Tag: Cloud Security

  • JFrog Aligns With AWS to Improve Cloud Application Security

    JFrog Aligns With AWS to Improve Cloud Application Security

    At the AWS re:Inforce event this week, JFrog announced it integrated its JFrog Xray software composition analysis tool with AWS Security Hub, a cloud security posture management (CSPM) service that alerts IT teams whenever a security issue is detected.

    In addition, JFrog also announced it is participating in a preview of an AWS Marketplace Vendor Insights tool. AWS created Marketplace Vendor Insights to provide cybersecurity and compliance risk assessments of the third-party software made available on the AWS marketplace.

    Steve Bohac, partner marketing manager for JFrog, said the integration of JFrog Xray with AWS Security Hub will streamline the flow of cybersecurity alerts an IT team receives by centralizing the delivery via AWS Security Hub. AWS this week similarly moved to integrate the Amazon GuardDuty Malware Protection service with AWS Security Hub.

    Collectively, security services accessed via AWS Security Hub are intended to make it simpler for IT teams that have deployed application workloads on the AWS cloud to embrace DevSecOps best practices. JFrog Xray, for example, is designed to be deployed using the AWS Lambda serverless computing framework, noted Bohac.

    The arrival of these services comes at a time when the focus on cloud security, as part of a larger effort to better secure software supply chains, is rising in the wake of a series of high-profile application breaches. In general, cloud platforms are more secure than on-premises IT environments; however, the processes used to build and deploy cloud applications are often problematic in that mistakes are frequently made. Developers routinely use open source tools like Terraform to provision cloud infrastructure and accelerate application development. Most of those developers have limited cybersecurity expertise so, inevitably, there are misconfigurations that cybercriminals have become more adept at finding and exploiting.

    The ongoing chronic shortage of cybersecurity professionals means most organizations are not able to keep pace with the rate at which workloads are being deployed in the cloud.

    Fortunately, more organizations are also starting to embrace DevSecOps best practices to make software supply chains more secure. The challenge is that no matter how much time and effort is made to educate developers, there will always be a development team that makes a mistake. Tools such as JFrog Xray make it feasible to discover those issues before an application is deployed.

    It’s not clear how long it might be before DevSecOps has a meaningful impact on cloud application security. The number of applications already deployed on cloud platforms is already innumerable. In theory, at least, as each of those applications is reviewed and updated, they should become more secure as DevSecOps best practices are more widely employed. However, it may be years before the overall security of cloud applications materially improves.

    Eventually, the next generation of cloud applications should be substantially more secure than their predecessors. The hope is, in the meantime, any vulnerable cloud applications that have security flaws won’t be exploited before IT teams can bring to bear the resources required to fix them. In effect, it is a race against time.

  • Orca Security Adds CLI to Improve Cloud Security

    Orca Security Adds CLI to Improve Cloud Security

    Orca Security has extended its cloud security platform via a command-line interface (CLI) that makes it simpler to integrate with a wide range of DevOps tools.

    Rather than relying on agents, the Orca Security platform creates a risk profile using read-only access to block storage accessed via a runtime hosted on Amazon Web Services (AWS), Microsoft Azure or Google Cloud Platform. That approach, dubbed SideScanning, eliminates the need for DevOps teams to deploy and maintain agent software to ensure cloud security.

    The platform then scans both workloads and cloud configuration metadata to build a map of risks that better enables DevOps teams to prioritize cloud security efforts.

    Orca Security CEO Avi Shua said the CLI will now make it easier to shift responsibility for cloud security further left toward developers and the DevOps teams that support them by making it easier to scan for vulnerabilities with the context of a larger set of DevSecOps best practices.

    Cloud security remains a major challenge because infrastructure is often provisioned by developers that have little to no security expertise. It’s almost inevitable that mistakes will be made. Orca Security is making a case for a tool that enables organizations to identify those security issues without deploying additional agent software across a wide area network.

    The challenge, of course, is determining how far left to shift responsibility for application security. Even when alerted to a security issue, many developers may not fully appreciate the severity of that issue, noted Shua. Many developers also assume their cloud service provider is providing a level of security that they actually don’t. It’s the responsibility of the entity deploying the application to secure it and the associated configurations used to deploy it. Integrating a cloud security tool within a DevOps workflow becomes critical because it enables more members of a DevOps team to evaluate potential risk to the business as the application is being built rather than after it’s running in a production environment, he added.

    Many existing DevSecOps tools don’t provide enough context; all they do is provide static analysis of the code that’s been deployed, Shua noted. Developers need to have a deeper understanding of which issues represent a level of risk that requires their immediate attention, he said.

    There is, of course, more focus than ever on cloud security as more organizations review how their software supply chains are constructed in the wake of a series of high-profile cybersecurity breaches. Many are discovering that the level of security visibility they have into cloud computing environments is limited, at best.

    It’s not likely security concerns will slow down the rate at which applications are now being deployed in the cloud. Instead, the challenge is better understanding how to secure those applications using substantially different tools and processes than those used to secure applications within an on-premises IT environment.

  • Why DevSecOps Should Be Top Priority

    Why DevSecOps Should Be Top Priority

    DevOps culture and process are integral to maintaining the pace of cloud-native software development for organizations, especially when code deployments might take place many times a day. The ability to instantly create, populate and scale cloud applications and infrastructure, often automated through code, allows enormous agility and incredible speed. But moving this quickly means security is often left in the dust.

    The reality is many organizations still haven’t come to grips with how to properly secure the cloud. A lack of cloud security experience, coupled with legacy security policies that don’t encompass the cloud and a shortage of cybersecurity expertise relevant to cloud environments, presents a challenge. And cybercriminals are moving quickly to exploit these gaps: a 2021 report showed that almost half of the more than 2,500 disclosed cloud-related vulnerabilities recorded were disclosed in the last 18 months. 

    Due to the agile nature of cloud technologies, security must be integrated at every stage of the DevOps life cycle—also known as DevSecOps. A DevSecOps mindset is an absolute necessity for any organization that is leveraging the cloud, and requires new security guidelines, policies, practices and tools.

    The Cloud is Vulnerable

    Data breaches are among the most urgent concerns of any organization today. A 2021 report revealed that data breach costs rose from $3.86 million USD in 2020 to $4.24 million USD in 2021. The techniques that adversaries used to infiltrate the cloud differ from on-premises environments. Malware attacks are far less prevalent; instead, attackers exploit misconfigurations and other vulnerabilities.

    Another major concern is that organizations are usually using multi-cloud, which can cause a visibility issue. It can result in cloud workloads and traffic that are not properly monitored, leaving security gaps to be exploited by attackers. Also, DevOps teams tend to provide employees with far more privileges and permissions than needed to perform their job, which increases identity-based threats. According to research, nearly 80% of cyberattacks leveraged identity-based attacks to compromise legitimate credentials. 

    Threat actors will also deploy a variety of attack methods to compromise an organization’s cloud environment. Lateral movement is a common technique that involves threat actors going from the point of entry to the rest of the network (for example, infiltrating an end user or system hosted on-premises and then shifting their access to the cloud). Research showed that adversaries move quickly—in just 98 minutes they can move laterally from a compromised instance to another instance within the victim environment. 

    Alternatively, another way for attackers to profit from cloud vulnerabilities is by installing cryptominers onto a company’s system. Cryptocurrency mining is an activity that requires large amounts of computing power. Threat actors will use compromised cloud accounts to carry out this process and extract as much profit as possible, while simultaneously using up the company’s resources. 

    Shifting Security Left

    Protecting the cloud means securing an increasingly large attack surface that ranges from cloud workloads to virtual servers and other technologies that underpin the cloud environment. Attackers are always looking for soft spots they can exploit, particularly vulnerable cloud applications. With organizations moving to the cloud now more than ever to meet the needs of a remote workforce, opportunities to exploit cloud apps have increased. 

    Traditionally, code is subjected to security as the last phase before release. When vulnerabilities are exposed, either the release is delayed or the development team has to scramble to correct each security issue while the security team has to scramble to check the revisions. For DevOps teams, shifting security left ensures vulnerable code is identified as it is developed rather than in the testing phase, which reduces costs and results in secure cloud apps.

    The concept of shift left security is an essential part of the software development life cycle, and getting it right must be a top priority. By embedding security into the earliest phases of the development process, organizations can achieve DevSecOps and significantly reduce the security concerns around cloud-native software and application development. 

    Effective Cloud Security can Enable DevSecOps 

    Organizations that use DevSecOps tools and practices can build a powerful and secure cloud foundation. Unifying the visibility of multi-cloud environments and continuous intelligent monitoring of all cloud resources are essential in cloud security. That unified visibility must be able to detect misconfigurations, vulnerabilities and security threats while providing actionable insights and automated remediation for developers and DevOps teams. 

    Additionally, it’s essential to have the right security policies in place that enforce cloud security standards to meet (or exceed) industry and government regulations across the entire infrastructure. This includes everything from multi-factor authentication to general security best practices for all employees and robust incident response that ensures the company is prepared for an attack.

    However, the core of any effective cloud security strategy should always be up-to-date threat intelligence. Adversaries are constantly finding new ways to target the cloud and search for any weaknesses they can exploit. Having the latest data about threat actors and their tactics, and then applying it to breach detection is an absolute must. Threat intelligence enables security teams to anticipate threats and prioritize defense, mitigation and remediation effectively to preempt them. Delivering all this functionality from the cloud and for the cloud through DevSecOps provides organizations with the prevention, detection, visibility and response capabilities they need to beat attackers.

  • Progress Expands Scope of Compliance-as-Code Capabilities

    Progress Expands Scope of Compliance-as-Code Capabilities

    Progress this week extended its DevSecOps portfolio—built atop the Chef automation framework it acquired in 2020—to now include the ability to programmatically address compliance mandates.

    At the same time, Progress has updated the Progress Chef InSpec framework for automating the discovery of compliance issues to add support for SAP ASE, IBM DB2, Mongo, Cassandra, Oracle, MS SQL platforms along with RHEL, CentOS, Ubuntu and macOS Monterey.

    Progress has also updated the Progress Chef Enterprise Automation Stack (EAS) to add the ability to combine infrastructure configuration processing with compliance audits within a single consolidated policy definition along with a high availability capability that makes certain the platform is always accessible.

    Prashanth Nanjundappa, vice president of product management for Progress, said Progress Chef Cloud Security enables DevOps teams to take advantage of a single policy-as-code platform to consistently implement compliance policies alongside security controls across both multiple public clouds and on-premises IT environments.

    Progress Chef Cloud Security leverages certified industry benchmarks, such as the Center for Internet Security (CIS) benchmark, to continually scan and automatically detect security configuration issues at multiple stages within a DevOps pipeline. Progress has now expanded CIS benchmark profile coverage for Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) to include more than 100 customizable pre-built service and resource templates. DevOps teams can take advantage of automated creation of code, test and documentation artifacts for those resources. Finally, visibility into the status and expected completion time for compliance scans has been added along with advanced Shell command support for control and testing without file output.

    In general, the ability to address compliance requirements within a DevSecOps workflow has become crucial because the number of misconfigurations that occur in the cloud has exploded. Developers that often have little to no security or compliance expertise are programmatically provisioning cloud infrastructure in a way that, for example, leaves ports wide open. As IT organizations embrace more cloud computing platforms, that security issue only compounds, noted Nanjundappa.

    More challenging still, cloud computing environments are becoming more complex with the rise of cloud-native applications based on platforms such as Kubernetes. The odds a developer is going to make a mistake only increase with each microservice deployed.

    Progress is betting that, as cloud computing evolves, responsibility for security and compliance will increasingly shift left toward DevOps teams; they’ll be responsible for implementing polices defined by cybersecurity and compliance specialists. The goal is to provide a set of guardrails that make configuration mistakes less likely because policies are being tested within the context of a DevSecOps workflow, said Nanjundappa.

    It’s only a matter of time before software supply chain security reviews that are occurring in the wake of a series of high-profile breaches force the DevSecOps issue within more organizations. The goal, of course, should be to eliminate the need to identify DevSecOps as separate from a DevOps workflow. Regardless of the approach, however, the one good thing about all this attention is that application environments will inevitably become a lot more secure.

  • Datadog Unfurls Application Security Service

    Datadog Unfurls Application Security Service

    Datadog, Inc. today made generally available an Application Security Monitoring (ASM) service that is based on the same agent software that many DevOps teams already use to monitor applications.

    Pierre Betouin, vice president of product for the cloud security platform at Datadog, said ASM is designed to make it simpler for DevOps teams to add additional DevSecOps best practices to their existing workflows. The ASM service is based on a runtime application self-protection (RASP) engine and web application firewall that Datadog gained with the acquisition of Sqreen a year ago.

    ASM then employs distributed tracing to discover code-level vulnerabilities such as server-side-request forgeries (SSRFs), SQL injection and cross-site scripting (XSS) flaws. It is designed to extend an existing Datadog Cloud Security Platform that includes cloud security posture management (CSPM), cloud workload security (CWS) and cloud SIEM services.

    The overall goal is to make it simpler for DevOps teams to address application security by eliminating the need to deploy and maintain a separate set of agents within applications, said Betouin. That approach reduces resistance among DevOps teams that would otherwise be concerned about the additional overhead another approach to application security would add to an application environment, he added.

    The number of organizations looking to implement DevSecOps best practices is expected to increase in the weeks and months ahead in the wake of a series of high-profile breaches and zero-day vulnerability disclosures. Many organizations are now performing security reviews across their entire software supply chain as part of an effort to discover any malicious malware that might have been inserted into applications.

    The challenge those organizations face is that as application environments become more dynamic, maintaining application security becomes more difficult as code is continuously updated. The best way to address that engineering challenge is to extend the reach of an observability platform that many DevOps teams already have in place, noted Betouin. Ultimately, the goal is to automate application security as much as possible but that’s not going to be achievable if DevOps teams lack the context required, he added.

    It’s not clear at what rate organizations are embracing DevSecOps best practices. However, it’s clear that DevOps teams are being held more accountable for application security. Most developers are now charged with becoming application security experts overnight, so the only way to effectively ensure application security is to uncover security flaws before applications are deployed in production environments.

    There are, of course, multiple ways of achieving that goal. Datadog is betting that the path of least resistance is via a cloud service that connects to agent software inserted within those applications. DevOps teams have been inserting agent software, in one form or another, into those applications for years. The issue is that with each new agent added there is yet another software component that needs to be deployed and regularly updated. If not carefully tracked, a DevOps team could find itself attempting to manage an entire portfolio of agent software for every platform employed.

  • Radware Embraces APIs to Improve AppSec Across Multiple Clouds

    Radware Embraces APIs to Improve AppSec Across Multiple Clouds

    Radware this week launched an application programming interface (API) approach to securing multiple clouds designed from the ground up to be an extension of a DevSecOps workflow.

    Eyal Arazi, a senior product marketing manager in Radware’s security group, said that Radware SecurePath makes it possible to invoke any of the company’s cloud security offerings via an API. That eliminates the need to depend on inline security platforms that require separate consoles to be managed.

    Instead, the out-of-path approach enabled by Radware makes it simpler to consolidate the management of security across multiple clouds, he said. The API approach allows application requests to go directly from the client to the application server and reduces complexity and latency, eliminates routing changes and increases overall availability, noted Arazi.

    DevOps teams can now access the entire Radware cloud security portfolio, including the Radware web application firewall (WAF), API protection tools and a service that thwarts distributed denial-of-service (DDoS) attacks via a consistent set of APIs, said Arazi. Radware will continue to make those offerings available to be deployed inline or out-of-path as IT teams see fit, he added.

    Every time an organization deploys workloads on another cloud platform, an already complex security challenge becomes more complicated. Today, most of the responsibility for securing those clouds lies with cybersecurity teams. However, as DevOps teams gain access to tools and platforms that make it more feasible for developers and DevOps teams to programmatically manage security, more of the responsibility for it is shifting further left.

    Part of the benefit of that approach is the elimination of the need to deploy and manage firewalls on virtual machines or the need to reroute traffic via content delivery networks (CDNs) to inspect traffic, noted Arazi. It also enables the Radware security offerings to piggyback on the certificates that are already being employed in cloud platforms, he added.

    In the longer term, the goal is to reduce—or outright eliminate—the vulnerabilities that now routinely make it into production applications. Many of the cloud security issues that organizations regularly face can be traced back to misconfiguration mistakes made by developers. It’s not that a developer deliberately sets out to build and deploy vulnerable applications. Rather, they simply lack the expertise required to make sure that, for example, ports are not left open. In the absence of that expertise, more tools must be embedded within DevOps workflows to better ensure application security. After all, it may be years before most developers attain any meaningful cybersecurity proficiency.

    In the meantime, closer collaboration between DevOps and cybersecurity professionals is required. There are simply not enough cybersecurity professionals available to participate in every phase of an application development project. DevOps teams need to be able to identify and remediate issues as early as possible. Otherwise, a cybersecurity issue that gets discovered at the last minute is likely to prevent a workload from being deployed in a production environment.

    In the absence of any additional effort, it’s really only a matter of time before cybercriminals become more adept at compromising cloud application environments.

  • Understanding SaaS Security for DevOps

    Understanding SaaS Security for DevOps

    As Software-as-a-service (SaaS) and DevOps adoption grew, new teams were formed to address emerging security challenges. Traditional solutions weren’t built to detect the new vulnerabilities in the cloud and created excessive noise for an already stressed pool of resources.  

    The combination of emerging zero-day vulnerabilities and an avalanche of false-positives ends up increasing security problems and slowing down DevOps projects. The good news is that recent developments in security and visibility are now increasing speed and improving visibility. 

    Gartner forecasted spending on public cloud services would reach $396 billion in 2021 and increase by 22% to reach $482 billion in 2022. SaaS applications based in the cloud have exploded with the market growing 18% each year; 99% of organizations will be using one or more SaaS applications by the end of this year. 

    What does this mean for security, especially for the security of personally identifiable information (PII) and business data in the enterprise? SaaS data includes, but is not limited to, customers’ sensitive PII and payment information; increasingly SaaS applications also house mission-critical enterprise information including product plans, patent information, business and operational processes and human resource records. 

    The extensive data held in SaaS applications presents huge security risks and costs for organizations globally. The average cost of a data breach exceeded $4.2 million, the most in the 17-year history of the IBM Cost of a Data Breach report, and nearly half of the breaches involved compromised PII, the costliest record type to lose, at $180 stolen record—an increase from $146 per record in 2020.

    SaaS Offers New Ways to Do Business but Introduces Significant Risk

    Salesforce is one of the most recognizable and widely used examples of enterprise SaaS software. Recently, analyst Vernon Keenan explained how Salesforce DevOps required guardrails. “Some companies go too fast when it comes to SaaS, DevOps and security, but smart developers and implementers will respect some basic guidelines to keep their product safe.”

    The same is true of other SaaS software platforms and solutions.

    General purpose application security testing solutions aren’t built for SaaS software environments, and often slow down DevOps processes as well as lack the necessary visibility into SaaS environments. Instead, the patchwork of tools must be replaced with a continuous integration and continuous deployment (CI/CD) approach. Specific steps include:

    1. Check all local and remote libraries. Only checking configurations and access controls, which focus mostly on insider threats, misses application vulnerabilities from custom development or app downloads that could open up your SaaS services to external threat actors.
    2. Carefully and routinely check third-party software libraries. If you are only testing source code and ignoring third-party software libraries, you are only securing half of your software application attack surface. CVEs are publicly reported every day on commonly used open source software libraries, showing attackers a direct path to compromise those key components. Running a software composition analysis (SCA) regularly to check all your locally bundled and remotely referenced libraries is a key step in achieving a secure software supply chain.
    3. Don’t assume you’re protected from common vulnerabilities. Static application security testing (SAST) can often miss cross-site scripting (XSS) or SOQL/SOSL injection attacks on SaaS platforms. 

    By identifying security vulnerabilities faster and more accurately, new SaaS security tools can allow organizations to gain the promised benefits of DevOps with better visibility.

     

     

  • Merging Secrets Management and Configuration

    Merging Secrets Management and Configuration

    Fresh from picking up $5.25 million in funding, CloudTruth CEO Greg Arnette talks with Mike Vizard on this episode of the View With Vizard about why configuration and secrets management need to converge. The video is below, followed by a transcript of the conversation.

    Announcer: This is Digital Anarchist.

    Mike Vizard: Thanks for the throw. We’re here with Greg Arnette, who’s the CEO for CloudTruth, they just raised $5.25 million to help us with these configuration issues that seem to plague us. Greg, welcome to the show.

    Greg Arnette: Thank you. It’s great to be here, and thanks for the opportunity to tell your audience about CloudTruth.

    Mike Vizard: So, what is the configuration problem, and why does it not seem to wanna go away? It’s been around for a while, things appear to be getting worse, and what’s to be done about it?

    Greg Arnette: Exactly. So, that ties into the history of founding this company. Both myself and my Co-founder were prior CTOs and DevOps leaders for several cloud-based SaaS companies, and we saw that our DevOps teams were continuing to build internal tools to address issues around configuration sprawl and complexity. And these tools tend to be the weak links in terms of solid deployments, good up time, good security, and basically, slows teams down.

    So, the history of kind configuration sprawl and what we see as the challenges is sort of driven by a number of macro trends—first, the fast rise of Kubernetes; everyone wants to get on the Kubernetes bandwagon. That introduces new complexities around configuration management, new sets of tools that haven’t been sort of well adopted inside of DevOps shops. Another trend is the breakup of monoliths to microservices adds lots of new dimensions on configuration complexity. And then there are the traditional needs around provisioning infrastructure, configuring your apps, and managing secrets are the sort of legacy challenges around configuration management. And as the cloud gets more mature and with more capabilities, configuration is not getting easier, but getting more difficult.

    So, CloudTruth is here to address those concerns. We heard, during our product market fit research where I interviewed over 500 cloud and DevOps leaders on their challenges managing configuration, that this over reliance upon tribal knowledge in terms of how a system is configured and why it’s configured a certain way is just held in key team members’ heads, and that’s not a very durable strategy for going forward or for on boarding new folks. So, there’s an element of CloudTruth that provides collaboration and sharing around configuration settings and context to help reduce that need of, or that sort of burden of the cognitive load to keep track of how are things configured, where is the data, how can I change it, what changed recently—that type of thing.

    Mike Vizard: You guys also acquired a company in this process in the secrets management space, so where does configuration and secrets management converge and how do we think about that?

    Greg Arnette: That’s a great question. So, we acquired Tuono, we’re thrilled to bring in the Tuono team, including Jesse St. Laurent, who was the CTO, who joins us as our Chief Product Officer. Jim King, Mike Healey, Mike Stack all joined us, they were the founding engineers at Tuono.

    And what we did was, we took the Tuono secret management engine, which was cloud native and we’ve now included that in the CloudTruth platform which rounds out our offering. So, CloudTruth, while it is also a configuration data hub to synchronize your configuration settings from all these multiple tools is also itself a parameter store and secret store that customers can use if they don’t already have existing parameter stores or secret stores in their environment.

    Mike Vizard: And in that context, what does cloud native mean? Because some will people say, you know, it runs in the cloud; other people will say that it only runs on Kubernetes, it’s optimized for microservices and containers. Or is there some middle ground there and what do we think about cloud native—what context are we using that phrase?

    Greg Arnette: Yeah, when we use cloud native, we mean or refer to the capabilities that are provided as part of core services at Amazon, Azure, and Google. So, an example is, Amazon themselves provide a parameter store, they call it AWS Parameter Store. Google and Azure provide the same kind of internal capabilities. Customers can also bring their own parameter store, like run something like Console on top of the cloud or using Vault sometimes as a general-purpose parameter store.

    So, the cloud native offerings like AWS Parameter Store, Secret Manager, and the equivalent on the other clouds are things that customers can use, they have different price points. We provide a layer of management and visibility and observability to all that config data stored inside of all these different systems.

    Mike Vizard: And when you talk about unifying configuration, are we replacing Terraform and CloudFormation, or are we just finding some way to layer some form of abstraction around them that makes the whole process easier to manage? Walk me through that a little bit.

    Greg Arnette: Yeah, you know, we’re not replacing Terraform or CloudFormation. We’re designed to coexist with the customers’ existing investments and their configuration tooling. So, whether it’s provisioning tools like Terraform, CloudFormation, Pulumi, or app config tools like Ansible, Puppet, Chef, Saltstack, or secret tools like Vault or the cloud native versions of those capabilities. We coexist and become a metadata wrapper around those different tools.

    Now, if customers don’t have some of those capabilities, we have functionality in our platform that can fill the gap, but more and more customers already have these systems in place. They’re not looking to rip everything out and replace it, but they’re looking to address these issues around configuration sprawl that leads to a misconfiguration causing unplanned down time or a security incident.

    Mike Vizard: We have been talking about DevOps and DevSecOps forever, and the idea has always been that we’re shifting more responsibility for the IT environment to the left of the developer. Sometimes they like that, sometimes they don’t.

    But I wonder, are we not approaching some sort of concern or maybe a backlash where folks are saying, “Hey, you know what? This isn’t really working. We have all this misconfiguration out there, we’re maybe running faster, but things are less secure, and we have more risk than ever.” So, is there a balance to be struck, or what’s your sense of where are we on this journey?

    Greg Arnette: That’s a very interesting question. This is something that we hear all the time in our outreach to our customer audience is what their journey looks like for adopting shift left or GitOps types of operating principles. We’ve seen a number of patterns emerge over our hundreds of interviews. Specifically, most teams do want to give developers more capabilities to do things themselves and reduce that burden on the Ops team, but they still want Ops or DevOps teams to have the overall sort of judgment and enforce the guardrails that were put in place by the security and compliance teams and by the other teams that are sort of deciding what are the best practices.

    So, with CloudTruth, we’re kinda serving both audiences in a purposeful way. You have centralized control and visibility that DevOps wants. They wanna build and enforce lockdowns, enforce default settings that can only be overridden with a permission or an override that’s allowed as part of a workflow. But you also provide capabilities for core developers to manage the config for their own environments and to suggest configuration changes that then can be adopted more system wide.

    So, we’re serving that duality that exists today. We’re gonna let the customer decide on where they ultimately land about developing shift left principles and moving that direction. But we see a lot of interest in that, and it helps to reduce that—you know, again, that cognitive load and that context switching on the DevOps professionals. Because so many times, they’re being bothered by other folks and other developer teams, like, “What’s the setting for this Redis cluster? Why is our Mongo configured this way? How do I tune my elastic search test cluster to match production?”

    That information will all be self-serviceable and findable inside the CloudTruth platform. And our role based access control permissioning system allows view only, read only, read/write access to the appropriate areas, and then DevOps teams can sort of wall off the production systems from other people having chances of changing those settings.

    Mike Vizard: Mm-hmm. What is the role of the security team as we go forward? It feels like, if we shift everything left to the developers, what are those guys doing?

    Greg Arnette: They still need to be involved in terms of ensuring that no bad information gets in and no good information gets out. So, we provide a number of views into configuration data that are helpful to security teams. First is, what changed most recently in terms of your compliance management reports for SOC 2 and other requirements and keeping track of changes. That’s really hard in a dynamic environment, especially cloud-based where you have microservices firing left and right, coming up and down. The old traditional CMDBs that were popular in the on prem world don’t really fit well in the new way that we’re using the cloud.

    And so, CloudTruth is a self-documenting change management control system that is, behind the scenes, keeping track of all the version settings of every configuration value that we’re monitoring, and then we provide views into that data that can be consumed by the security or compliance teams to get better insights for their needs without having to bother the DevOps teams.

    Mike Vizard: Do you feel like the bad people, otherwise known as cyber criminals, are getting better at scanning for misconfigurations and looking for these vulnerabilities to exploit? And we hear a lot about software supply chains these days—it seems like, in a lot of cases, the root cause of the problem is just misconfigurations.

    Greg Arnette: It’s true. We’ve found, in our own research, that 75 percent of unplanned down time or security incident was caused by a misconfiguration when you ultimately read the root cause analysis and do all the internal tracing.

    So, what we wanna provide are the best practices as early as possible in the software development life cycle process to implement good config hygiene. And then secondary to that is, once config is out there in the wild, provide monitoring and insight into how it could affect security vulnerabilities or security posture. Since everything these days is defined as infrastructure as code, it’s all about analyzing all the different locations where config values are stored, making sure those are secure and locked down, and then being able to use any kind of pattern recognition to understand where certain areas can be vulnerable to being taken advantage of by the nefarious factors out there in the world.

    Mike Vizard: Do you think we’ll get to the point where we can use automation to kinda get ourselves out of this mess? We have APIs and CLIs and everything else that’s out there—shouldn’t we, at some point, have enough intelligence in the work flows to say, “Hey, this thing you’re about to deploy is misconfigured, so don’t do it”?

    Greg Arnette: That’s part of our goals down the road is, we have a very thoughtful strategy how we wanna launch CloudTruth as a full configuration data management platform. So, the first goal is to get inserted into a company’s work flows where we have access to the data and can provide value with reports and work flows. The second goal is then, once we’re now managing this data on behalf of the customer, to apply AI and ML, looking for patterns, recommending optimizations, best practices, vetting what we see from a customer perspective against best practices being published by other standards bodies that are looking at this from different perspectives.

    One goal of CloudTruth is to be that configuration data layer management system that we think most companies using the cloud need these days.

    Mike Vizard: We also hear a lot about artificial intelligence—will that get applied to this space? Is there any scenario where we’ll just have a bunch of machine learning algorithms running around, figuring out what’s going on?

    Greg Arnette: We firmly believe that that is definitely gonna be happening a few years down the road. I think the maturity model is just getting started. The first act in getting that up and running is getting access to the data for trending the models and analyzing the trending results, optimizing the model. So, a full observe-orientate-decide-act OODA loop is involved here in terms of making sure those models are accurate, but we think that’s gonna be a big benefit in what we can provide down the road.

    Mike Vizard: So, what’s your best advice to folks? What should they be focusing on today to get to that nirvana tomorrow? Is there same way I should be organized, is there some way I should be talking to my developers? What do you think?

    Greg Arnette: There’s a couple themes that come to mind. The first is—which sounds almost obvious these days—is make sure you are able to do infrastructure as code ideas at all levels that you can, and that’s tied into automation. So, it’s a big portion to continuous deployment, CI/CD pipelines. Once you start the development of those types of workflows that accelerate getting what developers are creating out in front of the customers, whether it’s an internal app or external SaaS or mobile app, accelerating that team velocity is really a key element in terms of making that possible.

    The other area is this notion that you wanna implement systems that reduce the amount of copy and paste. So, that’s what we call the Do Not Repeat Yourself, the DRY approach to infrastructure as code management. So, that’s a key theme behind CloudTruth is, we provide capabilities that let you manage your multiple environments with the faults, inheritances, and overrides from a centralized capability, but still allow flexibility in your environment tree to manage certain sub-environments in different ways as needed.

    So, different developers can have their own custom environment, but they’re gonna inherit default values that are sanctioned by the architecture team or the security team. And then the overrides have to be allowed by a permission basis.

    So, there’s a couple sort of themes that are coming together as we go through 2021 around automation, infrastructure as code, shift left, and the DRY approach to managing input values to all the IAC tools.

    Mike Vizard: Hey, Greg, thanks for being on the show.

    Greg Arnette: Thank you very much. Have a great day.

    Mike Vizard: Alright, awesome. Hey, guys, we learned a lot about security there and things we didn’t know and—hey, there’s hope for the future. Back to you guys in the studio.

    [End of Audio]

  • EP 24: Cloud Performance Testing

    EP 24: Cloud Performance Testing

    The purpose of cloud performance testing is to identify and eliminate performance bottlenecks that might occur within an application. Performance testing allows DevOps teams to check the speed, scalability and stability of the apps to ensure that everything is working as planned under the designated workload. In this episode of DevOps Unbound, Kristen Webb (Tricentis), Donald Lutz (Taos) and Andreas Grabner (Dynatrace) join hosts Alan Shimel and Mitch Ashley to discuss the key benefits of performance testing in the cloud and what to consider when building a cloud performance testing strategy. Join the experts to find out what you can do to ensure that your apps are running smoothly and remain available during critical times. The video is below followed by a transcript of the conversation.

    Alan Shimel: Hey, everyone. It’s Alan Shimel, CEO of Techstrong Group, and you’re watching another Devops Unbound. For those of you who may be new to our audience, Devops Unbound is a biweekly video series sponsored by our very good friends at Tricentis. And we explore a wide range of topics around devops and devops-related technologies, practices, processes and people. As I said, we do this biweekly. It’s every other week, for those who’re a little challenged, and then around once every month we also have a live – what we call roundtable format of Devops Unbound, where we’ll have usually a little bit of larger panel. But we have a really large panel in that we opened it up to a live audience, and you and everyone joining are invited to participate in the roundtable by interacting with the panel and our host, asking questions, giving us your thoughts, and it really becomes sort of a group-hall/town-hall kind of meeting. When it goes right, it’s great, with wide levels of participation. 

    Actually, this is a really good point today, good time to bring this up. Today’s panel version of Devops Unbound is on a holistic approach to performance testing. But the upcoming or the next live roundtable, and I’m gonna have more information on that later in the show, is later this month, on February 24th, which is a Thursday, and it’s gonna feature a performance testing in the cloud. I’ll give you the actual title in just a bit. But once of our panel members here, Kristen, is going to be there, as well as some other great guests. You can sign up for that on devopsy.kinsta.cloud. If go to Upcoming Webinars and check it out, it’s February 24th. And as I said, I’ll bring more information on that in a little bit.

    But for now, let’s talk about holistic approach to performance testing. And in doing so, I think the right place to start is with our audience. I’ve already kinda preannounced Kristen, so I’m gonna ask her to go first, if it’s okay. Hey, Kristen, welcome to Devops Unbound. Please introduce yourself to the audience.

    Kristen Webb: Sure. Thanks, Alan. Kristen Webb here. I’m the director of product marketing at Tricentis. Currently running the product line around neo-loader performance and load-testing solution. I have about 20-something years in technology. I’ve lost count. I’ve worked for a long time on the product-development side, so I remember back when we were testing large software releases at Macromedia and Adobe and trying to get our products out on time as part of a broader release and making sure there was no watermelons, what we used to call the performance bottlenecks at the end of our three-week mean time between failure testing. So performance testing is near and dear to my heart, as is all application development, background, and excited to be here.

    Alan Shimel: Absolutely. Macromedia, that’s a name I haven’t heard in so long. It used to be such a big part of my workplace. And I just totally blanked on it until you mentioned it. But it brought back good memories, so that’s a good thing. Yep, a smile to my face. Next up I wanna introduce you to Andreas. We call him Andy. It’s Grabner, yes, Andreas?

    Andy Grabner: It is, but feel free to pronounce it the way you like, as long as you call me Andy. I always make the joke if you call me Andreas, then I typically did something wrong or rude, because my mom calls me Andreas if I did something not appropriate.

    Alan Shimel: I get it. Our youngest son is Bradley, and everyone calls him Brad, and you say Bradley, and he kinda – he knows he’s in trouble. But, anyway, Andy, welcome. Introduce yourself to the audience, if you don’t mind.

    Andy Grabner: Yeah, thank you. So my first start in performance engineering was, I think, pretty much 20 or 21 years ago maybe now. I was working at Segway Software. I was a performance tester on a performance-testing tool called Performer, still around. But I remember those days, and it was a large load-testing project, and I – with my first kind of customer gig that I did. And I also remember that my performance engagement was scheduled for one week, took exactly ten minutes, because we broke the system with two virtual users, and the virtual user was my left finger and my right finger hitting the Refresh button on two different keyboards. And I really quickly learned that performance testing, while we always think about the magic 10,000 – millions of virtual users, sometimes it’s as simple as just hitting Refresh quite a lot on your website. 

    Over the years I’ve morphed from a performance engineer. Now I’m working at Dynatrace for the last 14 years, actually, in the observability space, and I’m a self-proclaimed devops activist. I really like the idea behind devops, and I try to use channels like yours and my own channels to really advocate for what devops allows organizations to do in terms of tooling transformation, people transformation, process transformation. And I’m very glad to be here.

    Alan Shimel: Excellent. Thank you, and welcome, Andy. Thanks for being here. Our third panel member today is someone I’ve had the pleasure of knowing – I don’t know, Donald. It’s gotta be 20 years, 19 years.

    Donald Lutz: It’s 20 years. Yeah, it’s too long.

    Alan Shimel: Twenty years. On our original team at Still Secure, what became Still Secure, with Mitchell and I – but he is a developer-testing person extraordinaire. I’ll let him introduce himself. I don’t want to embarrass him, our friend, Donald Lutz. Hey, Donald. Welcome.

    Donald Lutz: Welcome. My name’s Donald Lutz. I’ve been doing software architecture for probably about 30 years. I’ve been focused on how to do development right, how to use design patterns correctly. The past ten years I’ve really dropped in the cloud. Right now I’m the senior cloud and software architect at Taos. We are a public cloud company. IBM just acquired us. Sullivan rated us number one for public cloud. We also are on the Gartner Magic Quadrant. So I’m sort of spending a lotta time helping us productize our consulting offering. So the whole idea of testing and how to do performance testing right and chaos engineering, those are really near and dear to my heart. And how do you use the right design patterns in your code to avoid all these performance issues?

    Alan Shimel: Well, an ounce of prevention is worth a pound of cure, as they say, right? And we’ll get to it. Our last member, though, is my cohost and friend, Mitchell Ashley. I’m gonna let Mitch introduce himself, though. Mitch, take it.

    Mitch Ashley: Oh, good to be here with everybody. Thanks for making me follow some really pretty tough people to follow. Oh, my gosh. And, by the way, Macromedia, Dreamweaver, Authorware, remember all that good stuff? And I’ve known Donald – tack on another ten years. So it’s a small world. No, I’m CTO with Techstrong Group working with Alan, and I also am principal with our analyst firm, Techstrong Research. So, great to be here, and I think we could fill up our whole session with war stories about performance testing, Andy. Maybe we’ll save that for another day, right? But good to have everybody here, and thanks to the audience for joining us.

    Alan Shimel: Thank you, Mitchell. Just real quickly, I think back to performance testing at Still Secure, Mitch, if you remember. It broke our budget, ’cause we didn’t have all the virtual – you weren’t able to do it from one machine then. I tried to go out to a place that had enough to do a load of –

    Mitch Ashley: You kept Dell busy.

    Alan Shimel: – Jesus. Man, was that crazy. Anyway, though, let’s jump in. In my mind, one of the most overused words I hear in tech is the word holistic. So let’s jump on that. When we talk about a holistic approach to performance testing, is it really holistic, or are we talking about, “Hey, what’s a great approach to performance testing?” How should we be doing performance testing?

    Kristen Webb: I can take that to start. So building on what Andy was saying earlier about his two fingers being the load test to start, I think what we mean by holistic or just in – the sound approach to performance testing is starting with the code, starting with the APIs, starting at one user and making sure before you check your code in or your API in, your micro-services in that you’re – does this code work for one user? 

    And then as you go through your development process and you start to build the components of your application and you integrate those components, you start to hit those components with maybe 100 or so users. And you’re getting feedback along the way so that by the time you have an application integrated within your whole system that mimics preproduction, by then you’re able to hit the load at hundreds of thousands, potentially. But you already had feedback along the way, feedback loops to say, “What’s performing? What’s not? What do I have to fix along the way so that by the time you get to the really high load, you have fixed a lot of the issues?” And what you’re fixing at the end is, “What do I need to tweak within my system to make sure this application or API is gonna perform?” So that’s one part of holistic, or we need to think of a better word, maybe. 

    The word I tend to use is standardization, is – you need to cover all your bases along the pipeline, but you also need to make sure you’re covering all your protocols and all your use cases. So having a standardized approach for everything from API to monolith like we just talked about, but also what’re all the protocols you’re covering from HTTP to JavaScript to SAP and Citrix? So having an approach that works for all the protocols and across all those use cases, whether it’s from the protocol perspective or even the browser, ’cause those are two different types of performance tests but and also one that’s –the third thing I think about in terms of standardization is the skill set for the people who are going to be doing the performance testing. 

    So you wanna be able to not only have your center of excellence be able to performance-test, but as you move to devops, you want to be able to have a more distributed model for who can participate in the performance-testing process and create more of a self-service approach so that a lot of times – if they can access a browser, they can run a performance test. They can share results. And that encompasses having the approaches both for performance testers who want to build within CI pipelines with an as-code approach or a CLI or for the groups that want to use more of a no-code approach with a GUI tool. So those are the three things that I would say mean – what we mean when we think about holistic.

    Alan Shimel: Love it. Thoughts on that, team, panel? Agree, disagree? You wanna add?

    Andy Grabner: I wanna add something. Again, I’m not a native speaker, so maybe the word holistic means also something different to me. But I wanna add one thing and then add a second thing. But the 1st thing, what you said, Kristen, is I think in the beginning you said developers need to understand actually how their code is doing with 1 user and 5 and 10 and 20 users. I think what we’re talking about here is people understand where are the breaking point and where are the scalability issues, because I think if you are building new code, however small or big it is, if you put it under different sets of load – I mean, you don’t have to go to the millions of users, but if you look at it at 10, 100 and 1,000, you immediately know where are your connectivity issues between your components and issues scaling the load, where things may break apart and where don’t they scale, because obviously we can’t throw a lot of hardware on a problem and we somehow get performance but at a certain cost. So I think it’s very important, as you said, from the beginning on make developers understand where are – where they may have some bad architectural decisions that will later on cost them a lot of money in order to scale this. I think that’s one thing.

    But for me, holistic also means not only looking at it in development and starting early, but for me holistic means I first need to understand what are my real performance goals. If I’m developing a new feature, a new app, I should sit down with whoever comes up with the idea and trying to get their thought on what do you expect from my software? How should it run under certain load? It’s like our nonfunctional requirements in production. And then really take this and then break it down into, what does this mean for me as a developer? To give an example, if we’re building a new mobile app, and let’s say there’s a feature to log in, how long do we expect the login to take? Let’s say a second. Okay, if it is a second under 10,000 users, what does this mean for me as the developer that implements 2 or 3 APIs in the backend? 

    So I think the term of a performance budget is something that I also hear and have heard over the years. So if you break down performance as we agree on with the business, if we have performance goals, and then we can break it down into more technical goals to individual teams. Then we, I think, take a holistic approach, because then everybody can really work on their component and really always make sure that their component is working and operating within the context of their performance budget that they have so that there’s a higher chance that in the end, when all the components are put together in production they’re actually meeting our business and our performance requirements in production. So I think these are kind of the two things, right, that I wanted to add.

    Donald Lutz: Yeah, I’d like to add one thing. The thing I think about a lot is ’cause I’ve been building a lotta micro-services over the past ten years, and thinking about synchronous versus asynchronous communication and how that plays out, because if you have too many APIs, you have to use things like circuit breakers. There’re a lot of things that can affect that. So if you start looking at things like Kafka, where do I split my workload so it’s asynchronous? How does that work? What patterns do we put in there? That makes a big difference, because most developers are always thinking synchronous, and I find that to be a real difficult issue, because you know what? We could put this in the background. When you look at Amazon, just ’cause you place an order doesn’t mean that actually went in and got billed against your card immediately. That whole synchronicity concept has to be embedded in the concept of performance.

    Andy Grabner: Yeah, true. Yeah, it’s also a nice decoupling of components, right? I mean, that’s the event-driven model, as you call it, right? You put a queue in the middle, but it’s basically an event-driven architecture and very important piece. And because the event-driven architecture also allows you to better test and also performance-test components in isolation and then also come up with beta capacity-planning models, right, because you know how many events fall out of the first component, when you put a certain load on it, it means, how do we need to size the queues or wherever it ends up, and then what do we need on the other end to work on the queues? I mean, that’s a very good point.

    Mitch Ashley: Maybe that’s why holistic is being overused, Alan. The topic has not only evolved. I think it’s grown, because I remember one of my first experiences working with Donald was on ISS and TP Gateway server, a third-party product, and he was new to me, and he knew how to tune it. We called it tuning then, right, but the load, the capacity, the scalability, and we’ve added onto that customer experience or user experience goals, metrics. How long does it take to log in, that kind of thing, with the experience to get back a response on a mobile device versus on a Web browser, whatever that might be? What’s our API performance goals to partners and third-party services, things like that? So I think that’s made the world a little bit more complex, maybe a lot more complex to deal with. But it also has brought us closer to what the end result is we’re trying to accomplish with whatever system or software is. Deliver this service or make this function happen for whatever it might be. Kinda help us also think across the system horizontally and vertically of what we’re trying to deliver.

    Alan Shimel: Yep. I think there’s another element, though, that I’m interested in your all thoughts on. When I think back to over my career how performance testing has changed, what’ve been the big factors? Well, I think as Andy referenced, early on, man, it was hardware-dependent, right, because, I mean, if you wanted to scale performance testing, you had to be able to test it on the hardware that was running. And that got expensive quickly, and not only expensive for the actual cost of the equipment but from a people perspective. Right? And then the virtualization of performance testing, wow, what a godsend. We can just have Andy here working with, as he said, his left and his right index finger, and that was enough to break his – the app he was testing or the software he was testing at the time.

    And then I think with devops and dev testing and so forth, the idea of automating our performance testing, right, being able to shift it left into – further left into our development process, right, making – ’cause it used to be you did all your coding, and that took one month of your three-month cycle, and now two months of that three-month cycle were your testing cycles, right? And, man, by shifting left, I really cut that out a bunch. All of these profound changes, right, in performance testing – as we sit here today, can we say that there really is a best practices, holistic or not, approach to performance testing? And where’s the people part of it, right? There’s always people, process and technology. What’s the people part of that? Kristen, would you mind kicking it off, or –

    Kristen Webb: So, I think there is some approaches that are best practices-ish, and one of the first steps is really understanding where your priorities are in your applications and where the risky areas are, because you can’t test everything. So you need to really prioritize what to test first and where the issues are most likely gonna come up. And, two, after you do that, it’s about establishing what your SLOs are, your service-level objections – objectives, sorry – and understanding, what do you need to hit within what level of virtual users hitting that, within what response times, and what you want that end user experience to be like. And building those SLOs within the pipeline so that when you’re running the test in a continuous manner, you’re able to say, “This didn’t hit the SLO when we ran it against XYZ load,” and you send that back, and you have actions based on that result to fail the build, for example, send a ticket to Jira so that it’s integrated within your already-existing development process is a good way to go about it. 

    And then also taking in production feedback is a good part of this, too, to make sure that you’re understanding what’s actually going on within production, and is – are my tests mimicking the real-world experience that my users are having under what load conditions and making sure you’re updating your Kubernetes environments to match that level of code. Do you need a new cluster based on that information that you’re getting from either APM tools like Dynatrace or other monitoring tools like Prometheus or Microsoft Monitoring. And bring that observability data back into the test definitions and updating them continuously to make sure you’re keeping up as things change, because in reality things do change. I mean, we have seasonality, or we have new marketing campaigns that may be a business that went digital. Now they need to keep up with their spikes in load. So you wanna be able to stay ahead of that instead of reacting.

    Alan Shimel: Agreed. Panel, thoughts?

    Donald Lutz: The telemetry idea has become – really the past two years I’ve been doing a lot of open telemetry so we can know what’s happening at every point. We put it in L. We put it in Datadog. We put it all over the place, but also the whole Kubernetes cluster thing, how do you monitor it correctly? What’s the right thing? There’re a lotta tools that I’ve used, but there’s – the whole Kubernetes things opens up a larger can of worms because of the way the control loop works in Kubernetes. So you have to kinda figure out how do you wanna deploy them? What do the environments look like? What’s the appropriate load-testing there? That’s why I’ve got into a lot of chaos engineering, breaking things in production, seeing what happens. I just turned this service off. It doesn’t talk to Slack anymore. Where’s all those messages going? Did we notice this not working? That whole idea I think is really valuable. Surprisingly, it makes developers very neurotic. They don’t like it a lot, because you’re basically saying – it’s sorta like doing improv, because we’re just gonna do it and turn stuff off, and they’re like, “Well, I think it works.” So it’s sort of a very strange response.

    Alan Shimel: It is. Andy, you’re at Dynatrace, right? This is kinda right up your alley there of what you guys do.

    Andy Grabner: Exactly, yeah. And so to add what you already said, both of you already said, on a very mature scale, I think of people at IC, they just go always straight into production and maybe using canaries or future flags and just deploy their new codes and then expose it to, let’s say, a small percentage of users. And I’m saying about the very mature, this is what we would love obviously more people to do, but the reality is just a small number of organizations can really do it. But it’s the ideal scenario. You deploy. Then you use your telemetry to figure out, did that code change now? Does it actually behave better or worse than what’s maybe currently out there?

    What I wanna add I think also what Kristen said. I think what we need to do is we need to get closer to the developers from the beginning. I know that’s different terms, and I’m just throwing one more term out there, performance-driven development, because I think we’ve taught engineers – and I’m an engineer by trade as well, right? We’ve taught them over the last 10, 20 years to do test-driven development, where you write your unit tests and functional tests to cover functionality. I think we should also educate them to do performance-driven development, which means you are – as you write your new micro-service that exposes five APIs, then write your API test that you can run once or can run continuously or with multiple virtual users to actually generate some load. And I think, too, they’ve become much more developer-friendly. Kristen, again, pointing to you, I know you have a great product where you actually allow developers to define their stuff as code, right? And code could be something like JavaScript, whatever it is. But I think as the tools have matured and we are making it easier and more natural for developers to also write these types of tests, I think we will also get more at option. I think that is very important, because we always talk about shifting left. It’s a great term, but shifting left in the end, if you think about it, if you take everything and shift everything left, we put all the burden on the developers. And I think this is nothing that is sustainable. Therefore, we need to make it as easy as possible also for developers to do all the things that we ask them to do. 

    So that means we need to give them tools that are natural to them in their habitat, which means in their ID, right? They need to be able to check in code, and as part of their commit process, they then will automatically not only get feedback on code coverage and functional coverage but also, “Hey, your code change now has slowed down your performance by 20 percent. Are you aware of this, or are you consuming 50 percent more memory? And, by the way, then bringing Donald, what you said also, learning from production – then you can correlate that with your production data and said, “Hey, your service runs in production with a certain amount of instances, and if you are making this code change, it means you have 50 percent more memory consumption. Are you aware of the additional costs?” So there’s a lot of things I think that we need to do, but it starts with really enabling developers just to do more in their natural kind of environment that they’re in, yeah.

    Kristen Webb: I’m gonna build on what you’re saying, Andy, because I wanna make sure I’m clear about what I mean about shifting left, and I do think it is bringing it to the developer but as a service. So I think of it as building out a self-service rather than putting the onus on the developer to build the performance testing within the pipeline. So if it’s automated in the pipeline that they’re operating within, then it’s really up to the performance engineer to build out – and the automation engineer to build out that testing platform for them so that really they’re just kind of functioning, like you said, within their IVEs and within their – whatever they’re using to check in. 

    And, really, they’re just getting the feedback once they do so that they know how to act in the moment about how their code’s performing for that one user to start. And then later, as they get further on, they get more information about an increase in load to a few hundred, maybe, once they have, like you said, a micro-service that might expose more APIs. And once you’re distributing your code like that, how is it going to impact other code, and how is other impact code and endpoints going to impact the new code that you introduce, so really kind of delivering that, and that’s what I was talking about earlier in terms of creating a self-service approach so that more people can participate in a process, but the performance engineers are still the masterminds behind building that.

    Mitch Ashley: I have a question for the panel. I’m curious. How do you think about this aspect of it? It may be for me a better word than holistic is systemic, and I’m thinking about how all parts fit together to contribute to the performance you’re delivering, as well as other things. It’s not just testing our app and our app code. It’s testing the whole stack, vertically and variations of that, different environments that it might run in. And a lot of it’s not our code. Donald was talking about Kubernetes, just as one great example. Is that part of what we mean by holistic as well?

    Donald Lutz: I think so. To me, one of the things I think about the holistic problem is that you get all these CICD pipelines built, but you don’t have a gitops process that keeps the platform aligned. You’re working on that, so fundamentally you don’t have the cluster. You’re not doing infrastructure as code where the cluster is effectively as you need. Therefore, when developers deploy code through their – runs all the tests, but fundamentally part of the cluster didn’t get – so I’ve been thinking a lot lately in my current position, how do we get across our whole organization, gitops deployed in all elements of our groups so we’re using that effectively with everything else we do, ’cause that is the one piece that is happening. Argo CD’s a great example. It works really well, but just getting that to happen and realizing you’re building a platform is also a thing that people need to think about.

    Alan Shimel: Agreed, agreed. You know what? I just wanted to throw another log on the fire. So, cloud. Game-changer? Makes no difference? Easier? Harder? Donald, you’re kinda the voice of the developer here, as well as IT. What do you think? And cloud, you work with a public cloud provider. What do you – 

    Donald Lutz: Yeah, I mean, public cloud is what we focused on fundamentally. That’s what we’re doing for all our customers, and cloud is simpler but more complex at the same time, ’cause they’re – fundamentally companies are used to having their various people within their data center. And when you move to the cloud, it’s upsetting. They have to figure out how to move all the workloads, but it’s also – one of the things that cloud gives that I’ve been thinking a lot about is if you can work with all three public clouds, you start increasing your reliability in everything, but how do you contain the costs so I can run this in GCP, this in Azure, this in AWS? Companies wanna go there, but they’re sort of always going, “How do I do that? Why do we do that? What do all these terms mean, and how do you sorta get the various executives to understand, ’cause we’re trying to sell them on sorta the advisory services. This is why you should do this. This is how you get your devops working. This is all these things. This is what you should do with open-shift.” It’s a really complicated soup, because they feel like it’s sort of like what happens to a lot of industry. They’ve outsourced it to all these people, and what’re all these people doing? Are they really making a Pinto, or are they making a fancy car? What are they doing?

    Kristen Webb: I mean, I’m curious, Donald, how you guys do performance testing for the public. But I will say that cloud is a game-changer in a lotta ways, because it’s not eliminating risk, right? It’s just moving it from one place to another. It’s shifting it from on-prem. to the cloud and also introducing new risk that – new considerations that didn’t have to be made before. And with auto-scaling systems, sometimes people assume that moving to cloud means that implicitly they don’t have to worry about performance anymore because of auto-scaling. 

    And the concern there is that when you’re in the cloud, you’re really bumping up against a lot more services. And you can also run into noisy neighbors and a lot of different scenarios that will introduce bottlenecks from distributed systems. I mean, you could have your SaaS application located in France, your hardware located in China and your middleware in a third location. And you need to make sure that a hybrid system like that is gonna perform, and it can be assumed that it would, just because it’s the cloud. And you really need to make sure that your – whether you’re migrating apps or re-platforming ’em that you have a baseline of performance tests that you know you’re measuring against to make sure that you don’t regress when you move to the cloud and that you’re able to test those again once  you do move there.

    Donald Lutz: And I have another thought I’d like to add to that, ’cause I’ve sorta done it. You run all your services in – pick it AWS, Azure or GCP. And then there’s the other thing where you say, “Well, I wanna run all my services in Kubernetes in all three public clouds. I don’t really wanna consume the services directly from the provider. There’s some new, cool APIs that’re out there, where I just wanna consume it in Kubernetes. So you’ve changed the idea that your hybrid is really Kubernetes, wherever it runs. So then you’re not really consuming it in the public cloud; you’re consuming the services through the cluster. So that also changes the whole discussion.

    Andy Grabner: Maybe what I wanna quickly add – and my first response to your question, Alan, was it doesn’t matter, because it – or it shouldn’t matter, the same with cloud native. When we talk about cloud native, cloud native doesn’t mean your cloud-native apps have to run in the cloud. Cloud native really means how you architect your apps, and they can essentially run anywhere, right? So it’s not where. Cloud native doesn’t define where it runs but how the system runs. And this is why I think, also to Kristen’s point, you don’t get, let’s say, performance for free, or you cannot sign up for performance as a service or for resiliency as a service just by checking a box on your favorite cloud provider, and then all of a sudden you have magic happening. But you still need to factor all of these decisions into your architectural decisions that you make, and you have to do the proper testing in the end. I also think that the cloud was great, because all of a sudden we got a lot of services that we could build upon and really focus on. It’s a business value that we could generate, because we didn’t have to invest time in, I don’t know, maintaining a database and certain stuff like this, because somebody took care of it. 

    So I think overall, the cloud was a great thing. From a testing perspective, to add one more thing – and I think also, Kristen, you said it again, if you have to make smart decisions where your software runs, because you always need to have in mind where your end users are, where your consuming services are, because that also means you need to test from those locations, because you may now have different latency. You may have different costs out of a certain data center, out of a certain through provider. I think these are some of the additional considerations, but in general for performance testing and scalability testing, in theory it shouldn’t matter whether my application that I’ve architecture well runs in one cloud, in three clouds or on premise. That’s kind of my answer. It shouldn’t.

    Mitch Ashley: Alan, too, I think one of the, I think, real game-changers about the cloud is just access to resources. And in the organization, when you do it internally, the two greatest bottlenecks are acquisition of hardware and firewall rules, to be straight about it. And you can kinda control your own environment, whether it be resources or security, whatever it might be. But that flexibility gives you more – not just more options. You can rethink how you can automate how you set up an environment, “Let’s configure it this way,” your permutations, or, “We’re thinking about changing it in some specific way,” and you can automate how you test that. So it seems that it gives you a lot more flexibility. Sometimes flexibility means complexity, too, but that to me was one of the biggest game-changers of moving to the cloud.

    Kristen Webb: Yeah, I mean, with hardware being the most expensive part of performance testing and – like you said, it’s difficult and time-consuming to go through IT to procure resources, to get them provisioned, to make sure you can access them at the right time and there’s no conflicts. So what you’re talking about, really, is more the app development, app testing within a cloud CI system, which is a whole other level, in addition to application deployment in the cloud. And that’s really exploding, too, and it does minimize – with neo-load SaaS, you can get up and start it and run a performance test within five minutes now, because it’s a fully managed service using AWS and Google, and we do that for you. So it is a game-changer in that way, too.

    But also, this is where I do disagree with Andy a little bit. Wherever your app is, it has to perform. It has to run well, but the cloud does introduce more risk, because – well, first of all, it’s shifting the risk from on prem. to cloud, but it’s also – you’re going to hit a lot more services now, particularly where you have a new architecture, where it’s a modernized architecture, and it could be a – what are they calling it, a microlift now? So more services are gonna be affecting you in that architecture. It could be really unrelated, and when you have that kind of a distributed system, you might not know where the bottleneck is coming from.

    Alan Shimel: I mean, I think the cloud does introduce more complexity, if you will, but there’s – I mean, look. The advantages of cloud I think far outweigh the disadvantages of cloud, right? I think that there’s chips on both sides of that scale. But you know what? I mentioned in the beginning that in addition to this prerecorded Devops Unbound episode February 24th – we do have the live roundtable for our audience. So I’d like to invite everyone that’s watching this, if you wanna learn more about what to consider in building a cloud performance-testing strategy, we do have this live roundtable. We have folks from Dynatrace and Tricentis and more joining us on February 24th. The roundtable, funny enough, is called “Strategies for Performance Testing in the Cloud,” and if you go to devopsy.kinsta.cloud under the webinar section, you can sign up for this webinar right there. We’re calling it a webinar. It’s a live roundtable. You will have a chance to have your questions answered, to speak to the panel members directly via chat, and help you with your strategy. So don’t miss that, February 24th, just a few weeks from now.

    We’re running low on time. I’d like to throw one other kinda question out at the three of you for our audience’s benefit, right? Right, okay, you convinced me. I need a holistic approach to performance testing. Other than listening to the three or the five of us on here today, can you point me to some good places, if I’m in the audience, where I can go find out more about this, where I can get smart quick? Donald, we let Kristen lead off everything, so if it’s okay, I’m gonna ask you to go first on this one.

    Donald Lutz: All right. Well, I mean, there’s a couple books I like that aren’t necessarily about performance testing, but one of them, it’s – I always forget the name. It’s over there, Building Micro-services by Sam Newman. It’s a really good book about – it’s a second edition came out. There’s another one that came out by the guys at – oh, God, I can’t think of where they were, but to me that’s a great reference, because it covers everything from culture to how you build your micro-services, how to performance-test it. I like a lotta written things. There’re various videos that’re out there. There’s a couple that Martin Fowler – that talk about this in particular. So those’re kinda the things off the top of my head.

    Alan Shimel: So I think Sam Newman, like Martin, were with ThoughtWorks, if I’m not mistaken.

    Donald Lutz: Yeah, he’s independent now. He went off on his own, and now he consults.

    Alan Shimel: Yeah, yeah, they did leave. I remember. Yep. Andy, how ’bout you?

    Andy Grabner: Yeah. So I would say, and this is a little commercial on what we do on the side of Dynatrace, we have a holistic approach to SLOs, to service-level objectives, with our CNCF Project Kaptn, spelled K-A-P-T-N. It’s a CNCF project, and what we do there, we are providing events-driven orchestration to actually embed performance engineering as part of your delivery process but also as part of your operational processes. And there’s a great integration also with Neutis, with neo-load, so that means we actually provide a framework on top of Kubernetes to enable developers to simply check in their code, and then Kaptn is orchestrating the deployment, the testing like triggering and neo-load test and then automatically evaluating your SLOs and then pushing it forward all the way into production but always evaluating SLOs, so always evaluating your performance criteria, your resiliency criteria, your business criteria. So if there’s one thing, check out Kaptn, our CNCF project, because I think it will definitely contribute towards having a more holistic approach to performance engineering.

    Alan Shimel: Thanks, Andy. Kristen, I saved you for last.

    Kristen Webb: Thanks. So a couple things. One is we have a performance advisory council that is run through Tricentis, but really it’s not about product as much as it’s about approaches, and it organizes all the performance experts from around the world, including – Andy, I think you participated in it a lot. And Henrik, who is gonna be joining me on the webinar later in the month, used to run those performance advisory councils, and he’s at Dynatrace now. So he’s a great resource as well.

    But we have a site for the performance advisory council, where you can see all the recordings of experts around the world telling their stories about what they found worked for them and what their learnings were and how they integrated with various development processes. In addition to that, on Tricentis.com/neoload there is a ton of information about the problems that neo-load is addressing and how we’re addressing ’em, the integrations we have across traditional tech stacks and the devops tech stack and how we work with Dynatrace to help shift right and bring that production feedback, along with all the monitoring tools for that observability we have. And we also have a trial that’s available to learn more.

    Alan Shimel: I love it. Hey, Kristen, thanks very much. Again, just to reemphasize, Kristen mentioned it, February 24th, “Strategies for Performance Testing in the Cloud” with some really great, smart people, including Kristen. Check it out on devopsy.kinsta.cloud. You can register, and you do need to register to attend that live roundtable, though. Hey, Mitchell, I’m gonna let you take it home.

    Mitch Ashley: Well, thanks, Alan. I was just reflecting and really absorbing what our panelists had to say today, and the thing I take away is I’m impressed with the sophistication of how we think about – and the sophistication of the people who work in testing now. Long gone are the days of testers are people who didn’t like to code, right, who were developers that didn’t like being developers. We’ve got some extremely brilliant thought leadership happening in testing, whether it be in the products that’re being created, people that’re trying to solve both complex problems and sometimes fun ones, too. So it was kind of a renaissance for testing time for me. It’s a great time to be a tester. It’s a great time to be a QA person and a software engineer working with test. So it’s a fantastic topic, and I hope people will check out the resources that everybody suggested.

    Alan Shimel: You’re right. It is. Is it an old Irish proverb, “May you live in interesting times,” or something like that? It’s great times to be a tester. Anyway, Donald, Andy, Kristen, thank you so much for being on our panel today. Mitchell, as always, thank you. To our audience, thank you. We hope you found this interesting, and if you did, again, I’ll beat the drum one more time: February 24th, “Strategies for Performance Testing in the Cloud.” Sign up for it. Don’t miss it. I think it’s gonna be a great one. But until then, this is Alan Shimel for Devops Unbound. Many thanks to our sponsor, Tricentis. Thanks to all of you for watching in, and we’ll see you soon on another Devops Unbound.

  • CIS Benchmarks: DevOps Guide to Hardening the Cloud

    CIS Benchmarks: DevOps Guide to Hardening the Cloud

    DevOps and cloud computing have become inseparable. But while the cloud started as primarily a dev/test environment — without stringent security and availability requirements — it has evolved into a mature platform for running production workloads. Moreover, devastating supply chain attacks like SolarWinds and Kaseya taught us all that development environments must also be secure. 

    Today, to practice DevOps, you require the cloud, and to avoid catastrophe you must ensure its security. The Center for Internet Security (CIS) is a research body that developed a series of “benchmarks,” essentially guidebooks to secure the configuration of computing systems. There are CIS benchmarks for all major public clouds. 

    Every DevOps professional must be familiar with these benchmarks, and ensure they are applying at least their basic recommendations across dev, test and production environments.

    What are CIS Benchmarks?

    CIS Benchmarks include best practices that can help secure system configuration. CIS Benchmarks are created using a unique consensus-based process that includes cybersecurity professionals and subject matter experts from locations worldwide. 

    Created by a diverse pool of volunteer stakeholders, they include experts from academia and government, private community members, various businesses and relevant industries. 

    How does the process work?

    • The initial benchmark development process defines the scope of the benchmark and leads to a discussion. 
    • Next, volunteers create and test the process of working drafts. 
    • The CIS WorkBench community website lets contributors establish discussion threads to continue the dialogue, until a consensus on the proposed recommendations and the working drafts is achieved. 
    • Once all collaborators reach a consensus, they publish the final benchmark and release it online.

    There are currently over 100 CIS benchmarks for more than 25 vendor product families. You can download these benchmarks for free in PDF format.

    Each CIS benchmark contains configuration recommendations divided into two levels:

    • Level 1 covers basic configurations that are easier to implement and have the least impact on business functions. 
    • Level 2 is intended for a high-security environment. Recommendations at this level require more coordination and planning to implement with minimal disruption to the business.

    CIS benchmark categories most applicable to cloud environments

    • Operating system hardening—cover security configurations of core operating systems such as Microsoft Windows, Linux, and Apple OS X. This includes best practice guidelines for restricting local and remote access, user profiles, driver installation protocols and configuring Internet browsers.
    • Server software—covers the security configurations of popular server software such as Microsoft Windows Server, SQL Server, VMware, Docker and Kubernetes. These benchmarks include recommendations for configuring Kubernetes PKI certificates, API server settings, server management controls, vNetwork policies and storage limits.
    • Cloud provider security—supports secure configurations of Amazon Web Services (AWS), Microsoft Azure, Google, IBM and other public clouds. It includes guidance on configuring identity and access (IAM), system logging protocols, network configuration, compliance management, securing auto-scaling and more.
    • Mobile devices—covers mobile operating systems such as iOS and Android, and focuses on developer options and settings, operating system privacy configuration, browser settings, application permissions and more.

    Hardening cloud security with CIS Benchmarks

    Cloud service providers (CSPs) have changed the way organizations of all sizes design and deploy their IT environments. However, the use of cloud technology also introduces new risks. The CIS Benchmarks provide guidance for organizations to establish policies, plan and manage secure cloud environments.

    CIS has released Foundation Benchmarks for all major public cloud environments, including AWS, Azure, Google Cloud Platform, Oracle Cloud Infrastructure, IBM Cloud and Alibaba Cloud. 

    Users include systems and application administrators, security professionals, auditors, help desks, and DevOps personnel who want to develop, deploy, evaluate, or secure cloud solutions or platforms.

    CIS Foundations benchmarks are tailored to specific CSPs, but the content of the documents all have common features. At a minimum, each benchmark provides prescriptive guidance regarding identity and access management (IAM), logging, monitoring and networking.

    Obtaining the CIS benchmarks

    You can download the AWS CIS Benchmark free by clicking here. The CIS website provides easy access to all other benchmarks, which you can download in PDF format.

    Universal recommendations from all cloud CIS benchmarks

    • Create secure cloud workloads that comply with industry best practices, save your tested, compliant images and monitor them to avoid tampering.
    • Enable cloud control plane logging through tools, such as AWS CloudTrail or Google Cloud Operations Suite. Keep track of all API calls made in your cloud service account. 
    • Configure and enable cloud-native monitoring and alerting tools for your workloads.
    • Enable strong authentication for all cloud management interfaces, including web portals and the command line. 
    • Implement a least-privileged identity strategy for various cloud operations roles.
    • Enable encryption and other data protection measures for cloud storage services.
    • Secure cloud-native network access to minimize access, and ensure all network activity is monitored.

    Consider configuration drift

    CIS benchmarks are great. But, they are not enough. Trying to manually configure every item of a public cloud benchmark (which typically covers hundreds of pages) is infeasible for even the most seasoned DevOps professional. However, there are automated tools, some free and open-source, some part of commercial solutions, which can automatically configure your cloud according to the benchmarks.

    It is even more important to consider configuration drift. The cloud is a very dynamic environment, and what you configure today will be gone tomorrow. To ensure you stay secure, ensure you:

    • Gain control over all processes to create new cloud workloads and services, and ensure they enforce security standards.
    • Use cloud-native tools like infrastructure-as-code (IaC) to automate secure configurations — just as you do with everything else.
    • Put a configuration monitoring solution in place, such as cloud security posture management (CSPM), cloud workload protection platform (CWPP), or cloud security access broker (CASB), which can automatically scan and verify secure configurations.

    All of this information helps as you move one step closer towards hardening the DevOps cloud.