devopsy.kinsta.cloud

Tag: Cloud Computing

  • Cloud Management Issues Are Coming to a Head

    Cloud Management Issues Are Coming to a Head

    A survey of 1,300 technology and data executives found that more than a decade after the initial rise of cloud computing, organizations are still struggling to manage these environments.

    Conducted by Wakefield Research on behalf of NetApp, the survey found 98% of respondents reported their business has been impacted by everything from the increasing complexity of data and heightened cybersecurity risk to lack of visibility into business operations and staff burnout.

    Top challenges include cybersecurity risk (45%), staff not taking full advantage of business applications (44%), increased skepticism about the cloud from leadership (44%), lack of visibility into business operations (42%), going over budget (37%) and burning out staff (31%).

    A full 88% continue to encounter technical challenges, including data mobility between clouds (33%), security risks (33%) and interoperability between cloud services (30%).

    The top drivers of cloud investments are scaling artificial intelligence (AI) and automation (39%), followed by driving business innovation (35%) and creating digital experiences (34%).

    Organizational challenges encountered include having a clear vision for cloud strategy (32%), establishing the right level of governance (31%) and managing costs (30%). A full 84% are under pressure to show short-term return on investments (ROI) in cloud computing platforms, with 76% noting CFOs and other business leaders are skeptical of savings. Nearly half of the tech executive respondents (49%) reported that when cloud strategy discussions occur, cost concerns come up often or all the time. As a result, nearly three-fourths of executives (74%) said tiered workloads are either very or extremely important, the survey found.

    Other factors impacting multi-cloud strategy include environmental, social and governance (ESG) concerns (79%) and data sovereignty (74%), the survey found.

    Ronen Schwartz, senior vice president and general manager for cloud volumes at NetApp, said as more organizations employ multiple clouds, total costs tend to rise. Each cloud platform requires mastering another control plane, which means someone in the IT organization must have the right skills to manage, he noted. IT leaders are attempting to exercise more control over cloud deployments, but developers, for a variety of reasons, have already deployed workloads across multiple cloud computing environments, added Schwartz. One approach to achieving that goal is to make sure data is stored on the least expensive tiered service possible for any given specific use case, he noted.

    Less clear is whether an uncertain economy might push organizations to consolidate workloads on fewer cloud computing platforms. Even then, the cost of moving a workload is not trivial given the proprietary application programming interfaces (APIs) that many developers have likely invoked as DevOps built and deployed cloud applications.

    Of course, there is no going back; the issue now becomes how to define a set of best practices for managing cloud computing environments in a way that minimizes costs. It turns out that cloud computing can be more costly than an on-premises IT environment simply because the infrastructure resources made available to developers are almost infinite. In the final analysis, however, that can turn out to be too much of a good thing—especially if organizations wind up spending more on IT to support these environments. Many of those environments are not rigorously managed because, for example, developers may not be inclined to spin down a development environment on a Friday because it takes too long to spin it back up the following Monday.

    One way or another, however, a level of long overdue scrutiny of cloud computing costs may be on the horizon.

  • Enfabrica Makes Cloud Networking Performance Advances

    Enfabrica Makes Cloud Networking Performance Advances

    Enfabrica Corp. today emerged from stealth at the MemCon conference to launch a class of processors for networking in cloud computing environments that are optimized for moving data between CPUs, graphical processor units (GPUs), accelerators and memory.

    Enfabrica CEO Rochan Sankar said the Accelerated Compute Fabric (ACF) enables scalable, streaming, multi-terabit-per-second movement of data in a way that also reduces the total cost of cloud networking. That’s critical as the amount of data being generated by applications infused with artificial intelligence (AI) capabilities that require access to larger amounts of data continues to increase, he added.

    At the same time, DevOps workflows will need to evolve as it becomes possible to compose AI fabrics of compute, memory and network resources capable of scaling to tens of thousands of nodes versus relying on top-of-rack network switches, network interface cards (NICs), PCIe switches and CPU-controlled DRAM that creates too many bottlenecks when moving large amounts of data.

    Enfabrica’s first chip, the Accelerated Compute Fabric Switch (ACF-S), supports standards-based interfaces, including multi-port 800 Gigabit Ethernet networking and high-radix PCIe Gen5 and CXL 2.0+ interfaces. The company claims that Enfabrica’s ACF-S is the first data center silicon product in the industry to deliver headless memory scaling to any accelerator by incorporating CXK memory bridging to enable a single GPU rack to have direct, low-latency, uncontended access to local DDR5 DRAM at more than 50 times greater capacity than GPU-native High-Bandwidth Memory (HBM). That approach should enable customers to cut their cost of GPU compute by an estimated 50% for large language model (LLM) inferencing and 75% for deep learning recommendation model (DLRM) inferencing, the company claimed.

    Simulation tests suggested ACF-enabled systems could achieve the same target inference performance using only half the number of GPUs and CPU hosts compared to the latest GPU servers.

    The cost of building AI applications today is prohibitive for many organizations, but as processor advances are made, there may come a time when the cost of building and training AI models substantially decreases. Advances in networking processor technologies will, as a result, accelerate the pace at which network operations are integrated into programmable DevOps workflows versus relying on dedicated networking teams to manage top-of-rack switches.

    It’s not clear yet whether cloud service providers will embrace ACF, but the chip makes it clear there is a significant opportunity to reduce the amount of networking infrastructure needed to build and deploy AI applications.

    Less clear, of course, is to what degree machine learning operations (MLOps) might ultimately be folded into DevOps workflows. While developers of AI models create a unique type of software artifact, they still need to be integrated with application code running in a production environment via application programming interfaces (APIs). One way or another, the total cost of building and deploying applications infused with AI models will need to decline.

    In the meantime, the networking bottlenecks that conspire to make deploying distributed computing applications difficult today may soon become overcome as latency issues are increasingly overcome.

  • IT Teams Need to Do More With Increased Budgets

    IT Teams Need to Do More With Increased Budgets

    A survey of 600 C-suite and IT decision-makers published today found the majority of organizations are trying to make increased IT budgets stretch even further as costs rise and the number of workloads deployed continues to increase steadily.

    Conducted by SoftwareOne Holding AG, a provider of software and IT services, the survey found 93% of respondents expected IT budgets to increase, with 83% planning to invest more in application modernization. However, 83% also noted they are under pressure to stretch budgets even further as part of an effort to increase agility (46%), improve customer experience (45%) and improve security to support remote workforces (45%). A full 92% said they would be increasing investments in security.

    The core issue that IT leaders are wrestling with appears to stem from increased cloud costs. The survey found the primary causes of those increased costs are inflation-related price hikes passed along by cloud service providers (41%), workloads exceeding planned capacity (40%), transformation initiatives that are cloud-dependent (40%), fewer cloud discounts (37%), lack of visibility into and management of cloud costs (34%), overprovisioning (34%), repercussions from previous lift and shift efforts (34%) and shadow IT (30%).

    Craig Thomson, senior vice president of cloud and application services at SoftwareOne, said that technical debt is having a significant downstream impact across organizations. For example, the survey found 72% of respondents reported that digital transformation initiatives are falling behind, with 38% noting the accumulation of this debt stems from rushed cloud migrations throughout the pandemic. Just under a third (31%) failed to optimize workloads before commencing the migration. More than a third (38%) admitted their organization miscalculated the cloud budget.

    Progress is being made, however, with 45% of respondents reporting they have improved transparency and control of cloud costs. A full 80% planned to increase their investment in financial operations (FinOps) to achieve this, and 39% said they would use cloud-native tools to reduce licensing costs.

    Those efforts suggested IT leaders are being very deliberate in their approaches to reining in costs while at the same time embracing best practices, said Thomson. IT leaders have finally started to realize the cloud is not so much a destination for workloads as much as it is an operating model, he added.

    The challenge is that cloud computing environments are becoming more complex to manage as organizations deploy cloud-native applications on Kubernetes clusters and serverless computing frameworks deployed alongside legacy monolithic applications that were lifted and shifted to the cloud. Organizations will need to invest more in automation to make up for an IT talent gap that prevents organizations from accelerating the rate at which they can build and deploy cloud applications, noted Thomson.

    On the plus side, it appears organizations are willing to allocate budgets to achieve their IT goals. The issue is that, as more organizations become more dependent on software, they are asking IT teams to do even more with the resources at hand. The degree to which that can be achieved, of course, is almost wholly dependent on how much of the technical debt that already exists in the cloud can be retired.

  • Akamai Makes Case For Next Era of Cloud Computing

    Akamai Makes Case For Next Era of Cloud Computing

    Akamai Technologies today unveiled a cloud computing service that combines its ability to deploy applications at the edge with the cloud platform it gained via its acquisition of Linode.

    Shawn Michels, vice president of product management for compute and apps at Akamai, said Akamai Connected Cloud will provide the foundation for running a new generation of modern applications that require access to both core infrastructure resources in the cloud alongside highly distributed edge computing services.

    As part of the effort to deliver that combination of services, in the second quarter Akamai is adding three sites in the U.S. to the 11 it already provides. In addition, Akamai revealed it had identified 10 additional cloud sites and 50 distributed edge computing sites that it will add throughout the rest of this year.

    As a long-time provider of a content delivery network, Akamai manages a massive distributed computing environment that spans 4,100 locations across 135 countries. The acquisition of Linode added a set of cloud computing services that enable Akamai to offer the same set of services, including CDN services, as cloud service providers.

    Akamai is now signaling it will compete more aggressively by discounting the egress fees charged whenever data is moved off a cloud platform. One of the most expensive and unpredictable costs is the egress fees cloud service providers charge whenever data is moved off their platforms, noted Michels.

    Finally, Akamai also revealed it has achieved ISO, SOC2 and HIPAA standards compliance for its services.

    Akamai is making a case for an alternative approach to cloud computing that it said will be optimized for both existing monolithic applications running on virtual machines and cloud-native applications based on containers and serverless computing frameworks. A recent survey of 458 development professionals, managers and senior leaders conducted by Techstrong Research, a sister entity of devopsy.kinsta.cloud, found 43% of respondents are considering adding additional cloud service providers in the next 12 months. Nearly two-thirds said they are at least considering, evaluating or are ready to buy from a trusted alternative cloud vendor, with 20% reporting they have already contracted with one.

    It’s not clear whether IT organizations might actually migrate existing applications from one cloud service provider to another. At the very least, Akamai expects that as new applications are developed, the company will be able to gain a larger share of the overall market.

    There’s no doubt that a new era of cloud computing is dawning as organizations look to deploy distributed applications that process and analyze data closer to the point where it is created and consumed. These applications will then share the results of the data processed at the edge with, for example, centralized data lakes that make it possible to analyze data collected across a distributed computing environment.

    The one thing DevOps teams can count on is that as this next era of cloud computing evolves, the management of IT environments will become much more challenging for all concerned.

  • Report Affirms Continued AWS Cloud Dominance

    Report Affirms Continued AWS Cloud Dominance

    A report published this week by Wiz, a provider of a cloud security platform, found more than half of organizations (57%) are using multiple clouds, with 22% currently using three or more platforms.

    However, the report also noted that 72% of all workloads are running on the Amazon Web Services (AWS) cloud. Among organizations that have more than one cloud platform, Microsoft Azure (41%) is the most common secondary platform (41%), while Google Cloud Platform (GCP) is the most used tertiary platform among organizations employing two or more clouds (44%).

    The report also noted 9% of AWS customers use managed database servers, compared to 87% in GCP and 82% in Azure. However, over 91% of companies also have non-managed database servers running in a cloud. In total, only 6% of companies use managed database servers exclusively, compared to 90% using a mix of managed and non-managed database servers, the report finds.

    The most widely deployed databases are PostgreSQL, Redis and MySQL, with 90% of organizations running at least one instance of a PostgreSQL server.

    Scott Piper, principal cloud security researcher for Wiz, said the report makes it clear that despite gains by Microsoft and Google, AWS remains the most dominant cloud service provider. Even after a decade, rival cloud service providers have not been able to overcome the first-mover advantage that AWS continues to enjoy. In many cases, a second or third cloud is being employed only because a single development team preferred it or an IT team assumed responsibility for it when their company acquired another organization using it, noted Piper.

    However, while most organizations have multiple accounts per cloud service provider, the report also found that the bulk of the application workloads are managed via only a handful of accounts, he added. That suggests more organizations are subject to higher levels of disruption in the event of an outage than many of them may realize, said Piper.

    One of the reasons so many organizations have a narrow range of accounts, of course, is they simply don’t have enough personnel. In fact, a general skills shortage also tends to limit the number of cloud platforms organizations might otherwise employ.

    Multiple cloud platforms also tend to exacerbate cybersecurity challenges. With the introduction of each additional cloud service, the overall size of the attack surface that needs to be defended expands. The Wiz report found 47% of organizations have at least one database or storage bucket publicly exposed to the internet. It can take less than 13 hours for cybercriminals to discover and access an exposed bucket with a guessable name, noted Piper.

    More challenging still are the number of application programming interfaces (APIs) that need to be secured as cloud service providers continue to add new services, he added.

    Ideally, organizations should be adopting a framework to harden privileges, encryption, authentication and connectivity and improve hygiene, otherwise known as PEACH, said Piper.

    Regardless of the approach to cloud computing, it’s apparent there’s still a long way to go before organizations are ready to embrace hybrid cloud computing spanning multiple clouds.

  • Azure Migration Strategy: Tools, Costs and Best Practices

    Azure Migration Strategy: Tools, Costs and Best Practices

    Azure migration refers to the process of moving applications, data and other resources from on-premises or other cloud environments to Microsoft Azure, which is a cloud computing platform and service offered by Microsoft. 

    Azure migration can include migrating virtual machines, databases and storage to Azure, as well as re-architecting applications to take advantage of Azure services. Typically, the goal of Azure cloud migration is to take advantage of the scalability, security and cost benefits of the Azure platform.

    4 Azure Migration Tools

    Here are several tools provided by the Azure cloud which can help you migrate applications to the Microsoft cloud.

    Azure Migrate

    Azure Migrate is a service offered by Microsoft as part of Azure that helps customers discover, assess, and migrate their on-premises workloads to Azure. It provides a centralized hub for the discovery and assessment of on-premises workloads and helps customers plan and execute their migration to Azure. Azure Migrate includes the following features:

    • Discovery: Azure Migrate discovers on-premises servers and their dependencies and creates an inventory of them.
    • Assessment: Azure Migrate assesses the readiness of on-premises servers for migration to Azure and provides recommendations for target Azure resources.
    • Migration: Azure Migrate helps customers plan and execute their migration to Azure using various migration tools such as Azure Site Recovery, Azure Database Migration Service and Azure Data Box.

    By using Azure Migrate, customers can move their workloads to Azure with confidence, knowing that they have a comprehensive plan and the right tools in place to ensure a successful migration.

    Azure Database Migration Service

    Azure Database Migration Service (DMS) is a fully managed service offered by Microsoft as part of Azure that simplifies and accelerates the process of migrating on-premises databases to Azure. The service supports a variety of databases, including SQL Server, Oracle, MySQL, and PostgreSQL.

    Azure DMS can perform both online and offline migrations, depending on the requirements and availability of the source database. Online migrations are performed while the source database is still in use, while offline migrations require the source database to be taken offline during the migration process.

    The service supports several migration scenarios:

    • One-time migration: Move a database to Azure once and leave it running in Azure
    • Lift and shift: Migrate an on-premises database to Azure and keep the same database engine running in Azure
    • Change the engine: Migrate an on-premises database to Azure, but change the database engine running in Azure to a different one.

    The Azure DMS provides a simple and efficient way to move your on-premises databases to Azure with minimal downtime, and it’s integrated with Azure Migrate for a holistic migration experience.

    Azure Data Box

    Azure Data Box is a service offered by Microsoft as part of Azure that allows customers to transfer large amounts of data to Azure for storage and processing. The service is designed for customers who have a large amount of data that needs to be transferred to Azure, but have limited network bandwidth or other constraints that make it difficult to transfer the data over the Internet.

    Azure Data Box provides customers with a physical device (called an “Azure Data Box”) that they can use to transfer data to Azure. The device is shipped to the customer, who can then copy data to the device and ship it back to Microsoft. Microsoft will then transfer the data to the customer’s Azure storage account.

    There are several different types of Azure Data Box, each with different storage capacities and data transfer speeds:

    • Azure Data Box: 100TB storage capacity, data transfer speed of 100Mbps
    • Azure Data Box Disk: 40TB storage capacity, data transfer speed of 40Mbps
    • Azure Data Box Heavy: 1PB storage capacity, data transfer speed of 100Mbps
    • Azure Data Box Edge: 100TB storage capacity, data transfer speed of 100Mbps and AI and IoT edge computing capabilities.

    Azure Data Box is particularly useful for customers who have large amounts of data to transfer, and don’t have the network bandwidth or other resources to transfer the data over the Internet.

    Azure Synapse Pathway

    Azure Synapse Pathway is a new feature of Azure Synapse, which is a fully managed cloud-based data integration and analytics platform. Azure Synapse Pathway is designed to make it easy for customers to move their existing data integration and analytics workloads to Azure Synapse without requiring significant re-architecting or rewriting of their existing code.

    Azure Synapse Pathway supports several migration scenarios, such as:

    • Lifting and shifting on-premises SQL Server Integration Services (SSIS) packages to Azure Data Factory.
    • Migrating on-premises SQL Server Analysis Services tabular models to Azure Analysis Services.
    • Migrating on-premises Power BI reports to Power BI in Azure Synapse.

    Azure Synapse Pathway also provides a migration tool that helps customers to move their existing data integration and analytics workloads to Azure Synapse, with minimal changes to their existing code. This allows customers to take advantage of the benefits of Azure Synapse without significant re-architecting or rewriting of their existing code.

    Azure Migration Strategy and Best Practices

    Prepare an Inventory of Digital Assets

    Understanding your digital estate is an important part of creating an effective Azure migration strategy. A digital estate refers to the collection of digital assets and resources that an organization uses to run its business, including applications, data, and infrastructure. In order to migrate your digital estate to Azure, you need to understand what you have and where it’s running. This information can be used to create a migration plan that is tailored to your specific needs.

    To understand your digital estate, you should start by creating an inventory of your applications, data, and infrastructure. This inventory should include information such as:

    • The name and purpose of each application
    • The technology stack used by each application
    • The location of the application and its data
    • The dependencies between applications and data
    • The number of users and usage patterns for each application
    • The storage and compute requirements for each application

    Once you have an inventory of your digital estate, you can use it to create a migration plan that takes into account the specific needs of each application, as well as any dependencies or constraints that need to be considered.

    Best practices for inventorying your digital assets:

    • Start by identifying the most critical applications and data that need to be migrated first.
    • Assess the readiness of your existing infrastructure and applications for migration to Azure.
    • Understand the dependencies between your applications and data, and plan for them accordingly.
    • Identify any constraints or limitations that need to be considered when planning your migration.

    By understanding your digital estate and creating a migration plan that takes into account the specific needs of your applications and data, you can ensure that your migration to Azure is successful and that your business is able to continue to operate during and after the migration.

    Estimate Monthly Workload Costs

    Estimating the monthly costs of your workloads is an important part of creating an Azure migration strategy. By understanding the costs associated with running your workloads in Azure, you can make informed decisions about how to migrate your workloads and how to optimize your cloud costs after migration.

    To estimate the monthly costs of your workloads in Azure, you can use the Azure pricing calculator. The pricing calculator allows you to estimate the costs of running various Azure services, such as virtual machines, storage, and networking, based on the specifications of your workloads. You can also use the Azure TCO calculator to estimate the total cost of ownership of your workloads in Azure, taking into account costs such as data transfer, management, and support. There are multiple other Azure calculators you can use to estimate storage costs, networking costs, and more.

    Image Source: Azure

    When estimating the costs of your workloads in Azure, it’s important to consider the following factors:

    • The size and number of virtual machines required to run your workloads
    • The storage and network requirements of your workloads
    • The number of users and usage patterns of your workloads
    • The services and features required to run your workloads, such as Azure Backup or Azure Security Center

    It’s also important to consider how the costs of your workloads may change over time, such as how the number of users and usage patterns may change or how the costs of Azure services may change.

    Best practices for estimating the monthly costs of your workloads in Azure:

    • Use the Azure pricing calculator and TCO calculator to estimate the costs of running your workloads in Azure.
    • Understand how the costs of your workloads may change over time and plan accordingly.
    • Optimize your costs after migration by using Azure cost management and Azure reservations.
    • Continuously monitor your costs and usage to ensure you’re getting the most value from your investment in Azure.

    By understanding the costs associated with running your workloads in Azure, you can create a migration strategy that is optimized for cost and that enables you to get the most value from your investment in Azure.

    Migrate Workloads and Optimize

    Migrating your workloads to Azure and optimizing them for the cloud environment is an important step in creating an Azure migration strategy. Once you have a clear understanding of your digital estate and have estimated the costs of running your workloads in Azure, you can begin migrating your workloads and optimizing them for the cloud.

    There are several ways to migrate workloads to Azure, depending on the type of workload and the migration requirements. Some common migration methods include:

    • Lift and shift: This method involves moving an existing workload to Azure without making any changes to the workload. This is typically used for simple workloads that do not require significant changes to run in the cloud.
    • Re-architecting: This method involves making changes to the workload to take advantage of the features and capabilities of Azure. This may include re-architecting the application to suit the target Azure service, such as Azure SQL Database or Azure Storage.
    • Refactoring: This method involves making changes to the workload to optimize it for the cloud environment. This may include refactoring the application using cloud-native patterns and practices, such as microservices or containerization.

    Once your workloads are migrated to Azure, you can optimize them for the cloud environment by:

    • Scaling your workloads to match demand.
    • Using Azure services and features to improve the performance and security of your workloads.
    • Monitoring and managing your workloads to ensure that they are running efficiently.
    • Optimizing costs by using Azure cost management and Azure reservations.

    Best practices for migrating your workloads and optimizing for the cloud environment:

    • Start by migrating your most critical workloads first.
    • Understand the migration method that is best suited for your workloads and plan accordingly.
    • Use Azure services and features to improve the performance and security of your workloads.
    • Continuously monitor and manage your workloads to ensure that they are running efficiently.
    • Optimize your costs by using Azure cost management and Azure reservations.

    By following these best practices, you can ensure that your workloads are migrated to Azure and optimized for the cloud environment, which will help you to get the most value from your investment in Azure.

    Monitoring

    Monitoring is an important part of creating an Azure migration strategy and ensuring that your workloads are running efficiently in the cloud. By monitoring your workloads, you can identify and address issues that may arise during or after migration and ensure that your workloads are meeting the needs of your business.

    Azure provides a variety of tools and services for monitoring your workloads, including:

    • Azure Monitor: A service that provides a unified monitoring solution for Azure resources, including virtual machines, storage, and networking.
    • Azure Log Analytics: A service that allows you to collect and analyze log data from your workloads.
    • Azure Application Insights: A service that allows you to monitor the performance and availability of your applications.
    • Azure Security Center: A service that provides security monitoring and management for your workloads.

    When monitoring your workloads in Azure, it’s important to consider the following factors:

    • The performance and availability of your workloads
    • The usage and costs of your workloads
    • The security and compliance of your workloads

    It’s also important to consider how your monitoring needs may change over time, as your workloads and usage patterns may change.

    Best practices for monitoring your workloads in Azure:

    • Use Azure Monitor, Log Analytics, Application Insights, and Security Center to monitor your workloads.
    • Continuously monitor your workloads to ensure that they are running efficiently.
    • Use Azure alerts to notify you of issues that may arise.
    • Use Azure dashboards to create custom views of your monitoring data.
    • Continuously assess and monitor your digital estate to ensure that it’s up-to-date and that your migration plan is still valid.

    By monitoring your workloads in Azure, you can identify and address issues that may arise during or after migration, and ensure that your workloads are meeting the needs of your business. This will help you to get the most value from your investment in Azure and ensure a successful migration.

    Conclusion

    In conclusion, migrating to Azure is a great way to take advantage of the scalability, security, and cost benefits of the cloud. However, migrating your workloads to Azure requires a well-planned strategy that takes into account the specific needs of your business and your digital estate. 

    To create an effective Azure migration strategy, it is important to understand your digital estate, estimate the costs of running your workloads in Azure, choose the right strategy, and optimize them for the cloud environment. 

    Additionally, monitoring your workloads in Azure is crucial to ensure that they are running efficiently, and to address any issues that may arise during or after migration. By following best practices and using the tools and services provided by Azure, you can ensure a successful migration and get the most value from your investment in Azure.

  • AppSec in the Cloud: What DevOps Teams Should Know

    AppSec in the Cloud: What DevOps Teams Should Know

    Cloud application security refers to the measures and controls that are put in place to protect cloud-based applications and data from cyberthreats, unauthorized access and data breaches. These measures can include technical controls such as encryption, access controls and secure networks, as well as operational controls like policies and procedures for managing and securing data in the cloud.

    Cloud application security is important because it helps to ensure the confidentiality, integrity and availability of data and applications in the cloud. It is especially critical for organizations that store sensitive or regulated data in the cloud, as a security breach could have serious consequences for the organization and its customers.

    There are many different approaches to cloud application security, including the use of security protocols, identity and access management (IAM) systems and security information and event management (SIEM) tools. Some organizations may also choose to use cloud security platforms, which provide a range of security services and tools that can be used to protect cloud-based applications and data.

    How DevOps Secures the Cloud

    DevOps is a software development approach that aims to optimize the collaboration and communication between development and operations teams to deliver software more quickly and efficiently. It involves using automation, continuous integration and delivery and other tools and practices to streamline the software development process.

    Cloud security operations, or CloudSecOps, refers to the practices, processes and tools used to secure and manage cloud-based applications, systems and data. CloudSecOps is a key aspect of DevOps, as it helps to ensure that cloud-based applications and systems are secure and compliant, while also allowing for rapid deployment, scaling and management of applications in the cloud.

    There are several key ways that CloudSecOps can be implemented in the cloud as part of a DevOps approach:

    • Automated security testing: CloudSecOps can be implemented using automated security testing tools, which can be integrated into the CI/CD pipeline to continuously test and validate the security of code changes.
    • Identity and access management: CloudSecOps involves using identity and access management (IAM) systems to control and monitor access to cloud-based resources. These systems can be integrated into the DevOps process to ensure that access to cloud-based systems is properly managed and secured.
    • Security as Code: CloudSecOps can be implemented using security-as-code practices, which involve writing security policies and controls in code and integrating them into the CI/CD pipeline. This allows organizations to automatically enforce security controls as part of the software development process.

    4 Cloud Application Security Best Practices

    Understanding and Monitoring Dependencies in Cloud Applications

    Application dependency mapping is a technique that can be used to visualize and understand the dependencies between different components of a cloud application. This can help organizations identify and manage the risks associated with dependencies and ensure that all application components are up-to-date and secure.

    There are several key benefits to using application dependency mapping as a cloud application security best practice:

    • Improved visibility: Application dependency mapping provides a clear and comprehensive view of the dependencies between different components of the application, which can help organizations to better understand the risks associated with these dependencies.
    • Improved risk management: By understanding the dependencies between different application components, organizations can identify and prioritize the most critical dependencies and take steps to mitigate any associated risks.
    • Improved security: By regularly monitoring dependencies for updates and vulnerabilities, organizations can ensure that all application components are secure and up-to-date.
    • Improved compliance: By understanding and managing the dependencies between different application components, organizations can ensure that they meet compliance requirements for storing and processing data in the cloud.

    Cloud Database Security

    Cloud database security is a critical aspect of cloud application security, as it involves the measures and controls that are put in place to protect data stored in the cloud from cyberthreats, unauthorized access and data breaches. 

    Ensuring the security of cloud-based databases is important because these systems often store sensitive or regulated data. A security breach could have serious consequences for the organization and its customers.

    There are several key best practices for ensuring the security of cloud-based databases:

    • Encryption: Encrypting data at rest and in transit can help to protect against unauthorized access to data stored in the cloud.
    • Access controls: Implementing fine-grained access controls can help to ensure that only authorized users have access to data stored in the cloud.
    • Security monitoring: Monitoring for security events and anomalies can help to identify and respond to potential threats to data stored in the cloud.
    • Compliance: Ensuring that cloud-based databases meet compliance requirements for storing and processing data is an important best practice to protect against data breaches and ensure regulatory compliance.

    Apply Cloud Governance Policies

    Cloud governance refers to the practices, processes, and controls used to manage and govern the use of cloud-based resources and services. Some of the key ways that organizations can apply cloud governance policies to improve the security of their cloud-based systems include:

    • Establishing policies for access and use: Organizations can establish policies that define who has access to cloud-based resources and how they can be used. This can help to ensure that access to sensitive data and systems is properly controlled and monitored.
    • Implementing security controls: Organizations can implement security controls such as encryption, access controls and secure networks to protect data and systems in the cloud.
    • Ensuring compliance: Organizations can establish policies and procedures to meet compliance requirements for storing and processing data in the cloud.
    • Monitoring and auditing: Organizations can establish policies for monitoring and auditing the use of cloud-based resources to ensure that they are being used in accordance with established policies and procedures.

    Identify, Categorize and Protect Sensitive Data Stored in the Cloud

    Sensitive data refers to information that is highly confidential or regulated and that requires special protection to ensure its confidentiality, integrity, and availability. There are several key steps that organizations can take to identify, categorize and protect sensitive data stored in the cloud:

    1. Identify sensitive data: The first step is to identify the sensitive data stored in the cloud. This may include personal data, financial data, intellectual property and other types of sensitive information.
    2. Categorize sensitive data: Once the sensitive data has been identified, it is important to categorize it based on its level of sensitivity and the potential risks associated with it. This can help organizations to prioritize the protection of different types of sensitive data.
    3. Protect sensitive data: There are several different measures that organizations can take to protect sensitive data stored in the cloud, including encryption, access controls and secure networks. It is also important to implement policies and procedures to ensure that sensitive data is handled and processed securely.

    Conclusion

    In conclusion, application security in the cloud is a critical concern for DevOps teams, as it involves the measures and controls that are put in place to protect cloud-based applications and data from cyber threats, unauthorized access, and data breaches. 

    To ensure the security of their cloud-based systems, DevOps teams should implement a range of best practices, including understanding and monitoring dependencies, implementing security controls, managing identities and access, and ensuring compliance. By following these best practices, DevOps teams can help to ensure the security and integrity of their cloud-based systems and protect against potential threats.

  • Opvizor Extends Monitoring Reach to the Cloud

    Opvizor Extends Monitoring Reach to the Cloud

    Opvizor, a unit of Codenotary, has extended its monitoring capabilities to cloud computing environments starting with support for Amazon Web Services (AWS) and Microsoft Azure.

    Codenotary CTO Dennis Zimmer said Opvizor aggregates data to provide a more efficient approach to applying analytics to surface performance and risk issues.

    Previously, Opvizor was optimized for instances of VMware vSphere running in an on-premises IT environment. Now the unit of Codenotary, a provider of a service for generating software bills of materials (SBOMs), is extending those monitoring capabilities to the cloud.

    That transition comes as many organizations are looking to strike a balance between monitoring pre-defined metrics and observability platforms that make it possible to surface unknown potential issues that could adversely affect IT environments.
    It’s still early days as far as observability is concerned, so Opvizor is focused on meeting most IT teams where they are today as they further embrace cloud computing, said Zimmer.

    Observability, in general, promises to query not just logs and metrics but also distributed traces that are applied to specific processes. In that way, observability allows organizations to detect patterns that have not been predefined. In effect, an observability platform makes it simpler to debug application environments where the number of dependencies that exist between services are becoming too complex to track manually, much less decipher. Without the aid of an observability platform it can take weeks to discover the exact cause of an application’s performance degradation.

    Of course, those applications will need to be instrumented using agent software capable of generating the data observability platforms require. Fortunately, open source projects such as OpenTelemetry are helping to drive down the total cost of instrumentation.

    However, in the absence of observability, most IT teams will rely on existing monitoring tools. Opvizor is making a case for centralizing monitoring across multiple platforms to reduce costs, noted Zimmer.

    Heading into 2023, each IT team will need to decide how and when to rely on traditional monitoring tools versus observability platforms. Many observability platform providers are justifying the acquisition of a new platform based on cost and the ability to eliminate the need for multiple monitoring tools. However, it remains to be seen whether IT organizations will prefer to employ both monitoring tools to track predefined metrics alongside observability platforms.

    Regardless of approach, the reality is that IT environments are becoming more complex to manage. In addition to running workloads in multiple cloud platforms and on-premises IT environments, organizations are deploying emerging cloud-native applications based on containers alongside existing monolithic applications deployed on legacy virtual machines. As workloads are deployed on multiple platforms, the total cost of IT starts to rise. One way to contain those costs is to standardize on a set of tools that can be applied to multiple platforms.

    The pressure to rationalize toolsets only increases during any period of economic uncertainty. The challenge, of course, is convincing one team to give up their preferred tool in favor of another to reduce costs.

  • AWS Makes Economic Case for Graviton Processors

    AWS Makes Economic Case for Graviton Processors

    Amazon Web Services (AWS) is making available in preview a C7gn instance on the Amazon Elastic Compute Cloud (Amazon EC2) based on AWS Graviton processors. The C7gn instances provide up to 200 Gbps network bandwidth and as much as 50% higher packet-processing performance compared to previous-generation C6gn instances.

    Announced at the AWS re:Invent 2022 conference, these instances are based on Arm processor architecture that AWS provides as an alternative to x86 processors.

    Rahul Kulkarni, director of product management for Amazon EC2, said interest in more efficient AWS Graviton processors has spiked sharply as the overall economic outlook softened. More IT teams than ever are being tasked with finding ways to reduce costs as the overall number of applications being deployed in the cloud continues to grow, he added.

    While it’s not clear how many applications are being developed to run natively on Arm processors, Kulkarni noted that the process of refactoring existing applications to run on Arm processors is not as intensive for most applications as it was when previously moving applications from one class of processors to another.

    Overall, AWS now offers more than 600 types virtual machine instances on its cloud platform, including a set of Inf2 instances, available in preview, based on custom AWS processors that are optimized for processing workloads that include machine learning algorithms that drive artificial intelligence (AI) models.

    Every AWS instance takes advantage of a set of AWS Nitro Cards that offload the overhead virtualization creates so IT organizations can take full advantage of compute resources without having to allocate any resources to run virtualization software, noted Kulkarni. That virtualization tax is instead absorbed by AWS to reduce total cloud costs for the customer, he added.

    In addition, more customers are taking advantage of tools such as AWS Cost Optimizer and AWS Karpenter for Kubernetes clusters that employ machine learning algorithms to identify opportunities to reduce the cost of cloud infrastructure by, for example, shifting workloads to different classes of services.

    There are, of course, multiple strategies for containing cloud costs that range from committing to consuming a specified amount of compute resources annually at discounted rates to relying more on spot instances that are available for limited amounts of time. Less effective is moving workloads from one cloud provider to another simply because the total cost migrating workloads can be substantial depending on the number of proprietary application programming interfaces (APIs) that have been invoked.

    Regardless of approach, the days when developers were allowed to invoke cloud resources at will appear to have come to an end. Enterprise IT organizations are a lot more conscious of the total cost of IT in the cloud era. As a result, many of them are adopting financial operations (FinOps) best practices to maximize utilization of cloud infrastructure resources.

    It’s not clear how readily IT organizations will embrace AWS Graviton alongside other classes of Arm processors to achieve that goal, but as the economic outlook continues to remain uncertain, there is no doubt all options are now on the table.

  • When the Cloud and the Edge Are the Same Thing

    When the Cloud and the Edge Are the Same Thing

    Edge computing remains a growing and exciting new architecture for enterprises across multiple industries. Distributing computing power across a decentralized network gives new opportunities for AI- and IoT-based applications. Demand is such that Gartner predicts by 2025, 75% of enterprise-generated data will be created and processed on the edge. 

    However, the cost and latency of sending all this data back to the cloud for processing are significant. To retain profitability, enterprises will need to keep as much data on the edge as possible while also moving processing to the edge. The benefits of these requirements are many, including:

    • Real-time processing, lower latency, faster answers
    • Resilience and availability, not relying on a stable connection to the cloud
    • More resource- and cost-efficient, less data shipping

    I believe organizations achieve these requirements and realize these benefits via a concept I call the cloud-to-edge data plane.

    A cloud-to-edge data plane unifies cloud and edge into a single solution that allows you to define your data and business logic once, package it up as a service and simply deploy it without having to worry if it should run in the cloud or out at the edge (which might change over time). This frees up the data plane automatically and adaptively to move services around, optimizing data access, coordination and replication, ensuring physical co-location of data, compute and user for the lowest possible latency with the highest throughput and availability.

    Choosing between cloud and edge is not a binary, black-and-white decision but has a lot of shades of gray in between. From an architectural perspective, the edge consists of many hierarchical layers between the cloud and the devices; each layer is further away from the cloud but closer to the end-users—a continuum. 

    Where you need your services to run in this continuum is very much use-case-dependent and might change over the lifetime of an application, depending on usage patterns or changes in features and business requirements. Critical parameters like latency, throughput, consistency, availability, scalability, compute resources, etc. change drastically as you move through this continuum. This results in both new opportunities and challenges:

    edge cloud

    One of the new services enabled by this architecture is mobile location transparent services. This new class of services is a thing of beauty. It means services are free to run anywhere and collaborate with other services without restrictions. It also allows the underlying platform to optimize overall system behavior by relocating services as needed, based on changes in usage, resources available, communication patterns, failure scenarios, and more. 

    If services are not location-transparent, then the system’s runtime topology needs to be part of the design and encoded into the services themselves. In practice, this means hardcoding decisions such as: 

    • If the communication between services is local or distributed—allowing for concurrency or distribution
    • If services are to be considered stationary or mobile—pinned to a specific physical address or free to be relocated
    • How the services can respond to failure—self-healing bulkheads that can be migrated to other nodes if needed or tied at the hip with the failed node

    Locking in decisions like this upfront will make the system harder to run efficiently, evolve, adapt and maintain over time. These should not be design or development decisions, not deployment decisions, but runtime decisions, not affecting the code. 

    It’s hard to predict the future. This includes knowing how an application will be used over time, how changes in usage and load patterns will evolve, and how future features or changes in business requirements will impact the initial design, assumptions, and runtime/operational characteristics. 

    Not having to take these decisions or worry about how they will be maintained efficiently but only focusing on API, data model, and business logic reduces time to market and overall risk substantially. 

    Here’s my vision for data…

    Data always exists wherever and whenever needed, but only for the time it is needed.

    • Having the latest and correct data always available to you right when you need it and wherever you happen to be located—in the central cloud or at the far edge—sounds like a developer’s dream.
    • On the other hand, it’s been said that “laziness is a virtue,” which is very much true of data management in a distributed system. Replicating data to locations where it will never be needed is a loss (unless needed for resilience/failover). The same is true for holding on to data longer than needed (holding resources hostage and forcing needless consistency mechanisms). 
    • Balancing this is very hard and should ideally be done by the platform adaptively at runtime at a global system level, rather than by the developer.

    Data is always co-located with processing and end-user—ensuring ultra-low latency, high throughput and resilience. 

    • If not, as in traditional three-tier stateless architecture, data is often somewhere other than where you need it to be and therefore has to be fetched before being used and pushed out to storage after modification. This increases latency, reduces throughput and puts the service at the mercy of the availability of the storage service.

    Data and compute move adaptively together with the end-user. 

    • Many use cases at the edge serve users on the move (e.g., cell phones, cars). To serve these users as efficiently as possible, their data and compute need to move geographically with them. 

    Data is injected into the services on an as-needed basis—automatically, timely, efficiently and intelligently. 

    • Data storage management is often very intrusive in application design and business logic: How to map domain objects to DB tables (OR-mapping), transaction management, storage API calls for fetching and updating the state, etc. 
    • Externalizing all of this to the platform and instead having the data injected into the service when new data is available (just as we are used to with events in a pub/sub system) makes the code easier to design, write, understand and maintain. 
    • Additionally, if the service is doing all data management itself, then it’s a black box to the platform. The platform has no idea what access patterns have been used, on what data, when data can be safely cached, replicated, sharded, prefetched, shared, etc. On the contrary, if the platform is doing all the data management, then it can look broadly across all services and safely optimize data management for the overall system holistically. 

    I believe RedMonk analyst Steve O’Grady’s concept of vertical integration fits well into this narrative. It all leads to what I feel is a distillation of a cloud-to-edge programming model (a continuum, as described previously). This model is about abstracting away everything that is not core business value, leaving the three things that can never be delegated: Data model, API and business logic. 

    As Timothy Keller said, “Freedom is not so much the absence of restrictions as finding the right ones, the liberating restrictions.”

    By using a serverless developer experience (DX), I believe the answer to extending real-time data and computing to the edge can be realized in a fully managed developer PaaS model. That model abstracts away all infrastructure into a single declarative programming model and effectively unifies cloud-native and edge-native development. This is “vertical integration” and the cloud-to-edge data plane vision.

    Conclusion

    Today, cloud computing and edge computing are typically treated as separate domains. However, rapidly evolving demands for intelligent low-latency processing of edge-generated data are creating requirements for a new approach combining cloud and edge into a single continuum. With cloud-native applications, architects and developers have already embraced the concepts required to build services that run in an essentially infinitely scalable (but logically centralized) cloud infrastructure. Extending this thinking to a fully decentralized infrastructure, including the edge, is a natural next step in enterprise application architecture. Programming models that enable a data-centric, location-transparent approach combined with intelligent runtimes that automatically enable data and processing to be co-located where and when needed will allow developers to take full advantage of such a wholly distributed edge-to-cloud environment.