devopsy.kinsta.cloud

Category: News

  • Survey Surfaces Massive Number of Application Vulnerabilities

    Survey Surfaces Massive Number of Application Vulnerabilities

    A survey of 16,510 IT and IT security practitioners published today by Rezilion, a provider of a platform for automating the remediation of software vulnerabilities, found nearly half of respondents (47%) worked for organizations that have a backlog of vulnerable applications. More than half (66%) said their backlog consisted of more than 100,000 vulnerabilities and the average number of vulnerabilities that need to be remediated is 1.1 million.

    The survey, conducted by the Ponemon Institute, also found more than half of respondents ( 54%) said they can only patch less than 50% of the vulnerabilities.

    Factors that keep teams from remediating included an inability to prioritize what needs to be fixed (47%), a lack of effective tools (43%), a lack of resources (38%) and not enough information about risks that would exploit vulnerabilities (45%).

    More than a quarter (28%) also said remediation is too time-consuming. The survey found that 77% of respondents said it takes longer than 21 minutes to detect, prioritize and remediate just one vulnerability in production.

    In addition, 85% said they spend more than 16 minutes detecting one vulnerability in development. A full 82% also noted it takes longer than 21 minutes to remediate one vulnerability in development. A majority of respondents said it is either very difficult (36%) or difficult (25%) to remediate vulnerabilities in applications.

    On the plus side, more than half (56%) said they use automation for vulnerability remediation, with 43% reporting times to respond are significantly shorter as a result.

    Rezilion CEO Liran Tancman said the survey makes it clear there’s still plenty of room for improvement. The number of vulnerabilities that need to be addressed is staggering, he said. IT teams need to focus their immediate efforts on identifying the vulnerabilities that are the most critical, he noted.

    Remediating those vulnerabilities will soon become a higher priority as more regulations focused on securing software supply chains come into effect. In fact, the software bills of material (SBOMs) that these regulations require will expose much of the dirty laundry that currently exists in application environments, said Tancman.

    Ultimately, the goal needs to be enabling organizations to address vulnerability issues without slowing down the rate at which applications are being built and deployed, Tancman added. The degree to which that goal can be achieved will vary widely as more responsibility for security is shifted left toward application developers. However, the need to provide tools to developers that enable them to address vulnerability issues has never been more apparent, noted Tancman.

    It’s clear the level of application security vulnerability debt that organizations will need to address can no longer be ignored. The issue now is to determine how best to resolve these issues either by fixing existing applications or replacing them with new ones. Either way, it’s clear that there is a need to adopt DevSecOps best practices to better secure software.

    In the meantime, as application security becomes a boardroom-level issue, there be a lot more scrutiny applied all across the software supply chain.

  • How’s Facebook Work? They Don’t Know! | Cali. Pay Law | NASA RISC-V Launch

    How’s Facebook Work? They Don’t Know! | Cali. Pay Law | NASA RISC-V Launch

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Facebook engineers admit they’ve no idea what Meta stores (or where), California requires job ads quote salaries, and RISC-V will power future NASA spacecraft. (more…)

  • Federal Agencies Share DevSecOps Guidelines

    Federal Agencies Share DevSecOps Guidelines

    The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and the Office of the Director of National Intelligence (ODNI) have published a set of DevSecOps best practices based on the Enduring Security Framework (ESF).

    Developed by a public-private cross-sector working group led by NSA and CISA, the ESF framework was created in the wake of the breach of the SolarWinds software supply chain that led to malware being distributed downstream to a number of organizations that relied on the company’s IT management platform.

    The Securing the Software Supply Chain for Developers set of best practices published by NSA, CISA and ODNI takes the ESF a step further. The guidance walks organizations through the processes required to develop secure code, verify third-party components, harden build environments and deliver code.

    The best practices provided are the latest dividend of an executive order issued by the Biden administration that requires every federal agency to review the security of its software supply chains. The expectation is that enterprise IT organizations will conduct similar reviews using the best practices and frameworks defined by the federal agencies that specialize in cybersecurity.

    The challenge, of course, is embedding those best practices within existing DevOps workflows. In theory, more responsibility for cybersecurity is shifting left toward application development teams. However, the level of cybersecurity expertise that exists today among application developers is limited at best. Cybersecurity was an elective in most developers’ training and education programs, so it should come as no surprise that few of them ever attended a cybersecurity class.

    There’s a clear need to improve cybersecurity training for developers, but the real work involves automating cybersecurity processes within the workflows managed by the tools developers employ to write code and the platforms that DevOps teams use to deploy applications, said Mitch Ashley, principal analyst for Techstrong Research, an arm of Techstrong Group that is also the parent company of DevOps.com. “Security needs to be part of the toolchain, workflows and how the software is designed,” he said.

    Ideally, organizations should appoint a security champion that will work with development teams to consistently implement a set of DevSecOps best practices, added Ashley.

    Of course, the security champion doesn’t eliminate the need for cybersecurity professionals. Rather, it reduces the pressure when there is a chronic shortage of cybersecurity professionals. In the absence of any formal cybersecurity review during the application development process, it’s simply too easy for developers to inadvertently introduce malware into a software component or misconfigure a cloud infrastructure service. In either case, cybercriminals are increasingly finding it easier to compromise software supply chains at multiple points.

    It’s not clear how much the federal government’s guidance might impact the overall state of application security. However, one way or another the level of security scrutiny being applied to how applications are built and delivered is only going to increase in the months ahead. The challenge is finding a way to deliver secure code without necessarily slowing down the rate at which applications are currently being built and deployed.

  • CodeSee Unveils Enterprise Codebase Visualization Platform

    CodeSee Unveils Enterprise Codebase Visualization Platform

    CodeSee this week launched an enterprise platform based on its codebase visualization and mapping tools that makes it easier for developers to navigate and learn how an application was developed.

    CodeSee CEO Shanea Leven said this capability makes it simpler to understand how a codebase is constructed, including the application programming interfaces (APIs), without having to read each line of code. Organizations can use the CodeSee Enterprise platform to review code in addition to making it easier to add new developers to a project, she said.

    The CodeSee Enterprise platform makes it possible to automatically detect, visualize and link to the code used to create every connection between the services that make up an application. That capability is especially useful for any security review of an application before or after an application is deployed.

    A code automation feature codifies and automates the code knowledge that previously could only be passed from one developer to another, Leven noted.

    It takes a significant amount of time for developers to pore over a codebase to understand where they might contribute. The larger a codebase is the more challenging it becomes to make meaningful contributions.

    By definition, application development in the era of microservices is now a group effort. The days when a lone developer cared for an entire application are long over. The issue is finding a way for teams of developers to more easily collaborate when most of them may have never actually met in person.

    The amount of focus on developer productivity has increased substantially since the start of COVID-19 pandemic spurred organizations to accelerate a wide range of digital business transformation initiatives. Developers are generally challenging to recruit and retain, especially individuals familiar with the latest cloud-native platforms for building and deploying applications. Making it possible for developers to more easily contribute to multiple application development projects has never been more critical.

    Of course, most developers would rather spend more time writing code rather than studying it. The amount of time devoted to understanding codebases and maintaining development environments far exceeds the amount of time spent writing code. Many developers are not always going to be able to take advantage of advances in application development without the aid of a DevOps team to provision new tools and platforms.

    One way or another, the rate at which applications are being developed and deployed needs to accelerate. An uncertain economic outlook is increasing the pressure on business leaders to digitally transform processes in a way that increases both revenue and profitability. The application experience is especially critical because customers are not inclined to patiently wait for organizations to finetune their digital processes over an extended amount of time.

    Less clear, however, is the level of stress individual developers might be willing to tolerate. There’s no doubt most of them are sympathetic to the needs of the organizations that have hired them but that does not necessarily mean they’re willing to continuously work overtime to achieve goals that might not be attainable using the tools they have at hand.

  • Stable Diffusion Goes Public — and the Internet Freaks Out

    Stable Diffusion Goes Public — and the Internet Freaks Out

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters. (more…)

  • VMware Embraces Graph Technology to Manage Multiple Clouds

    VMware Embraces Graph Technology to Manage Multiple Clouds

    At the VMware Explore 2022 conference today, VMware launched a portfolio of multi-cloud management tools, dubbed VMware Aria, based on a graph-based data store that captures the resources spanning multiple clouds and their relationship to one another.

    Accessed via a VMware Aria Hub platform previously known as Project Ensemble, VMware Aria Graph provides a common definition of applications, resources, roles and accounts in near-real-time across a multi-cloud environment that can consist of millions of nodes.

    VMware CEO Raghu Raghuram told conference attendees the Aria Graph is at the core of an effort to enable IT organizations to move beyond “cloud chaos” to embrace a next-generation “cloud smart” approach to managing distributed computing environments that span multiple platforms.

    Based on an event-driven platform, the VMware Aria Graph aggregates data pulled from public application programming interfaces (APIs) into a data store residing on that cloud. The data store is based on a federated model so there is no need to move data into a central repository. Instead, VMware is making use of GraphQL to launch queries across a federated data model. In addition, IT teams can discover dependencies and analyze historical configuration data to discover the root cause of any issue. All operational data is now aggregated in a way that creates a single source of truth.

    VMware has also provided a set of API services that can be used to integrate the Aria Graph data store with third-party platforms.
    In general, the company is committed to accelerating “the great replatforming” of IT environments spurred by digital business transformation initiatives, said Raghuram. The challenges IT organizations are encountering are roadblocks that involve everything from a lack of skills, the weight of existing enterprise applications and fragmented operations and cybersecurity models, he noted.

    The VMware Aria graph data store will enable the company to automate a wide range of management tasks, Raghuram said. That includes using the right cloud for the right application and governing and accessing them at the lowest cost possible, added Raghuram. The ultimate goal is to enable a unified developer experience that provides a frictionless multi-cloud experience across a consistent set of enterprise infrastructure, he said.

    VMware offerings that leverage the VMware Aria Graph include VMware Aria Guardrails for enforcing IT policies, a VMware Aria Migration tool for automating assessment, planning and execution using the VMware HCX platform and a VMware Aria Business Insights tool that surfaces business insights using machine learning algorithms. The rest of the VMware Aria portfolio is anchored around extensions to existing platforms in the form of VMware Aria Cost powered by CloudHealth, VMware Aria Operations and VMware Aria Automation.

    VMware also announced today that its existing VMware Cross-Cloud Service offering for deploying its stack of software across multiple clouds has been extended to add support for the Microsoft Azure cloud.

    Overall, VMware claims there are now five million developers in its ecosystem that collectively launch 350,000 projects every week. That equates to roughly 35 new applications a minute, according to Raghuram. All told, VMware claims there are 85 million workloads running globally on its platform.

    The bulk of those workloads today still run in on-premises IT environments. In fact, Raghuram noted that cloud platforms still only account for $413 billion in IT spending each year, which is only 10% of the total IT spending that reaches $4.4 trillion each year.

    VMware, which is expecting to complete its acquisition by Broadcom in the next few months, is betting that as more of those workloads move to the cloud, the need to centrally manage heterogenous IT environments will play to its strengths.

  • TidalScale Enables Hot-Swapping of Failed Servers

    TidalScale Enables Hot-Swapping of Failed Servers

    TidalScale has updated its namesake software for automating server management to include the ability to detect and prevent impending failures and enable IT teams to hot-swap another server.

    Version 4.1 of TidalScale also adds server wear leveling and preventative health checks that identify servers that should be replaced based on their remaining estimated life span.

    TidalScale CEO Gary Smerdon said that capability is especially critical given the high rate of DRAM memory failure that results in a high rate of downtime caused by server failures. The latest update to the company’s software-defined server management software reduces the failure rate in on-premises or cloud computing environments by a factor of 100 to ensure 99.999% uptime, he said.

    The company also announced that its software is now available on the Amazon Web Services (AWS) Marketplace.

    TidalScale employs machine learning algorithms to aggregate and virtualize CPU cores, memory and I/O across servers to present operating systems with a single software-defined server. That makes it possible to hot-swap individual servers to ensure availability.

    The single biggest cause of downtime in IT environments is memory failures; they are now 100 times more likely than they were a decade ago, noted Smerdon. In most cases, the root cause of the issues is the demands of modern applications running on legacy infrastructure that was not intended to support the latency requirements of those applications, he added.

    That issue can be especially acute in cloud computing environments where infrastructure is often shared by multiple applications, said Smerdon.

    It’s not clear at what rate cloud service providers are replacing legacy server infrastructure, but the ability to determine when to replace infrastructure gives IT teams an added measure of control over servers regardless of where they are deployed. The biggest issue, of course, is not so much replacing a server as it is determining which one actually failed. It often takes longer to identify a failed server than it does to bring a new one online.

    TidalScale is made available by both cloud service providers and manufacturers of servers used in on-premises IT environments, but it needs to be configured and deployed by an IT team. The overall goal is to not only increase system availability but also reduce the total cost of IT by managing infrastructure more efficiently across the life span of a server, said Smerdon. Some IT teams routinely replace servers at specified intervals, regardless of actual usage, to avoid downtime. TidalScale enables IT teams to determine which servers to replace based on the actual wear within the context of a self-healing server farm, he noted.

    Given all the things that might potentially go wrong in an application environment, not having to worry about server failures should enable DevOps teams to spend more time optimizing application performance.

    In theory, of course, modern applications based on microservices should be able to reroute calls to application programming interfaces (APIs) anytime a server becomes unavailable. However, over time it’s not uncommon for single points of failure to emerge as applications are updated. In the meantime, the majority of applications running today are based on legacy monolithic architectures that are much more susceptible to server failures that, unfortunately, are still far too common.

  • Force Me Back to the Office? Apple ‘Hasn’t Learned Anything’

    Force Me Back to the Office? Apple ‘Hasn’t Learned Anything’

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: I’m devoting my entire column to new ways of working. Whether it’s remote work, enforced hybrid working or a four-day working week, let’s triage the trends and futz with the future.

    Analysis: The Great Resignation — Not So Great

    Too many managers are stuck in their old ways. Despite the success of pandemic-era WFH, they yearn for how it used to be. But that ship has sailed.

    Mark Gurman: Apple Sets Return-to-Office Deadline

    “Pushing employees back into the office”
    The company … set a Sept. 5 deadline [and] will require employees to work from the office on Tuesdays, Thursdays and a regular third day that will be determined by individual teams. [It] has been working toward getting its employees back in the office since at least June 2021, when it first announced the three-day policy.
    …
    The iPhone maker has been one of the most stringent technology companies when it comes to pushing employees back into the office, irking some staffers. … An Apple spokesman declined to comment.


    It “Shows the Company Hasn’t Learned Anything,” cries Jason Aten:

    “Not the same thing as actual collaboration”
    Right now, every company is trying to figure out how to get its employees back to the office. Despite the fact that the world did not, in fact, come to a stop over the past two years. … Many companies—especially Apple—had their best two years ever when most of their employees were working from home.
    …
    Apple SVP of software Craig Federighi … told employees in an email … he “can’t wait to experience the special energy of having all of us back in the office together again!” … I imagine a lot of the people who work in the software organization are wondering whether that “special energy” actually makes them more productive—or if it’s just a thing managers feel as they watch employees.
    …
    If we’ve learned nothing else from the pandemic … coming to the office doesn’t make them more productive. It might make managers feel better … but that’s not the same thing as actual collaboration.


    But WFH doesn’t suit everyone. Here’s Aunty’s Kate Morgan: Why workers just won’t stop quitting

    Anthony C Klotz, a professor of management at University College London’s School of Management who coined the term “Great Resignation” [says] in addition to the original push factors … the reasons people are resigning have diversified. … Some workers are now swapping jobs that require them to be present in the workplace for remote positions. Other workers … are leaving remote jobs for ones that have a larger in-person component.


    WWSJD? quonset knows:

    Regardless of the jerk he was, Steve Jobs had grand visions which he brought to fruition. … One thing he stressed was the personal connection and serendipitous encounters.
    …
    It’s why, before he died, he was arms deep in the design of Apple’s headquarters. He wanted people to bump into each other, he wanted interaction between different groups. It’s why it’s designed the way it is. People are funneled to certain areas and have no choice but to interact with others.


    Is there an unintended brand consequence? u/Latinhypercube123 demonstrates there might be:

    Hahahaha. Apple is such a dead end company now. They’ve literally become what they ridiculed IBM of being: Corporate monolith of sameness.


    But is there a better way? You should read Evelyn Yu: Bank Says Four-Day Week Is The ‘Future of Working Life’

    “Flexible work is here to stay”
    Six months after switching to a four-day working week, the UK’s Atom Bank said it’s seen benefits from talent retention to improved productivity. … Days lost to sickness fell over the period and customer service ratings also improved.
    …
    Even as the pandemic recedes and some bosses push for a return to the office, there’s increasing evidence flexible work is here to stay. Office vacancies in central London are at the highest level in more than 15 years.


    Not just in the UK—it’s in Canada too. Here’s Sean Davidson:

    “Huge impact on employee retention”
    Ross Wainwright, CEO of Alida, said the software company implemented four-day work weeks for its 500 employees at the start of June and the two-month trial wraps up this week: … “The early results are fantastic. … The employees are clearly happier. … This is about getting better balance for our employees and helping to invest in their mental health.”
    …
    He said the trial is also having a “huge impact” on employee retention. … The most “unanticipated” result of the trial was how empowered his employees told him they felt, knowing the company trusted them to get the job done with a reduced schedule: “We empowered the employees to get the work done within their schedule.”


    Also in Toronto is u/SuperChloe:

    We had similar results at my company when we initially trialed 4-days (also not longer days, still 9-5) — overall increased output/productivity and employee satisfaction. We’ve moved to permanently having a 4 day work week.


    Meanwhile, @AnnaLovesVoting is just fine with a hybrid schedule:

    I don’t need 100% WFH, I’m willing to go to an office 1 maybe 2 days a year.

    The Moral of the Story:
    The tempter or the tempted—who sins most?


    You have been reading The Long View by Richi Jennings. You can contact him at @RiCHi or tlv@richi.uk.

    Image: Carles Rabada (via Unsplash; leveled and cropped)

  • F5 NGINX Delivers Modern Management Platform

    F5 NGINX Delivers Modern Management Platform

    F5 NGINX has revamped an implementation of its management suite as part of an effort to make the platform both more accessible and simpler to use.

    Eric Braun, vice president of product management for F5 NGINX, said NGINX Management Suite 1.0 is based on a modular platform that makes it possible to dynamically scale instances of NGINX proxy software, application delivery services, application programming interface (API) management workflows and the company’s security offerings.

    That approach makes it possible to automate the deployment of F5 NGINX software without relying on manual processes that are prone to misconfiguration, Braun noted.

    The platform is based on a modern architecture that also makes it possible for administrators to enable development teams to self-service their own requirements within the limits of a set of policies defined via a portal, he added.

    The NGINX Management Suite replaces NGINX Controller, a more monolithic platform that is not based on an API-first approach to managing services, said Braun.

    The core modules of the NGINX Management Suite are an Instance Manager for the open source and commercial instances of the company’s proxy software, an API Connectivity Manager, App Delivery Manager and an App and API Security module. NGINX Management Suite will enable organizations to use NGINX App Protect Web Application Firewall (WAF) to protect applications and APIs while the App Delivery Manager module will be extended to enable configuring, securing, monitoring and troubleshooting of NGINX Plus when used as a load balancer.

    The revamp of the NGINX management plane is the latest in a series of efforts to modernize application and IT infrastructure management using a microservices-based platform that more easily scales as more resources are required. The more modular approach also gives IT teams more granular control over how various modules are accessed.

    It also makes it simpler for IT teams to deploy, for example, a service mesh or API gateway without having to add additional management platforms, noted Braun. That capability should significantly streamline the process of deploying those platforms because the need for a dedicated platform to manage them has been eliminated, he added.

    It’s not clear to what degree that latter capability will enable IT organizations to shift responsibility for managing various tasks further left toward application development teams. However, it is clear application development teams want to be able to self-service their own IT requirements and make services available without intervention from a centralized IT organization. In effect, IT organizations are trying to strike a balance between the benefits of centralization and the need to build and deploy applications faster within the context of a DevOps workflow.

    It may be a while before most IT organizations are able to consistently strike that balance. In the meantime, however, as IT management platforms continue to be modernized using APIs it should also become easier to integrate them. It will be up to each IT organization to then decide how many management platforms are going to be required, but at the very least, the various management silos that make up an IT environment today are finally starting to break down.

  • Agile Sucks (Redux) | Plus: DevOps on Mars

    Agile Sucks (Redux) | Plus: DevOps on Mars

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Agile is bad, but “Wagile” is worse.
    Plus: This prod is even worse than yours. (more…)