Category: Features

  • Tidelift Secures Open Source Software Supply Chains

    Tidelift Secures Open Source Software Supply Chains

    Tidelift today announced the general availability of a platform dubbed Tidelift catalogs, through which enterprise IT organizations can more effectively manage their open source supply chains.

    Donald Fischer, Tidelift’s CEO, says the Tidelift catalogs platform enables IT teams to curate, track and manage open source components that have been vetted and adhere to compliance requirements by Tidelift. The company is working directly with the maintainers of those open source projects to compensate them for making that additional effort, said Fischer.

    Developers can reliably pull components spanning common language frameworks like JavaScript, Python, Java, Ruby, PHP, .NET and Rust, with more programming environments to follow, added Fischer. Those components are made available via a Tidelift Subscription service.

    Fischer said Tidelift is going beyond merely scanning open source components for vulnerabilities. The company is ensuring that when developers access versions of open source components, those versions comply with specific sets of policies, said Fischer. As a part of that subscription service, Tidelift monitors components for vulnerabilities as they are discovered, and works with maintainers to implement updates as needed.

    While many organizations are starting to employ DevSecOps best processes, Fischer said the discovery of an issue involving open source components often comes far too late in the process. The Tidelift catalog approach ensures there are no last-minute surprise that are only discovered just before an application is about to be deployed in a production environment.

    Securing software supply chains has become a higher priority since it was revealed that cybercriminals successfully inserted malware into an application update made to network monitoring software provided by SolarWinds. That malware subsequently rippled across IT environments involving multiple corporate entities, as well as several Federal agencies.

    Of course, securing a software supply chain doesn’t happen overnight. Most IT organizations don’t have the processes and platforms required to vet open source components and frameworks. Tidelift is betting most of those organizations would prefer to subscribe to a service, rather than set up that infrastructure themselves. However, for organizations that require in-house monitoring of all the elements of their application development platform, Tidelift will make an on-premises edition of its platform available.

    As organizations become more dependent on software, the potential impact malware can have on their operations can be extensive. Organizations of all sizes should expect to be fielding inquiries from customers, suppliers and partners concerning the level of rigor being applied to their software development processes. In effect, they are going to demand to know the provenance of the software they are being asked to implicitly trust. In many cases, those inquiries will provide the incentive to accelerate adoption of DevScOps best practices.

    The days when organizations blindly used software with little regard to its origins are coming to a close. That doesn’t mean reliance on open source software is necessarily going to decline; however, it does mean application development teams will be held more accountable for the open source components they rely on.

  • vFunction Automates Conversion of Java Apps to Microservices

    vFunction Automates Conversion of Java Apps to Microservices

    vFunction has developed an eponymous platform capable of automatically converting a monolithic application written in Java into a set of microservices. The startup is emerging from stealth mode today.

    Fresh from raising $12.2 million in seed funding, vFunction CEO Moti Rafalin said the company’s platform employs dynamic analysis, static analysis, data science and automation to enable IT teams to reengineer, in a repeatable fashion, the source code used to create monolithic Java applications.

    As part of that process, vFunction also detects and eliminates code that is no longer executed to reduce the footprint of an application, minimize security risks and overall maintenance tasks.

    The vFunction platform is deployed as a server that communicates with agent software injected into the legacy monolithic application. The server then creates a microservice that is scanned by additional tools to determine how best to optimize it to run on, for example, a Kubernetes cluster based on the Red Hat OpenShift platform, said Rafalin.

    IT teams can also employ vFunction to determine which monolithic applications are better suited to being converted into a set of microservices that can be automatically extracted into separate compilable projects. Each project comes with an estimated timetable for completion that can be accessed via a Modernization Factory Dashboard and Application Complexity Assessment tool provided by the platform.

    Rafalin said most monolithic applications are made up of large amounts of ‘spaghetti code’ that was added over multiple generations by different development teams. Manually analyzing that code as part of an effort to refactor a legacy application would require weeks of effort, Rafalin said. As such, the rate at which most organizations are re-engineering applications is extremely slow, he said.

    In fact, it’s not unheard of for IT organizations to to start, but quickly abandon such because the time and effort required proved too costly. vFunction claims its automated, domain-driven processes accelerate manual refactoring by a factor of ten, resulting in a savings of anywhere from $300,000 to $500,000 per application.

    Pricing for vFunction is based on a per-application model. The company has also established alliances with system integrators such as HCL Technologies, Tata Consulting Services and Wipro that are regularly contracted by IT organizations to refactor their applications.

    Of course, not every monolithic application needs to be converted into a set of microservices. However, most monolithic applications have components that would be easier to maintain and support as a distinct microservice. Organizations, in general, are embracing microservices to build applications that are more resilient. In the event a microservice becomes unavailable, requests for services are rerouted to another microservice to make sure the application degrades gracefully, rather than crashes altogether. The challenge is that, over time, the dependencies that can exist between hundreds of microservices can be more challenging to manage than those of the monolithic application being replaced.

  • The State of Digital Innovation, One Year Into the Pandemic

    The State of Digital Innovation, One Year Into the Pandemic

    It’s obvious COVID–19 accelerated digital reliance for many companies. And it’s no surprise that, according to a recent study, 89% of tech leaders believe digital experiences are critical to addressing new COVID–19 challenges. In this race toward 100% digital business, agile innovation is the new elixir of life — without it, a company may face an early retirement.

    Kong just released their 2021 Digital Innovation Benchmark, which summarizes the tech priorities of 400 IT leaders. The findings stress the importance of rapid digital innovation, open source, microservices architectures, and high quality practices for scaling today’s application ecosystems. Here are the key points technology leaders need to know to remain competitive.

    Innovate or Dissipate

    The urgency to innovate is increasing. According to the survey, 84% of respondents predict a business will go under within six years if they lag behind in digital innovation. Fifty one percent of tech leaders believe their business can only survive three years.

    If digital transformation happens too slowly, it can pose an existential threat. But there are many factors that can hinder faster digital innovation; the complexity of using multiple tech stacks, reliance on legacy IT and lack of automation. Not only are there internal woes, but external danger — 62% of respondents worry about failing to keep up with competitors who innovate faster.

    It seems the urgency has increased over the last year. In last year’s report, just 37% reported they’d be out of business in three years if they didn’t keep pace with digital innovation. That figure rose to a whopping 51% in 2021.

    COVID Amplifies Digital Drive

    Virtually no one is anticipating a decreased IT budget in light of COVID–19. On the contrary, long-term digital transformation efforts are well on target at the majority of institutions, and 75% expect to see an increase in IT/developer budgets over the next 12 months.

    Interestingly, when it comes to securing the digital-only economy, European tech may have a head start. Only 40% of European tech companies have increased their security focus, compared to 51% in the U.S. This could be due to previous investment in security and stricter regulation in European countries.

    In terms of cloud adoption, 40% of tech leaders feel COVID–19 has accelerated their move to the cloud. Nearly 40% say the pandemic has encouraged the use of microservices and cloud native architecture.

    Quality Outweighs Speed

    When gauging what matters most to tech leaders, “improving operational efficiency” is still a top priority. However, this year’s report saw a spike in respondents saying application performance and reliability, as well as application security, were moving up the priority list. Though 3 in 5 (62%) respondents said they are “extremely concerned” about competition from speedier rivals, application stability outweighs the collective drive to innovate.

    These trends are likely indicative of a notable rise in cybercrime. As I’ve covered previously, to respond to emerging threats, DevSecOps practices and new security tooling are shifting left within the development cycle, automating things like vulnerability detection. Simultaneously, roles to increase application integrity, like site reliability engineers, are in high demand.

    New Technologies and Open-Source Thrills

    As mentioned earlier, IT budgets are increasing across the board. When adopting new technologies, companies place the highest emphasis on the tech that increases efficiency. A surge in automation follows a low-code movement gaining steam. Companies consider the following key factors when introducing new tech: reducing deployment risk, increasing collaboration, and increasing development. Ninety five percent of US respondents also listed the “need to integrate with existing tools” as necessary — no surprise in today’s API-driven development landscape.

    Ninety one percent of organizations use open-source software in 2021 — this is up from 82.5% in 2020. Across the board, open-source is intrinsically embedded into most software projects. We see open-source especially used in open databases, infrastructure automation, API design and testing, CI/CD tools, Docker containers, Kubernetes and service mesh. Arguably, modern DevOps would not be possible without such open source initiatives.

    Bring it on, Microservices

    If you haven’t heard of microservices yet, we would be worried. An impressive 87% of survey participants believe that microservices-based applications are the future.

    While that sounds substantial, a path toward 100% distributed microservices architecture has not been mapped within most organizations. In 2021, only 33% of companies have transitioned entirely to a distributed architecture, whereas most (53.5%) adopt a hybrid mix of microservice and monolithic styles.

    “This is strong evidence that microservices have quickly become the de-facto approach for modern application architectures that enable digital innovation,” the report said. Though more development is required, a microservices-centric future seems obvious.

    Within organizations that have already adopted a microservices approach, the average number of microservices in production is 102. And those are primarily to increase security. Ironically, the report also found maintaining security to be the top challenge of deploying a microservices system. Other drivers for microservices adoption include integrating new tech, increasing development speed and boosting flexibility.

    Kubernetes Becomes Ubiquitous

    Kubernetes has clearly emerged as the industry standard orchestration platform. Eighty six percentof all respondents report they now use Kubernetes in production, or plan to within 12 months. This is a massive jump from VMWare’s 2020 report, which put Kubernetes use at 48%.

    However, there are challenges to implementing Kubernetes in practice. Companies cite security, complexity, performance and monitoring as top setbacks when introducing Kubernetes. To say Kubernetes has a steep learning curve may be an understatement, as abstraction layers are introduced to rectify a widening knowledge gap.

    Service Mesh Prickly for Early Installs

    Interestingly, API gateway adoption and container usage, according to the survey, are both 38%. Yet, service mesh adoption is only at 20%. This could underscore the fact that service mesh is still an emerging concept — service mesh experts say the tech isn’t ready for widespread adoption. Or, it could reflect that production use cases are rare (primarily for supporting vast microservices deployments).

    Early service mesh adopters see increased service connectivity and discovery as a top benefit of the technology. This seems logical, as service mesh aims to be a common networking framework. Other common benefits include cost reduction, meeting compliances, zero-trust security in networking and traffic observability.

    Naturally, service mesh isn’t without its thorns. Complexity in deployment and ensuring performance at scale top the list of challenges faced when deploying service mesh, slowing its adoption.

    Hybrid Multicloud

    The current status of multicloud deployment sees a mix of on-premises and multiple cloud providers, with 41% of organizations using multicloud deployment strategies. While cloud adoption rates are increasing, 31% of organizations are still running on-premises servers. The saturation of cloud tooling, and the market validity of Azure and Google Cloud Platform to take on AWS, have influenced a multicloud environment. Cloud expertise is now a hot commodity to navigate multicloud modalities — so much so that some companies have introduced a new role, The Other CFO, or Cloud Economist, to balance the cloud checkbook.

    Riding out the Virtual Wave

    The pandemic has accelerated the move toward digital experiences, and in turn, quickened the pace of enterprise technological evolution across the board. As COVID–19 effects continue, there’s no indication the virtual wave will recede anytime soon.

    To summarize the current state of digital innovation:

    • Rising digital tide: The pace to innovate is rising, and those left below the new-digital-normal water line will drown.
    • IT spend is up: Most companies have increased IT budgets moderately to support new digital norms.
    • Needs for adoption: Desires for automation, speed, security and integration rank high for adopting new tech.
    • Microservices on fire: The report describes “accelerated mainstreaming of microservices.” Microservices, and the tech that supports them, are clearly the future.
    • Kubernetes everywhere: As Kubernetes rises to ubiquity, last-mile efforts center on security and developer usability.
    • Bullish on service mesh: Service mesh sees early production uses, which will likely signal more growth in this area.

    There’s nothing unexpected in these findings; instead, they affirm what most of us already know — digital innovation is going full throttle. Check out the entire 2021 Digital Innovation Benchmark here.

  • Ambassador Insights: Enterprise Digital Transformation

    Ambassador Insights: Enterprise Digital Transformation

    Digital transformation has been on the minds of many organizations for a few years now, but since the onset of the COVID-19 pandemic last year the need to transform IT infrastructures has taken on a sense of urgency. The rush to work from home coupled with the shift to online everything has pushed organizations to adopt the tools and technologies necessary to enable IT agility for all users.

    In this inaugural episode of Ambassador Insights, featuring DevOps Institute ambassadors Sean Davis, information security advisor, DevSecOps, at TransUnion; Jennifer Fischer, executive director of the Center of Innovation and Professional Studies at Felician University; and Pankaj Gupta, senior director of Product Marketing, Cloud ADC, and SD-WAN at Citrix, we take a look at some of of the factors driving digital transformation, the need for security in digital transformation initiatives and how organizations can get started on their transformation journeys now, if they haven’t already.

    The video is below, followed by a transcript of our conversation. Enjoy!

    Transcript

    Charlene O’Hanlon:  Hey, everybody, this is Charlene O’Hanlon, Chief Content Officer at MediaOps, and I am just thrilled to pieces to be introducing a brand new segment that we have on TechStrong TV which we’ll also be running on the DevOps.com website. It is a panel discussion that I’ll be having monthly with DevOps Institute ambassadors—you see three of them right here on the screen with me. As I said, it’s the first in what I hope will be a series of monthly panel discussions with these ambassadors and other ambassadors on the future topics that we have on DevOps.com.

    The first inaugural discussion will be on Enterprise Digital Transformation, and the featured topic will be changing every single month, so this week it’s Enterprise Digital Transformation, next month it will be on Cloud Native.

    So, I’m looking forward to all these discussions, but I wanna go ahead and kick off this first one with our speakers today. First up, we have Sean Davis, who is Information Security Advisor, DevSecOps, at TransUnion. Hi, Sean, thanks so much for joining me today.

    Sean Davis: Thanks for having me, Charlene.

    O’Hanlon: Next up, we have Jennifer Fischer, who is Executive Director of the Center of Innovation and Professional Studies at Felician University. Jennifer, thank you so much for joining me today. Good to see you.

    Jennifer Fischer: Thank you, Charlene. Pleasure to be here.

    O’Hanlon: Alright, and last but certainly not least, we have Pankaj Gupta, who is the Senior Director of Product Marketing, Cloud ADC, and SD-WAN at Citrix. Pankaj, thank you so much—as always, great to see you.

    Pankaj Gupta: Thank you, Charlene. Glad to be here.

    O’Hanlon: Okay, great. Well, as I said before, the topic of this panel discussion is on Enterprise Digital transformation, which I know is a huge topic to swallow. There are so many things that we can say about Enterprise Digital Transformation, but it’s certainly a topic that has been on a number of organizations’ minds, especially since the onset of the pandemic and the rush to basically align their business practices with digital transformation efforts to be more productive and to stay relevant in today’s fast-paced business environment.

    But as I said before, a lot of things have changed since the onset of COVID, and I want to kinda maybe set the stage a little bit by asking you guys—where do you think digital transformation and these initiatives have kinda progressed since the onset of COVID-19 and that rush to remote work that so many organizations have had to kinda go through? Whoever wants to start?

    Gupta: I can take the first crack, Charlene. This is an excellent question. The impact of COVID is twofold. First of all, it’s realization by IT and business for the need of the digital transformation. So, that’s first, is the faster realization of the need for digital transformation.

     And the second thing is about execution speed of digital transformation has increased tremendously due to COVID in the last one year or so. IT and business are more in lockstep than ever before. IT is more aligned now with the business outcomes. In the last 12 to 18 months, we have seen four phases of it. The first was, it started just with business continuity. How do I get my business moving in this new COVID environment? Then focused more into employee productivity, because as they started working more from remote.

    And then, more people started working remote, workers started working from remote, then security became very paramount, that, “How do I secure all of them?” And I think the next phase which is coming is that digital transformation will be more about hybrid workforce; some of the employees coming back to the office. So, that’s the fourth phase which I see for that.

    And in this environment, talking to customers, I have seen CIOs, the number one priority is to keep employees engaged, remain productive from anywhere, from any device they are working. They want reliable connectivity for every employee whether they are working from home. They also want us to ensure that same application experience, whether they are there in the office or now working from home.

    But what is also keeping them awake is that now these workforces working from home and home networks are not as secure as the corporate infrastructure. So, when employees access these applications or direct Internet access, their endpoints or home network doesn’t become an entry point for vulnerabilities into the infrastructure.

    O’Hanlon: Right, right, right.

    Fischer: Yeah, I fully agree, and I echo the need for a focus on security and a remote workforce. I think that really will become the foundation for digital transformation going forward. And I think it’s really interesting to look at the longer term impacts, transformational impacts on some key industries. So, when we think about things like telehealth and online learning and consumer facing applications like in retail and grocery and food delivery and those types of things, you know, you really have to plan for this hybrid environment as we’ve discussed going on for an extended time.

    And, you know, whether some of it will ever truly sort of come back, right? I think, to some degree, you know, some of the convenience and the productivity and the benefits that have been realized through this will be here to stay for the longer term.

    Davis: Absolutely. I’m thinking about—the pandemic has been a really great pressure test of a lot of these concepts that we’ve heard for years across the industry, remote work being one of them. You know, everyone says, “Oh, we get better productivity because there’s remote work.” But what this seems to have done is, it’s really allowed the business to pressure test how well they can pivot. What does that mean for their customers? Because now customer needs are different, what they’re looking for that’s a priority to them is a little bit different. Internal needs of the organization are different. Now, you know, you’re shifting focus from just delivering those products to ensuring they’re highly secure, right?

    So, a lot of these things we’ve been preaching in the industry for a very long time, especially around DevOps and DevSecOps, are really starting to take a front seat in organizations. One of the brilliant things that I’ve seen because of the pandemic over the last year is, even organizations who don’t have formal transformation initiatives and efforts in place are forced to still go through some type of transformation with their organization to maintain competitiveness or even survive. Because now it’s not just about thriving in the environment, it’s about understanding how to pivot to even survive. We’ve seen a lot of retail industries go bankrupt, we’ve seen a huge shift in real estate, right—so, how businesses decide, even with their hybrid strategies, how they’re gonna renegotiate contracts with all of this office space that’s sitting idle right now, and does it make more sense for them to shift there?

    So, there’s a lot of operational considerations that are being made by organizations as well as some unique opportunities and unique challenges are starting to be presented. I think HR is starting to take a front seat a lot more in initiatives. You look at employee wellness—it’s more important than it’s ever been, and it’s giving the opportunity for these guys to stand at the front lines and finally be cheerleaders or their organizations in a way maybe they haven’t had an opportunity to have a spotlight shined on.

    Because a lot of us think HR sits in the background, and now, a lot of their programs are really pivotal and the cornerstone of how businesses are going to move forward and look at employee care, satisfaction. You know, onboarding is a lot different. You know, it’s pretty reveletional to see just a lot of these things we’ve been talking about in the industry, even before DevOps, that people have played around with and said, “These are better concepts or better ways of business,” but now we’re actually pressure testing them through a real world tragedy and pandemic and seeing how that plays out and what that looks like for each and every organization.

    O’Hanlon: Yeah. You know, it’s interesting, because we’ve been talking about digital transformation for years now, and there was a lot of talk, but not a lot of action. And I think it was because a lot of organizations really just couldn’t wrap their brains around it. You know, they didn’t have, like, a reason to do it beyond, you know, providing customer satisfaction or keeping up with their competitors.

    But, you know, having this pandemic occur kinda gave them a reason to really go and say, “Alright, this is what we need to do to (a) keep our employees productive, (b) provide that top quality customer experience, and just kinda keep the wheels on the bus.” And, you know, before, it was more like—okay, well, we’ll see these, we’ll measure by certain metrics and maybe we’ll see an increase, maybe we won’t. Is that enough for us to do digital transformation?

    But I also think that it’s important for—and Sean, you alluded to this—digital transformation impacts so many different areas of the business, it’s not just about improving customer experience. It’s not just about making employees more productive. It’s about keeping them same, you know, [Laughter] with the HR apps and things like that and employee wellness. It’s amazing how, by having that laser focus on digital transformation, once there was a reason to do it, a real, legitimate reason to do it, companies that have undergone the digital transformation and are still undergoing them have really started to thrive and they’ve been able to pivot their business successfully. And that, to me, I think is—you know, it’s a success story. If you really take a seat at, you know, take a look at what’s been done so far and just the fact that so many organizations have been successful so far in their efforts.

    And I didn’t want to take that off the rails, but I wonder how much of that is, when we’re talking about DevOps, where does that fit into a lot of these kinda success stories, if you will, with the organizations? I mean, is it a central core of digital transformation efforts, or is it more of a tool, if you will, within a larger process? Whoever wants to answer that one.

    Davis: I’ll hop in first this time, if you like.

    O’Hanlon: Yeah, sure.

    Davis: So, with DevOps, I think there’s a unique opportunity that a lot of organizations are taking. At the core of most digital transformations, at least I’ve been part of and been privy to from peers in the industry, they’re very centered around technology. You’ll hear the term “every business is a software company” being thrown around. Now, while that may not always ring true for everyone, I believe the spirit of what they’re trying to say is, there’s a better way for us to use technology to enable a better customer experience, a more valuable outcome or our customers, and through leveraging that technology, we’re able to see better returns and give back to the community in a lot of different ways beyond just our products.

    DevOps, I think where the real value comes is, there’s been this evolution over the last year or two where people are starting to realize that a value chain, or the supply chain of an organization and the value that’s being delivered doesn’t end when the product is in our customers’ hands, but it’s when value has been delivered to our customers’ customers, right? So, we go to that Nth degree to make sure that not only are we just selling something and saying, “Hey, have a great day” because we got it in your hands as fast as possible, but we’re able to use feedback loops and telemetry to actually say, “How successful is this for your customers? You know, what type of experience are your customers having? How can we work with you and partner to have a deeper relationship than just a buyer and seller?” Right? So, we’re starting to see a lot of that proliferate the industry.

    The pandemic’s also provided us a really great opportunity to take a step back, because everyone is slowing down, everyone’s having to adjust and pivot and say, “How do we overhaul all the systems?” Right? Instead of looking at this, you know, where, “Let’s improve this silo” or, “Let’s improve this area of the business,” we’re able to start bridging a lot of those areas instead of just saying, “Well, you know, let’s throw the hammer down and start busting these silos”—

    O’Hanlon: Right.

    Davis: – “let’s start bridging a lot of these areas and understanding where the challenges are.” It allows us as leaders of our organizations to dig much deeper to understand broader problems with the organization, and we can see that, once again, going back to how that’s being pressure tested, right.

    We all know, as building continuity plans, that looks really great on paper, but if it’s not put into practice every year, and what better way, unfortunately, to practice that than actually experiencing a real outage, a real security breach, a real pandemic do we put those things through the paces to say, “Is the theory and the practice that we put on paper actually practical and applicable to what we’ll do in real life?” and then suss out where those problems or challenges are with the execution of that plan to be able to reinforce that plan and strengthen it so we can deliver better value, both internally to our organization and externally to our customer and market.

    Gupta: I think before the pandemic, for many of the organizations, digital transformation was an initiative. It was a goal, it was a project.

    O’Hanlon: Mm-hmm.

    Gupta: But during the pandemic, digital transformation has become a necessity.

    O’Hanlon: Yes.

    Gupta:  And when a project becomes a necessity, that means that what you’re really looking for is the agility and speed and ability to respond faster, almost in real time. And this is not just about IT, this is about wall to wall, end to end processes. And IT is that connecting tissue of the overall digital transformation, and the foundation of that is the DevOps. Because DevOps brings automation, brings ability to respond faster. And the technology trends which have happened in the last five years, like the emergence of the cloud, ability to auto scale in cloud, ability to automate things from the cloud, more and more people are working remote. Ability to deploy automation tools which are delivered from cloud, because IT is not going back to the office.

    So, DevOps has become a very critical component to achieve that speed. Every company’s starting point is different. For cloud native companies, they already have a lot of implementation of their IT into the cloud already—if not, more and more companies have started moving. And that is actually creating new opportunities for the DevOps engineers overall. It is their skill set which is tremendously needed in this marketplace, and it will continue to grow. And that’s where the places like DevOps Institute help to build that skill set for IT teams across the world.

    Fischer: Yeah, absolutely. And I would add that, from the point of view of transformational outcomes, you know, one of the key things there is making sure that cultural change has been institutionalized. And so, you know, from the standpoint of DevOps, and sort of coming back full circle to your question, Charlene, around, you know, is it a core or is it something broader—it’s both, right? Because, of course, it’s underlying the technology and the ability to achieve success is there, right, within the pipeline.

    But beyond that, you know, there’s relevance as well, even in business functions, if we’re talking about the opportunity to identify new revenue streams or looking at the overall impact of building a continuous learning culture and the ability to accelerate change—these are things that translate to every area of the business. So, from my perspective, you know, DevOps really has that overall end to end impact to be able to deliver against. And I totally agree with my co-panelists that the pandemic has been that driving force to be able to surface that and really, you know, sort of shine a light on the value that it can add in a time of crisis. But from a long-term perspective, the value certainly continues to be there.

    Innovation as well has a significant role to pay here, too, right? So, just in terms of being able to innovate faster, to be able to look at that pivot point as was described earlier that, you know, that’s a huge learning curve. I mean, there’s some pain that went along with that, you know, having to do it through the pandemic, but there’s also some long-term gains in being able to understand resiliency and responsiveness in that time of crisis.

    O’Hanlon: Yeah, it’s really, it’s been amazing for me to see how quickly organizations have been able to undergo these digital transformation efforts and really understand what their business needs. It’s almost like they—you know, they just kinda launched, if you will. It’s just like, from zero to 60 in, like, nothing.

    Fischer: Exactly.

    Gupta: Mm-hmm, yeah.

    O’Hanlon: But, that said, are we too late for organizations that haven’t started their digital transformation processes yet? I mean, those that may be a little slow to start, they recognize the value, they just haven’t been able to kinda get their stuff together yet to do it, but you know, is it too late for them? And if not—I hope not, I hope not—but if it’s not, what are some of the things that maybe they need to keep in mind as they start to think about undergoing a digital transformation process? You know, what are maybe some of the best practices that they need to consider?

    Jennifer, I’m gonna let you start with this one because, you know, this is your turn, so. [Laughter]

    Fischer: Sure, sure. And I think, you know, interestingly, I think the same principles hold true, right, in terms of best practices for digital transformation, whether we’re talking about, you know, in terms of the pandemic or not, right?

    O’Hanlon: Mm-hmm.

    Fischer: The key thing, the most important thing is that introspection and insights, right? So, really understanding and being honest about and knowing your business, right, understanding what those end to end processes are, knowing and understanding your marketplace, knowing and understanding your customers so that, to Sean’s point, when you do wanna deliver to that Nth degree, you’ve got the insights there as part of your end state, right, that you wanna achieve.

    So, I think all of those things hold true in either case, and then bringing them together into a well-defined strategy that reflects—honestly reflects, right, the strengths and weaknesses of your own organization. And then, last but not least, I think something that often gets not as much attention as it needs to, having metrics in place, right, so that you’ve got that continuous learning ability over time and being able to come back and not only say, you know, “Did we achieve what we set out to?” but on an ongoing basis, where do we need to continually pivot and shift our efforts to make sure that we stay.

    And, of course, as goals change—I mean, we talked a little bit before about what happens when this is done, right? So, be it a hybrid workforce or some of the other trends that we might expect to see in 2021 with DevOps and, more broadly in business and in the economy, how do we help ourselves and our business partners to be able to continually pivot in that very agile way? And, you know, so to me, it’s about those three things, right? Having the right insights, the right strategy and tactics to find, and then third, the right metrics in place to keep you on point.

    O’Hanlon: Alright. Sean or Pankaj, do you guys have any best practices you want to share?

    Davis: Sure. So, I want to answer your earlier question—no, it’s not too late.

    O’Hanlon: Okay. [Laughter]

    Davis: There is no such thing as too late. Please, if there’s any business out there, you have not gone through a digital transformation now, it is never too late.

    O’Hanlon: Good.

    Davis: Now, the second part of that I will caveat with, because I think it just needs to be said. A lot of the practitioners feel this way, but it’s not often announced, and I don’t believe it’s always heard enough—transformation is not about just carrying you from one state to the other. I really wish that the industry as a whole would start to adopt digital evolution. Because that’s really the truth of what we’re doing. We should be evolving every single day. We’re adapting to the pandemic, and then we will adapt to the next event that occurs within our industry—good or bad.

    We’re constantly adapting to the needs of our employees. We’re adapting to these new technologies and frameworks and ways of doing business every single day. That’s an evolutionary step that will never change. The transformation is just the spark, the catalyst, if you will, for that evolution to begin and to be recognized and, you know, as Jennifer had mentioned earlier, institutionalized in the organization, right? And that’s your culture, that’s your people, that’s your technology, whether it’s DevOps, whether it’s agile—whatever it is, right? There’s never, it’s never too late to start.

    From the perspective of best practices, I know I’m gonna sound like a broken record to all those that have probably seen millions of videos on the culture of transformation, but start with your culture. And I don’t just mean implementing programs that are making onboarding easier or customer satisfaction—employee satisfaction. But I mean, really start by taking stock of where your organization is right now. You don’t have to be light years ahead, you don’t have to be like Netflix, you don’t have to be like Amazon or Microsoft. You are your own unique entity. You will be the next whatever company, right, that somebody is going to want to model the great things that you do.

    I always think back to the TPS system, Toyota Production System, right? Toyota was massively successful in being one of the best manufacturers in the entire world despite giving the secret away to the rest of the world and all these other manufacturers adopted it, but they still were not able to achieve the same level of performance as Toyota, because it was built by Toyota, for Toyota. This was the way they did business, they felt this worked best for them.

    And I think that’s a sorely missed or overlooked area in a lot of transformations is—there’s so many frameworks, there’s so many ways of doing it, there’s so many quote-unquote best practices that are out there. Take a look at where your organization is. Take a look at where your people are and think about where you want to be. And then find things that align to that, that help you be successful, and eventually, you’ll start noticing you’re creating your own processes—you’re creating your own frameworks, you’re creating your own ways forward, and then share those with the world, right? Because it’s not just enough to consume something, see that it works, and move on, but take the lessons that you’ve learned and the things that you’re creating and share that out in the world. Maybe someone else is able to use that and perpetuate their business in a positive direction.

    O’Hanlon: Alright.

    Gupta: I think Sean and Jennifer covered many, many great points, and there are so many great practices. We are in 2020, so if you sum all the numericals in 2020, it comes to the fore, and I’m going to cover the 40 best practices.

    First, I think Sean and Jennifer did a wonderful job explaining that embrace the cultural shift. It is a new way of thinking, it’s a new way of doing. But to succeed in this cultural shift, IT skill set is the most important part. You must shift the culture, all ________ aligned, but if you don’t have a skill set inside that organization, you will not succeed. So, as you are embracing this cultural shift, invest in the IT skill set. That’s the first.

    The second one is design and build for speed. Because the automation and the speed to respond to the market differentiates the winners versus losers.

    So, the philosophy should be to automate everything you can, and that’s where the DevOps comes into the play. Look for every possibility which you can automate. And automation requires the DevOps skill set, but it also looks at your applications in a different way. What I can modernize so I can reuse those functions—that’s what the microservices kind of application brings into that.

    DevOps is also about modernization and connecting them together, so they work like a machine, one after another, one feeding another. So, that’s that whole part.

    Also, start thinking, as we move into 2020 or 2021—how do I build a self-correcting infrastructure? And cloud is already giving you auto scale, resiliency—all those pieces into that. We don’t have to go into detail, but when you’re building and designing for the speed, see what are things that can achieve that.

    Third thing, which is going to be more and more critical, is the security first, security first, security first.

    O’Hanlon: Yes.

    Gupta: The recent SolarWinds example taught us so much. A small component on a broader enterprise, a small crack or vulnerability can impact the whole ecosystem.

    And in this world of application and API, where API has become the lifeline of the businesses and more and more digital transformation related business, are you protected your applications in API? As we move into the world of the multi-cloud, do I have a consistent security posture across multi-cloud? So, those are some of the things, that security first rather than the bolt-on.

    O’Hanlon: Mm-hmm.

    Gupta: And the last is that build for visibility. What I mean by invest into your observability stack, build into tools and mechanisms to give you a visibility inside what is happening in your infrastructure, what is happening in your application. Because if you don’t see, you can’t fix it.

    To summarize—embrace the digital shift, embrace the cultural shift, but make sure you have the right skill set to do that, design and build for speed, security first (no more bolt-on security) and visibility, visibility, visibility. Because if you can’t see, you can’t fix it.

    O’Hanlon: Excellent. Excellent. Well, all are great points, all are great best practices, and I want to thank all of you, all three of you for your expertise today during our discussion. Great stuff.

    If organizations have not begun their digital transformation efforts, now is the time. I think every organization understands the importance of digital transformation now more than ever, and it’s great to hear that it’s not too late—thanks, Sean. And it’s security, as Pankaj and Jennifer both mentioned—super, super important, and it should be an integral part of digital transformation efforts.

    We have lots of information about digital transformation and what’s happening in the space in general and some—you know, again, some of the best practices on DevOps.com. So, I do urge everybody to check out the website and read up what we’ve got on digital transformation.

    Guys, before we close things out, any parting words, any parting advice on digital transformation or DevOps in general?

    I guess not, alright. [Laughter]

    Gupta: This is the time—this is the time that will create the stories which you will tell to your grandkids.

    O’Hanlon: True. Absolutely.

    Davis: Yeah, I think focusing on doing what’s right for your organization and doing what’s right for your customers, take care of your people, take care of your customers, don’t just do what’s easy. Because there can be so much change that’s going on that it’s very easy to say, “Okay, well, we can revisit this,” right, and generate a lot of cultural debt that never gets paid back off.

    Fischer: Yeah, I was thinking similarly, you know, there’s—in some way, too, you know, the reality of the pandemic conditions has been a level of exhaustion, I think, as well. And even despite that, it’s important not to keep focusing ahead and making sure that things that might be beneficial, particularly, coming up on the radar, trends for ’21 that could be taken advantage of—you know, don’t lose the momentum. Even though it’s been an exhausting past number of months, keep the momentum going and take advantage of the exciting trends that are on the way for 2021.

    Davis: Absolutely.

    O’Hanlon: Excellent. Alright. Well, on that note, I do want to thank all three of you, Sean, Jennifer, and Pankaj. Thank you so much for your time today, thank you so much for your expertise, and love to have you guys back on a future panel discussion or even on TechStrong TV. So, thank you, again, I appreciate it, and thank you, all, for watching and we’ll see you next time.

    Gupta: Thank you.

    Davis: Thanks, Charlene.

    Fischer: Thank you.

  • Meet the Winners of the 2020 DevOps Dozen² Awards

    Meet the Winners of the 2020 DevOps Dozen² Awards

    This is the moment you have all been waiting for. It is time to announce the honorees for the 2020 DevOps Dozen² Awards, and we couldn’t be more excited to share the names of the most outstanding leaders and tools in the DevOps community. Although, I must say, all the finalists have done an amazing job at making the DevOps community better through their mentorship, service and innovative ideas, and every single one is deserving of special recognition.

    The DevOps Dozen Awards recognize the best of the best in the maturing DevOps space and this year’s winners have demonstrated exceptional leadership and support to the community through 2020 and the COVID-19 pandemic. Last year was a tough year for all of us for sure, but it was also a year of agility, innovation and rapid digital transformation. The 2020 honorees have displayed resilience, determination, commitment and willingness to embrace change in a year of unprecedented challenges to drive their business—and the industry—forward. Congratulations to each and every one of the honorees.

    Winners have been chosen from among the finalists with general public voting being weighted for 40% of the final total and our judges selections for 60% of the weighted total. Our team has gone through thousands of votes to pick out the winners in each category—it was not an easy task. Many thanks to our panel of judges for making the hard calls and to everyone who voted and nominated candidates.

    Ladies and gentlemen, I am proud to present to you the 2020 DevOps Dozen² Awards honorees:

    DevOps Dozen Community Awards

    Best DevOps Industry Implementation

    Lloyds Banking Group, the largest financial services organization in the UK, is the winner of the Best DevOps Industry Implementation award. Lloyds Banking Group has invested heavily in driving the adoption of Agile development and DevOps practices across its business to strategically modernize its digital service capabilities and align with customer expectations.

     

    Best DevOps Survey/Analysis/Research

    The Best DevOps Survey/Analysis/Research award goes to Puppet’s 2020 State of DevOps Report. The report focuses on two areas that can help organizations scale their DevOps initiative: a platform approach to software delivery and applying DevOps principles to change management. It is the ninth year in a row that Puppet produces a State of DevOps Report. It is the longest-running and most widely referenced DevOps research in the industry.

    Best DevOps Related Video Series (Video)

    The Best DevOps Related Video Series is DevOps Unbound, a bi-weekly video series that focuses on DevOps, automation, CI/CD and testing. Top industry leaders join the series to explore the challenges and issues that software delivery and IT teams face on a daily basis.

     

    Best DevOps Related Podcast Series (Audio Only)

    The Modern Mainframe: Building a Better Software Delivery Platform is the Best DevOps Related Podcast Series. The Modern Mainframe is a podcast by Compuware that explores mainframe modernization and how to transform mainframe culture, processes and tools with DevOps to help your business compete in a digital age. Building a Better Software Delivery Platform is episode 9 of the podcast, featuring Compuware DevOps Architect Rick Slade.

    Best DevOps Books / eBook of the Year

    Standing On Shoulders: A Leader’s Guide to Digital Transformation by Jack Maher and Carmen DeArdo is the Best DevOps Books / eBook of the Year. This must-read provides leaders with practical, actionable information about the breadth of Agile, Lean and DevOps topics that are generally dealt with individually; and explains how each of these are necessary but alone are not sufficient to avoid market disruption of your business. The authors focus on how to build an employee and customer-obsessed culture with an organizational structure that drives speed and efficiency, while leveraging technology to enable speed to value that is faster, safer, better and cheaper.

    Top DevOps Evangelist

    The Top DevOps Evangelist award goes to Helen Beal, chief ambassador at DevOps Institute. Helen is a well-known DevOps evangelist leading the DevOps Institute Ambassador program’s efforts to provide broad-based thought leadership and localization. She is an analyst at Accelerated Strategies Group and an editor at InfoQ. Recently, Helen has been working with a group of ambassadors to develop a new, online DevOps Capability Assessment (DOCA), launching in 2021. Taking on strategic advisor roles with Plutora and Moogsoft has given her the opportunity to dive deep into value stream thinking and observability. She is the host of Day-to-Day DevOps, a BrightTalk series that focuses on topics ranging from neuroscience, to ChatOps, to AIOps and everything DevOps related.

    Best DevOps Transformation (Non-Vendor)

    The winner of the Best DevOps Transformation award is Fidelity Investments, a financial services company that supports financial institutions with innovative investment and technology solutions to grow their businesses. Fidelity’s embrace of cloud-based platforms has yielded tangible improvements, such as better operational resiliency.


    Best DevOps Virtual Event of the Year

    The DevOps Dozen award for the Best DevOps Virtual Event of the Year goes to DevOps World 2020. The virtual event, featuring more than 100 business and technical breakout sessions, focused on how DevOps is transforming the world of software delivery and how businesses are adapting their ways of thinking during the COVID-19 pandemic. Top industry leaders discussed where DevOps is headed and how the audience can best leverage advanced practices to succeed in the future.

    Most Innovative DevOps Open Source Project

    Grafana Loki was chosen as the Most Innovative DevOps Open Source Project. Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus.

     

     

    DevOps Executive of the Year

    The DevOps Executive of the Year is GitLab CEO and Co-Founder Sid Sijbrandij. Sid’s career path has been anything but traditional. He saw the first Ruby code in 2007 and loved it so much

    that he taught himself how to program. It was during his time as a Ruby programmer that he first encountered GitLab, and quickly discovered his passion for open source.

    In 2012, he helped commercialize GitLab, and by 2015, he led the company through Y-Combinator’s Winter 2015 batch. Under his leadership, the company has experienced 50x growth in the last five years, expanded from nine to more than 1,300 remote team members across 65+ countries and regions and is now valued at $2.75 billion. A champion of the open source community and a pioneer in scaling remote organizations, Sid is altering conventional wisdom on DevOps practice.

    Best DevOps Presentation of the Year

    On Ramp to Open DevOps for Mainframe by George DeCandio, chief technology officer of the Mainframe Software Division at Broadcom, is the winner of the Best DevOps Presentation of the Year award. In this keynote presentation, George DeCandio explained what you need to adopt an open strategy and how you can integrate with existing DevOps tools such as Git and Jenkins, or into existing cross-platform CI/CD pipelines. George discussed how Zowe, OMP’s first project devoted to the mainframe, is opening mainframe system commands, data sets and source libraries so you can integrate with tools that know nothing about mainframe.

    Best DevOps.com Article of the Year

    How to Reduce Engineer Burnout During COVID-19 by Henry Jewkes, staff software engineer at Split, is the Best DevOps.com Article of the Year. Henry explains how to cope with burnout effectively as it becomes increasingly common during the COVID-19 pandemic.

     

    DevOps Dozen Tools and Services Awards

    Best End to End DevOps Tool/Service

    The winner of the Best End to End DevOps Tool/Service in 2020 is GitLab. GitLab has demonstrated to be the most efficient solution for DevOps teams to collaborate and build software. The GitLab solution is the result of the collaboration between thousands of community contributors and feedback from the more than 100,000 organizations that have adopted GitLab to power their DevOps transformations. The GitLab community contributes code, documentation, translation, design and product ideas based on their real-world challenges, making GitLab more useful and valuable.

    Best DevOps Repo/GitOps Tool/Service

    The DevOps Dozen award for the Best DevOps Repo/GitOps Tool/Service goes to GitHub, the most popular open-source version control code repository. GitHub is great to manage and maintain code in the cloud and contribute to projects quickly with automatic environment setup.

     

    Best CI/CD Tool

    CircleCI was chosen, by the public and the judges, as the Best CI/CD Tool. CircleCI is the leading CI/CD solution for software innovation at scale. The CircleCI platform allows teams to build and deliver software in the cloud or on their own infrastructure. CircleCI manages more than 35 million builds per month on Linux, macOS and Windows.


    Best Value Stream Management Tool

    The 2020 DevOps Dozen winner of the Best Value Stream Management Tool is Digital.ai Value Stream Platform. Digital.ai enables the world’s largest enterprises to accelerate their digital transformation initiatives by combining industry-leading enterprise Agile planning, application security, continuous testing, software delivery and AI-powered analytics in the first intelligent value stream platform. Digital.ai Value Stream Platform provides a unique view of the software delivery lifecycle through the customer experience lens to better align with business objectives and scale Agile and DevOps processes.

    The Digital.ai Value Stream Platform features end-to-end connectivity, visibility with AI-powered analytics, continuous testing and quality, release management and flow optimization, and measurable outcomes through quantified metrics. The platform allows organizations to set business goals based upon market needs, deliver products and technologies to achieve those goals, measure and analyze results, and make adjustments to continuously improve.

    Best Observability Solution

    The award for Best Observability Solution goes to Splunk Observability Suite, a comprehensive combination of solutions designed to help IT and DevOps teams tackle new monitoring challenges that other tools haven’t been able to effectively address. The Observability Suite helps users maintain the highest levels of business performance and adaptability, improve release quality and velocity, improve developer efficiency, minimize downtime, and deliver world-class digital experiences.

    Best DevSecOps Solution

    JFrog Xray was voted the Best DevSecOps Solution of 2020. JFrog Xray is a universal impact analysis product enhancing artifact security, container security and OSS license compliance across your DevSecOps pipeline. JFrog Xray scans your artifacts, builds and Release Bundles for OSS components being used, and detects security vulnerabilities and licenses in your software components.

    Best Testing Service/Tool

    Tricentis Tosca, a continuous testing platform that accelerates testing to keep pace with Agile and DevOps, is the winner of the Best Testing Service/Tool of 2020. With the industry’s most innovative functional testing technologies, Tricentis Tosca breaks through the barriers experienced with conventional testing tools. Simplifying end-to-end functional testing, Tricentis Tosca automates tests across all layers of modern enterprise architectures.

    Best Kubernetes Platform/Service

    The Best Kubernetes Platform/Service award goes to Red Hat OpenShift Container Platform. 

    Red Hat OpenShift is an open source enterprise Kubernetes platform offering a consistent hybrid cloud foundation for building and scaling containerized applications.

    Best Cloud Native Security Solution/Service

    Styra’s Declarative Authorization Service (DAS) is the winner of the Best Cloud Native Security Solution/Service award. Styra DAS was purpose-built to solve the authorization challenges of cloud-native, containerized application, and the infrastructure they run upon. Built on the open source project Open Policy Agent (OPA), Styra policy-as-code solutions have been proven in production, at scale, in many of the largest cloud-native deployments in production today.

    Styra DAS allows enterprises to define, enforce and validate authorization policy across services, teams, clusters and clouds. As businesses move their cloud-native applications from development through to production, Styra DAS provides the tooling to minimize the risk of human error, offload compliance overhead and ensure security and compliance best practices are enforced across your environment. Styra DAS simplifies policy creation with a built-in library of best practices and security policies, as well as a point and click interface for building custom policy from scratch.

    Best DevOps for Mainframe Solution

    It was very difficult to choose a winner in this category. There was a tie between two solutions, CA Endevor Bridge for Git by Broadcom and Compuware’s Topaz, and after a long discussion the judges decided that both should be honored as the Best DevOps for Mainframe Solutions of 2020.

    CA Endevor Bridge for Git is a component of the CA Endevor Integrations for Enterprise DevOps. It connects Git to Endevor via an Enterprise Git Server, such as GitHub, Bitbucket or GitLab. Git as well as traditional mainframe developers can easily collaborate on the same mainframe application managed in Endevor. Only code that is pushed from local Git repository to the Enterprise Git repository is recognized by the integration and gets propagated to Endevor.

    Topaz is a modern Agile platform of mainframe development and testing tools that integrates into the DevOps toolchain, empowering any developer, regardless of experience, to understand and work on any program, no matter how old or complex, so that their organizations can easily maintain and innovate from their base of mainframe investments.

    Best DevOps for DataOps/Database Solution

    The Best DevOps for DataOps/Database Solution is InfluxDB. Developed by InfluxData, InfluxDB is an open-source time series database that empowers developers to build IoT, analytics and monitoring software. It is purpose-built to handle the massive volumes and countless sources of time-stamped data produced by sensors, applications and infrastructure.


    Best New DevOps Tool/Service Provider

    The winner of this category is Opsera, the first continuous orchestration platform for DevOps teams. The Opsera platform automates any CI/CD toolchain, enables declarative pipelines and provides unified insights across the entire software delivery process.

     

     

     

    Winners will receive both digital and physical trophies and badges celebrating their achievements.

    Thanks for supporting DevOps.com and the DevOps community. For more information, visit the 2020 DevOps Dozen² Awards website and stay tuned for the 2021 DevOps Dozen Awards.

  • DevSecOps Implementation: Intrusion Detection

    DevSecOps Implementation: Intrusion Detection

    Originally, this series was just going to be four articles on the DevSec side of DevSecOps. There are many reasons for this, but primarily because that side is cleaner. The other reason is that these topics are beyond the work we were doing at Accelerated Strategies Group.

    But we’ve had a number of requests to continue, and I’ve used many tools in the space, so on we go.

    Intrusion Detection

    Intrusion detection (IDS) started because attackers were getting through firewalls, and, once inside, seemed to have free rein. Intrusion detection wanted to offer another option for detecting and stopping attackers by watching things inside the firewall for indications your organization had been compromised. Relatively quickly, intrusion detection was supplemented by intrusion prevention (IPS). The idea of prevention was to proactively make changes based upon known issues to keep intruders out. Intrusion detection offered information about what paths attackers were exploiting, and intrusion prevention would plug them. Note that IDS and IPS are often further subdivided into host-based (HIDS) or network-based (NIDS) systems. Since their role – detection of intruders – is the same, for this overview we will discuss them together. A serious deep dive into IDS/IPS should look at HIDS and NIDS separately.

    In the DevSecOps space, some have folded these into security monitoring, but they are still performing the same basic tasks – just much better. In fact, if you found intrusion detection to be limited and clunky to work with because of rules maintenance and fingerprinting issues, it’s probably time to take another look. Here’s why:

    Problems With Traditional Intrusion Detection

    The problems with pure rules-based intrusion detection were two-fold.

    First, rules were hard and fast.

    “Look for X and Y and Z. If all are present, raise an incident.” This tended to result in only two types of rules – ones that were too narrow, and thus brittle, or ones that were too broad and that buried IT/security staff in alerts.

    Second, those rules were outdated before they hit the network.

    The old adage “You are always fighting the last war,” (meaning you are doing what worked the last time you won) is more true in IT security than almost anywhere else. For a rule or a fingerprint to be assembled, it has to have been seen. That means we were perpetually protecting against previously successful attacks and doing little against emerging threats. Security vendors took a lot of steps before coming to our current solution, which is a great step in the right direction.

    Attacks against IT infrastructure share a lot of commonalities. Purely rule-based systems counted on tribal knowledge to code those commonalities into rules. It was clunky and imperfect. Templates helped, by adding common items based upon the type of rule you were creating, but, like rules, they tended to be static and old news.

    Enter Machine Learning

    Bright people with an eye on the ever-changing environment knew that we needed something that could adapt to multiple attack forms/vectors and draw the type of conclusions that security analysts were tasked with. The ability to reduce the number of alerts that get raised is pretty close to miraculous. Anyone with a web presence sees thousands of security events a day, as attack bots and scanners automate chunks of the attack matrix. Some kind of solution to weed out the false information is nearly mandatory, as no organization has the manpower to monitor at those levels and reasonably follow up on threats.

    Machine learning (ML) makes connections between alerts – that might not be a big deal in isolation – and other events that, together, make a case for human intervention. Added to fingerprinting and rules, it is a powerful addition. While a successful attack would require going through rules and making certain you covered the behavior/changes found in the new attack, ML can take that information in and adapt automatically.

    This is cranking through volumes of data we couldn’t even imagine a decade ago, and finding anomalous behavior, correlating it and alerting where necessary. How much it reports up the chain is generally configurable, allowing an organization to tighten the flow of alerts that analysts have to deal with.

    Go With the Flow

    More recently, flow evaluation has become a positive step in the monitoring process. If this connection/user moves from A to B to C, it might be an attack. This allows for another way to rate suspicious activity and raise it to an analyst’s awareness.

    An increasing number of vendors are moving the analysis portion of these activities into their hosted environment. This is a “great strength/great weakness” solution – putting the data points gathered from your system into their cloud allows them to correlate events and improve all customers’ responses. The other side of the coin is that you are paying them operational costs each month, and for most vendors, you’re charged based on how much of the service you use. This has budget implications. It also assumes you have connectivity to their service. If you don’t, for any reason, no analysis will be done on collected data. A careful rollout and contingency planning are in order for this scenario to be successful.

    Integration with security information and event management (SIEM) systems is ubiquitous. We’ll talk about SIEM next; I just wanted to include here that IDS/IPS vendors are feeding SIEM.

    IDS isn’t perfect, and there are a ton of other things out there to help, but it’s a step in the process, one you should consider as you gear up your DevSecOps to professional levels. Some of you are using the tools, but don’t have them integrated into your DevOps systems. This is a nudge to do so. If resolution of an attack automatically creates tickets for Dev to make the code (or ops to make the config) more secure, it absolutely is a plus to the organization responding proactively.

    Keep kicking it. These are just tools, and they’re useless without you. Figure out what your organization needs, and update those needs regularly as the environment (both attackers and architecture) continually changes around you.

  • Predict 2021: What Does the Future Hold?

    Predict 2021: What Does the Future Hold?

    While 2020 was a challenging year, it was also a year of resilience, innovation and rapid acceleration of digital transformation. So, what does 2021 have in store for us? At Predict 2021 Virtual Summit, taking place Jan. 21-22 at 10 a.m. ET, top industry leaders will share their speculations on what the future holds in the realms of DevOps, cybersecurity, digital transformation, cloud native and IT.

    Predict 2021 is a free, multi-track virtual event featuring a conference lobby, presentation theater, expo hall and more. Attendees will be able to interact with sponsors and peers, watch videos and download information. It will be a great opportunity for networking and learning about what the “new normal” will look like for DevOps.

    In addition to the great speaker sessions, there will be panel discussions, interactive Q&As with speakers, a scavenger hunt, giveaways and other interactive activities.

    This year’s event features outstanding sessions from industry leaders, including:

    • “Sustaining The Pace of Digital Change,” keynote by Emmet B. Keeffe III of Insight Partners.
    • “Digital Transformation Panel,” keynote by Flint Brenton of Centrify, Ashok Reddy of Digital.ai and Tracy Ragan of DeployHub.
    • “Welcome to the Data Care Industry,” keynote by Ron Gula and Cyndi Gula, Gula Tech Adventures.
    •  “What Does 2021 Hold for DevOps and CI/CD?,” by Jim Rose, CircleCI.
    • “Cloud Native Tech,” by Tracy Miranda of CloudBees, Tracy Ragan of DeployHub and Isaac Mosquera of Armory.
    • “Software’s Not Living Up To Its Cloud-Enabled Promise,” by Jen Grant, Appify.
    • “Observability and AI: Bringing DevOps Back to the Future,” by Adam Frank, Moogsoft.
    • “Increase in Cloud-Native Apps Drives Key Challenges and Opportunities in 2021,” by Ankur Singla, Volterra.

    On the second day of Predict 2021, MediaOps CEO and DevOps.com Editor-in-Chief Alan Shimel will also be announcing the 2020 DevOps Dozen² Awards winners.

    To check out the full agenda and to register, please visit the Predict 2021 website.

  • How Managed Detection and Response (MDR) Solutions Benefit DevOps

    How Managed Detection and Response (MDR) Solutions Benefit DevOps

    Managed Detection and Response (MDR), a relative newcomer in the cybersecurity realm, is starting to have a noticeable impact on enterprises seeking to better secure their operations. Research giant Gartner notes that, “By 2025, 50% of organizations will be using MDR services for threat monitoring, detection and response functions that offer threat containment capabilities.” Despite rising adoption rates, though, much confusion remains about MDR and how it should fit into enterprise IT.

    MDR is typically defined as an outsourced security service that enables organizations to better detect malicious activity over the network. MDR is usually sold as a service, and vendors offer tools and technologies that integrate into a business’s IT to detect and mitigate network intrusions, malware attacks, attempted data theft and other malicious threats. MDR can be a powerful ally in the quest to contain cyberattacks, but only if deployed correctly and leveraged properly.

    Enterprise Benefits

    MDR offers obvious benefits for enterprises, but there’s enormous potential when MDR is integrated with DevOps. Many organizations are turning to DevSecOps methodologies to build cybersecurity into their development and deployment pipelines, and MDR can help.

    “One challenge is that DevSecOps is a term that is poorly defined in most cases, and misunderstood in many others,” said Dave Martin, senior director, product management – threat response at Open Systems. “Some people think of DevSecOps as an extension of a quality assurance department, which means that cybersecurity is mostly an afterthought, and not part of the development cycle. MDR, at least how we do it at Open Systems, brings forth a full-time security operations layer, which includes a security analyst, that can become part of the DevOps team,” Martin said. 

    Martin makes an interesting point. As more organizations attempt to implement DevSecOps, knowledge, along with action, are lacking. MDR has the potential to supplement knowledge and insight into the security posture of the code being generated. Many organizations leave cybersecurity to the network or operations teams, expecting endpoint or network security tools alone to contain threats. However, many threats in the wild may leverage older code, or target unpatched applications. MDR can enable DevOps teams to get ahead of the latest threats by keeping developers informed about evolving threats and vulnerabilities, as well as incorporating tools for continuous cybersecurity into the development and deployment pipelines. One of the core concepts of MDR is providing access to experts that can take action to mitigate an attack. This is an important consideration, according to the Enterprise Strategy Group, which reports that 51% of survey respondents face a problematic shortage of skills in the area of cybersecurity.

    What’s more, MDR becomes a tool to secure the DevOps environment, as well as a tool for developers to make code more secure. “It is critical to find advanced threats, ones that may have bypassed existing security controls, before those threats impact DevOps, yet people need to be made aware of those threats so they are not mistakenly included in the development pipeline,” said Martin.

    Choosing an MDR Provider

    With so many players in the MDR space, choosing a provider that fits into a DevOps and enterprise strategy can be daunting. According to Reports and Data, the global MDR market is expected to grow at a CAGR of 30.4% until it reaches $4.6 billion by 2026. Today, providers number in the dozens, and while many claim they have “complete” offerings, they may not consider the needs of DevSecOps along with traditional network operations concerns.

    There are some important considerations when choosing an MDR platform. For example, visibility of the attack surface is a critical concern. If an MDR provider does not have visibility into all potential attack surfaces, breaches and compromises may still occur. Also, adopters should be keenly aware of how false positives are contained, as well as the level of alert activity. Many cybersecurity solutions can introduce alert fatigue and obscure effectiveness. Automation should be a key part of any MDR solution, as it can help to categorize threats, initiate responses and identify the latest threat trends without human interaction. 

    “MDR should tear down many of the cybersecurity silos that businesses have today, and bring the various pieces of IT together into a unified cybersecurity sensitive culture,” said Martin.

    Ultimately, MDR is about people, processes and technology, and should bring these elements together to ensure success in the ongoing battle against cybercriminals. 

  • Low-Code To Become Commonplace in 2021

    Low-Code To Become Commonplace in 2021

    A new study finds 85% of engineer leads predict low-code and no-code will soon become common

    New findings from an Internal-endorsed study suggest 2020’s software development challenges will undoubtedly carry into 2021. Many businesses are making immediate transitions to a digital-only economy, forcing a ton of new app development requirements. Yet, hiring top engineering talent is especially difficult, amid a developer drought and pandemic uncertainties.

    One in three organizations has implemented a hiring freeze. Respondents also cited rising development challenges and insecure internal software, putting a strain on normal operations. To help address these challenges going forward, a whopping 85.1% believe implementing low-code and no-code will become more and more omnipresent within their company.

    Below, we dive into the report’s major findings, which surveyed 500 IT and engineering workers at medium-to-large enterprises. Using this data, we’ll forecast hurdles software development teams may face in 2021, and gauge if low-code tooling adoption is the ultimate panacea or no more than a Band-Aid for a much larger ongoing problem.

    Development Challenges Will Increase

    In the thick of the pandemic, software is often the only touchpoint many traditional companies have with a user. Naturally, the number of digital experiences required to meet this new reality is skyrocketing. Experts and data show this trend has no signs of stopping.

    In fact, 60.1% of surveyed saw app development increasing due to work-from-home policies. Only 9.7% reported a decrease in app development. One could easily attribute rising app development with growing software requirements brought on by the current digital-first climate.

    In this new economy, finding bold ways to increase productivity is critical. Improving the efficiency of engineering teams was a priority for most respondents and a high priority for 40% of respondents. For small groups with lean margins, improving automation for software delivery could help compete with larger players.

    Talent Will Become More Competitive

    The biggest challenge employers face is finding talent—30.6% of respondents cited increased competition for talent as a top challenge in 2020 and 22.2% also recognized developer drought as a significant obstacle. If you had trouble finding skilled software engineers in 2020, good luck next year …

    Looking to 2021, 45% see competition for talent remains a top challenge. Trailing problems include developer drought, immigration issues and a poor reaction to new work-from-home policies.

    Hiring Practices Will Continue to Shift

    With COVID–19 in full force and a developer scarcity, you’d think hiring would come to a freeze. Yet, the results of this study were mixed—hiring practices are pretty varied across teams.

    According to the report, 34.5% of organizations surveyed had paused hiring new engineers. Conversely, 37.3% have hired more engineers, and 18.5% of organizations reported no change to hiring practices at all. About 10% had layoffs.

    Whereas some tech companies are thriving in the new normal, others may pause hiring due to uncertainness around COVID-19. These companies could be turning to low-code technologies as a replacement. “If you pause hiring, you still need to build, and low-code is a great option for that,” said Arisa Amano, CEO of Internal.

    Low-Code Will Become Commonplace

    To address the above issues, companies are turning to low-code solutions. These platforms help relieve the development burden for internal business tools and open up citizen developer use. And, it’s more than a fad—the report was able to squarely demonstrate an uptick in low-code use.

    Most companies (75.2%) have already implemented a combination of low-code and traditional engineering methods. It appears that low-code is complementing existing software engineering practices at a number of institutions.

    In addition, 28.8% of respondents predict low-code and no-code will become a high priority in the coming months, and for 21.6%, it will become an essential focus. Impressively, 85.1% of developers foresee low-code and no-code as becoming more commonly implemented within their company.

    Low-Code Will Open Doors for Non-Tech

    The citizen developer concept has been gathering marketing steam, but it might not be just hype. Now, data suggests low-code tools are actually opening doors for such non-developers. Seventy percent of companies said non-developers in their company already build tools for internal business use, and nearly 80% predict to see more of this trend in 2021.

    It should be noted that low-code and no-code do not seek to replace all engineering talent; instead, to free them up to engage in more complex tasks. “With low-code, you free up your engineers to work on harder problems, instead of having them work on basic things,” said Arisa Amano, CEO of Internal. She believes this could translate into more innovation companywide.

    Surprisingly, bringing non-traditional engineers into the development fold is not being met with ambivalence—69.2% of respondents foresee that citizen developers positively affect engineering teams, with the rest primarily exhibiting a neutral reaction.

    Improved Access Control Will Boost Internal Security

    The costs of internal security threats are high. Breaches could decrease customer trust, harm brand reputation and lead to escalating legal fees. With cyberattacks a prevalent concern, cybersecurity must come back in style.

    Not only are threats external, but internal too—46.8% of respondents were extremely concerned about employees having access to customer data. The cause for concern is duly noted, as the majority, 58.1%, have experienced internal data security breaches in the past.

    The reasons for internal breaches vary across the board. Respondents attributed the top cause simply to a rise in the number of employees and contractors with access to sensitive information—a surge in employees means a greater chance of human error or leaked credentials. It also means an increase in the number of devices with access to sensitive data—this is particularly tricky, as CISOs face a dilemma on how to govern privileged access for housebound laptops and mobile devices.

    Respondents also noted the increasing complexity of technology and the overabundance of new cloud applications. It’s hard to expect DevOps to secure modern infrastructure when they’re still trying to figure out how it works! As a knowledge gap could quickly introduce vulnerabilities, 62.7% of respondents are actively investing in increased employee security training.

    Other security problems, such as a lack of granular access control or lack of logging and audit trails, seem like they could be mitigated with the right configurations and DevSecOps approach. In fact, 55.4% of respondents are in the process of baking in fine-grained access controls. “Having that at the forefront of internal tools is key,” said Bob Remeika, co-founder, Internal.

    Shifting security left could correct an age-old trend of adding security after the fact, which only prolongs the problem. On the whole, companies require a combination of better access enforcement, multi-factor auth and increased monitoring to mitigate mounting threats.

    Low-Code Becomes Mainstream in 2021

    Software development teams face many challenges in the coming year. Demands for new software will increase and processes to increase efficiency will fall under the microscope. Rising engineer competitiveness and developer drought will also continue to shift hiring practices.

    Companies that weren’t 100% digital will be forced to embrace the new norm and develop internal software and automation. Yet, building internal tools isn’t straightforward and will be especially difficult for companies less technical than their software-as-a-service counterparts. All this, paired with ongoing security threats, means internal app development in 2021 has its challenges.

    Although conditions look dicey, the underlying issues are not unusual, Remeika said. They have just been amplified. “There’s always been a developer drought, companies have always been trying to find ways to do more with less, and competition for talent is never getting less fierce,” he said.

    Though we’ve seen a spike since COVID-19, the desire to offload work has been everpresent. Remeika believes sophisticated low-code platforms will empower technical non-engineers and assist with things people typically tend to disregard when building internal applications, such as security, deployment, testing and review capabilities.

    Nevertheless, development team output appears to be resilient throughout work-from-home policies. And as I recently covered, a low-code movement could also enable a democratization effect, helping SMEs who can’t afford the top talent to still compete at the same table as large tech companies. We expect low-code and no-code adoption to spill well into 2021, seemingly, as a panacea to these mounting concerns.

  • DevSecOps Implementation: Interactive Testing

    DevSecOps Implementation: Interactive Testing

    This is the fourth installment in this series on DevSecOps. Read the first installment, on static analysis, here the second installment, on source composition analysis, here, and the third installment, on dynamic scans, here.

    Dynamic testing looks at the running application, poking and prodding to see how it reacts to known vulnerabilities. A complete dynamic scan watches a test runner as it runs against the application and tries all points of entry it can find, normally a highly automated process that takes a while.

    Where dynamic scans fall short is in pinpointing the problem within the application. Knowing that things went wrong when a given CVE was exercised against the app is one thing, but knowing what went wrong and where it went wrong is much more useful to make development teams productive. This is where interactive application security testing (IAST) tries to lend a hand. Using tooling in the application, interactive scans can offer the exact module/source file/shared library (etc) that caused the error.

    Generally speaking, interactive tests are best run at a targeted subset of an application, finding details needed to resolve issues the organization is already aware (or suspect) exist. In our test environment, we use interactive scans to zero in on issues that were detected by static and/or dynamic scans.

    It is likely that the interactive testing market will be the one to continue to move down the line to full-on security monitoring and/or it will encompass a growing list of environmental issues—it is, after all, designed for a running application to get exercised and find the issues. It is not a stretch to see these tools move in the above directions, and indeed you can see the beginnings of these moves in different vendors.

    But for today, the things-you-want-to-look-for list is here. My usual disclaimer applies … Through my (and others’) work for ASG, we’ve turned up a lot of information about DevSecOps tools and what to look for. We don’t have room in these blogs to delve into the depths of that research, but I’m offering an abbreviated hit-list of things to look for when moving toward this type of product. There is a lot to look for, and please be aware that this list is just to get your journey jump-started.

    • Language/framework support: It doesn’t need to be as tightly integrated as language-dependent static scans, but the tool still needs to support your specific development efforts. Support for Ruby/RoR, for example, is important if that is your dev platform of choice.
    • Source of vulnerabilities: Like other security tools, understand what interactive testing tools cover and how it is covered. Currently, most of these tools count on an external test running tool to actually run the test, while the dynamic scan watches what is happening inside the application.
    • Toolchain integration and support: Can the tool be called from your build/test toolset? Does it have integrations to feed results back into your build/bug-tracking systems? While these tools offer good interfaces to see what is going on, the explosion in tools that DevOps brought is making us dashboard-weary. Make certain your centralized code quality information store can be used as the single pane (or pain, depending upon implementation) of glass for initiating scans and reporting results.
    • Test tool support: As mentioned above, most of these tools are watchers that rely on another source to run tests. Make certain that there is some manner of coordination between these two so the test runner can be kicked off from the dynamic scan or vice-versa. More manual steps aren’t needed here and just slow the process.
    • False-positive rate: Interactive testing still struggles with false positives, though these tools are getting better. Have an understanding about average false-positive rates of the product in question, then ask about customization options to reduce this number in your given environment without reducing security posture.
    • Cost to configure/maintain: As is probably obvious, tooling an application to look inside of it is a step beyond normal production needs. Make certain the overhead of adding interactive testing to a project and the cost of integrating are worth the results to be had.

    Vendors call it “interactive” because it watches the interaction of the pieces of code inside the app as it’s running. Many customers call it “interactive” because the “tool” used to run apps for testing ends up being people “interacting” with the application. Both are somewhat accurate, though automation is coming apace, as it is for everything software testing.

    Choose a product that has enough automation today to suit your organization’s needs, and is progressing to wow you. Of all the security tools out there right now, interactive holds the greatest promise for wowing us. Since it is happening at runtime and can see inside the application, everything from environment to installed applications on the host could be covered, and that’s where some vendors are headed. An integrated environment security test tool with deep knowledge/reporting that includes knowledge gained from static scans and source code analysis is on the horizon—and, given the direction of all of DevOps, making that solution fully automated and reporting back to build systems is coming also.

    Interactive won’t replace the other steps in DevSecOps, but it will replace some of their functionality—or more often enhance some of their functionality. If a static scan notes a potential vulnerability, dynamic could verify if it is a real vulnerability before a human ever sees a report on the issue, for example.

    I’ll end this as I’ve ended the others: You all are kicking rear and taking names in a tough IT environment that exploded into near-100% remote for most of you. Keep kicking rear and don’t forget security. It is more important as your organization becomes geographically dispersed because now applications that were “secure enough” for the internal network are shared publicly. Even with infrastructure protections such as VPN in place, more caution should be applied to those applications simply because they are more exposed than “must be on our LAN” allowed for.

    Most users forget that in the end, someone is running those servers and keeping things working. So from me, for all those who’ve never seen the inside of IT, thank you. And keep rocking it.