devopsy.kinsta.cloud

Tag: acquisitions

  • GitLab Adds Fuzz Testing to DevSecOps Toolbox

    GitLab Adds Fuzz Testing to DevSecOps Toolbox

    GitLab today announced it has acquired Peach Tech, a provider of protocol fuzz testing and dynamic application security testing (DAST) API testing tools, and Fuzzit, a continuous fuzz testing tool, as part of its efforts to advance the adoption of best DevSecOps practices.

    David DeSanto, director of product for GitLab Secure & Defend, said the two acquisitions should make it easier for DevOps teams to incorporate both whitebox and blackbox fuzz testing techniques for security testing much earlier in the application development and deployment process.

    Fuzz testing is an automated technique that involves providing invalid, unexpected or random data as inputs to software, which is then monitored to see what happens—if it, for example, crashes or a memory leak is created.

    Peach Tech adds Peach Fuzzer, an automated security testing platform that employs definition files known as Peach Pits to generate the fuzzed data consumed by the test target along with a framework for automating the web application programming interface (API) security testing process.

    Fuzzit provides a service that enables DevOps teams to continuously generate fuzz tests and correlate crashes in a way that can be integrated within a continuous integration/continuous delivery (CI/CD) workflow.

    Once Peach Tech and Fuzzit technologies are fully integrated with each other and the GitLab platform, DeSanto said GitLab Secure customers will be able to automate myriad tasks, from security testing to vulnerability management and remediation.

    GitLab will also employ technologies from both companies to further its ambitions to drive the adoption of interactive application security testing (IAST). The goal is to not only make it easier for developers to employ DevSecOps tools but also understand what issues are being created as applications are developed, said DeSanto. That approach should reduce the number of instances where development teams are continuously making the same mistakes across multiple application development projects, he noted.

    The further left cybersecurity testing is shifted the less stress there will be on chronically short-staffed cybersecurity teams. The challenge is that while most organizations recognize the potential benefits of DevSecOps there hasn’t been much progress in educating developers on what issues to look for and providing them the tools needed to discover and remediate vulnerabilities.

    There is, of course, no silver bullet when it comes to cybersecurity. As long as humans write code there always will be potential issues. However, many more routine cybersecurity issues should be addressed long before an application is deployed within a production environment. To achieve that goal organizations are providing developers with tools that identify cybersecurity issues as they write code in addition to incorporating more security testing into their CI/CD workflows.

    Of course, GitLab is not the only provider of a CI/CD platform focusing on how to foster the adoption of best DevSecOps practices. There’s clearly a race to embed security testing tools within CI/CD platforms that should advance adoption for DevSecOps, if for no other reason than they are becoming easier for developers to discover and employ.

  • DevOps Chats: CloudBees Remains at Top of DevOps Market

    DevOps Chats: CloudBees Remains at Top of DevOps Market

    In this special DevOps Chats video edition, we speak with Sacha Labourey, CEO of CloudBees. From the very beginning of the DevOps movement, CloudBees has been one of the companies at the top of the DevOps market and, based on its latest business metrics, the company remains there.

    Being the enterprise Jenkins company helped CloudBees early on to be a leader at the top of the DevOps market. But with Jenkins and Jenkins X handed over to the Continuous Delivery Foundation (CDF), CloudBees can no longer count on its Jenkins connection to stay on top.

    Sacha, like any good CEO, did not allow CloudBees to rest on its laurels. An aggressive acquisition strategy including acquiring Electric Cloud, Rollout.io and others, has kept CloudBees on top. At the same time, Sacha has led the product and engineering teams as they roll out a new generation of DevOps products and services including the upcoming Software Delivery Management (SDM) and Software Delivery Automation (SDA).

    In this video, Labourey lays out what the past year has seen for CloudBees and what the coming year could bring. Of course, with Covid19 everyone is sailing into unchartered waters. But Sacha has the course in mind for CloudBees to follow.

    Have a listen to our conversation with Sacha to understand CloudBees’ plan to stay at the top of the DevOps market.

    [video src="https://videos.files.wordpress.com/TNgFIQ9x/2020-03-19-interview-with-sacha-labourey-1_hd.mp4" /]

    — Alan Shimel

  • DevOps Deeper Dive: VMware Transformed

    DevOps Deeper Dive: VMware Transformed

    At the VMworld 2019 conference this week, VMware in no uncertain teams made it clear it wants to become a major DevOps force.

    Following the acquisition of sister company Pivotal Software last week, VMware is moving to build out an application development framework for building and deploying cloud-native applications based on Kubernetes. That effort coincides with ongoing investments in its vRealize Suite of management tools, through which VMware is committed to automating IT operations across both on-premises IT environments and public cloud computing environments.

    To advance those twin goals, VMware this week launched a series of Tanzu management tools for managing any distribution of Kubernetes while at the same time launching VMware hybrid cloud platform, which combines everything—from vRealize automation tools to the monitoring tools from Wavefront by VMware—to create a central console through which all of IT can be managed.

    [su_box title=”The VMware DevOps Timeline”]

    • October 2015 – Dell Acquires VMware along with EMC
    • April 2017 – VMware acquires Wavefront monitoring service
    • August 2017 – VMware shifts public cloud strategy via Amazon Web Services (AWS) alliance; VMware and sister company Pivotal Software unveil Kubernetes distribution
    • November 2017 – VMware Launches VRealize Management Suite
    • February 2018 – VMware acquires CloudCoreo to gain cloud configuration tools
    • August 2018 – VMware acquires CloudHealth Technologies to gain governance tools; VMware launches AppDefense to provide a zero-trust framework
    • November 2018 – VMware acquires Heptio for Kubernetes expertise
    • December 2018 – Dell acquires all VMware outstanding shares
    • May 2019 – VMware Acquires Bitnami for application packaging tools
    • July 2019 – VMware Acquires Avi Networks to gain Web Application Firewall (WAF); VMware Acquires Bitfusion for machine learning algorithms and GPU virtualization software
    • August 2019 – VMware Acquires Pivotal Software; VMware Acquires Carbon Black; VMware Launches Tanzu Platform to manage Kubernetes; VMware Unveils Hybrid Cloud Platform

    [/su_box]

    After deciding to launch a series of services through which it manages instances of its software on public clouds such as Amazon Web Services (AWS) and local servers from sister company Dell EMC, VMware has been slowly expanding its reach into the realm of applications. The most significant element of that thrust to date has been its acquisition of Pivotal, a provider of the widely used Spring framework based on Java and a platform-as-a-service (PaaS) environment based on open source software from the Cloud Foundry Foundation (CFF).

    The CFF is in the process of migrating the application development environment created for Cloud Foundry to Kubernetes, a cloud-native container orchestration engine being developed under the auspices of the Cloud Native Computing Foundation (CNCF). Both the CFF and the CNCF are arms of the Linux Foundation. The rise of Kubernetes has resulted in many organizations shifting their application development strategies to a platform capable of supporting multiple application development environments.

    Prior to announcing the deal to be acquired by VMware, Pivotal cut its revenue forecast for fiscal 2020 by $40 to $50 million.

    VMware DevOps
    VMware CEO Pat Gelsinger

    Pivotal Software spun out of VMware in 2013, so to a certain degree VMware’s move to acquire Pivotal represents something of a homecoming that last week was valued at $2.7 billion. Pivotal currently has about 350 customers, many of which are hosting a distribution of the Cloud Foundry PaaS on VMware platforms. VMware also tapped Pivotal to jointly develop a curated instance of Kubernetes, dubbed Pivotal Container Service (PKS), that is optimized for VMware platform. As part of that effort, VMware is also developing an instance of VMware vSphere that will run Kubernetes natively.

    At the VMworld 2019 conference, VMware CEO Pat Gelsinger made it clear VMware plans to leverage Kubernetes to bridge the historical divide between developers and IT operations teams. In fact, he told attendees Kubernetes was the most important technology to emerge since the virtual machine was created. As part of that effort, Gelsinger noted that the acquisition of Pivotal coupled with the recent acquisition of Bitnami, a provider of tools for packaging applications, means there are now more 5 million developers participating in the VMware ecosystem.

    VMware is clearly hoping the developer ecosystem will expand as VMware makes it easier to launch virtual machines on every major public cloud as well as on-premises IT environments. VMware has faced a major challenge over the last several years as DevOps teams have bypassed internal IT teams to deploy applications on cloud services based on alternative virtual machines by AWS or Microsoft. Thanks to the inherent portability of Kubernetes, VMware is hoping organizations will now deploy cloud-native applications on VMware platforms. It remains to be seen, however, to what degree DevOps teams will embrace VMware on public clouds versus continuing to employ those virtual machines.

    When it comes to cloud-native computing, VMware is clearly playing catchup. VMware has 250 PKS customers today, while rivals such as Red Hat (now an arm of IBM) have already redeployed their application development and deployment platforms on Kubernetes as an alternative to the Cloud Foundry PaaS. On the plus side, VMware now claims to be the third-largest contributor to Kubernetes, thanks in part to its acquisition of Heptio, a provider of Kubernetes tools.

    In the meantime, there’s no question VMware is at the forefront of developing tools for automating the management and securing of IT infrastructure running its virtual machine software. Less clear is to what degree VMware will be able to translate that success to also unify application development and IT operations across multiple platforms a truly meaningful DevOps way, rather than merely bundling a suite of disparate tools together at a discount.

    — Mike Vizard