devopsy.kinsta.cloud

Category: Microservices Journal

Microsoft Enlists Endor Labs to Integrate SCA Tool with CNAPP

Microsoft has tapped Endor Labs to incorporate a software composition analysis (SCA) tool into its cloud-native application protection platform (CNAPP).

Lara Goldstein, a security product manager for Microsoft, said after evaluating multiple SCA tools the decision to partner with Endor Labs to add an SCA tool to the Microsoft Cloud Defender platform was made because that approach provided deeper insights into the actual reachability of any vulnerability discovered. That’s critical because it reduces the number of potential issues that application development teams would have to investigate, she said.

Endor Labs earlier this year added analytic capabilities to its SCA tool that makes it possible to determine, for example, how challenging it might prove to upgrade an open-source software package, including its potential to break an application.

Additionally, the company added an Endor Magic Patches capability to enable DevSecOps teams to apply patches created in a later release to a previous version of the module, if they determine upgrading that module would be too difficult.

Jenn Gile, director of product marketing for Endor Labs, said that approach increases the empowerment of the DevSecops teams to address issues without having to shift all responsibility for applications left toward developers, who either lack the required expertise or simply don’t have the time available to apply a patch.

The alliance with Microsoft further advances that capability by now providing native integration with a CNAPP that enables DevSecOps teams to address both application and infrastructure security issues within a single platform, she added. In effect, Endor Labs in collaboration with Microsoft is now addressing application security from code to runtime, in a way that makes it simpler for DevSecOps teams to visualize the actual attack path that cybercriminals might exploit to compromise an application environment, she added.

In the long term, the alliance also set the stage for Endor Labs to integrate its SCA tool with GitHub Copilot, to enable that generative artificial intelligence (AI) tool to surface additional remediation guidance.

While a lot of progress has been made in terms of adopting best DevSecOps practices there is still much work to be done. A Techstrong Research survey finds less than half (47%) of respondents work for organizations that regularly employ best DevSecOps practices. Slightly more (54%) regularly scan code for vulnerabilities during development.

A full 59% of respondents did note that their organization is making further investments in application security, with 19% describing their investment level as high. Specifically, 64% of respondents are investing in a code scanning tool, with 24% describing those investments as being at a high level.

On the plus side, DevOps, in general, has already had either a high (34%) or medium (43%) impact on improving software security for more than three quarters (77%) of organizations, the survey finds.

Of course, as regulations become more stringent, it’s only a matter of time before more organizations are forced to improve the security of their software supply chains. The only issue left to determine now is at what cost will that goal be achieved.

November 25, 2024
Five Great DevOps Job Opportunities

devopsy.kinsta.cloud is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience.

Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained so when one DevOps professional takes on a new role it tends to create an opportunity for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration.

LinkedIn

Citi
Rutherford, NJ
Senior Vice President for DevOps Core Engineering
$176,700 to $265,100

Indeed.com

Mayo Clinic
Rochester, MN
Principal Platform Engineer
$148,720 to $215,675

CareerBuilder.com

Wiz
New York City
DevOps Engineer
$140,000 to $190,000

SimplyHired.com

BMC
Remote
DevOps Engineer
$120,000 to $135,000

Dice.com

GovCIO
Remote
DevOps Lead
$120,000 to $130,000

November 25, 2024
Checkmarx Extends DevSecOps Reach to Repository Security and Secrets Discovery

Checkmarx this week extended the scope of its ability to protect software supply chains with tools that access how secure a repository is and find where application secrets have been shared in a way that is not secure.

Ori Bendet, vice president of product management for Checkmarx, said the Repository Health and Secrets Detection tools are now part of a Checkmarx One platform that already provides software composition analysis (SCA) tools to scan for malicious code in software packages, containers and artificial intelligence (AI) models.

The need to assess the level of security attained by a repository has become a more pressing concern because cybercriminals have become more adept at impersonating legitimate contributors to the software development project, said Bendet. The Repository Health tool makes it possible to, for example, determine whether multifactor authentication (MFA) is being used to verify the identity of contributors.

The Secrets Detection tool, meanwhile, makes it possible to discover application secrets that might have been, for example, shared as plain text via a messaging platform, added Bendet. The challenge that DevSecOps teams regularly encounter is that these secrets can wind up being inadvertently being stored anywhere as members of a development team collaborate to build an application, he noted.

The Checkmarx One is based on a platform that the company gained with the acquisition of Dustico in 2021. Since then, Checkmarx has been steadily extending the capabilities of that core platform to provide a more holistic approach to software supply chain security based on the Supply-chain Levels for Software Artifacts (SLSA) framework, said Bendet. Checkmarx is the only provider of a security platform that implements that framework in its entirety, he added.

In general, Checkmarx provides a multi-tier approach to assessing threats. The first tier is based on a scan that is then augmented using machine learning algorithms and other forms of artificial intelligence (AI) to assess code. Checkmarx security researchers then review findings to verify the nature of the threat, noted Bendet.

There is no doubt that software supply chain security has become a major concern. A Checkmarx survey recently found that 63% of respondents work for organizations that have been the victim of an attack on their software supply chain in the past two years.

It’s not clear how aggressively organizations are moving to secure software supply chains in the wake of some infamous breaches, but a Techstrong Research survey finds less than half (47%) of respondents work for organizations that regularly employ best DevSecOps practices. However, 54% of respondents regularly practice code scanning for vulnerabilities during development, while 40% conduct security testing. A full 59% of respondents said they are also making further investments in application security, with 19% describing their investment level as high. At the same time, 64% of respondents are investing in a code scanning tool, with 24% describing those investments as high.

Ultimately, as regulations continue to become more stringent it’s more a question of when and to what degree organizations will improve software supply chain security.

The days when organizations were not held accountable for vulnerabilities in their code that cybercriminals found a way to exploit are all bit over. The issue now is finding the best way to ensure code is secure without unduly slowing down the pace at which modern applications are now being developed.

November 21, 2024
Five Great DevOps Job Opportunities

devopsy.kinsta.cloud is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience.

Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained so when one DevOps professional takes on a new role it tends to create an opportunity for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration.

LinkedIn

Taylor Made Golf Company
Carlsbad, CA
Associate Vice President IT Global Applications
$215,000 to $275,000

SimplyHired.com

Apple
Elk Grove, CA
DevOps Engineer – Insights
$148,700 to $223,900

Dice.com

TransUnion
White Plains, NY
Senior DevOps Architect
$135,010 to $228,800

CareerBuilder.com

Parsons
Herndon, VA
DevOps Engineer
$120,000 to $180,000

Indeed.com

Tesla
San Jose, CA
Software Engineer – Infrastructure
$104,000 to $210,000

November 18, 2024
Splunk Tightens Integration Across Observability Platforms

Splunk this week made a bevy of updates to its observability platforms including the addition of a revamped user interface that provides a more consistent experience across Splunk Cloud and Splunk AppDynamics.

In addition, there is now deeper integration between the platforms made possible by Log Observer Connect for Splunk AppDynamics, deeper linking and a single sign-on capability.

Finally, the Splunk Observability Cloud has been updated to provide deeper visibility into Kubernetes clusters along with an update to Tag Spotlight capability that provides a more intuitive understanding of issues for IT operations teams.

Splunk Field CTO Cory Minton said Splunk since being acquired by Cisco has been working to integrate the AppDynamics platform with multiple Splunk observability platforms. Cisco acquired AppDynamics in 2017 and is now being advanced within the Splunk arm of Cisco.

Rather than having one single platform, Splunk is working to make it simpler for the various teams with an IT organization that are using these platforms to collaborate, said Minton. An IT service management (ITSM) team that uses the core Splunk platform to troubleshoot an infrastructure should be able to easily share insights with an application development team that is using AppDynamics to manage the software development lifecycle, (SDLC), said Minton.

As part of that effort, Splunk is making it possible to analyze data even if it has not been indexed, he added. That federated ability to process data both internally and externally will foster deeper levels of collaboration across IT teams by ensuring the right data is made available at the right time, said Minton.

Splunk is also investing in generative artificial intelligence (AI) to make its platforms more accessible by, for example, being able to use natural language to query data, he noted. The overall goal is to extract more signal for all the data being generated by applications, said Minton.

Mitch Ashley, vice president and practice lead for DevOps and application development at The Futurum Group, said it’s clear AppDynamics is now being pulled into the Splunk technology ecosystem in a way that makes workflows and processes seamless.

Each IT organization will need to decide for itself to what degree to meld those workflows. However, with the rise of platform engineering, more organizations are looking for ways to streamline the management of IT operations. A Techstrong Research survey finds that 61% of respondents work for organizations that are already applying platform engineering principles across all or some element of their IT operations. Improving developer productivity (59%), the need for standardization of configurations (58%), reducing costs (51%), decreasing the increased complexity of modern applications (49%) and improving security (48%) as the primary drivers of adoption, the survey finds.

Observability, of course, is a core tenet of DevOps and an essential element of any platform engineering strategy. The challenge, as always, is finding a way to collect and process all the telemetry data generated by applications as efficiently as possible. Otherwise, the cost of observability starts to reach a level that quickly becomes unsustainable for many organizations.

November 15, 2024
Akka Unfurls PaaS for Building Distributed Java Applications

Akka, formerly Lightbend, today at the KubeCon + CloudNativeCon 2024 conference, unfurled a revamped Akka that adds a software development kit (SDK) to make the platform-as-a-service (PaaS) environment for building distributed Java applications more accessible.

In addition, Akka is making available a serverless instance of the PaaS, dubbed Akka 3, along with enabling IT teams to deploy the framework on the cloud computing environment of their choice.

Akka 3 also now makes it possible to replicate applications across clouds, regions and devices to enable no-downtime migrations, repatriation to on-premises IT environments, and disaster recovery.

Company CEO Tyler Jewell said Akka is now the first application runtime to provide multi-master replication, which is made possible because Akka applications have access to their own in-memory databases with writable conflict-free replicated data types (CRDT) running globally.

Finally, Akka is now indemnifying customers for any losses stemming from data that becomes unrecoverable. Akka can make that pledge because each application has its own in-memory database that makes it unlikely data will ever be lost, said Jewell.

More than 100,000 applications have already been built using Akka and the decision to rename Lightbend was made to align the company more closely with an Akka framework that has been downloaded one billion times, noted Jewell. The overall goal is to make it possible for IT organizations to build and deploy truly elastic applications that consume infrastructure resources more efficiently.

IT teams are adopting Akka because it enables them to guarantee service level agreements (SLAs) by running applications that can continuously adapt independently of IT infrastructure environments, said Jewell. Every other framework that might be used to build these types of applications can’t guarantee that data won’t be lost, said Jewell.

Akka 3 is the culmination of an eight-year effort to turn a set of libraries into a more opinionated PaaS environment that an SDK now makes it easier to build high-performance distributed Java applications capable of running at scale, he added.

It’s not clear how large the Akka developer community is. However, organizations of all sizes are increasingly focused on ensuring their applications are portable in case, for example, licensing terms are altered in a way that suddenly increases costs. At the same time, more data than ever needs to be processed in memory to support applications running in near real-time. Much of the data needs to be processed and analyzed in memory at the point where it is either collected or created. The challenge is that data eventually needs to be synchronized with some type of central repository that typically resides in the cloud or an on-premises IT environment.

Regardless of whether IT teams adopt a publish-subscribe approach to building these types of applications or some other type of event-driven programming model, these applications are much more challenging to build and maintain than traditional batch-oriented applications. As such, they will no doubt require a level of DevOps expertise to build, deploy and maintain across highly distributed computing environments that depend on network connectivity that is not always reliable.

November 15, 2024
Analysis Finds DevOps Engineers Are Being Promoted Faster

An analysis of a data set collected by SignalFire, a platform provider for recruiting employees, finds that IT professionals specializing in areas such as DevOps move into leadership roles within their organizations within two to three years.

Additionally, the analysis finds that engineers with degrees from top-tier schools are promoted 22% faster. However, most engineers with college degrees are on a par with one another by the eighth year of their career regardless of whether they have a degree or not, according to the report.

On average, it takes 3.07 years for graduates from a top-tier school to reach a senior position, compared to 5.37 years for graduates from other schools. Interestingly, the report also notes that senior engineers with no college degree are reaching senior positions in slightly more time, which suggests that by skipping four years of college altogether they may attain those positions at a younger age. Overall, the analysis finds that 47% of the DevOps engineers tracked have no formal degrees.

Finally, the report suggests that engineers might be promoted more often if they switch jobs. Engineers who work for startups get promoted 22% faster than those at larger companies.

Jarod Reyes, head of the developer community for SignalFire, said the report also makes it clear that engineers, once they join an organization, tend to stay put, rather than move from one company to another. As a result, salary increases tend to come at a slower rate compared to a double-digit percentage gain that might be attained by taking a new job at another organization. In their last job transition, only 2.7% of engineers moved to a smaller startup.

SignalFire created a platform that leverages multiple forms of artificial intelligence (AI) to track more than 60 million employees who have been hired by more than 80 million companies.

As is often the case, the economic value of a college education tends to decline as individuals gain more hands-on experience in a field, said Reyes. More employers of IT professionals are interested in the skills and expertise that have been acquired, than they are in educational pedigree. Certifications that have been acquired are likely to be ranked higher as a means for identifying a job candidate than a college degree.

Of course, not every engineer aspires to be promoted to a senior position. Many are quite content to fill a specific role so long as they earn enough to be comfortable. In general, career advancement in IT is often tied to an ability to understand how to achieve the goals of the business as it is technical prowess.

Regardless of career aspirations, the overall demand for IT expertise continues to exceed the available supply, especially among DevOps engineers. Exactly how those job roles will evolve in the age of artificial intelligence (AI) remains to be seen, however, the report does note the pool of engineers with AI and machine learning expertise has grown 2,770% from almost nothing 10 years ago. The one certain thing is before too long just about every engineer, to one degree or another, will need some level of AI expertise if they expect to hold on to their current position.

November 13, 2024
Scarf Integrates Platform for Tracking Open Source Software Usage With Salesforce

Scarf today at the KubeCon + CloudNativeCon 2024 conference revealed it has integrated its platform for tracking consumption of open source software with the Salesforce customer relationship management (CRM) platform, at a time when the debate over what open source constitutes remains heated.

The platform has also been updated to add an ability to directly correct and flag event data for improved accuracy in company matching and attribution and enhanced data filtering options for exporting data.

The Scarf platform is primarily used by IT vendors to identify organizations that are consuming open-source software at a level of scale that might warrant additional support. Alternatively, some vendors may have developed commercial add-ons to an open-source tool or platform that they are trying to encourage organizations to license.

The Scarf platform ties usage data and attributes such as internet addresses to specific organizations that have downloaded a significant amount of software from an open-source software repository. In total, the Scarf gateway has tracked more than seven billion events.

Scarf CEO Avi Press said the company works in partnership with consortiums such as The Linux Foundation to help ensure the open-source software ecosystem remains economically viable. In the absence of those insights there would not be as many IT vendors sponsoring open source software projects, he noted.

There is, of course, a lot of contention within the open-source community that often results in forks being created, because an IT vendor that originally created one project or another has decided to change its licensing terms. Usually, that change is attributed to cloud service providers that wind up benefiting more financially from the open-source software than the vendor that created it.

When those changes are made to licensing terms, however, it’s usually not too long before disaffected members of a community, sometimes with the help of a cloud service provider, create a fork of that original project that is made available under the same licensing terms as the previous project.

That level of friction, however, could be avoided if it was simpler for IT vendors that sponsor open-source projects to find opportunities to add additional commercial value in a more targeted way, said Press. In fact, many of those organizations are more likely to respond positively to such inquiries than a generic cold call from a salesperson, he added. Those types of customer engagements ensure the open-source software ecosystem remains healthy, said Press.

There are, of course, strident open-source software advocates who are generally suspicious of any project sponsored by IT vendors. However, many of the contributions to those projects are made by software engineers who work for IT vendors.

Arguments over open-source licensing models have been occurring for decades. Most recently, the community has been arguing over what constitutes an open-source AI model, many of which don’t make available how the weights were applied to train the underlying large language model (LLM). It’s not likely any of these issues will be resolved any time soon, however, ultimately each organization will need to decide for itself what definition of open source it wants to embrace and support.

November 13, 2024
Five Great DevOps Job Opportunities

devopsy.kinsta.cloud is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience.

Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained so when one DevOps professional takes on a new role it tends to create an opportunity for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration.

LinkedIn

Harley-Davidson Motor Corp.
Remote
Director for Digital Software Engineering
$162,400 to $249,900

SimplyHired.com

DCI Solutions
McLean, VA
DevOps Engineer
$160,000 to $225,000

Indeed.com

Perchwell
New York City
Senior DevOps Engineer
$160,000 to $190,000

Dice.com

Endava
Berkeley Heights, NJ
Senior DevOps Cloud Engineer
$140,000 to $160,000

CareerBuilder.com

Backcountry
Park City, UT
DevOps Technical Lead
$130,000 to $160,000

November 11, 2024
Survey Sees DevOps Teams Focusing More on IT Sustainability Issues

A survey of 504 DevOps practitioners finds 59% work for organizations that have a sustainability initiative specifically tied to application development and deployment.

Conducted by Techstrong Research, the survey also finds that 54% of respondents work for organizations that have sustainability initiatives tied to IT operations.

Other areas that have sustainability initiatives include improving application software efficiency (45%), site reliability engineering (39%), cloud migrations (37%), artificial intelligence (29%) and platform engineering (28%).

Mitch Ashley, principal analyst for Techstrong Research, said from cloud resource consumption to AI processing to software design decisions, sustainability is now part of the conversation. Sustainability considerations will have a strong influence on the software, infrastructure and operational decisions, he added.

The amount of carbon an IT organization is on one level just another type of cost metric. IT environments that generate excessive amounts of carbon are consuming IT infrastructure resources at rates that are probably inefficient. Optimizing the rate at which IT infrastructure is consumed will both reduce costs and reduce the overall amount of carbon emissions. The challenge is that as application workloads become more distributed it’s difficult to continuously assess how efficiently software is running.

The simple fact of the matter is that many IT teams, especially in a cloud era that makes it relatively trivial for developers to spin up virtual machines, have not been paying a lot of attention to the amount of infrastructure they consumed.

In addition, there are still plenty of opportunities to replace legacy applications with a more modern application that executes code much more efficiently. Much of the code running in production environments today was written at a time when how efficiently that code might run was less of a pressing concern than it is today.

Fortunately, there are more tools available that enable IT organizations to track power consumption as part of an effort to reduce carbon emissions.

The SustainableIT.org consortium has also developed a set of 240 industry agnostic metrics for tracking and measuring the impact of sustainability initiatives. The non-profit consortium also partnered with ServiceNow to infuse best sustainability practices into its IT management platforms.

The Green Software Foundation (GSF), meanwhile, is working with SustainableIT.org to define a set of best practices for writing energy-efficient code.

Additionally, Red Hat has donated an open source Kubernetes-based Efficient Power Level Exporter (Kepler) tool that captures power usage metrics from Kubernetes clusters to the to the Cloud Native Computing Foundation (CNCF).

Cloud service providers now also routinely make available reporting tools to enable organizations to more precisely track how much carbon they are generating.

Right now, tracking of carbon emissions is still a bigger issue in Europe than most anywhere else and it remains to be seen how much regulatory pressure might be applied to organizations in the U.S. as a new administration take office. One way or another, however, the pressure to consume IT infrastructure resources as efficiently as possible is only going to continue to rise in an era where organizations are not just concerned about environmental impact but also the total cost of IT.

For more information, download a copy of the DevOps Next report here.

November 8, 2024