Category: Features

  • Tricentis Extends Mobile Testing Reach

    Tricentis Extends Mobile Testing Reach

    Tricentis has added the ability to test native iOS and Android applications to its Testim software-as-a-service (SaaS) platform.

    Previously, the Testim platform was designed to test web applications, but is now being extended as organizations build and deploy more native mobile applications. Capabilities of the Testim Mobile platform include codeless authoring of mobile tests to eliminate the need to write and maintain Appium, Espresso or XCUITest scripts and the ability to set up, configure and manage mobile devices in minutes using the Tricentis Mobile Agent.

    Additionally, applications can be uploaded to the cloud to enable collaboration across testing teams as they opt to run tests on real or virtual devices. DevOps team can also customize tests with JavaScript, branch tests, and run tests from a scheduler or continuous integration (CI) build.

    Tricentis CTO Mav Turner said Tricentis is moving to implement a consistent set of mobile testing services across its entire portfolio of testing platforms now that mobile applications are equal, first-class citizens alongside web applications. The primary driver of that shift has been the COVID-19 pandemic, which saw more organizations relying on external-facing mobile applications to engage customers, partners and employees working remotely, he added.

    Testing those applications is more critical than ever because the cost of failure—in terms of impact to the business—is now much higher as more organizations depend on software to drive business processes, noted Turner.

    The goal is to make it simpler to test these applications as they are being developed to ensure quality, he added. The challenge is that many developers don’t have a software engineering mindset. Hence, they need to rely more on testing platforms infused with artificial intelligence to discover issues relating to, for example, scalability and security, said Turner.

    Most organizations are trying to shift more responsibility for testing toward developers as part of an effort to remediate issues earlier in the software development life cycle. It’s more challenging for developers to remediate issues after an application has been developed simply because they have lost context. Testing platforms infused with AI capabilities make it easier for developers to identify issues at the time they are writing code. In the future, Tricentis expects to take advantage of generative AI platforms to make it easier to author tests using a set of best practices that can be easily reused, noted Turner.

    That approach doesn’t necessarily eliminate the need for a dedicated quality assessment review, but it does allow testing teams to focus more of their time and effort on testing the application experience versus identifying lower-level errors that many developers routinely make.

    Over time, the quality of applications should steadily improve as many of the low-level mistakes that developers make are eliminated. That should improve everything from application security to the user experience as applications are continuously updated. In the meantime, organizations that embed testing within DevOps workflows are steadily reducing the number of issues that need to be addressed just before applications are supposed to be deployed.

  • How Will Low-Code and AI Coexist?

    How Will Low-Code and AI Coexist?

    Over the last few years, low-code solutions have become important to help organizations widen programming accessibility to a broader base of users and help fill development gaps. And these technologies are still gathering steam—Gartner estimated the market for low-code development technologies would grow to a total of $26.9 billion in 2023 and that 65% of applications would be developed using low-code by 2024.

    However, AI-based code generation is set to further level the playing field with advanced auto-completion and AI coding assistants. Take GitHub’s Copilot, a helpful AI pair programmer, or OpenAI’s ChatGPT, which can generate complex functions given natural language prompts. Other AI tools trained on UIs, like Galileo, can derive frontends for any project in a matter of seconds. So, are low-code development platforms still relevant in this new paradigm of AI-driven software development? If so, how will low-code solutions and AI coexist?

    Well, generic algorithms can only go so far in creating truly unique and innovative experiences that solve real-world business cases. And since most programmers don’t have the skills to train machine learning or deep learning models from their own datasets, this is one area where low-code solutions could lower the barrier, enabling users to tag unstructured data, generate models, run simulations and share reusable AI across departments.

    I recently chatted with Johanna Pingel, MathWorks AI product marketing manager, to discuss the role of AI in low-code programming. According to Pingel, low-code solutions can lower the barrier to AI functionality, both in quickly integrating AI-driven functionality into applications and seamlessly generating new AI algorithms based on unique datasets. Below, we’ll consider some additional use cases for AI and how low-code platforms may work alongside it.

    Use Cases For AI

    First off, what are application developers using AI for these days? Well, AI has an increasingly wide range of uses. It began with computer image and processing, such as identifying cats and dogs or postal codes. Now, voice recognition, voice-to-text and text-to-voice are commonplace, and AI is being used to create ever more sophisticated applications. One area that Pingel is excited about is applying AI to help with battery life management, predicting the lifespan of batteries for electric vehicles and consumer electronics.

    “Anywhere there’s data, there’s an opportunity to create models and make predictions based on that data,” said Pingel. This especially rings true for scenarios involving data and visualization. For example, consider visual inspection in a pharmaceutical production line to ensure there are no defects with any pills. Another use case is visual inspections of parts in automotive assembly lines. Applied to these scenarios, AI can remove grunt work and make production safer and more efficient.

    ChatGPT is another example of an AI application quickly becoming mainstream, not only for content creators but for scientific research. For example, ChatGPT can spin up MATLAB code and create functions and unit tests, which can be copied and pasted into IDEs. However, code written by ChatGPT should still be checked and verified by engineers and scientists to ensure its accuracy, said Pingel.

    How Low-Code Lowers the Barrier to Bespoke AI

    Low-code solutions can bring many benefits—these platforms help to speed up tedious tasks and level the playing field for those with different coding abilities and desires, said Pingel. Low-code platforms can also be a great tool for engineers looking to incorporate AI into their business systems. For example, having a low-code method could be helpful in generating code for machine learning algorithms and new models, which can help companies create their own algorithms and incorporate them into their own platforms.

    More people are interested in incorporating AI into their applications, but the use cases are growing increasingly more sophisticated. Businesses may start with simple needs, such as identifying faces or identifying text from handwritten letters. These rely on simple datasets, and algorithms already exist to accomplish most of these tasks. Off-the-shelf AI is helpful at the start, but eventually, companies tend to want to use their own data and settings far more specific to their applications, said Pingel.

    For example, a more niche case could be as specific as identifying cracks in a windshield. Or, in a financial industry, it might be analyzing mass amounts of loan applications to determine approval rates. In these situations, using your own internal data becomes necessary to create AI that understands the situation at hand. Yet, the hard part is assembling this data in a way that is accessible for a model to comprehend. Analysts estimate that upwards of 90% of data held within enterprises is unstructured, meaning it requires a heavy amount of tagging to become usable for AI/ML.

    Low-code is a perfect solution to avoid the point-and-click aspects of cleaning, cropping and structuring this data, said Pingel. This can introduce automation into the process of labeling data while still involving some human intervention to fix mistakes. Machine learning models can take a while to train and simulate, underlining the need for a fast way of iterating on models. A common platform could help companies develop custom machine learning algorithms and models and keep track of experiments. This helps to ensure that the most effective model is used for the final application.

    End Benefits of Democratized AI With Low-Code

    Overall, low-code platforms can provide a number of benefits that lower the barrier to unique AI creations. Low-code platforms like MATLAB and Simulink are useful for structuring and labeling data and quickly generating ML models. Low-code also makes it easier to bridge different programming languages and quickly generate code for a variety of different languages, such as C, C++ and Java.

    Additionally, low-code platforms enable users to collaborate easily with other users. But low-code doesn’t mean no-code, Pingel explained. In fact, “you can learn to be a better programming through low-code tools, too,” she said. For example, it could enhance understanding of the structure and syntax of code.

    In general, democratized AI is an important capability for businesses to take advantage of. Although AI-based solutions are coming to market to displace old tools and processes, there is still an argument to be made for low-code—namely in empowering non-technical users and lowering the barrier to creating custom AI-driven functionality.

  • Logz.io Integrates ChatGPT With Observability Platform

    Logz.io Integrates ChatGPT With Observability Platform

    Logz.io has integrated the ChatGPT generative artificial intelligence (AI) platform with its Open 360 observability platform to extend its automated recommendation capabilities to reduce mean-time-to-remediation.

    ChatGPT, developed by OpenAI, is based on a large language model that Logz.io uses to enrich crowdsourced data. That approach enables ChatGPT to surface links to related information and best practices for resolving IT issues.

    Logz.io CTO Asaf Yigal said the company has integrated ChatGPT with its existing AI engine, dubbed Cognitive Insights, that applies machine learning algorithms to identify anomalies indicative of potentially critical IT issues. The company expects to be able to add other generative AI capabilities as additional advances are made, he added.

    The Logz.io Open 360 platform is based on open source OpenSearch, Prometheus and Jaeger software that the company has infused with machine learning algorithms. The integration with ChatGPT is enabled via an application programming interface (API) that OpenAI has provided.

    The overall goal is to employ AI to surface the most relevant issues a DevOps team needs to focus on without having to search huge volume of logs, tracing and metrics data, said Yigal. Generative AI platforms solve a fundamental cognitive load problem created today as DevOps teams collect more data, noted Yial. The more data a DevOps team collects, the harder it becomes to determine what’s going on in an IT environment, said Yigal. He added that generative AI platforms make it possible to analyze massive amounts of data at a scale that isn’t otherwise achievable.

    AI tools should make it possible to manage IT at a level of scale that eliminates many of the low-level data engineering and analytics tasks that previously required manual effort from a DevOps engineering team. It’s not clear how many other DevOps tools and platforms will be invoking generative AI capabilities in the months ahead, but DevOps teams should assume that large language models will soon be augmenting DevOps teams in ways that previously would have been thought unlikely.

    For example, discovering vulnerabilities in software running in production environments is about to become trivial as artificial intelligence (AI) platforms such as ChatGPT evolve. A generative AI platform can identify code vulnerabilities in much the same way as a traditional scanning tool. An AI platform, however, could theoretically monitor code repositories and scan them for vulnerabilities as updates and commits are being made in real-time. DevOps teams should be able to use generative AI platforms to discover and remediate these issues before code is deployed in a production environment.

    It’s just as probable bad actors will use the same platform to achieve the same goal, so from that perspective, many DevOps teams will now find themselves in an AI arms race to improve DevSecOps workflows.

    There are still lots of issues to be worked out in terms of the overall accuracy of generative AI platforms, but they will only become more intelligent as processors continue to advance. The issue now will be determining precisely where the man-machine interface for DevOps teams is today and in the future.

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers. Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it creates an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    Dice.com

    Pyramid Systems
    Remote
    AWS Cloud DevOps Platform Engineer
    $160,000 to $200,000

    Monster.com

    Apidel Technologies
    Los Angeles, California
    Software engineer
    $140,000 to $160,000

    SimplyHired

    Cox Communications
    Atlanta, Georgia
    Senior DevSecOps Cybersecurity Architect
    $120,000 to $150,000

    LinkedIn

    EdgeLink
    Beaverton, Oregon
    DevOps Engineer
    $110,000 to $120,000

    Indeed.com

    CrowdStrike
    Remote
    DevOps engineer
    $105,000 to $195,000

  • Tips For Standardizing API Life Cycle Management

    Tips For Standardizing API Life Cycle Management

    Software life cycle management is becoming more critical for today’s technology-fueled organizations—because you can’t just release software into the world and expect it to work perfectly for years to come. More often than not, development teams must constantly adapt their software, progressively add features and cater to new use cases as they arise. This is nothing new for web APIs, which are prone to continual evolution and whose integrations require regular upkeep to avoid breaking changes.

    As such, the discipline of API life cycle management has gathered steam. This concept focuses not only on the design and development of APIs, but on the entire life cycle, including testing, monitoring, documentation, maintenance, versioning, CI/CD and even deprecation. Localizing a strategy for API life cycle management from the get-go can increase the longevity and usability of a platform. It also helps software providers treat their APIs as an iterable product rather than a one-and-done offshoot of a digital platform.

    I recently met with Rakshith Rao, co-founder and CEO of APIwiz, to gather insights on standardizing API management across an organization. According to Rao, there are many ways to implement governance to make these interfaces more consistent. For example, automated security analysis, contract-driven development and implementing style guides are just a few ways to wrangle an increasingly extensive API portfolio. Below, we’ll review these tips and others to consider how to best manage API life cycles, hopefully, before sprawl sets in.

    Four Tips to Increase API Governance

    Medium-to-large organizations might be handling thousands of APIs, said Rao. This new paradigm brings many opportunities for digital transformation, but it can also be a nightmare to manage. Too often, APIs aren’t built with tangible business requirements taking center stage.

    Many of these initiatives didn’t begin with consistent policies from the get-go. For example, it’s also easy to skip out on documenting internal services. But, fractured practices harm discovery and reusability. To rectify this issue, Rao shared many ways in which technical leads can promote better API hygiene.

    Enable Visibility of API Usage With API Monitoring

    The API life cycle spans stages of design, deployment, deprecation and eventual retirement. And throughout this life cycle, developers will likely release new versions of the same service. But although you want consumers to adopt the latest version, some large organizations must support legacy versions for years to come, explained Rao. As a result, different API versions are often developed and run simultaneously by various internal or partner teams. Sometimes, “no one turned the tap off and the water’s still running,” he said.

    To enhance visibility for all active (and non-active) sessions, it’s important to conduct ongoing monitoring. This will help discover individual client usage patterns and help avoid shadow or zombie APIs from forming. These forgotten endpoints could pose security vulnerabilities, said Rao, as you might not enforce best practices on older versions if you don’t know they exist.

    Automate Security Analysis to Capture Vulnerabilities at the Design Level

    Not having consistency between APIs could pose data compliance issues. One method to avoid errors is to conduct design reviews on an ongoing basis, and to automate this security analysis at the design level, said Rao. Perhaps authentication tokens need to be encoded, logging requests aren’t coming in, or payloads are structured incorrectly. Whatever the case, having a complete checklist to scan and performing ongoing security analysis early on to catch these inconsistencies can be a big boon to overall governance and long-term cybersecurity.

    Adopt Style Guides but Allow for Flexibility

    Very simple data modeling errors could severely impact a system, said Rao. Thus, it’s in an organization’s best interest to use standard taxonomies and ensure data governance is an overall aspect of life cycle management. One way to ensure consistency is by using specification-driven development—OpenAPI is a common standard for this need.

    Rao also suggested developing API design style guidelines but admitted that these guides become challenging to enforce and limit as an organization scales. This is because various teams in different departments will have different API needs and often design their interfaces for various front-end requirements. His takeaway is to centralize practices but take a GUI approach to configuring and sharing them. This way, API style can be “minimally intrusive but uniformly enforced.”

    Use an Abstraction Layer for Multi-Cloud

    A full 98% percent of enterprises are using at least two cloud infrastructure providers, according to a recent Oracle report. Nearly everyone is adopting a multi-cloud strategy, but this new reality brings novel pressures for DevOps, especially when overseeing the deployment of APIs across different cloud platforms. An API life cycle management platform decoupled from these CSPs could help wrangle polyglot deployments.

    Sticky Notes Aren’t Enough for API Management

    API life cycle management goes well beyond the development and runtime phase. And as more API-first development occurs within organizations, maintaining standard interfaces will naturally require more effort. Rao also advocates for increased infrastructure automation and low-code solutions to meet these new challenges. Automating various parts of the API life cycle so there is less manual work “helps to bring down the guesswork of ensuring reliability when you release an API,” said Rao.

    We’re seeing some enterprises move from supporting hundreds to thousands of APIs. In this new paradigm, “API sprawl is imminent,” said Rao. As such, it will become virtually impossible to manually keep these interfaces in line, understating the need for more automation. Especially during times of economic uncertainty and leanness in the tech market, the democratization of such API management automation will be vital in helping organizations move faster.

    Having broken pieces of information and scattered API contracts will lead to a messy and potentially insecure adoption. As such, API management can no longer be done using sticky notes on the edge of a computer screen, said Rao. Taking the guesswork out, centralizing common policies and shifting more legwork behind the scenes will be required to avoid a splintered portfolio of services.

  • Dev of core-js Will Flip Table ¦ Another 451 PyPI Maldeps

    Dev of core-js Will Flip Table ¦ Another 451 PyPI Maldeps

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Denis Pushkarev is fed up with core-js freeloaders, and hundreds more malicious packages found at PyPI. (more…)

  • Technical Debt is a Major Threat to Innovation

    Technical Debt is a Major Threat to Innovation

    A survey published today suggested that technical debt is starting to take a heavier toll as IT environments continue to become more complex to manage.

    The survey of 400 IT leaders at organizations with 1,500 employees was conducted by Foundry, the market research arm of International Data Group (IDG) on behalf of Insight Enterprises, a provider of IT services. The survey found that 86% of respondents reported their organization was impacted by technical debt over the past 12 months, with the top areas affected being the ability to innovate (43%), meet service level agreements (41%) and avoid downtime (37%).

    Technical debt is created when organizations cut corners and leave known bugs in the race to meet application delivery deadlines. Application code is often not as thoroughly tested as it should be. In some cases, it turns out that what was intended to be a minimum viable product doesn’t scale all that well. Quick fixes needed to improve performance are also frequently undocumented. Inefficient code also winds up consuming more IT infrastructure than required, which adversely impacts everything from cloud costs to the amount of carbon generated.

    Juan Orlandini, chief architect for the Cloud + Data Center Transformation (CDCT) division of Insight Enterprises, said every organization struggles with technical debt; it will never be eliminated, but it does need to be contained, he added.

    The challenge is instead of trying to keep the proverbial IT lights on during the COVID-19 era, IT teams are now being asked to innovate to advance digital business transformation initiatives, said Orlandini. A full 87% of survey respondents cited modernizing critical applications as a key success driver.

    As a result, many organizations are embracing platform engineering to bring more structure to their DevOps processes, he noted. The challenge, however, is striking a balance between a more centralized approach to DevOps and maintaining the ability of developers to innovate, said Orlandini.

    The issue, of course, is that in addition to massive technical debt, the latest generation of applications are more distributed than ever. The survey found 91% of respondents now rely on multiple public cloud providers for different workloads, with 54% of data residing on a public cloud. However, the survey also found on-premises IT environments are still relevant, with 20% planning to repatriate select public cloud workloads to an on-premises model over the next 12 months.

    Nearly three-quarters (72%) of respondents also noted data volumes are growing faster than their ability to manage them, with 64% ranking implementation of a data governance program to improve data management as their top data-related objective this year. Just over a third (35%) of the data estate is now, on average, driven by edge workloads, with 29% of respondents reporting that at least 50% of data volumes now reside on the edge. Nearly two-thirds (64%) expected that to increase in the next 12 months.

    A total of 85% of respondents also indicated their organization is using artificial intelligence (AI) to some degree to drive business insights and/or efficiencies, although only 36% reported having optimized their use of AI and machine learning (ML) across the enterprise.

    Finally, cybersecurity also remains problematic, with 51% reporting they were impacted by a cybersecurity breach over the past 12 months. Just 20% resolved their issue in one day, while 31% needed less than a week. Nearly half (49%) required one week or more to recover.

    It’s clear that IT isn’t becoming any easier to manage. IT teams need to find ways to build and deploy new applications while reducing technical debt so it doesn’t strangle future innovation.

  • Fiberplane Adds Wasm Plug-in Framework for DevOps Notebook

    Fiberplane Adds Wasm Plug-in Framework for DevOps Notebook

    Fiberplane today announced it is extending the reach of a real-time collaboration notebook designed for DevOps teams by making available tools for building plug-ins based on the WebAssembly (Wasm) framework.

    Micha Hernandez van Leuffen, Fiberplane CEO, said these plug-ins, dubbed providers, will make it much simpler for anyone to connect the Fiberplane notebook to other DevOps tools and platforms.

    The Fiberplane notebook uses the same operational transformation algorithm used in Google Docs to enable teams to easily collaborate around a document or spreadsheet. The core platform itself is built in Rust and WebAssembly. That approach enables a DevOps team to, for example, write and run PromQL queries and display Prometheus charts alongside other data presented via an integrated graph. Wasm makes it possible to run those providers both in the browser and on a backend platform.

    Fiberplane also announced it is open sourcing its Provider Development Kit (PDK), written in Rust, to enable organizations or third-party developers to create additional plug-ins. A Fiberplane Daemon then executes the plug-ins. The overall goal is to provide an open format based on Wasm for consuming DevOps data, noted Hernandez van Leuffen.

    The full open source Fiberplane WebAssembly-based Plugin System includes a Fp-bindgen to provide the bindings generator for building plug-ins, the Provider Development Kit (PDK), a toolchain for building plug-ins, a set of pre-configured plug-ins for Prometheus, ElasticSearch, Sentry, Grafana Loki, Cloudwatch and a generic HTTP provider, the Fiberplane command line interface and the Fiberplane Daemon.

    Fiberplane is essentially taking the concept of notebooks used for collaboration by data science teams and applying it to DevOps workflows. The goal is to improve DevOps teams’ productivity by reducing the amount of time it takes to sort through multiple types and classes of DevOps data to resolve an issue.

    As IT environments become more distributed in the age of the cloud and microservices, troubleshooting issues now invariably spans the responsibilities of multiple members of an IT team. Fiberplane, in effect, makes it possible to spin up a virtual war room that enables the members of an IT organization to collaborate until the issue of the moment is resolved.

    The speed at which any IT issue is resolved has become a crucial metric. Given the complexity of IT environments, it’s inevitable that incidents will arise. Ideally, IT teams would discover those issues before they disrupt the business. However, in reality, the metrics organizations use to evaluate the effectiveness of a DevOps team are often how quickly IT issues are resolved once they are discovered. The longer it takes for a distributed DevOps team to marshal its resources, the more likely it becomes that team will be perceived as being inefficient—regardless of what level of application availability is actually achieved.

    Most DevOps teams have, of course, implemented a wide range of incident management best practices that create a level of muscle memory for responding to a wide range of issues. The trouble is there will always be unforeseen issues that arise. DevOps teams, as a result, need to find ways to quickly focus on an unpredictable issue that they didn’t anticipate.

  • More Java Apps Are Migrating to the Cloud

    More Java Apps Are Migrating to the Cloud

    A survey of 879 enterprise developers and architects from Vaadin, a provider of framework for building Java applications, found that, as part of modernization efforts, the pace at which Java applications are moving to the cloud is now accelerating.

    The survey found more than one-third (36%) of Java applications are already deployed in the public cloud. More than half of respondents (56%) are also already deploying some of their Java applications into Kubernetes or serverless environments. Nearly two-thirds (63%) said they planned to move more Java applications to the cloud over the next 24 months, the survey also found.

    Kim Weins, vice president of product and marketing at Vaadin, said the survey makes it clear that enterprise IT organizations are still highly committed to Java. Still, there is a clear shift underway in terms of where those applications are being deployed. More than a third of respondents (35%) said they have Java applications deployed on Amazon Web Services (AWS), while 22% have deployed them on the Microsoft Azure Cloud. Another 11% are running them on the Google cloud platform.

    This shift, however, will take time. Almost half (47%) of Java applications still need modernization. As a result, 63% of respondents planned to increase their investments in modernizing existing Java applications.

    Maintainability is the top-ranked motivation for modernizing Java applications (32%), followed by security (20%) and ongoing maintenance costs (10%), the survey found.

    The top three challenges in developing Java applications are building an intuitive and simple user interface (81%), upgrading the tech stack (81%) and ensuring app security (78%).

    There is also a shift underway in terms of the frameworks used to build and modernize applications using a more cloud-native approach. A full 70% of respondents use Spring today, but 50% also noted they are planning to increase their use of Spring Boot. Other Java frameworks used include Vaadin Flow, Quarkus, Hilla and React. While derivatives of Spring are the dominant framework, it appeared more organizations are at least evaluating other options, noted Weins.

    Most organizations are also integrating Java applications with modern tools for logging (72%), observability (61%) and single sign-on (53%), the survey found.

    The shift to Java 17 is also well underway, with nearly three-quarters of respondents (73%) using or planning to use it over the next year. More than a quarter (26%) are already on Java 17 or a later release. Another 21% are currently upgrading, while 26% plan to update in the next 12 months.

    Overall, the survey found Java is being widely used for both internal (64%) and customer-facing (62%) applications. Java is most often used to build full-stack Java apps (70%) and backends (69%), the survey found

    Finally, the survey found more than a third of respondents (38%) expected that finding and retaining developers would be a significant challenge in 2023.

    There are, of course, no shortage of options when it comes to deploying Java applications. Most organizations will deploy Java applications everywhere from the network edge to the cloud. The one thing all these applications will have in common is they will be written in a venerable programming language that itself has been modernized.

  • Quali Update Strengthens Infrastructure Security

    Quali Update Strengthens Infrastructure Security

    Quali today announced enhancements to its Torque automated infrastructure platform to add support for security scans and Open Policy Agent (OPA) software being advanced under the auspices of the Cloud Native Computing Foundation (CNCF).

    OPA enables organizations to implement cybersecurity policies as code. The challenge many organizations have encountered is that not many developers have mastered the programming language required to implement OPA. Quali is embedding OPA in a platform that enables IT teams to implement it using a graphical tool that enables central management and application of those policies.

    David Ben Shabat, vice president of research and development at Quali, said the overall goal is to implement scans and policies in a way that reduces the number of misconfigurations that are made when organizations provision infrastructure-as-code (IaC).

    As part of that effort, Torque now flags any policies that fail validation. In addition, administrators can pick and choose which OPA policies to import, including both out-of-the-box and existing custom policies. Those policies then enable Torque to automate approvals or denials of deployments based on compliance with those policies after scans and other health checks have been run.

    Quali has been making a case for policy-based triggers for cost controls, automated start-up, shut down and pausing of IT environments to give IT teams more control over infrastructure using a software-as-a-service (SaaS) platform. That approach enables IT teams to provide a set of guardrails for provisioning infrastructure that prevent mistakes from being made, noted Ben Shabat. Those controls can be applied using the graphical tool Quali provides or programmatically via an application programming interface (API) that Quali exposes, noted Ben Shabat.

    It’s not uncommon for a port to be left open, for example, which cybercriminals later exploit to exfiltrate data. Quali is offering a DevOps platform that allows for central application of policies that act as guardrails to prevent developers from making these types of mistakes as an alternative to scripts created using tools such as Terraform. That approach also provides more visibility into how infrastructure resources are being consumed.

    Every minute a developer spends managing infrastructure is one less minute they could be spending writing code. As application environments become more complex, it is becoming more challenging for developers to manage infrastructure-as-code. The issue is that DevOps teams who could provision infrastructure for developers are overwhelmed by the number of projects they need to manage. As a result, DevOps teams are becoming bottlenecks. Naturally, that only encourages more developers to provision infrastructure on their own, leading to more mistakes.

    It’s not clear whether IT organizations will look for an alternative to provision infrastructure in a way that doesn’t require developers to have as much infrastructure expertise. However, as organizations look to lock down software supply chains, the way infrastructure is provisioned using code will, in many cases, need to be reconsidered within the context of a larger DevSecOps workflow.