, that’s essentially what we do. We deliver this as a cloud based service, so it’s SaaS. Our customers essentially tap into our infrastructure, send us the data, and they then get to use their data and get the insights in real time.

    Shimel: And you just joined the company last month?

    Kurtic: No, I’m—

    Shimel: I’m kidding. [Laughter]

    Kurtic: I’m a Founding VP. [Laughter] So, a little bit longer than a month, I’d say maybe two months, maybe close to 10 years—here we go, right?

    Shimel: Close to 10 years. Ten years goes in the blink of an eye, doesn’t it?

    Kurtic: It does, it really does. It’s really astonishing. Sometimes, it feels like a really long time, and sometimes, it’s like it was yesterday, right? And so, it depends on the day.

    Shimel: Unbelievable. Yep. I agree. I’ve been there and done that. The last startup I did before MediaOps, I did nine years, and it just—

    Kurtic: Oh, okay, there you go.

    Shimel: I know how that goes. Anyway—so, Bruno, thank you for joining, thanks for the background. But let’s, I wanted to jump into continuous intelligence, which is, you know, kinda the phrase that Sumo Logic is gathering around. And of course, you know, in DevOps, we have continuous everything, right?

    Kurtic: Yep.

    Shimel: But continuous intelligence—continuous intelligence, excuse me. What do we mean by it? What does it mean in the terms of the way Sumo uses it?

    Kurtic: That’s a great question. And actually, sort of, this whole, the purpose of this platform that we’ve built, it really is to provide the continuous intelligence through a digital enterprise, right? And what we mean by continuous intelligence is the following.

    As you just said a couple seconds ago, in DevOps, everything is continuous, right? You continuously push code to production, you do continuous testing, continuous integration, right? And you’ve got continuous feedback from your application services that you deliver and then you take that feedback into your product development cycle and you continue to improve, right?

    When we talk about continuous intelligence, we recognize and see that in this world of high speed software development and digital economy that the data generated by production application, mission critical applications and services that serve customers and generate revenue—collecting that data is important in real time, and this data is ubiquitously applicable, right? This is not just for DevOps teams to manage the applications, it’s not just for security teams to secure those applications. This data is relevant to the entire digital business, right? It’s useful to product managers to understand how their products and services are being used. It’s useful to sales and marketing teams to understand how the customers and prospects are leveraging their digital services. It’s useful to finance teams to understand how the—what’s the cost, behavior, and other things related to those digital services.

    So, continuous intelligence, it basically refers to this continuous need for data in the business to continue to improve how it operates, how it competes, how it delivers value to the customers, how secure, how to secure those properties and so on, right? So, it’s ubiquitously applying the data that’s generated by the digital services across all those use cases.

    Shimel: Fantastic. You know, an aspect to this and an aspect to a lot of DevOps as well as DevSecOps is automation.

    Kurtic: Yep.

    Shimel: But, you know, Bruno, my time in security, if I learned anything is, sometimes, people don’t embrace automation because they’re afraid of security run amok, right? I’m gonna block the CEO’s email or I’m gonna shut down a critical application or, you know, business process.

    Kurtic: Yep.

    Shimel: So, how do you reconcile, right—and so, it’s one thing to gather intelligence, actionable intelligence, as we used to call it, right, and on a continuous basis make adjustments and stuff, but to really, to move at the speed of business today, you then have to, you almost are forced to automate, right, responses and so forth.

    Kurtic: Right, absolutely. So, you know, you bring a very valid point. Like, you know, my entire career has always been in enterprise software and the last 12, 14 years has been in this specific area of sort of monitoring and troubleshooting security. And it has always been the case that—not just on the security side, that our remediation, you know, people are scared of, it’s also on the operation side, right?

    Shimel: Yeah.

    Kurtic: You know, should I—when do I trigger auto scaling, when do I not and all this stuff, right? And, you know, we’re now getting much better at that, but you know, if you look at the history just this last decade, it has been a tricky area for enterprise to adopt.

    And so, you know—but I don’t think it’s possible to not. Like, we, just like you said, the speed of business demands that we make automated actions based on data that we are observing, and there are some insights we get from that data.

    The challenge has been, is how good are your insights, right? The tricky part is, I used to be in the SIM space, S-I-M space, so on the security side prior to Sumo Logic. And, you know, it was tricky to be able to sort of adopt full automation based on those security rules, because those security rules themselves were fragile, right?

    Shimel: Yep.

    Kurtic: They weren’t necessarily overly deterministic, you could get false positives, you could block CEO’s e-mail, you know, inadvertently and prevent something important from happening. And so, it was a—in those days, it was much harder to sort of bet on that automation, right?

    As you fast forward to now, when you apply advanced analytics—this is why we call our platform an intelligence platform. When you apply advanced analytics, you know, more sophisticated technologies like machine learning and AI, when you start sort of looking across not at individual incidents and alerts, but you start looking across multiple incidents to really have a better understanding of what’s the actual impact of these events that I’m observing, then you can start, you know, making those automated actions.

    And of course, there’s always gonna be things you will not know how to act on, right, which then goes into a wholly different pipeline that, where you enable people to understand what’s actually happening and then decide, in the future, do I wanna make this an automated action or not. But basically, as we go through this cycle of, you know, capture a new unknown, learn what it is, route it to the right place—when it becomes unknown, it gets added to that sort of automation engine, and eventually, you keep sort of reducing the number of manual steps you need to perform to run a good business, to run a secure business or whatever it might be at the use cases.

    And so, we’re not done, right? There’s still plenty of situations where you’re not gonna wanna take an automated action. But I think at this point, we’ve achieved the level of intelligence to make that automation actually be useful without hurting you.

    Shimel: It does my heart good, man. [Laughter] I gotta be honest. So, I think I mentioned to you off mic that my last startup was a security company I started in 2001, and that’s when we were making the move from, like, IDS to IPS, right? Intrusion detection to prevention, which meant automated blocking of traffic.

    Kurtic: Mm-hmm.

    Shimel: And, you know, I always thought it was a no brainer, but it really wasn’t, because the state of the art at the time was, we didn’t have an intelligence platform.

    Kurtic: Mm-hmm.

    Shimel: Right?

    Kurtic: That’s right.

    Shimel: You know, we were constantly trying and striving, but, you know, it just wasn’t there. So, Bruno, what would you—and, you know, there’s a tough one—what would you point to that has really sort of moved the needle in this evolving intelligence platform that you could say, “Hey, man, you can trust this now, right, because 99 out of 100 is making the right choices, or 999 out of 1,000.”

    What is—you know, you alluded to it, but let’s get down into it. What’s providing, what do you think triggered it? What do you think was the breakthrough?

    Kurtic: Yeah, so, I would say that it’s definitely not one thing, right? It’s multiple things.

    Shimel: Yeah. It never is, right?

    Kurtic: Exactly. So, I’d say it’s sort of, you know, there’s a few sort of things that have occurred in the last decade at least that we have done internally to bridge this gap, right? At first, the old systems were siloed. They were not scalable enough to actually be able to ingest all of the telemetry required to make these decisions, right?

    So, you have to compromise. Like, if you’re sort of familiar, since you’re familiar with IDS and IPS, you might be familiar somewhat with the old SIM systems, right?

    Shimel: Sure.

    Kurtic: The SIM systems of the old age were, you know—you have to compromise. You couldn’t scale them sufficiently to accept all the telemetry, and so, you have to continue to reduce the amount of data that you were sending into them. And when you have limited visibility, it is much harder to be able to make a deterministic decision on what you can act on automatically, right?

    We’ve built a highly scalable, cloud based microservices multi-tenant back end that can basically accept literally almost an unlimited amount of data, right? And so, we get all the data and all the required telemetry to be able to make those decisions, which then creates a different problem, right? Now that you have all the data, how do you actually make sense of it all, right? And, you know, the data analytics techniques have dramatically improved over the last decade. You know, the old world used to be strictly rule based, and if you know this in sort of the IDS and IPS world, like, it’s basically signatures, right? In the SIM world, it was rules, right?

    And now we’ve moved away from that, right? We don’t even require our customers to tell us what the schema of their data is, because in the new world of high speed software development and DevOps, there is no schema, right? Developers put whatever they want into their logs of whatever metrics are coming from that infrastructure. And so, you need to be able to deal with the fact that this data has no schema and you’re gonna have to deal with the schema on demand and still need to be able to derive intelligence from that.

    So, we built a back end that then allows any data to be ingested, any data to be indexed and analyzed. And then, as you analyze that data, we realized very quickly that even if you have a very scalable back end and a very open ended sort of platform that can accept any data, giving a human a keyboard and a coding language is insufficient in empowering that human to actually construct what they actually want to derive out of this, right?

    So, we invested heavily into a couple of things. One is, you know, from the very beginning, we invested into automated techniques for analysis—advanced statistical analysis, machine learning, and things like that, that basically are special purpose built for these types of data systems where, you know, they detect anomalies, they detect outliers. They enable you to sort of remove 99.9% of stuff that is noise and sort of highlight and find all of those things that are real signals in that data.

    And the second part that we talked about last year, which was one of the big innovations we delivered, was something that we called global intelligence service, which basically leverages all this telemetry that we see across sort of the global infrastructure that we run. And it’s able to sort of derive what I would call best in class behavior. What are you expecting to see to happen on this type of infrastructure, right? If I see 1,000 pieces of infrastructure that is common across hundreds of our customers, and I know that this is what’s normal—well, that can tell me whether your stuff is normal as well, right?

    So, there are all these novel heuristics analysis techniques that can inform those decisions as you then run those automations on the back of them.

    Shimel: Yeah. So, you mentioned, Bruno, you were working—was that on ArcSight before, or a different SIM?

    Kurtic: No, actually, my other founding members were at ArcSight. I was at a company called SenSage, which was competing with ArcSight.

    Shimel: Okay. I—yeah, those were my days, those were my peeps.

    Kurtic: Yep.

    Shimel: But, you know, you’re 100% right. You know, they say you can’t make wine before it’s time. And as much money and effort and blood, sweat, and tears that we poured into SIMs back then, they were almost at some level doomed for failure, just because it was state of the art, right? It was—

    Kurtic: Yeah.

    Shimel: You were always trying to dumb down the amount of signal in there and reduce the signal to noise and what you can do and what people would trust with it. And, you know, in many ways, kinda that, that right there, the flip side of that is kind of the success story behind Sumo Logic—right platform at the right time.

    Kurtic: That’s right. That’s—and we’ve learned those lessons, right? All of the founding teams, Sumo has seen how it worked before, right? And when we started the company, we wanted to build something different, take this to the next level, and that has been the task for the last 10 years.

    Shimel: Yeah, 10 years in the making, another overnight success. [Laughter]

    Kurtic: Right, yeah.

    Shimel: Now, we’ve got this platform, we are—you know, we’re in the right place at the right time. Let’s assume we are. Where do we go from here? Where do we go from here?

    Kurtic: So, where do go from here? So, you know, where we go from here, I think, is—we, as a company, sort of, we deliver on this vision of the continuous intelligence category and platform for our customers. Where we are moving into is, we’re moving into sort of fine tuning and shipping multiple products that are optimizing the outcomes for specific user personas and use cases.

    So, I’ll give you some sort of examples of that. You know, on the DevOps side, right, we’ve spent a lot of time on the use cases around cloud, multi-cloud, packaging out of the box solutions for people running in AWS, GCP, in Azure. We recently introduced a, what we call a Kubernetes solution. So, as more and more of our customers move into solutions like—into platforms like Kubernetes and containers and serverless, they’re looking for out of the box insights that, as soon as you plug the data coming out of these platforms into a platform like Sumo Logic, they want to know what—how is my application, how is my platform doing, right?

    So, we’re spending more and more delivering special purpose insights on top of these specific use cases and areas for specific personas. On the security side, we are sort of extending our product set into things like the cloud SIM, you know, tuning it for compliance, again, across specific domains. Like, if you are running on premise or in multi-cloud or in single cloud, we want to deliver more and more specialized packages that basically enable our customers to consume this without having to think too hard about it, right?

    Shimel: Yep.

    Kurtic: The old SIMs were difficult, because you had to write all this stuff yourself, right?

    Shimel: Agreed, agreed.

    Kurtic: Right?

    Shimel: And I think, you know, it’s almost continuous automated intelligence for DevSecOps.

    Kurtic: Mm-hmm.

    Shimel: Right? And I’m not saying that’s the end of the road or the end of history as we know it, right, because we’re in a constant cat and mouse game and as things change, but it really is such a different place than we were 10 years ago, or even five to seven years ago, for that matter, right?

    Kurtic: That’s right, yep.

    Shimel: Bruno, let me ask you personally, right? Ten years in here, you are, you know, the key person developing this, you’ve got this to where it is—what gets you juiced in the morning, man?

    I know I love doing what I do now, right? I got out of the software game, I’m a media person, I love building my company and doing it. What gets you excited in the morning about coming to Sumo and doing this?

    Kurtic: Thanks for the question. It’s actually, you know, if I kind of, when I look at what’s happening, what are the undercurrents here of this market that we’re in, right? We talked about use cases and all this, but the undercurrent here is that there is a massive transformation that’s happening in the technology landscape, right? And the transformation is driven by the business transformation occurring in all industries today, right? Everybody’s—every company is getting remade from inside to go from a traditional business model to a digital business model.

    And these digital business models are then meaning that every single company is becoming, essentially, a software company. And they’re competing not on manufacturing or whatever business they were in, they’re competing on delivering products and services—digital products and services to their customers.

    So, essentially, the entire GDP is gonna be based on software, right? And in order for all of these enterprises and government organizations, you name it, to do this effectively, they’re all going through basically modernizing of how they do their technology, how they build their applications, how they develop them, how they understand them, how they improve them, how they optimize them.

    And we are just at the very, very beginnings of what this market is going to need, right? And I think our goal from the very beginning has been that we kind of want to be that platform for the digital business that’s leveraging all this new stuff, and to enable those users to actually do this effectively. And the challenge that those users have today are sort of, they seem insurmountable today. There’s so much data, right? There’s so much digital exhaust that they have to contend with. The skill sets available to them to actually adopt these technologies are very, very scarce, right? But everybody is going there because there is no other way.

    And so, to me, this is really exciting. We are sort of at this crossroads, this sort of fork and every 18 months today there’s a massive paradigm shift in technology. And, you know, every 18 months, we have to think really hard about how do we now do this and help our customers do that? You know, it’s no longer like two decades ago when it was like, you know, your three tier applications and that trend is going on for 20 years, right? Now, we’ve gone from on-prem, three tier, to cloud, to microservices, to Kubernetes, to containers, to serverless, and God knows what’s gonna happen in six months, right?

    And that’s just really exciting, and having to build—building a company that can respond to that and support our customer base as they go there so they can compete better is extremely exciting for me. And so, that’s what keeps bringing me back and keeps me smiling when I wake up in the morning.

    Shimel: Great answer, man. You know what? It’s a great time to be alive and in this industry, it really is. There’s so much happening.

    Kurtic: It really is.

    Shimel: We’re on the precipice of so much more, though. Because it’s like—you know, the more we accomplish, the more we can accomplish. And that, I think it keeps a lot of us in this, right?

    Anyway, Bruno, I told you we were gonna do this for 15 minutes, and we’re closer to a half hour now, I apologize. [Laughter]

    Kurtic: No problem.

    Shimel: But it was a great conversation, I’m really happy we got caught up on Sumo, you know, and the continuous intelligence platform. You guys are gonna be at RSA, yeah?

    Kurtic: We will.

    Shimel: Yep. So, I’m gonna try my best to have this up for our audience listening to this, RSA is the week of February 24th in San Francisco, and if you’re attending RSA Conference, go check out the Sumo Logic booth.

    Also, we’re gonna be putting on a whole DevSecOps event conference within a conference at RSA on Monday, February 24th at Moscone—I think we’re in Moscone West this year. So, if you have an RSA bench and you want to talk DevSecOps, come join us there. We have a great lineup of speakers. We also can visit the Sumo booth at RSA Conference, which is, I think it starts Monday night the 24th, the expo floor opens and it runs through Friday. So, check that out—shout out to our friends at RSA.

    Bruno, thanks very much, man. Say hello to all of our Sumo Logic people. Keep up the great work.

    Kurtic: Will do. Thank you, Alan. Appreciate it.

    Shimel: Alright. This is Alan Shimel for devopsy.kinsta.cloud. You just listened to another DevOps Chat.

    — Alan Shimel