Tag: defects

  • ZeroNorth Adds Security Defect Density Dashboard

    ZeroNorth Adds Security Defect Density Dashboard

    ZeroNorth today announced it has added a Defect Density Dashboard to its software-as-a-service (SaaS) platform for managing and orchestrating application security scans.

    Company CEO John Worrall said Defect Density Dashboard borrows a concept employed to measure software quality and applies it specifically to application security. The dashboard surfaces the number of application security defects per thousand lines of code discovered during scans of code made using software composition analysis (SCA) and software application security testing (SAST) tools.

    That metric will create a key performance indicator that application security champions within DevOps teams and chief information security officers (CISO) can use to quantitatively measure the progress being made toward improving overall application security, he said.

    As organizations begin to adopt best DevSecOps practices Worral said one of the challenges IT leaders face is showing the board of directors that the level of investment being made is delivering measurable results. The Defect Density metric applies a concept that is already widely employed by quality assurance teams in manufacturing and other vertical industries to software development, he noted.

    As a provider of a SaaS platform for orchestrating security scans across multiple third-party tools, Worral said ZeroNorth is in the unique position of being able to normalize all the data generated by the tools.

    The Defect Density Dashboard also makes it easier to identify specific areas of weakness such as larger numbers of SQL injection vulnerabilities that would indicate a need to make additional training available to software development teams, he added, noting that approach allows the application security advocate to be viewed as an ally versus someone who merely criticizes the efforts of a software development team.

    Encouraging developers to scan their code before they make a commit is, of course, at the heart of any effort to shift more responsibility for application security to the left. ZeroNorth has been making a case for a platform that makes it easier to implement multiple scans across a DevOps workflow using different tools. That approach makes it more likely that a vulnerability that isn’t discovered by one tool is uncovered by another.

    The challenge, of course, is making sure developers scan their code often. There is a natural tendency to delay a scan in the name of productivity. However, the larger the base of code that needs to be scanned, the longer it takes to complete those scans. Most developers would be well-advised to scan smaller amounts of code more often.

    Regardless of the approach to scanning, developers should expect to be evaluated based on the number of vulnerabilities that are inadvertently introduced into their code. Cybersecurity teams can no longer keep pace with the rate at which application code is being deployed and updated. As such, many organizations have launched a concerted effort to eliminate as many vulnerabilities as possible before code gets deployed in a production environment. It may never be possible to eliminate 100% of vulnerabilities, but at the very least the most common exploits that cybercriminals actively scan for when looking to compromise an application can be greatly reduced.

  • 3 Reasons Why Traceability Should Be a DevOps Priority

    3 Reasons Why Traceability Should Be a DevOps Priority

    Traceability in DevOps is about ensuring clarity, accountability and the best possible end product for customers

    There’s a lot to think about when it comes to mobile DevOps. For a start, there’s the need for effective cooperation between members of different teams, perhaps even via team collaboration software for remote workers. With so many people working on DevOps, it’s easy for some to become siloed from their colleagues, hampering communication and undermining teamwork.

    Then there’s the wider question of DevOps strategy—deciding on a vision, setting goals and working out how to measure your success (or otherwise, as the case may be). One thing that has to be central to your strategy is traceability. You may have come across the term a few times before. It’s commonly used elsewhere in the business world, especially with regard to supply chains. Basically, what it means is keeping track of a commodity or product at every stage of the production process.

    Records of the product’s entire manufacturing and distribution history are kept so that the sources of any problems can later be determined and dealt with. Traceability thereby ensures that suppliers can act quickly and decisively in the event of a product recall, for example.

    Another advantage of traceability is that it provides additional transparency, which helps to maintain consumer confidence. As consumers are becoming increasingly aware of how products are sourced and manufactured, this is now an important consideration. It reassures consumers that manufacturers and suppliers are aware of their concerns and that they’re looking out for their best interests.

    traceability

    You can see already, then, how much of this also applies to mobile DevOps. Traceability in DevOps is about ensuring clarity, accountability and the best possible end product for the consumer. But it’s especially important in DevOps because speed is of the essence—there’s constant pressure to get apps developed, into the hands of users and then incorporate feedback as soon as possible. It goes without saying that this can lead to oversights and slip-ups that might otherwise be avoided.

    In addition, DevOps teams have sought to accelerate this process by allowing for greater decentralization and autonomy among their teams. The logic behind this is that it allows for quicker delivery and deployment. Screenshare solutions and other such technological fixes can help to facilitate closer collaboration. However, this easing of control can nevertheless create some potential for confusion in the development process. That may make it more difficult to maintain consistent coordination between developers and testers, and so on.

    Here we’ll list three of the key reasons why traceability should be a leading DevOps priority. All are based on the experiences of development teams and the challenges they’ve encountered.

    Cutting Down on Defects

    As we’ve already discussed, the pressures for faster software rollout and feedback can make it more likely for certain bugs to not be addressed as quickly or as effectively as might otherwise be the case. We’ve noted further that buggy apps can do a lot of damage to companies’ reputations by providing a shoddy and unreliable user experience.

    This can have serious repercussions—after all, word travels fast, especially on social media. It’s therefore in your interests to take whatever steps you can to make sure your software runs as smoothly and reliably as possible.

    Experience strongly suggests that the more rigorous your traceability processes are, the less prone to faults your apps will be. The completeness of your captured traceability information makes all the difference here.

    So, for example, EMR software developers will get great value out of more complete traceability info, as it will contribute to reducing the likely defect rate. This correlation between detailed traceability and defect rate can help to produce more reliable apps and improve efficiency by cutting out avoidable errors and bugs. You should actively solicit feedback from users where appropriate, and integrate this into your wider customer support package.

    Ensuring Compliance

    In other industries, thorough traceability is often a requirement set by regulatory bodies. This can be so that, in the event of a product needing to be recalled, the entire supply chain can be re-examined and the cause of the problem discovered. For example, food and feed businesses operating in the EU have been subject to compulsory traceability requirements since the General Food Law came into force in 2002. Similarly in DevOps, developers have to take regulatory compliance into account.

    Thus, robust and detailed traceability helps DevOps firms working across a variety of sectors in their efforts to comply. There are numerous industries where this is relevant, whether it be financial services (a well-known regulatory minefield), HR software, insurance or public sector contractors and healthcare firms, any of which may be subject to stringent traceability requirements.

    Tracing code is a common prerequisite insisted upon as part of compliance frameworks. For example, you won’t be able to complete the SOC 2 process integrity requirement unless you’re able to provide a complete, evidenced account for each code alteration in your application’s source code.

    Improving Speed Without Sacrificing Quality

    We’ve already discussed how there’s a delicate balancing act that needs to be struck in DevOps. That’s the balance between software rollout speed and the reliability of its performance. We’ve also noted how the increasing autonomy of different sections can hamper coordination between them; thus providing some benefits in terms of speed and rollout but often at the cost of the reliability and quality of the end product. The key here, then, is to find a way of threading the needle, ensuring that apps can be produced at a consistently quick rate while maintaining rigorous standards.

    This is where traceability comes in. It helps to not just enhance speed but also drive up standards. It allows developers to execute tasks more quickly while simultaneously improving the standard to which they do so.

    This also has a positive effect on overall efficiency levels, freeing up resources (i.e. members of the team) to take on other tasks for which they might be needed. Engineers working on contact center software, for instance, can benefit from better-maintained code by reusing or altering existing code depending on their needs.

    It’s worth noting again here that requirement-to-code traceability may be mandatory from a regulatory standpoint. It will depend on the industry in which you’re working. But even if it isn’t, it’s something that’s still worth doing. It can lead to dramatic improvements across the board, leaving as its legacy sharpened and more efficient processes that enhance your team performance, benefits clients and consumers, and—most importantly—deliver real gains for your bottom line.

    Having taken all this into consideration, then, you’ll need to think about exactly how to implement DevOps traceability. Certainly, when introducing traceability processes, you must do so with real care and consideration. Being too rash about implementation can either create bottlenecks, thus exacerbating or even causing problems which traceability otherwise ought to help resolve, and slowing down the overall speed of production.

    Make sure, then, that traceability is implemented in a way that takes the needs of developers seriously. To start with, draw up a guideline document offering developers a clear and concise explanation of what’s expected of them. Outline the traceability process and how it ties in with key objectives. Furthermore, give developers some autonomy in the choice of tools they use for traceability purposes. You might, for instance, make astute use of automation (such as automatic code checks, for example). This should help everyone reap the rewards of traceability and avoid any unnecessary implementation hiccups.

  • Defects: Pay More Attention to What, Less to Who

    Defects: Pay More Attention to What, Less to Who

    Software defects have been with us forever, and while DevOps and agile can reduce the number of defects generated, it is unlikely this number will ever get to zero for a given organization—and even if it does, it won’t likely stay there. Simply put, we’re developing increasingly complex systems on increasingly short timelines. The reduction possibilities that DevOps offers cannot completely combat this combination.

    But the quest to keep defects down is necessary. The goal should always be “Less, not more.”

    One of the things we have historically done is associated defects with developers. It is natural to want to know “who broke the entire payroll system,” but quite often “who” is the wrong question.

    A huge benefit of both agile and DevOps is that it allows us to look closely at where the process fails and determine why. While every developer in a shop knows “you should avoid modifying that module,”—and those are the easy ones to target for early bug reduction—there are other modules and source files that might be a hidden source of a certain percentage of defects. Using the defect tracking toolset to keep tabs on where bugs are occurring might show that the problem is a given developer, but more likely it will show that the problem is a given set of source.

    So if you are not already, it is time to start tracking defects closely and looking for patterns. There are some great documents out there about relatively common break points that might be useful. However, reviewing your own data is more useful, as it isn’t about common—it’s about actual problems in your source pool.

    This is all part of the process for agile and DevOps, I’m just saying it a different way than the usual “blameless” discussions because I think they fail to connect for some shops. Of course blameless is great, the point here is focus on problems—whether that is blameless or not depends upon which problem you find you have.

    Meanwhile, keep cranking it out. If you’re working on a viable product, then defects are an annoyance, but not something to gnash your teeth over. You are developing a viable product, after all.

    — Don Macvittie

  • You’re Not Doing DevOps if You Can’t Pull the Cord

    You’re Not Doing DevOps if You Can’t Pull the Cord

    There are many concepts in Lean manufacturing that have applicability with software development “factories.” One example is the Andon Cord.

    The Andon Cord concept involves using signals and alerts to indicate that a station on the assembly line has a problem. Alarms are activated manually by workers pulling a physical cord or automatically by the equipment itself.

    Developed as one element of the Jidoka quality method and pioneered by Toyota and the Toyota Production System, the Andon Cord empowers workers to notify co-workers and management of quality and process problems across the assembly line—and even stop production.

    While pulling the cord to stop production sounds crazy, if a defect is found and can’t immediately be fixed, then pulling the cord means stopping the problem from flowing downstream, where it will be costlier to fix and have a severe impact on the customer experience.

    But the point of Andon Cord pulling isn’t only to fix problems. As part of a continuous improvement program, much of the “pulling power” comes from how it helps teams build quality into products and processes. When production stops, improvement begins.

    Many would argue that the application of Lean management concepts such as the Andon Cord is more challenging in software engineering. With software, there are many more opportunities for defects, and testing for problems only occurs late in the development cycle. So late, in fact, that in some cases customers end up doing most of the testing.

    But as the digital and physical world becomes inseparable, excuses and outdated practices are no longer acceptable. Just as we wouldn’t ask a customer to test air bag deployment in a car, we shouldn’t expect them to test whether a new software-enabled telemetry system is subject to security hijacks.

    So having the power stop software development production line to prevent defects, security problems and safety issues during the actual development process makes perfect sense. But how do you start?

    Automate Andon with Continuous Testing

    In many organizations people are often afraid to speak up about problems. Even if bugs are suspected, teams will cover up problems by coding around them, even fudging tests. Owning up to problems doesn’t come naturally, so defects and crippling technical debt accumulates. DevOps practitioners need their own version of the Andon Cord: fully automated testing.

    With DevOps promising software throughput at dizzying rates, quality must accompany the velocity. Fail here and the continuous delivery glass can only be half-empty. This is why the process must incorporate its own automated testing Andon Cord to prevent problems moving downstream. Automation must be comprehensive, providing maximum coverage at every stage in the software pipeline—from requirements definition to full production and including code quality, performance, security, compliance and test data. Then, when a test fails, the system must be capable of stopping everything until the problem isn’t just fixed but can’t happen again.

    Eliminate Waste at the Source

    If you’re pulling the cord but not making improvements you don’t have an Andon Cord. Consider a factory scenario where machine operators always have to sweep up dust that’s clogging production equipment—obviously, they should be eliminating the source of the dust.

    Unfortunately, many software engineering practices involve lots of dust-sweeping.

    When developers need access to dependent systems for testing, they might mock up test code. If QA needs test data in a hurry, it could copy production data but fail to mask sensitive customer details. In IT operations, staff console watch in the hope of gleaning signals from all the noise—the list goes on. Lots of sweeping without ever eliminating the source of the problem.

    Fortunately, tools with Andon-like capabilities can help. Service virtualization techniques can emulate dependent systems to remove testing constraints, while automatically generating synthetic test data helps eliminate the possibility of costly compliance breaches. Modern performance monitoring systems also play an essential role. By providing performance insights before, during and after every software build, they help cross-functional teams swarm problems when the cord has been pulled by an automated test.

    Build the Ultimate Cord – Customer Experience

    If an organization considers itself in any way customer-centric, it will be able to “pull the cord” when it detects anything that detracts from the customer experience as delivered across multiple channels—web, mobile, call-center. The winners go further, using these events as fuel for continuous improvement programs.

    This all requires some serious smarts, not at the least application analytics to monitor the customer experience in real time. Such advanced systems become the ultimate Andon Cord, since they treat every sub-optimal customer experience (e.g. functional issue, usage behavior, performance problem) as both a defect and opportunity for improvement. Through advanced analytics and integration this improvement could take many forms—such as immediately prescribing code improvements to developers, or support systems notifying customers when a poor experience is about to occur—maybe even (shock-horror) compensating them financially for any inconvenience.

    A strong DevOps culture thrives when individuals call out mistakes and inefficiencies. Fail in this respect and organizations risk paying a heavy price, such as broken customer trust and lost business. Seek out automated methods that help you metaphorically pull the cord and keep on pulling it. Only then can teams truly excel in driving real improvements that will help business gain and retain customers.

    — Peter Waterhouse