devopsy.kinsta.cloud

Tag: devops

  • Database Virtualization – Driving the Next Big Transformation

    Database Virtualization – Driving the Next Big Transformation

    Data is both the most important asset and the biggest challenge for most corporations. It impacts every aspect of the business from financial considerations to AI/ML training. Data is used by development and DevOps teams, engineering teams, quality assurance, business intelligence teams and database administrators. Despite its central role in operations, traditional forms of database delivery remain complex, costly and time-consuming.

    In many cases, enterprise data is growing exponentially, increasing management challenges and driving up the cost of data storage. Duplicating data to each new environment as use cases arise is overwhelming DBA teams and incurring a significant storage footprint. This has resulted in data becoming a significant bottleneck for DevOps teams, highlighting the importance of finding a quick and automated solution for the replication process across non-production environments.

    What’s Changed?

    In the past, development teams would work with the same dataset for upwards of six months. This left DBA teams with plenty of time to meet all database delivery needs. However, as technology became more sophisticated and consumers grew more demanding, the data delivery life cycle was cut down dramatically. Today, with agile development, new features may be added every few days, if not hours. Coupled with QA teams’ requirement for testing data continuously, AI/ML teams requiring millions of data points for accurate training, and data analysts constantly needing fresh data for organizational growth, this means DBA teams are flooded with demands they are incapable of managing.

    What Now?

    Database virtualization is an automated and easy solution to the dataset bottleneck. By simplifying the creation and distribution of database replicas, DevOps teams will be able to create fully functioning virtual environments via a self-service process–allowing DBA teams to focus on more critical duties relating to production databases.

    Speed Up

    The first—and most obvious—advantage of this approach is the increased speed at which data is delivered. To keep DevOps teams productive and avoid the use of old, stale data, new environments need to be produced on demand. By integrating the production of new environments into the CI/CD pipeline, enterprises will be able to automate the process and provide DevOps teams with full autonomy. By cutting out the dependency on the DBA, teams will be able to access the data they need, when they need it.

    Scale

    Agility is fundamental to the success of database management. Each team requires an independent environment, unaffected by other use cases. The creation and supply of virtual databases allow for quick provisioning. Once created, these databases look identical to the original physical database and function completely independently of each other. Any changes made to a vDB remain unique to the environment it’s in.

    Save

    As the need for data grows, so does the cost of storage. Creating a physical copy for each team and use case results in a significant storage footprint. This means that these datasets come with a hefty cost. However, the creation of virtual databases led to a dramatic decrease in storage needs. Where traditionally, physical datasets can weigh upward of several TB, vDBs only weigh a few hundred megabytes. Further, virtualization solutions also compress the weight of physical copies – such as the golden copy – actively decreasing the weight and cost of storage across all fields.

    Secure the Database

    Even after the database delivery problem has been solved, enterprises are faced with another major issue – security. With so many different teams accessing data in virtual and low-level testing environments, the risk of ransomware and other cyberattacks increases dramatically. Generally, the investment in securing non-production environments is significantly weaker than in production.

    A common approach to address this issue is masking sensitive data so it is rendered useless to outside sources. However, traditional masking requires a data expert to manually sift through all existing data and implement data masking algorithms on any sensitive information found. This time-consuming solution creates a new data bottleneck. By automating the process and applying it to the golden copy, corporations can be confident that all vDBs created are completely secure and privacy compliant.

    Looking Ahead

    Database virtualization is the future of database replica management. Virtual databases are delivered in a matter of minutes, significantly accelerating the speed of delivery. These environments are easy to use, independent, and can be maintained via a self-service portal. The ongoing sync between the original database and the vDB ensures continuous access to the latest data without the need for timely or expensive processes.

    Effective database virtualization will allow well-established enterprises to more easily compete against those agile startups that face significantly fewer barriers to entry.

    Image Source: joshua-sortino-LqKhnDzSF-8-unsplash

  • The Business Case for DevOps Culture

    The Business Case for DevOps Culture

    Culture is nebulous. It encompasses all the behaviors and attitudes of an organization, from overarching business values down to the individual actions of an employee. Because culture is transient, it’s unique to every business, feels difficult to change and is even harder to measure. This can make it frustrating to see DevOps research continuously name ‘culture’ as the critical factor for DevOps success.

    Many teams are left wondering what a ‘successful’ culture looks like and struggle to pinpoint what changes they should make. While there isn’t a one-size-fits-all approach to cultural transformation since every business is different, there are three key traits of high-performing DevOps teams: Buy-in to the DevOps process, collaboration and continuous improvement.

    But even once you’ve identified how your team can embody these traits, it can still be difficult to put forward a case for improving culture when it’s so difficult to measure its returns. By linking each of these traits to measurable impacts on the wider business, it’s possible to make a strong business case for improving your DevOps culture.

    Buy-In Makes Your Business More Resilient

    No organization can foster a successful DevOps culture without buy-in from the whole team. Buy-in not only encompasses an understanding and acceptance of the DevOps process but is also a commitment to getting it right.

    Without cultural buy-in to the DevOps process, team members are more likely to circumvent established procedures. Following a DevOps process should overcome unnecessary downtime and failed releases, but neglecting the proper release management strategy will stop your team from seeing these improvements and hinder your ROI.

    Team buy-in to DevOps makes your release process far more resilient. With a common appreciation of and investment in DevOps, teams are far more likely to follow the planned and robust process. This attitude allows businesses to see far higher ROI. For example, Veolia, the energy and utilities giant, secured a 500% return on their DevOps investment within one year of buy-in to a new approach. Team buy-in is the first step you need to take in improving your DevOps culture—it’ll ensure the technical resilience of your processes necessary to secure ROI.

    Collaboration Makes Your Business More Efficient

    DevOps doesn’t just encourage collaboration between Dev and Ops teams—it encourages all team members to work together across functions and share responsibility.

    When only one team member has the expertise or responsibility required to move through a stage in your DevOps process, there’s a single point of failure. If this team member doesn’t have the capacity to unblock others, then the process is slowed and time is wasted. Collaboration and knowledge-sharing can overcome this bottleneck by empowering team members to handle a greater scope of the process. This avoids the significant costs that come with increased labor and missed opportunities by removing the pressure on individuals and drastically increasing the efficiency of the whole system. You’ll see an accelerated project delivery, which will be faster in getting value to your end users and see quicker ROI.

    Further, collaboration across the entire release process encourages all team members to remain mindful of compliance, which ensures you’re practicing DevSecOps at each stage of your release. Rather than handing development over to the dedicated compliance team once it’s complete, shared responsibility ensures that it’s baked into the DevOps process, saving time that could be needlessly spent at the end of development reworking to meet compliance stands. In the 2022 State of Salesforce DevOps Report, teams who self-reported as ‘excellent collaborators’ managed to avoid data and metadata loss in that year’s DevOps process, whereas only 25% of very poor collaborators could say the same. Excellent collaborators were much faster to restore when needed and significantly more likely to state that backups were their responsibility.

    To sum up, collaborative development teams are better at supporting the business growth needed to draw in customers. You’ll be able to sustain this growth, as efficient and secure releases will improve customer retention.

    Continuous Improvement for Your Team and Business

    Many teams only think about digital transformation when their process begins to fail, meaning the necessary changes require a disruptive overhaul of their whole system. Teams that nurture a culture of continuous improvement will make incremental improvements to their system, which avoids drastic ad-hoc changes and ensures the business will see continual value from gradual tweaks.

    It’s difficult to identify a singular ‘best DevOps system,’ as best practices are constantly shifting, but it is easy to realize that something could work better. Teams that reflect on their own systems and keep abreast of the latest tech trends can continually implement process improvements that amount to significant adjustments in the long term. This ongoing optimization of the DevOps process means no stasis and no need for disruptive and costly upgrades every few years.

    Developing your own team members not only creates a better DevOps process but also empowers team members to fill knowledge gaps, lessening the need for costly expert hiring or consultancy. Further, hiring and onboarding is a huge cost, which can be reduced by the morale and retention boost that comes with upskilling and collaboration. This will be critical as companies look at hiring freezes in the upcoming recession.

    Proving that small behavioral shifts can help maximize DevOps ROI will strengthen your business case for DevOps culture and create an agile team that can adapt as the landscape changes. Eventually, your DevOps ROI will become synonymous with your culture.

  • Salesforce Spring 2023 Release: Out With the Old, A Lot of the New

    Salesforce Spring 2023 Release: Out With the Old, A Lot of the New

    Salesforce is the connector and enabler of so many critical business functions. But that doesn’t mean it doesn’t come with its headaches. The environment is so complex that it really takes a conscious, focused effort to properly leverage all that Salesforce has to offer, as well as stay up-to-speed on everything that’s new and evolving.

    The Salesforce spring ‘23 release brought a lot of change. Some old tools disappeared and new products, dashboards and automation tools were introduced that admins will have to adapt to. There’s a lot to catch up on.

    Combing through the 600+ pages of release notes, there are three main themes represented in the spring release that will be useful to the entire organization, from DevOps and RevOps to sales and marketing teams, including: 1) new admin and developer tools and dashboards, 2) doubling down on low-code/no-code with enhancement to Flow and 3) commitment to security and permissions best practices.

    Admin and Developer Updates

    From an administrator’s and developer’s perspective, there are some exciting new features that will undoubtedly improve DevOps’ day-to-day. For instance:

    • Flows – allows you to migrate your old automations.
      • Connect to external data source (beta)
      • Support for lookup fields
      • Reactive screens (reduce the number of “Next” clicks)
      • Removal of “Iteration Limit Exceeded” governor limits
      • Element descriptions are now visible on the canvas
      • Migrate to Flow from Process Builder

    • DevOps Center – Still in V1, but it provides developers with a new interface.
      • Getting on the software development life cycle bandwagon so we can all say goodbye to change sets – finally!
    • Dashboards – Now you can insert text and graphics around charts.
      • Collections – organize reports and dashboard into logical collections that are free from their folder hierarchy. While they will still “live” in their folders, they can be accessed from a collection as well.
      • Add image and text components in your Dashboard to make better experiences with additional information, descriptions, instructions or whatever you want.

    These updates are not only useful for DevOps but, from an executive viewpoint, are extremely useful to showcase the business’s data with a clearer perspective. In other words, the new dashboards have more options to provide additional context and insight. In general, the user interface is not only more organized but can be navigated at a significantly faster rate than before.

    Doubling Down on Flow

    As the old adage goes, “Out with the old, in with the new;” Salesforce will be retiring the automation tools Workflows and Process Builders and converting them to Flow. The reason Salesforce is making this move—and ultimately forcing users to Flow—is because Workflows and Process Builders don’t have the flexibility or functionality that Flow does. Flow can create automation and provide great screen experiences that derive a far greater bandwidth of context and situational logic. The additions made to this much-anticipated migration tool will help administrators convert their current automation into Flow with less stress and hassle than rebuilding them all from scratch.

    So what is the timeline for this migration? Salesforce plans on blocking the ability to create new Process Builders in the Summer ‘23 release but has admitted that it’s not a hard date and will look at the success of customers’ migrations to Flow and feedback from the community. They have not yet announced a date for complete retirement but expect it to come sometime in 2025. That said, users should start doing this now. With any major change to your Salesforce environment, a plan is always recommended, especially with such a huge migration like this one. Given the amount of data and processes most organizations already have in place, we suggest taking time to strategize and test your migration prior to releasing it directly to Flow to make sure your order of operations for your automation is clear and follows best practices. Analyze your business processes and confirm with your users that these processes are still accurate.

    Commitment to Security

    As organizations lean more on Salesforce as their primary business operating system, Salesforce is becoming a critical piece of infrastructure rather than just software that businesses consume. It is also the “build-and-develop” nature of Salesforce that has more companies treating Salesforce as software they build rather than just software they use. The ripple effect is that as companies build within Salesforce, more developers are responsible for deploying and managing data. With that comes the responsibility for security and compliance.

    This has traditionally been handled as an administrative task, but now, Salesforce has created the tools for true enterprise infrastructure security and data management with permission sets and permission set groups. Even though permission sets have been around a while, the introduction of permission set groups and the growing need to transition permissions into more complex structures have changed the way permission sets are being consumed. Permission sets were previously used for basic exceptions to the permissions provided by profiles, but now they are front and center, providing even more organizational capability with Permission Set Groups (and their muting capability, but that’s a different story).

    Salesforce has taken note and announced the partial end of permissions within profiles as they lean into the new, better way to manage permissions. Profiles won’t be gone entirely, as they will still be needed for basic defaults, i.e., defining users’ default app selections. However, while Permission Sets will still have the responsibility for what apps you have access to, it will be the Profile that states which one is your default. This is also true for other types of assignments where there needs to be a single source of truth, like page layout assignments.

    Salesforce said they will be enforcing this plan in 2026 but are beginning to make sure everyone gets on board now by releasing great new tools to make this transition smoother, including user access policies and access to Permission Sets when adding new fields (currently only available for profiles). For large organizations, three years is just around the corner when it means implementing major overhauls in technology and philosophy to the business. While some are heading to building Permission Sets based on each object, I’d recommend basing them on features or functional areas to have the most control and the clearest overview of your new vast area of Permission Sets.

    Next Salesforce Release

    Overall, the spring ‘23 release was jam-packed with content to boost productivity, strengthen security, enhance the user experience and improve the overall business functionality. There are two Salesforce releases still to come in 2023, and I’ll be dissecting them both to highlight the most critical changes that can help you better your business. I’m looking forward to seeing what the summer ‘23 release has in store – any predictions on what Salesforce will come up with next? I’ve got a few guesses…

  • How to Maximize Telemetry Data Value With Observability Pipelines

    How to Maximize Telemetry Data Value With Observability Pipelines

    The software landscape has shifted significantly in recent years as companies digitize their operations and adopt cloud and microservices technologies. The complexity of modern software systems has led to an increasing need for real-time visibility into their performance—resulting in an explosion of telemetry data that is stretching IT budgets and outpacing engineering teams’ ability to find value in that data. In fact, data volume is growing at 23% yearly, while IT budgets are only growing at 5%.

    Managing all this data at increasing cost is further compounded by unpredictable software failures and ever-evolving security threats. As a result, companies are forced to pick which parts of their software to instrument and monitor. To overcome this challenge, a different approach to managing data is required.

    Observability pipelines are emerging as a way to address this problem. They centralize telemetry data (i.e., logs, metrics and traces) from many sources, transform that data to fit downstream needs, and route it to various destinations for analysis. With complete control of the data, companies can sort through large amounts and prioritize what is essential, allowing them to act swiftly to avoid disruptions while reducing costs by only storing the data they need.

    Research indicates 62% of organizations currently have an observability practice. This means 38% operate with limited awareness of what’s happening in their software. Even those with an observability practice can only afford to store some data and have to choose which applications to instrument. This leads to blind spots and, ultimately, issues that are time-consuming to fix due to a lack of data.

    Managing Limited Resources With Observability Pipelines

    Engineers face more demands in today’s fast-paced business environment than ever before. Despite an increase in their responsibilities, the size of engineering teams has yet to grow accordingly. Given this, there has been a rise in full-stack engineers responsible for technologies from the front end to the back end. Short on time and resources, it’s difficult for these engineers to instrument and monitor software.

    Observability pipelines help control the amount of telemetry data using various processors such as sampling, throttling, filtering and parsing, and only forward valuable data to the downstream systems. The rest of the data can either be discarded or stored in a low-cost system, such as Amazon S3. This reduces costs and lets engineers focus on analyzing relevant data to identify issues.

    Engineers can also use observability pipelines to consolidate data from various tools. Many teams use different platforms or open source tools, like Prometheus or Jaeger. The fragmented data makes it hard to solve issues and understand application health. Observability pipelines combine all this data to make it easier to act on.

    It’s also important to remember that real people work on these technical challenges. Engineers face burnout working long hours to keep up with software development demands. Constantly switching between tools and manually moving data adds to the pressure. Moreover, the number of data sources, observability tools, and platforms that need that data are constantly increasing. Embracing open standards such as OpenTelemetry can ease this integration burden. Engineers can swap out tools without extensive testing and integration. The increased control and easy integration enable engineers to focus on delivering business value.

    Making Data More Usable

    Teams across organizations want access to data but struggle to use it effectively. The difficulty stems from the lack of data usability: Telemetry data is unstructured; varying formats make it hard to use; data preparation is time-consuming and sensitive data in logs may lead to compliance violations.

    By most estimates, 80%-90% of data is unstructured, which makes it hard to store and analyze because it doesn’t adhere to traditional data models. Observability pipelines make sense of unstructured data before it reaches its final destination. This is achieved using data processors that shape and transform data to make it more actionable. These processors include advanced parsers that identify and extract relevant information, transforming data into consumable formats that make it easier to work with and analyze.

    The advantage of performing these operations within the pipeline is that the same data can be prepared to fit different use cases downstream. For instance, while one team may require data optimized for visualization and trend analysis, another may require complete data for threat hunting. These transformations are managed from a single control point, eliminating the need to maintain separate data streams.

    Observability pipelines can also help companies meet data compliance requirements. For example, teams can scrub, mask or redact PII data based on a defined key structure before the data reaches a SIEM or audit platform.

    Taking Immediate Steps to Make the Most of Telemetry Data

    Organizations can take immediate action to make the most of their telemetry data. First, they need to adopt a visibility-first rather than a cost-first approach. They should assess what software they’ve instrumented. This will identify gaps in telemetry, which can be used to develop a plan to instrument all software. Next, they need to create a strategy for managing their telemetry data, being particularly thoughtful about how and why the data is stored and analyzed.

    Once a company has taken these two steps, it can decide which tools to use. One of the great things about OpenTelemetry is that it provides flexibility for future decisions about what tools to use.

    As companies invest more resources into building observability practices, they’ll encounter problems processing an extraordinary amount of telemetry data for any meaningful action. Observability pipelines provide a competitive advantage of prioritizing the essential data that will enable companies to make better decisions faster.

  • Bug Bounty Vs. Crowdtesting Programs

    Bug Bounty Vs. Crowdtesting Programs

    Digital quality and excellent user experiences are more important today than ever. When a digital experience doesn’t work as expected or is rife with friction points or glitches, customers are quick to give up and move on to a better, easier solution. Bugs and defects often come with high stakes and can result in loss of revenue, dissatisfied customers and potential damage to a brand’s reputation.

    With this in mind, software testing is tasked with the important role of catching and fixing bugs and defects before they hit production. There are several approaches to finding bugs in software, two of which are bug bounty programs and crowdtesting. In this article, we’ll examine the values of each.

    Bug Bounty Programs

    A bug bounty program typically involves people outside an organization with software testing experience, leveraging their expertise to hunt down product defects in exchange for money. Bug bounty programs can be a cost-effective way to find defects that otherwise go unnoticed. They provide an outside perspective and a sanity check for digital products to find vulnerabilities and defects.

    From a security perspective, bug bounty programs are also valuable. Today’s security teams have trouble managing the sheer volume of software vulnerabilities found in software. That’s part of the reason behind the growing number of cyberattacks and breaches that continue to be a topic of discussion. Bug bounty programs leverage white-hat hackers to find and report vulnerabilities in an effort to improve overall security posture and support the organization’s own cybersecurity team.

    Bug Bounty Benefits

    Bug bounty programs offer a variety of benefits to organizations, including:

    ● Helping with blind spots: It doesn’t matter how well your software is designed and coded. Defects and bugs, whether minor or major, will find their way into applications. The developers themselves and internal testing teams may only test certain paths based on organizational norms. Bug bounty testers offer a fresh perspective that can help reduce overall blind spots in application testing.
    ● Resource flexibility: Most organizations don’t have the flexibility to scale internal resources on short notice. Bug bounty programs offer outsourced help and are flexible. They can be scaled up if needed to help with finding defects before a major launch. Or, if a business needs to save money, it can be scaled down by either reducing payouts or limiting testers to high-value defects.
    ● Continuous evaluation: Whether an application is in use by customers or is just a prototype, a bug bounty program can go to work finding and revealing bugs and vulnerabilities. Bug bounty programs can continuously search for bugs that help improve the quality of an application.

    Bug Bounty Challenges

    While there are some great benefits to using bug bounty programs, there are challenges, as well, including:

    ● Money focus: As the name suggests, this is a bounty program. High-severity defects come with a higher payout. If a large percentage of bug bounty hunters are focused on high-severity bugs and vulnerabilities because of the higher earning potential, they may miss the smaller defects. This can add up and result in a less-than-ideal user experience, with smaller issues going unfixed.
    ● The perspective of the tester: No matter how experienced and skilled a tester is, everyone is limited by their own blind spots and perspective. A diverse group of testers can help offset this, but there is still no guarantee that they will test the product in the same way that customers will use them. This challenge is multiplied when we add in different devices, operating systems, languages, and locations. Bug bounty hunters may be more focused on finding high-value issues to earn more, while an internal tester may be more invested in a specific product or feature and making sure it works as it should.
    ● Communication: Many have gotten used to working from home or from anywhere and collaborating remotely. Bug hunters work like this too, but they are outsourced assistance from an organization, which requires a bit of extra thought for communication, project scope and qualifications to make sure misunderstandings or lags in progress are kept to a minimum.

    Crowdtesting

    A crowdtesting model leverages skilled testers and testing teams that can be sourced from a globally dispersed community of independent digital experts. Depending on the size and diversity of the community, testers can apply a nearly limitless variety of demographic characteristics, locations, skill levels, spoken languages, abilities, devices, browsers and operating systems into a testing scenario. This breadth of feedback provides valuable insights into how real users will interact with an app, device or digital experience—which may not necessarily be the “typical” way it is intended to be used. This real-world interaction can unearth bugs, friction points and localization issues that may otherwise go unnoticed before the experience is released to actual customers.

    The remote and on-demand nature of crowdtesting provides scalability and timely results in comparison to more traditional testing methods, like offshoring or lab-based testing, which are typically more limited in scope and flexibility. Plus, the crowdtesting model inherently provides the ability to scale testing services up or down as needed to meet the project-based requirements of a company’s internal teams.

    Crowdtesting Vs. Bug Bounty Programs

    Both bug bounty and crowdtesting programs involve digital experts looking for app defects and vulnerabilities with the goal of improving digital quality. These programs can be aligned in this goal and even work in tandem, but there are some notable differences between them worth mentioning.

    ● Scope: Bug bounty program scopes will always be somewhat limited. Defects can be found outside of the payment scope and go unflagged. Crowdtesting allows for either a broader or more specific scope, depending on needs. Organizations can give specific instructions, like making sure UX considerations are taken into account.
    ● Volume: Both crowdtesting and bug bounties rely on skilled professionals who know how to root out bugs and defects. Crowdtesting, however, allows for as many or as few testers as needed. Instead of gathering a moderate amount of defects from a more technical audience, crowdtesting enables testing for any amount of defects from a diverse and vast pool of testers. As a result, crowdtesting finds a larger variety of defects, and across more devices, locations, and OS versions. This can also be a challenge, as internal staff can become overwhelmed by so many bug reports to look through and address. Therefore, prioritization is key.
    ● Flexibility: Digital quality is a multi-faceted process. It’s not just about functional and security bugs but also accessibility assessment, making sure to test using specific devices and use cases, and more. Bug bounties fall short here, while crowdtesting delivers the flexibility to test and address situations your potential customers may face when an application is live.
    ● Specificity: Most bug bounty programs are not tailored. They can be application- or region-specific, but that doesn’t always reflect a target customer use case. Crowdtesting enables an organization to focus on specific demographics in terms of user experience. An organization can specify testers in certain locations with a certain device or devices and who speak specific languages. Crowdtesting isn’t always just about technical ability; it’s about finding the correct group of people needed for the task at hand.

    Both bug bounty and crowdtesting programs provide unique benefits that help organizations improve overall digital quality. Bug bounty programs offer help with organizational blind spots while leveraging testing professionals in a flexible way. Crowdtesting enables businesses to harness the power of real people using actual devices out in the world to test for use cases. It delivers the power to augment internal testing initiatives, helping to improve overall quality, usability, accessibility and more. When improving digital quality and user experience are the goal and end result, bug bounty and crowdtesting programs can each be impactful and helpful for today’s businesses and for improving the user experience.

  • Low-Code Should be Worried About ChatGPT

    Low-Code Should be Worried About ChatGPT

    Is ChatGPT the technology revolution that will save the world, or the Pandora’s Box that will eventually destroy it? How about neither? Putting these two extremes aside, a more rational concern is whether ChatGPT will steal your job, especially if you work in software development.

    Is this a fair concern? Conversations like this are nothing new. New technologies always go through this cycle; starting with intrigue then moving onto fear and resentment until eventually being accepted and embraced as the new normal.
    ChatGPT and other natural language AIs are undoubtedly exciting new trends with huge potential. One area of ChatGPT’s potential that has largely been overlooked is how it can democratize software development. Should low-code/no-code providers be worried about this?

    Delivering the Low-Code Promise

    Low code has long promised to democratize software development by providing a way for non-coders to develop applications themselves. This “democratization of IT” promises a new wave of innovation by enabling organizations to create new processes without the new to engage with IT. While low-code has already achieved some great things when and where it has been implemented, the amount of change it can deliver is fundamentally limited by the developer’s choices. The developer still chooses which aspects of the application can be configured by the user, so the user still has no fundamental access to the code. While this has been low-code’s strength (since users cannot damage the underlying code if they can’t access it), users are still beholden to developers to do anything significant. ChatGPT could allow users to make more significant changes to applications, potentially enabling organizations to achieve far more than with low-code and in half the time.

    Software Development is Just the Start

    ChatGPT can achieve more than helping non-developers build the applications they need. If you think about the most common reason for an IT project failure, it is rarely down to poor delivery or mismanagement alone. Most IT projects fail because they do not deliver the outcomes that users want. This happens because of a communication breakdown between IT and end users. On one hand, users fail to convey exactly what they want and IT fails to ask the right questions to find out. The requirements (i.e., the intended outcomes) get lost in translation because technical and non-technical people simply speak different languages.

    In a scenario where the message is too often lost in translation, ChatGPT can serve as the interpreter between those who build and maintain IT and the wider staff who use it day-to-day. ChatGPT can bridge the gap because users won’t need technical skills to realize the changes they want.

    Always Start with the Business Case

    Delivering change in an organization is fraught with challenges and uncertainty. Like any project, it is important to start with the fundamentals of what you’re trying to achieve, not the technology you want to use. No matter how much you want to use ChatGPT, you must start by defining the outcomes you want to achieve and working backward from there. How you achieve these outcomes is a technical decision that comes much later. If one of your questions is to enable change to happen faster and to be more adaptive to the company’s needs, then ChatGPT may well form part of the answer. Just remember to define the problem first, build the business case and then evaluate the various solutions to achieve those objectives. Don’t get carried away by the hype.

    ChatGPT Needs Room to Flourish Outside of IT

    ChatGPT has the potential to be the bridge between technical and non-technical users in every organization. It can reduce the gulf between these radically different types of people to speed up change in the organization and deliver better outcomes for all. But it is crucial for technologies like ChatGPT to sit within the domains where they will have the best chance to flourish. In what might sound like a controversial statement from someone in the IT sector, I believe that, like low-code, ChatGPT must sit outside of the technical domain. ChatGPT needs to move out of the IT sector where it was born to reach its full potential. The question is, is IT ready to let it go?

    Image via Unsplash

  • Understanding Cloud APIs

    Understanding Cloud APIs

    Six out of every 10 businesses had moved their workloads to the cloud as of last year. More steady traffic in the cloud and more direct cloud instances mean more to juggle–and the need for greater customization and integration. That’s where APIs come in. APIs are doing for the cloud what they did for on-premises resources: Segregating, simplifying, specializing and integrating services across a network–only this time, it’s future-proofing the architecture by building it in the cloud. As one cybersecurity researcher quipped, “Everyone wants to use APIs to build innovative solutions, but no one wants to invest in building them.” Cloud APIs will soon spell the difference between companies that can keep up with digitization and those that can’t.

    Ultimately, it will come down to which organizations take the time to understand them and use them to their best benefit.

    What is a Cloud API?

    Simply put, “a cloud API is a software interface that allows developers to link cloud computing services together.” APIs allow services to share functionality and information for other programs to use, and nowhere is this more important than in the interconnected ecosystem of the cloud.

    Because APIs act as a waiter in a restaurant, the better the waiter, the simpler ordering will be for you and for your customers. The best cloud API connects backend cloud components, services and platforms and does all the busy work so all your users see on the front end is a seamless customer experience. Since most of the work of tomorrow will be in the cloud (and is moving there in ever-increasing numbers), to not build up this functionality now is to take a deliberate risk.

    Types of Cloud APIs

    There are several types of cloud APIs based on the four major areas where cloud computing will require integration–either with another platform or another cloud provider.

    ● PaaS APIs (Service level): These platform-as-a-service APIs are designed to integrate with databases, portals, storage components and messaging systems, providing access and functionality in the cloud.
    ● SaaS APIs (Service level): Referred to as software-as-a-service APIs, these connect application layer resources with the cloud and underlying IT infrastructure. A CRM is a good example of where these types of APIs can be used to create a “cloud application extension” for your ecosystem.
    ● IaaS APIs (Service level): Infrastructure-as-a-service APIs control the distribution and deployment of specific cloud resources, performing such tasks as rapid provisioning and de-provisioning, network configurations and workload (VM) management in the cloud.
    ● Cross-platform APIs: Because many environments use multiple cloud providers and platforms, cross-platform compatibility is required. Cross-platform APIs streamline data management by allowing tenants to access their cloud-based resources and workloads from any of their cloud providers, not just their primary one. They provide a higher level of abstraction by translating a specific provider’s API calls into a more generic form, making accessibility, manageability and interoperability in the cloud easier.

    Cloud API Security

    In many respects, the security threats faced by cloud APIs are the same that any cloud-based resource would encounter and present the same challenges. That being said, malicious API traffic surged over 117% last year, from an average of 12 million to over 26 million calls, according to one industry report. The same study revealed that over a third of respondents experienced authentication and data exposure-related incidents with their APIs, and 54% delayed rolling out a new application because of API security concerns.

    Unguarded, a cloud API could present the keys to the kingdom and allow an attacker to access the hub of not just one but several cloud providers and their workloads, resources and assets. Protecting cloud-based APIs with standard authentication and authorization practices such as OAuth2.0 and OpenID Connect can reduce the chance of a lateral attack.

    Why Cloud APIs

    Cloud usage is not set to slow down and will soon become ubiquitous. Companies that aren’t on it are migrating their workloads in greater numbers and entrepreneurial ventures are spinning up as cloud-native. Cloud APIs are simply the logical response to the complexities that come with the terrain. Without cloud APIs, the user experience will be negatively impacted and will only become more apparent when compared with companies that do use cloud APIs.

    For companies looking to innovate in 2023 and release new applications, APIs are the way to cut-and-paste the process safely. Similarly, as more cloud-based services become API-reliant, application reusability is another factor requiring cloud APIs. And lastly, the complexity of cloud products, platforms and ecosystems (even within one organization) makes cloud APIs a necessity for smooth interoperability. And they help with scalability–multiple components of a cloud-based service can be parsed out, updated and patched individually and refined separately so that one area can develop without being dragged down by the whole. Cloud APIs allow for that granular level of customization that can help an organization refine its edge.

    Simply put, organizations will need these APIs to not only compete but stay relevant as businesses continue to take their fight to the cloud.

  • DevSecOps Provides a Modern Security Model for Modernization

    DevSecOps Provides a Modern Security Model for Modernization

    Developers and security experts are now tasked with bolstering, extending and adjusting cloud and Kubernetes security to protect against cyberattacks that are ever more complex, volatile, and frequent. To foil attacks and create a secure foundation for applications and infrastructure from the beginning, DevSecOps (development, security and operations) has become the trending development and operations practice. In the DevSecOps model, security becomes a shared responsibility. Thus, DevSecOps requires a mindset shift to enable collaboration between development, security and operations teams. This shift, commonly referred to as shift left, involves culture, processes and tools. With DevSecOps, whether it’s testing for security vulnerabilities or building security services that can be used directly for business purposes, the goal for all participants is to build security into applications from the start and throughout the continuous integration and continuous delivery (CI/CD) workflow of DevOps.

    DevSecOps to the Rescue

    In the past, security considerations and practices were often introduced at the end of the development cycle by a separate security team and tested by a separate (QA) team. This was manageable when software updates were released every few months or even years. But in today’s landscape, consumer habits and expectations are shaped by smartphones and digital commerce, which has fueled the demand for software services that are real-time and available 24/7. This requires modern enterprises to find ways to improve the efficiency of application developments, releases, and updates.

    Because of these factors, enterprises realize that security can no longer be a small part of an afterthought in the production environment. The purpose of DevSecOps is to ensure that through collaboration, security can be carried through to every point in the development cycle. This enables teams and enterprises to deliver secure, high-quality applications in a more efficient manner without extensive security checks and fixes occurring during post-production.

    To meet these more extreme demands, cloud computing, containers, and microservices have made it possible to accelerate the development and delivery of software releases. Developers adopting agile and DevOps practices can reduce software development cycles to days and weeks, thus meeting the diverse needs of enterprises and users.

    This fast-paced development and upgrade frequency has created new security concerns and the need for companies to be more agile in responding to security issues. DevSecOps has been introduced into the DevOps framework to meet these needs by make security a shared responsibility. Today, continuous testing and integration, including security scanning of pipelines, is becoming the norm.

    DevSecOps Business Benefits

    In principle, DevSecOps shares the DevOps ideal of multiple teams working together to improve team efficiency and achieve secure, continuous software delivery.

    In addition to the security benefits DevSecOps provides, there are significant business advantages to be gained, including:
    ● Efficiency–Under the DevSecOps practice, security is integrated into all periods of development to help all teams be more agile in responding to security risks, eliminating the need for teams to spend a lot of time tweaking and fixing during the production cycle.
    ● Cost reduction–By discovering security vulnerabilities before they enter production, organizations and teams can significantly reduce the time and labor costs of fixing them.
    ● Ensure compliance–DevSecOps can ensure compliance with industry-standard regulations, such as the General Data Protection Regulation (GDPR). DevSecOps gives teams a holistic overview of these measures that makes compliance easier.
    ● Establishes collaborative culture–Integrating security practices into DevOps enhances the value of DevOps and improves the overall security posture as a culture of shared responsibility. When everyone is involved in the process, it increases their awareness of security fundamentals and best practices and provides a sense of ownership in the results.

    Meeting New DevOps Challenges

    Kubernetes offers many advantages but also poses unique security challenges that can be difficult to address for organizations lacking in Kubernetes talent and experience. This is why organizations will increasingly see the need to reevaluate their security practices and prioritize a more advanced security-focused culture.

    Because DevSecOps requires security to be addressed throughout all development stages, it requires developers to have security expertise while coding and operating. We are currently seeing a growing skills gap in the DevOps industry, and developers are feeling burned out. Security training is a way for teams adopting DevSecOps to acquire additional knowledge.

    Deploying Kubernetes platforms with security built in by default also will be recognized as a means to reduce the burden of security on IT teams. This will reduce the pressure and burnout on all sides.

    Platform Engineering Provides Additional Help

    With the rapid development of Kubernetes and cloud-native applications, organizations are realizing the inadequacies of their IT teams to leverage DevOps practices. Just as platform engineering eases the burden of DevOps by providing an Internal Development Platform (IDP) that serves as a “golden path” for developers, an IDP can simplify the practice of DevSecOps.

    We’ve seen that a DevOps workload is difficult to practice in small and medium-sized enterprises, as well as in large enterprises that lack sufficient talent. The gradually accumulated cognitive load ultimately leads to a less agile and efficient collaboration between teams. Given these issues, more organizations will adopt platform engineering as a better alternative.

  • Good Things Happen When DevSecOps and Cloud Collide

    Good Things Happen When DevSecOps and Cloud Collide

    The marriage of cloud and software development is arguably the heart and soul of digital transformation. Providing pathways to greater efficiencies, lower costs and greater enterprise performance, the duo is poised to fundamentally transform industries as we know them. The compounding complexities of hybrid cloud operations and software supply chains, however, have led to a greater risk of vulnerabilities, errors and attacks.

    Increasingly wrapped around microservices, containers and orchestration platforms, the complexities of cloud expansion and software development couldn’t be more intertwined or expose more complicated risks than they do today.

    Software: A World of Consistent Change

    The state of software development is one of consistent change. Whether we call it agile or adaptive matters far less than the need to infuse operations with a new mindset and culture about the need for continuous development. Increasingly that includes the infusion of security disciplines and technologies directly into the main artery of that development.

    Enter DevSecOps, an approach to software that integrates security initiatives at every stage of the software development lifecycle to deliver high-performing secure applications.

    The cause is not lost on the National Institute of Standards and Technology (NIST) and its cybersecurity center of excellence (NCCoE) which has announced a DevSecOps project dedicated to “developing and documenting an applied risk-based approach and recommendations for secure DevOps and software supply chain practices consistent with the secure software development framework (SSDF), cybersecurity supply chain risk management (C-SCRM), and other NIST, government, and industry guidance.”

    This is a far cry from software development of old. According to CTO Emeritus, Hu Yoshida, “Software, once the product of developers confined to writing long lines of code for specific applications, is now an exercise of integration – an amalgamation of third-party components provided by a variety of vendors, cloud providers, and open source software (OSS) groups. In fact, today, as much as 90% of code comes from such outlets, creating a software supply chain.”

    Although these new processes provide great advantages in terms of access to innovation and faster development cycles, the addition of external touchpoints and third-party software increases the risk of flaws, mistakes, and vulnerabilities. These risks only rise further when considering their deployment, usage, and management across complex hybrid cloud environments.

    How to Take Advantage of the Collision

    Cloud-based data is accounting for 39% of successful cyberattacks. Containerized applications, which have been a boon to both migration and management can also lead to vulnerabilities – which is fitting for security to be cited as a top concern for more than half of the organizations surveyed.

    From business continuity to business performance, organizations must begin assuming a security posture that considers the rising confluence of cloud management and software development.

    The idea is simple: You must find a way, a process, a method, and the right partners to help secure all workloads across any cloud environment, regardless of the platform or the amount of data and application real estate needed.

    By establishing this model, organizations are able to create a fundamental layer of protection against the ever-evolving threat of cybercriminals. Take one of our large banking customers, for example, who runs critical applications on AWS with stringent security and compliance requirements. We implemented a secured framework to protect their applications running on modern, cloud-native services like containers and Lambda functions using DevSecOps principles and cloud-native SIEM solutions. This enables them to scale their business in the cloud without worrying about compliance violations.

    One of our large pharmaceutical customers with a very large presence in both AWS and Azure experienced challenges keeping their cloud security posture in pace with the growing business demands on the cloud, increasing risk to the environment. By establishing a security process using cloud security posture management, we were able to significantly reduce cloud misconfigurations and auto-remediate several cloud vulnerabilities proactively to improve the security posture of the environment.

    The bottom line is that building security into the workloads will provide a fundamental layer of protection. The collision of cloud and DevSecOps is real. Organizations would be wise to realize it and take advantage of it to dramatically improve business performance and resiliency.

  • DevOps Flow: Accelerating Velocity With Software Factory Best Practices

    DevOps Flow: Accelerating Velocity With Software Factory Best Practices

    In the cloud era, senior executives are investing in key capabilities like DevOps with the expectation this will accelerate innovation and bring new digital products to market faster. To deliver on these goals, enterprise organizations seek to deploy high-quality code faster and more frequently, but they face a organizational, process and technology complexity that can hinder this objective, slowing throughput and incurring high error rates. Often when DevOps is discussed, the focus is concentrated on the technology layer, particularly the latest tools like Kubernetes, and also on the productivity of each individual developer.

    However, for many organizations, the main challenges will be with team practices and organizational models.

    Writing for DevOps.com, Mike Vizard highlighted the reality of DevOps uptake; that most adoption issues are related to organizational challenges, not technology. The top two barriers to adoption are slow processes and speed of adaptation (29%) followed by budget and funding (21%). Only 18% identified technology limitations as an issue.

    As Mike writes, it is the broader organizational transformation that is more challenging. ‘Addressing bottlenecks’ might be a function of confronting the situation of a department manager who zealously guards their turf and acts politically to resist any changes required.

    Implementing DevOps for one team is a relatively straightforward exercise, but for enterprise organizations, they face a much larger magnitude of complexity, as they typically have multiple teams spanning multiple geographies and suppliers with hundreds of developers all contributing to the same software development process.

    Therefore, a DevOps methodology that also addresses the organizational level is required, one that maps processes end-to-end and identifies the improvements needed to speed production across this entire life cycle.

    Software Factories

    Transformation leaders are turning to a ‘digital factory‘ approach to streamline this complexity into a production line model that yields consistently high throughput and quality using Lean principles derived from the manufacturing world.

    McKinsey explored the dynamics and successes of the digital factory model, a new approach to organizing digital teams. This model involves a self-organizing structure rather than rigid departmental hierarchies, and they described the KPI improvements the digital factory enables: “We see reductions in management overhead of 50% for technology teams in the digital factory, 70% in the number of business analysts needed to write technology requirements, and, as test automation becomes the norm, a drop of 90% in the number of testers. Finally, we see top engineering talent performing at eight times the level of their peers, as measured with metrics such as code commits.”

    In short, McKinsey described a development team that improves quality and finds efficiencies as a direct by-product of one that leverages the latest tools and team methods to produce better digital products faster. The concept of a ‘software factory’ is a very powerful metaphor because much of the insights are drawn literally from the world of manufacturing, where over many decades they have perfected the science of optimizing the efficiency of a production line.

    To close the loop and map these development improvements to business value, management can leverage organizational performance practices, notably Six Sigma and the theory of constraints, to define their ‘DevOps algorithms,’ a systematic formula for quantifying and improving the rate of software development throughput.

    DevOps Flow

    DevOps Flow is a methodology for implementing high-performance, cloud-centric software development based on science developed by pioneers like Toyota to optimize factory lines and apply this to software engineering.

    Organizations need the ability to measure the entire system end-to-end to understand how value flows and where it is constrained and, most importantly, to correlate those metrics with desired business outcomes. This approach allows for continuous optimization in the pursuit of delivering greater and greater value to the organization faster.

    It can be applied to speed the deployment of new software releases, notably identifying and removing constraints, reducing batch sizes and eliminating waste. These are all steps taken within manufacturing to increase production throughput and are improvements that software teams can adopt to achieve equivalent benefits.