devopsy.kinsta.cloud

Tag: API

  • Trend Micro Partners With Snyk to Advance DevSecOps

    Trend Micro Partners With Snyk to Advance DevSecOps

    Trend Micro today announced an alliance with Snyk through which alerts about vulnerabilities in open source code will be passed on to the tools Trend Micro makes available to apply virtual patches to both monolithic and microservices-based applications.

    Snyk provides a tool that identifies and fixes vulnerabilities and license violations in open source dependencies and container images. Trend Micro COO Kevin Simzer said his company leverages the alerts generated by Snyk to inform developers and cybersecurity professionals where virtual patches need to be applied.

    Virtual patches are a capability Trend Micro developed to enable IT organizations to address a vulnerability by applying a security policy that limits access to a specific piece of code until a developer can update a monolithic application or replace the containers housing vulnerable code within a set of microservices.

    By working more closely with Snyk, Trend Micro is trying to increase the appeal of its approach to virtual patching among DevSecOps teams, said Simzer. It’s not possible for most developers to address every vulnerability that manifests itself in a timely manner. Virtual patching allows DevSecOps teams to establish which vulnerabilities need to be addressed immediately while making use of virtual patches to protect applications from less severe vulnerabilities until they can be addressed during a DevOps cycle. To advance those capabilities, Simzer noted Trend Micro has already integrated its security offerings with continuous integration/continuous deployment (CI/CD) platforms such as Jenkins.

    Simzer said it will take a while for most cybersecurity professionals to trust developers to address cybersecurity issues during the application development process. However, virtual patches provide a mechanism through which both cultures can collaborate more closely without compromising the rate applications are being built and deployed. The primary reason developers tend not to pay as much attention to cybersecurity issues as everyone would like is because of the deadline pressure most of them are operating under. However, as responsibility for application cybersecurity continues to shift left, more developers are trying to address these issues earlier in the application development process.

    More than 16,000 enterprise IT organizations are already using Trend Micro security offerings to secure both monolithic applications and cloud-native applications based on containers, said Simzer, adding that footprint puts Trend Micro in a position to help organizations embrace best DevSecOps practices.

    Of course, Trend Micro is not the only cybersecurity vendor with similar ambitions. The challenge many organizations will face is defining what processes are best handled by developers invoking application programming interfaces (APIs) versus cybersecurity professionals who are more comfortable employing graphical user interfaces (GUI). There may come a day when more cybersecurity professionals are able to write code, but for now the two camps could not be further apart in terms of the tools they prefer to use. For IT security vendors such as Trend Micro, that means for the foreseeable future, they will continue to need to build GUIs alongside APIs.

    — Mike Vizard

  • GitHub Actions Advances Automation Strategy

    GitHub Actions Advances Automation Strategy

    GitHub Actions, a set of application programming interfaces (APIs) through which DevOps tools can automate workflows, is now available in beta.

    Previewed last year at the GitHub Universe event, GitHub Actions is intended to provide not only a way to automate responses to events occurring within a GitHub Repository but also share those workflows across multiple DevOps teams, said Max Schoening, senior director of product design for GitHub.

    Actions are based on YAML files, which makes it possible to write them in JavaScript or other programming languages or package them up as a set of containers. In either instance, they are designed to interact with the full GitHub API and any other public API.

    In addition, higher levels of automation enabled by GitHub Actions should make it more feasible for DevOps teams to test multiple versions of a project in parallel as workflows written in code replace manual processes, said Schoening.

    As more manual processes become automated, the number of IT teams who are intimidated by DevOps processes today should begin to decline. Organizations also should be able to apply best DevOps practices more consistently across multiple teams. Too often today the DevOps practices within the same organization tend to vary widely. Schoening also noted that given the open source history of GitHub, organizations will be able to see how workflows have been created for popular open source projects and then copy them.

    In addition, Schoening said the arm of Microsoft will continue to invest in analytics that will surface workflow recommendations that can be applied to any project regardless of the language employed or the platform on which it’s destined to be deployed.

    On one level, DevOps is all about a ruthless commitment to automation. But when automation goes wrong at scale, it can be extremely problematic. Rather than relying on “black box” approaches to automating processes, a truly open source approach to automation makes it possible for DevOps teams to see how a process is being automated and then extend it if they so choose, said Schoening. To help address the concern, GitHub Actions also provides access to live logs to provide real-time feedback as builds run, which Schoening said makes it easier for DevOps teams to debug automations created using GitHub Actions.

    It’s too early to say just how automated DevOps processes will get. There’s an emerging school of thought that contends the goal is to make it feasible for developers to spend 100% of their time writing business logic. It’s not clear whether that goal is achievable anytime soon, but progress is made with each update to continuous integration/continuous development (CD/CD) platforms. As complementary advances in machine learning algorithms and other forms of artificial intelligence (AI)—otherwise known as AIOps—occur, it’s apparent many manual DevOps processes will fall by the wayside.

    In the meantime, the workflows that make up any DevOps process should become increasingly sophisticated as advances in automation span everything from hybrid cloud computing environment to internet of things (IoT) deployments. The issue soon may not be how cumbersome any DevOps workflow is, but rather the potential limits of the imagination applied to automating them.

    — Mike Vizard

  • Product IT Operating Model: The Next-Gen Model for a Digital World

    Product IT Operating Model: The Next-Gen Model for a Digital World

    Digitization presents many new opportunities for businesses to create value. At the same time, it forces IT to rethink the way it operates. Modern CIOs need an operating model that understands the blurring lines between IT and business and is designed for agility and speed. The product-centric IT operating model is rapidly emerging as the answer.

    What does the model entail? In the product IT operating model, product lines are funded based on their strategic value to the organization, from the top-down, and are supported by dedicated management and delivery resources. The entire product team is measured on a common set of goals, which include customer experience, time-to-market, efficiency improvements, quality of software and availability and reliability of production environments.

    5 Dimensions of Product IT Operating Model

    Adopting a product IT operating model requires organizations to take an integrated approach toward product-based development and embark on a journey of continual improvements. While scaling agile DevOps that aligns business outcomes with engineering effort, enterprises must focus on these five key dimensions:

    1. Organizational Change Management (OCM): Successfully transitioning from the traditional IT operating model to a product-based development approach requires organizationwide change management. An experienced IT service provider, can prove to be a key ally in ensuring a smooth transition.

    2. Culture: Culture is an intrinsic characteristic of any organization, and instituting small but effective cultural changes coupled with OCM is the right approach to transition, rather than a “big bang” change. That’s also what some of the well-known enterprises across industries are doing.

    a. Teams and Collaboration: The alignment of large teams across multiple organizational groups delivers to a common plan on the pace of change and helps to continuously embed innovation and experimentation for improved services.

    3. Structure: Product-focused and highly talented teams across design, architecture, DevOps and operations are key to enhancing business capability. By measuring the entire team on same set of goals, it is easy to enhance customer experience, efficiency and quality of software while creating a stable production environment.

    Structure also means aligning traditional application portfolios to specific business outcomes and bringing together all the capabilities and resources required for an organization to deliver on its business outcomes.

    4. Technology: If business models, organizational structures, people and ways of working are the gears that run the enterprise IT engine, technology is the grease that enables this engine to run smoothly, without friction. Two key aspects of technology include:

    a. Application Programming Interfaces (API): API-based architecture provides an extensible framework of building blocks, which in turn can be used to build powerful applications or software products. Easy maintenance is a hallmark of API-based architecture, as it can be quickly migrated further to any other target architecture.

    b. Cloud, Microservices and Containers: Modern organizations need on-demand scalability. Cloud and microservices enable just that without disturbing ongoing business operations. However, it is important to first understand an organization’s product vision and road map, business priorities, competition, pace of market transition in their area of business and industry trends before choosing cloud or container-based infrastructure.

    5. Process and Automation:

    a. Agile Delivery Model: This is a critical prerequisite to building a minimal viable product (MVP), ensuring rapid delivery of critical enhancements or delivering a suite of product features in appropriate increments. Industry-standard agile practices such as LeSS and SAFe should be used, as they allow complete flexibility to tweak the model on the fly.

    b. DevOps and DevSecOps: A DevOps culture is fundamental to adopting a product IT operating model. Continuous integration and delivery (CI/CD) require DevOps to be fully interwoven into the software development life cycle (SDLC), along with the right tools and governance mechanisms. This ensures high-quality products are delivered within short deployment lead times, along with the ability to fix production issues with low mean time to restore (MTTR) and ensure minimal to no change failure rate. DevOps also enables new-age practices such as automated testing, self-service access to infrastructure and automated performance management.

    DevSecOps goes hand-in-hand with DevOps. It ensures security aspects are built into the products across the delivery pipeline, so the products are not only fault tolerant but also fool-proof, to a large extent. An experienced DevOps team builds and integrates security tools, solutions and processes to safeguard the organization.

    c. Test Automation and Test-Driven Development (TDD): By integrating test automation into the development process, the product IT operating model allows organizations to create high-quality and quickly deployable products. Additionally, TDD enables governance to be integrated into the delivery pipeline by developing quality code in line with test cases written to describe user requirements more precisely. Tests are fully automated to ensure quality of code.

    d. Service Health: With KPIs focused on the financial health of engagement, it’s easy to set a budget based on business capabilities and product levels to meet business goals effectively. The KPI framework encompasses key KPIs such as business, financial, learning and innovation and employee engagement outcomes, while staying flexible enough for different contracting models.

    Delivering Value in a Changing Business Environment

    Digitization mandates that IT deliver on three important aspects: Improve time to market, optimize costs and increase quality.  Adopting a product IT operating model helps IT deliver on the mandate by enabling a fail-fast way to deploy software quickly and cost-effectively, without sacrificing quality. However, given the extent of change involved in the shift, it is not something that can be achieved overnight. It must be underpinned by a journey of cultural change and continuous learning, using tools such as design thinking-driven, persona-based change journeys, alignment workshops and targeted campaigns and communication. Partnering with an expert system integrator can help organizations jump-start the process and ensure on-track transition with minimal disruption to business.

    — Gagan Jain

  • API Security: A Key Part of the Bigger Plan

    API Security: A Key Part of the Bigger Plan

    Standing as the “fuel” powering the customer-driven platform revolution, application programming interfaces (APIs) are the new “it thing” amongst operating systems.

    APIs are responsible for how apps communicate with each other and have become key components in many digital transformation strategies. Serving as a set of tools for building software application, they have empowered many businesses to increase their value. However, as they have risen in popularity, concerns have risen over the adequacy of measures being put in place to ensure security for businesses using APIs.

    The Open Web Application Security Project (OWASP) is a global non-profit organization committed to improving application security and makes it a primary mission to ensure software security is a priority for all. OWASP regularly issues a top 10 standard set of rules that are applied to security policies across various platforms. The most recent list presents notable changes that reflect the increase in dependency on APIs, with a focus on how they can both help and hinder security efforts.

    Why Should Businesses Care About API Security?

    Every application needs APIs. It is difficult to find an organization today that doesn’t have its own app or uses an app to complete critical business activities. They contain programming standards, instructions and protocols that allow applications to communicate with one another. Essentially, APIs serve as a bridge that ensures proper and consistent communication between two systems.

    API security is a critical part of API development because millions of applications communicate back and forth daily. With the cyberthreat landscape constantly evolving and the cloud API market predicted to experience a 20 percent CAGR by 2022, it is easy to understand why it is so imperative that companies develop and continually implement thorough API security measures.

    Most APIs do have some governance from management tools, which can offer a range of control features aimed at making APIs more reliable, secure and controllable. However, security should also be top of demand in the design phase of an API and formulating controls that can be implemented across the organization.

    Arming Your Organization with the Right Security Tools

    Systems that host public APIs feel the impact of heavy traffic on a daily. Some of that influx is, unfortunately, not authentic. To avoid overburdening the legitimate users and protect their system, companies need to evaluate behavior to flag potential problematic traffic.

    API security works in the same manner by using rules and algorithms that evaluate client sessions. APIs ask simple questions that gauge how clients are behaving, what they are doing and whether there are unusual error rates or repetitive behavior in short time periods.

    Machine learning is often used to answer these questions and to identify and deter malicious API client practices. Standard web approaches typically don’t function properly with APIs, simply because hackers work to continuously be ahead of the game. They know that standard DoS attacks don’t work, so they distribute hacking attempts across bots that hide alongside legitimate traffic to sneak them through the system, undetected.

    To find these bad eggs and stay on top of the large amount of them, it’s necessary to set up a machine learning-based system that have a deep understanding of API traffic, with a thorough understanding of API keys, access tokens and what the typical request context is on any payload.

    How Can You Prevent Attacks Right Now?

    There are several actions you can take immediately to protect your system from potentially damaging attacks. Begin by using HTTPS, if you’re not already, to ensure proper authentication and authorization. Also, adjust your software development life cycle (SDLC) to include rigorous API security testing and validation with a primary focus on input validation.

    Also important: Make sure all network servers are running on regularly patched OS versions that are stable and include carefully configured security groups. Implementing role-based access control and VPC isolation across environments also can help improve responses to prevent attacks.

    Finally, having a pre-documented response policy for security incidents will help your company establish a secure development environment that is properly maintained at all times.

    Routine API audits and testing can help your organization continually improve the API development and ensure your business is protected against DDoS attacks and malicious bots, while still letting legitimate API traffic through. These techniques will help you validate API requests and sort through which are legitimate and which are not, to completely eliminate or reduce API attacks.

    — Eltjo Hofstee

  • What AI Could Mean for Developers

    What AI Could Mean for Developers

    Artificial intelligence has been dominating the tech news headlines for a few years now, as the innovations in the sector keep rolling out at increased rates. The technology is, for lack of a better term, awesome, and when used correctly, it can have tremendous effects. We have already begun to see artificial intelligence in the consumer sphere take off at lightning speed.

    Artificial Intelligence is in More Things Than You Think

    Smart assistants, such as Google Home, Amazon Alexa and Apple’s Siri, have all dominated their share of the market with intuitive daily assistants that can keep track of your schedule and tell you the weather. They can even tell jokes—which may or may not leave you in a state of disrepair.

    Looking to the future, we also have autonomous vehicles, which will change our lives undoubtedly by potentially limiting traffic collisions and deaths. That is the true endeavor of technology: to change our lives in such a way that they are never quite the same.

    Artificial Intelligence Development is Open to All

    Development of AI programs is being accelerated due to the availability of AI libraries. With these powerful libraries, development teams are able to build custom code on a complex pre-built infrastructure. Google, IBM and Microsoft all have their own AI APIs that programmers can use to create better products.

    Using paid APIs, developers can use advanced programs developed by tech giants in their own applications. Google Cloud AI provides a suite of machine learning services. You can venture into other APIs also powered by AI. For example, you can use Google’s Cloud Speech API, which uses AI to dynamically convert audio to text in an existing application.

    TensorFlow is freely available to help programmers, developers and engineers use machine learning algorithms to better manage and classify data. All of these APIs empower development teams to dig deeper into deep learning.

    What Advancements Mean for Developers

    The goal of the openness of AI development is to create a new normal brought to life by the endless innovations of the tech industry.

    Without hesitation, we can call AI the next great invention. It has an ability to completely reshape the face of our world in such a way, that this current life will become one of distant fondness and inelegant trite labor. Indeed, the developers of AI will be contributing to the total revolution of life as we know it and the consequences thereafter.

    This is why it is so important to get it right. Using a guideline to build the future will ensure that it can handle the weight of use, without failing itself into obscurity.

    Innovation Means Opportunity

    Ultimately, AI is at its best when it fixes a common problem and is developed with best practices. Because the technology is so new, developers must work around the clock to create applications and get them to market so that their impacts, if any, can be registered and used for analytics. Developing AI is much bigger than a simple web application or smartphone app.

    The pure potential of the tech alone is enough to incite the most lethargic to action, but development will be in vain if not for best practices. Once developers around the world start to follow a development guide, it will increase the fluidity of innovation and knock down any barriers in its way.

    This ensures that developers can share ideas and technology easily, without being in the dark when it comes to the shared development process. Artificial intelligence is an ongoing innovation that may never cease to improve on itself.

    Conclusion

    In this article, we examined the best development practices in AI so that you and your team can create AI applications with the future in mind.

    In fact, the pursuit of humanoid AI, upon its completion, will most likely give us its own revolution in the tech industry as it slowly becomes pervasive in all industries. There is a beauty in contributing to grand goals. You and your team should not be limited or sidelined by a lack of knowledge about best practices when developing AI applications.

    There’s a wealth of resources for developing AI programs through the use of existing AI libraries. There’s plenty of help from the AI community, who are all pursuing a greater utopia with AI—and your team should not be left in the dust.

    — Anthony Coggine

  • Kong Applies AI to API Management

    Kong Applies AI to API Management

    Kong today announced today two offerings that rely on artificial intelligence (AI) to automate the management of application programming interfaces (APIs).

    The first offering, dubbed Kong Brain, collects data from any existing platform to auto generate documentation, which can then be used to automate the configuration of the Kong Enterprise API management platform.

    The second offering, dubbed Kong Immunity, leverages machine learning algorithms to analyze traffic patterns to first define normal traffic and then train models to automatically detect any anomalies and issue alerts when those anomalies are detected.

    Kong CTO Marco Palladino said Kong Brain is intended to make it easier to manage APIs across a modern IT environment by making it possible to continuously reconfigure APIs as new code is added to any platform connect to Kong Enterprise.

    In addition, Kong Brain makes it simpler to visually map services and their endpoints to provide deeper visibility into API traffic and the health of any given service, said Palladino.

    Kong Immunity, meanwhile, enhances the overall security of the IT environment by identifying potential threats before they proliferate across the API ecosystem, he notes.

    Available under an early access program, Kong Brain and Kong Immunity represent the first steps toward employing AI to layer a central nervous system that automates governance, security ad documentation while increasing the reliability of the overall API ecosystem, Palladino said.

    As microservices specifically and IT in general continue to evolve, the number of dependencies that will exist across the IT environment will far exceed the ability of any IT staff to manage manually. That issue will become especially acute as more organizations embrace applications based on microservices, Palladino said, because each microservice within that application has its own set of APIs that need to be managed. While Kong Enterprise can support both microservices and traditional monolithic applications, Palladino expects the proliferation of microservices across multiple cloud platforms to force the need to adopt API management platforms infused with AI.

    Obviously, the introduction of AI into IT environments will have a profound impact on API management and associated DevOps processes. While developers typically create APIs, responsibility for managing APIs has been shifting to IT operational teams. By adding AI to API management platforms such as Kong Enterprise it should become significantly easier for any enterprise to manage APIs at scale. Of course, AI models don’t work out of the proverbial box. But as the machine learning algorithms that drive those AI models become more familiar with the IT environment, the more automated the management of the APIs distributed across that IT environment becomes.

    What impact AI will have on DevOps processes remains to be seen. But it’s increasingly clear that AI will be applied across the IT operations spectrum. In theory, the more automated IT operations becomes the more resources any organization should be able to shift toward developing more applications, which naturally generates more APIs to be managed. It may take a little more time before most organizations have enough confidence in AI to make that transition. But at this point, it’s not so much a question of whether AI will be applied to IT operations as much as it is to what extent.

    — Mike Vizard

  • Talend Fall ’18 Enables Enterprises to Deliver Insight-Ready Data at Scale

    Major integration platform update adds advanced catalog and API development capabilities and dramatically accelerates machine learning at scale

    REDWOOD CITY, Calif. and LONDON – October 16, 2018 – Talend (NASDAQ: TLND), a global leader in cloud data integration solutions, today announced a major update to Talend Data Fabric, the company’s unified data platform for data integration across complex, multi-cloud and on-premises environments. Announced at Talend Connect UK, Talend’s Fall 2018 release delivers insight-ready data at scale with new features including Data Catalog, which creates a single source of trusted data, and Cloud Application Programming Interface (API) Services, which speeds access to standardized data for building data-as-a-service applications and increasing productivity. Talend’s new release also accelerates running machine learning algorithms at scale with extended serverless big data support.

    “Data is at the heart of digital transformation, yet the promise of data remains elusive for many companies,” said Ciaran Dynes, SVP of Products, Talend. “For businesses to survive and succeed in this ever-evolving, expanding and complex data landscape, there is a need to optimally automate every step of the data value chain and enable self-service for more data consumers. With this release, Talend helps enterprises dramatically improve how they can organize, process, and share data, which in turn enables organizations to collaborate and innovate on insight-ready data at scale.”

    “As part of our cloud-first strategy, Talend has enabled us to create a governed data lake with self-service access for business units and clients in an effort to monetize new services and generate additional revenues,” said Abderrahmane Belarfaoui, CDO, Euronext. “We compete in a highly regulated industry and face many requirements that push the processing, agility and cost of IT platforms. Using Talend, we have the confidence that our data is compliant, organized and highly sharable, with the efficiency and speed we require in order to stay ahead of the competition.”

    As part of the new Talend Data Fabric, Talend adds an API delivery platform enabling data-driven businesses to simplify data access. Talend Cloud API Services provides full API development lifecycle support from API design to test and deployment, enabling significant time savings in building and maintaining APIs. This API foundation serves as a standard and scalable way for companies to make data available to more users inside and outside an organization and to create new products and services that can drive new business models, revenue and profitability.

    “In this new era of digital transformation, nearly every organizational role is using data daily to inform decisions and actions,” said Stewart Bond, Research Director, Data Integration and Data Integrity Software, IDC. “Data cataloging software is experiencing a higher than market growth rate because it is filling a gap in the intelligence required to help organizations discover data and derive better insights to inform decisions and drive actions.”

    To organize data at scale, Talend adds new Data Catalog capabilities that enable a single source of trusted data. The Data Catalog automatically crawls all data, whether it is in a data lake, on-premises or in the cloud; profiles and classifies all the data; automatically finds and suggests relationships between data, and provides easy search-based access so end users can leverage trusted data when they need it to make immediate business decisions.

    The Fall 2018 Talend Data Fabric also accelerates running machine learning models at scale with native, extended serverless big data support for Microsoft Azure Databricks as well as Qubole in AWS cloud environments. Talend’s self-service Apache Spark processing makes it easy to spin up a cluster and control costs by just paying for what is used through serverless and spot instances. The new capabilities help to automate insight and enables businesses to process more data at lower costs.

    The comprehensive Talend Data Fabric delivers a unified platform for data integration across public, private,and hybrid cloud, as well as on-premises environments, and facilitates greater collaboration between IT and business teams. Combined with an open, native and extensible architecture for rapidly embracing market innovations, Talend enables customers to cost-effectively meet the demands of ever-increasing data volumes, users and use cases.

    The Fall 2018 update to the Talend Data Fabric will be available in November for free to customers with up-to-date paid subscriptions. For information on new features and capabilities, please visit https://www.talend.com/products/whats-new. Additionally, a webinar detailing the Fall 2018 update will take place on Nov. 8. Register here to join.

  • Kong Inc. Defines Services-Centric Approach to Integration

    Kong Inc. Defines Services-Centric Approach to Integration

    Kong Inc. has released a feature-complete version of its namesake services broker for legacy and microservices-based applications that promises to eliminate the need for legacy application programming interface (API) management platforms.

    Company CTO Marco Palladino said traditional API management platforms, for all intents and purposes, are now dead. Formerly known as Mashape, the core technology developed by Kong Inc. has been widely employed to manage APIs. But the time has come to focus on managing services at a much higher level, he said.

    Despite Kong having been downloaded more than 45 million times, the latest version is being labeled a 1.0 release because the open source service broker has now been deemed to be feature-complete, which includes support for service mesh patterns, Kubernetes Ingress controller and backward application programming interface (API) compatibility to future releases, Palladino said.

    Kong is being positioned as a microservices API gateway capable of supporting sub-millisecond response times in a way that would not be possible to achieve using legacy API management platforms that reside in the cloud or in a local data center. Kong can be deployed on-premises or in public clouds based on virtual machines, Kubernetes or bare-metal servers. That approach makes it possible to employ Kong to manage services regardless of where they run. Kong has also developed a “Kong Brain” function that employs machine learning algorithms to optimize the flow of data traffic between services that has increased dramatically in the last few years, Palladino said.

    Palladino noted that while service meshes exist specifically for Kubernetes clusters, most enterprise IT organizations will require an approach to managing services across legacy monolithic applications and emerging microservices-based applications that are based on multiple types of runtime environments and serverless computing frameworks. Over time, Kong will integrate with various platform-specific service meshes as they emerge to further enable a more comprehensive approach to services lifecycle management, he said, adding that Kong automatically configures itself to serve traffic to new applications as they are deployed and new services are created.

    In addition, organizations can migrate from one service to another based on a different databases schema without incurring any downtime.

    When it comes to managing services, Palladino said there’s still too much focus on tribes that have emerged around specific platforms that wind up polarizing the IT industry. IT organizations clearly need a means to broker services regardless of where they run or might have originated, he said, noting API management could be viewed as a stepping stone toward achieving that goal.

    It’s not clear yet whether legacy approaches to API management are truly dead or simply in the process of transforming into a means for managing services at higher levels of abstraction. Regardless of the outcome, it’s clear that a less brittle approach to managing integration in the age of microservices will be required. Many forget, however, that in most cases a monolithic application is now just another type of service.

    — Mike Vizard

  • Netifi Rises to Microservices Integration Challenge

    Netifi Rises to Microservices Integration Challenge

    Netifi this week launched an integration platform based on the open source RSocket communications protocol to replace HTTP ad REST application programming interfaces (APIs) as the mechanism for connecting microservices. RSocket was originally created by Netflix and is now being strengthened via contributions from Netifi, Facebook and Pivotal Software for use within enterprise IT organizations.

    Fresh off raising $2 million in seed funding, Netifi is also committing to support a community edition of RSocket later this year.

    Company CEO Robert Roeser said the Netifi platform is designed to make it easier to build microservices and interconnect them. Most of those microservices are being built using Docker containers, but Roeser said that, as part of a polyglot approach to integration, Netifi is leveraging RSocket to connect microservices built using a variety of runtimes as well as provide access to legacy monolithic applications. The Netifi platform can be deployed on-premises, in a public cloud or in a hybrid fashion.

    Roeser said RSocket was born of necessity at Netflix because the number of microservices that needed to be interconnected at scale was simply too complex a task using HTTP and REST APIs. Soon after, Facebook also started employing RSocket and now Netifi and Pivotal are making contributions designed to make Rocket more accessible for traditional enterprise developers. In the case of Netifi, that means providing mechanisms to both discover and advertise microservices and provide a layer of abstraction that shields developers from the underlying complexity of the network underlay, he said.

    As applications based on microservices become more widely distributed, enterprise organizations tend to become more intimidated by the challenges associated with managing them at scale. Traditional enterprise IT organizations don’t have access to a small army of software engineers to solve the problem. As a result, many of them retreat to building monolithic applications in which all the services that need to be accessed are baked into the application itself. They typically sacrifice scale and flexibility in favor of a construct that is both familiar and easier for them to navigate, Roeser said.

    The challenge Netifi and other supporters of RSocket will face is the considerable amount of inertia surrounding REST APIs and HTTP. Several generations of developers now consider REST APIs to be the default mechanism for connecting various applications together. The issue many of them will need to wrestle with is the extent to which the rise of microservices breaks that integration construct. A shift away from REST APIs also could have significant implications regarding how services are exposed externally, how pipelines are constructed within DevOps environments and other factors.

    It remains to be seen whether integration platforms based on RSocket or some other approach ultimately makes microservices more accessible to enterprise IT organizations. But significant resources now are being poured in to solve the problem, many of which leverage contributions of companies, such as Netflix and Facebook, that already rely on thousands of microservices to deliver a broad range of cloud-native applications.

    — Mike Vizard

  • Why Open Banking Should Consider DevOps

    Why Open Banking Should Consider DevOps

    There is a craze sweeping Europe, and rippling across the world—and no, I’m not talking about the next British Invasion. Open banking is a trend that’s significantly altering how banks work with fintechs and maintain agility in the global marketplace.

    A main enforcer is PSD2, a piece of EU legislation that sanctions access to personal banking data. It’s resulted in an explosion of EU banks providing public application programming interfaces (APIs) for fintechs to develop with. The implications aren’t limited to Europe; many banks all over the world are looking to PSD2 as a baseline, forcing some tough evaluation of how financial architecture should adapt.

    Banks are also under consumer threat to evolve or get out — a 2016 Accenture study found that 78 percent of respondents would bank with a tech firm such as Amazon or Google.

    As banks transition into savvy software providers due to market pressure, one thing is certain: they must adopt agile software development strategies that streamline the deployment and maintenance of these services. In other words, banks must adopt a DevOps philosophy to maintain a market advantage.

    Open Banking Evolves Bank Architecture

    The bank has become programmable. Many banks are now required to allow third-party authentication and access to payment, account information, fee details and other data. This involves support for various integration methods; SDKs, APIs and OAuth for authentication, as well as documentation, sandboxes and other developer tools. Whether they like it or not, banks are now SaaS providers.

    It should be noted too that open banking is not limited to the European Union. The UK’s open banking standard is the Competition and Markets Authority (CMA), and Australia, Japan and other countries are making similar inroads with regulating banking data. The excitement has also encouraged North and South American players to open up.

    The new bank APIs help bypass traditional methods, saving a ton of time. In an article in American Banker, BBVA noted that online e-commerce system Dwolla was able to slash the typical three-day to six-day deposit time frame using their payment APIs. “We’re allowing that all to occur in real-time,” said Chad Ballard, director of mobility and new digital business technologies at BBVA Compass.

    Letting FinTechs focus on web UI development helps banks focus on their core competencies: banking and authentication. Establishing connections via API-driven microservices is also a safer alternative to screen-scraping.

    Why DevOps for Banking?

    Banking Exchange defines agile banking as “the future of retaining relevancy for banking as a whole.” For open banking to be successful, the platform must be tested, monitored and secured for fintech consumers. Sounds a lot like the hallmarks of quality DevOps practice.

    Popular services Google Maps, Uber, Stripe, Twilio and others have adopted an API-as-a-product mentality. These programs adhere to best practices, iterative feedback and agile development methodologies to excel. Similarly, for banks to remain competitive, they must treat their platform architecture and public gateways with the same tenacity.

    For banks, uniting iterative development with stability testing—essentially the Dev + Ops mantra—for their APIs, microservices and frameworks will go a long way to help reach open banking goals and maintain future regulations on API performance standards.

    A DevOps mindset is crucial to consider early on in the open banking journey, as it can impact how banks address:

    • Iterative development and testing: By tying in iterative development with stability testing, organizations can surpass the time limitation often incurred between shipping versions between development teams and testing teams.
    • Continuous monitoring: Many tools are available to monitor the CI/CD pipeline, helping banks respond to issues and improve uptime.
    • Versioning strategies: DevOps in banking will see the larger picture, working in the REST mantra to build on the scale of decades to avoid breaking change.
    • Transition to microservices: As enterprises dispose old monolithic architectures, bitesize services are arguably more appropriate for modern banking; however, they come with unique caveats that DevOps can address.
    • Collaboration between silos: By pivoting to more point-to-point, collaborative processes, banks can reduce friction to meet the responsive expectations set by FinTech, who are becoming new public faces for banking.

    An end result of DevOps is to increase agility in an organization. Especially for large banks, this signifies drying up the traditional “waterfall” development life cycle known to stigmatize the corporate approval process.

    Case Studies: How Banks Are Utilizing A DevOps Cycle

    Many banks have been vocal about what they are doing to ignite positive technological innovation alongside third parties. For example, Capitol One’s DevExchange recently announced a new initiative called experimental APIs. “They are designed with the goal of getting early feedback from the community around API desirability and design before the product release,” the company noted in a blog post.

    In this experimental setup, operational cues inform development. Getting the two sides to talk and respond to community feedback is paramount for DevOps to succeed.

    For banks to adopt an agile makeup, Manfred Bortenschlager, Red Hat’s director of Business Development for API-based Integration Solutions and API Management, recommends what he calls an “agile integration.” This involves a distributed integration for greater flexibility, containerization for the ability to scale better and managed portals for reusability.

    Another interesting effort is that of CIBC, a Canadian bank that is responding to the open banking movement with a responsive microservices framework the company has developed using open source components.

    What’s evident is that many banks already acknowledge DevOps principles as key for innovation in their sector. Through the the use of iterative testing, innovative tooling and automated workflows, banks can achieve greater operational efficiency.

    Open Banking Must Follow Software Development Practices

    A result of the open banking movement is that banks must keep technological pace with fintech. Especially with regulatory pressure, banks must consider how best to approach new technological initiatives.

    DevOps is a way to mitigate concerns. As a philosophy for uniting technical procedures with responsive operations, it’s a prime strategy for banks to consider when readdressing their technology.

    In defining what “agile” embodies for banks, Steve Williams of Cornerstone Advisors said: “The idea is you need to start taking the management and operations of a financial organization and start adapting some of the things that have made technology companies viable.”

    American Banker echoes this, believing that “banks should be more like software companies.”

    Now prodded by open banking, it’s high noon for luddite banks to embrace contemporary software development practices; that means incorporating DevOps into the open banking agenda.

    — Bill Doerrfeld