devopsy.kinsta.cloud

Tag: DevOps

  • This is Not Just a Test: DevOps and the Need to Automate

    This is Not Just a Test: DevOps and the Need to Automate

    Creating software is as much about the process as it is about the product. In recent years, we’ve seen the speed of innovation reach new heights due to more efficient development and quality control. DevOps has further accelerated development by combining software and operations in unified, self-improving teams. With automation taking care of rote tasks, developers can now tackle more difficult issues, resulting in even greater software quality and faster development. The need for speed to market is vital; a month or two can make or break a product launch. Then again, if a product isn’t tested thoroughly in the rush to get to market, flaws can slip through and an organization’s revenue and reputation can take a serious hit. In the U.S., software failures in businesses’ operations systems cost a total of almost $1.6 trillion in 2019. The problem is that it can be a bottleneck and create major delays in the release cycle. In fact, A recent survey of 4,300 developers revealed that it is the top reason that releases are delayed.

    In the past, the waterfall approach was common. Tests usually took place after code was written; carried out by testers who had no interaction with the original developers. As a result, bugs that could have taken moments to correct during development required days or even weeks to fix afterward. Even worse, the complexity of the finished software and its many dependencies meant that fixing a localized bug could introduce additional problems that needed to be fixed after another round of testing, further delaying the release.

    But even in a modern DevOps environment, testers and developers are still speaking entirely different languages. By and large, testers do not code and software developers are not expert testers. The two teams typically converse through multiple logs, event viewers and other operating system tools. It creates a great deal of friction and slows down the process.

    Shift Left 

    DevOps represented a big improvement over waterfall methods but, even so, it’s far from a set-in-stone process. It, too, has evolved and right now, shift left testing has moved into the spotlight.

    In this approach, the guiding philosophy is to test early and often, beginning very early in the development cycle and continuously throughout every stage whenever there’s an opportunity. As a result, bugs are caught early when the relevant code is still fresh in the developers’ minds, so it’s easier to fix. In the end, businesses are able to release higher quality software much faster and more frequently.

    Environmental Tests

    When it comes to the DevOps process, it’s not always clear where and how to automate the process. The following looks at how that can be incorporated into DevOps based on four different environments in a continuous delivery (CD) pipeline.

    These environments include local development (usually a coder’s personal device), a continuous integration (CI) or development server, test servers for user interface (UI) testing and the production environment itself. Each has stages with requirements that must be met for code to advance.

    Whenever any new software features or capabilities are entertained, though, developers and the QA team should begin by answering the question, “How can this be tested?”

    Moving Through the Stages

    Once code is created, it must be able to be built without error, passing all unit tests and local verification.

    This stage is particularly important because the development environment echoes the requirements of production; if it works here it’ll likely also work for the customer.

    At this stage, running early regression and developer verification tests ensures the build is ready while providing feedback about the reliability of the environment. It’s useful to have individual test cases as part of more than one schedule. This enables developers to test minor parts of the software without undergoing regression tests of all product features. These tests should be automated and triggered as part of the same process.

    Developers should have the ability to perform basic tests on their own code. After all, the sooner a flaw is identified, the easier it is to eradicate. Just as testers are not experts in coding, neither are developers expert testers. To shift left and effectively integrate tests at all stages of the development life cycle, it must be automated. This will allow developers to test larger quantities of code earlier and more frequently.

    Once through this stage, the software can advance to the test environment.

    This is where a variety of product tests take place, including those for function, load and performance. Passing this stage entails completing all automated functional UI tests, verification of visual appearance, an inspection of server logs and performance evaluation.

    This is where most regression tests are conducted and automation is crucial for scheduled tests to be triggered.

    Next, the product moves into the production stage.

    Tests still occur in this stage to pinpoint any remaining bugs. Automated tests are then run against the production environment to closely mirror interactions with real end users. At this point, it’s highly unlikely there will be major issues but, if there are, running tests at earlier stages could very well be the culprit.

    Throughout the process, ideally, testers will use a visual, no-code tool to create these automated tests. In this way, testers are able to more rapidly and intuitively implement test automation without having to tap into programming resources. Additionally, the integrated documentation of the actions taken during automation will be interactively connected to visual documentation of the test results. The upshot is that testers and developers gain a shared language for both building test automation and troubleshooting the issues it identifies.

    This is Not Just a Test

    Effective, scalable tests are crucial to delivering the reliable, high-quality software that today’s businesses rely on for day-to-day operations. This is why DevOps and development teams need to integrate tests at all stages of software development. Shift left speeds up the creation of better quality software, which provides a significant market advantage. After all, it’s not just about software quality; it can show which companies are best prepared to meet market demands.

  • Teleport Raises $110 Million Series C at $1.1 Billion Valuation Led by Bessemer Venture Partners with Participation from New Investor Insight Partners

    Funding follows dramatic revenue growth as identity-based access requirements skyrocket

    Oakland, CA, May 3, 2022 – Teleport, the leading provider of Identity-based Infrastructure Access Management, today announced it has raised $110 million in Series C funding led by Bessemer Venture Partners with participation from Insight Partners and existing investors Kleiner Perkins and S28 Capital. This investment brings Teleport’s total funding raised to $169 million at a current valuation of $1.1 billion, and comes after the company nearly tripled its revenue and doubled its customer base from 2020 to 2021.

    As a part of the investment, Bessemer Venture Partners’ Mary D’Onofrio will take a seat on Teleport’s board, and Insight Partners’ Matt Koran will be a board observer. In August 2021, Teleport announced its $30 million Series B round led by S28 Capital and Kleiner Perkins.

    “Growing complexity of modern cloud environments has led to a situation where managing secure access to infrastructure begins to break, as evidenced by increased frequency and severity of breaches.,” said Ev Kontsevoy, co-founder and CEO, Teleport. “Our customers are forward thinking organizations that are scaling quickly. They realized that the right way to scale access is consolidation across all protocols and environments. Our platform, the open-source Teleport Access Plane, addresses these challenges by giving every engineer, every piece of hardware and every application an identity. With identity based access for everyone and everything, more security threats are neutralized and the impact of breaches is dramatically reduced without impacting developer productivity.”

    As organizations deal with complexity because of shifts to the cloud, modernization of IT stack and growth of mixed infrastructure environments, Teleport’s open-source Access Plane technology consolidates the four essential capabilities every security-conscious organization needs: connectivity, authentication, authorization and audit. By providing the only cloud-native, identity-based infrastructure access solution for humans and machines, Teleport eliminates network perimeter security issues, reduces attack surface area, cuts operational overhead, enforces security & compliance, and improves developer productivity, all at once.

    With this latest funding, Teleport will expand its go-to-market organization to serve its fast-growing, global customer base. Teleport will also bolster its R&D organization to solve the most complex security challenges faced by organizations of all sizes.

    “Now, more than ever, is the time to make it easy for any company to employ world class security practices as global cyber attacks become more and more sophisticated,” said Mary D’Onofrio, partner and co-founder of growth investment practice, Bessemer Venture Partners. “With Teleport, security becomes stronger *and* simpler for both humans and machines, making it possible to deploy and enforce security and compliance best-practices throughout all organizations. We’re excited to lead this round and I am looking forward to working closely with Ev and his team to offer elegant cybersecurity solutions to a growing customer base of household names.”

    Customers including Doordash, Elastic, Nasdaq, Snowflake and others use Teleport to secure digital infrastructure access for remote and hybrid workforces and combat the ever-increasing cyber threats.

    “Speed is key to our business. But so is security,” said Luke Christopherson, Software Engineer at Doordash. “The Teleport Access Plane allows our engineers to securely access the infrastructure they need to do their jobs without getting in the way of productivity. Everybody wins.”

    Teleport recently announced Teleport 9, the latest edition of the open-source Teleport Access Plane. This release introduced Teleport Machine ID which delivers identity-based access and audit capabilities for resources including servers and databases, CI/CD automation, service accounts and custom code in applications such as microservices. Teleport 9 also included Teleport Connect, a secure, developer-friendly browser for cloud infrastructure. The browser solves the issues posed by terminals optimized for local environments when a majority of development now happens in the cloud.

    Steven Dickens, Senior Analyst, Futurum Research commented, “As digital transformation takes hold from the core to the edge, security becomes more critical. The team at Teleport are focused on delivering cloud-native, identity-based infrastructure access solutions for both humans and machines. The announcement today take the company one step closer to its mission of eliminating the need for secrets when accessing infrastructure, and as a result delivering both simpler, stronger identity-based authentication.”

    To learn more about Teleport and today’s news, visit the company’s website or most recent blog about the funding.

    About Teleport
    Teleport, leading provider of Identity-based Infrastructure Access Management, consolidates the four essential infrastructure access capabilities every security-conscious organization needs: connectivity, authentication, authorization, and audit. Teleport’s unique approach is not only more secure but also improves developer productivity. Teleport is used by leading companies including Elastic, Snowflake, Doordash, and NASDAQ. The company is backed by Bessemer Venture Partners, Insight Partners, Kleiner Perkins, and S28 Capital. Headquartered in Oakland, California, the company embraces a remote-first work culture.

    About Bessemer Venture Partners
    Bessemer Venture Partners helps entrepreneurs lay strong foundations to build and forge long-standing companies. With more than 135 IPOs and 200 portfolio companies in the enterprise, consumer and healthcare spaces, Bessemer supports founders and CEOs from their early days through every stage of growth. Bessemer’s global portfolio includes Pinterest, Shopify, Twilio, Yelp, LinkedIn, PagerDuty, DocuSign, Wix, Fiverr and Toast and has $9 billion of capital under management. Bessemer has teams of investors and partners located in Tel Aviv, Silicon Valley, San Francisco, New York, London, Boston, Beijing and Bangalore. Born from innovations in steel more than a century ago, Bessemer’s storied history has afforded its partners the opportunity to celebrate and scrutinize its best investment decisions (see Memos) and also learn from its mistakes (see Anti-Portfolio).

  • EP 27: DevOps Dojo

    EP 27: DevOps Dojo

    Leveraging DevOps Dojos and Centers of Excellence (CoE) A DevOps Dojo is the place where DevOps teams come together for hands-on training in a collaborative, risk-free learning environment. DevOps Dojos and CoEs can improve automation and software development processes and enable teams to deliver higher-quality products. DevOps Dojos and CoEs create a knowledge and learning hub that boosts teamwork, improves communication and leads to the implementation of better processes and tools. Whether you are starting your career as a DevOps engineer or you are a seasoned professional, a DevOps CoE or a DevOps Dojo can help expand your knowledge, enhance your existing skills and help your organization maximize the potential of DevOps. In this episode, hosts Alan Shimel and Mitch Ashley are joined by Larry Maccharone (Contrast Security) and Shaaron Alvares (Salesforce) to discuss the benefits of DevOps Dojos and CoEs and offer insight on how to build your own DevOps Dojo.

  • Tackling the Complexities of Multi-Cloud With a New IT Model

    Tackling the Complexities of Multi-Cloud With a New IT Model

    The pandemic put incredible pressure on organizations to modernize and accelerate digital transformation efforts, with many businesses rushing to embrace cloud strategies in response. According to this year’s Enterprise Cloud Index from Nutanix, multi-cloud—an IT operating model that combines multiple clouds, public or private—is the most commonly deployed IT environment and the only IT model on an upward adoption trajectory. In fact, nearly two-thirds (64%) of organizations plan to operate a multi-cloud environment within three years.

    But there are complexities and challenges of managing across cloud borders that organizations are still grappling with, and concerns about security, data integration and cost remain. Enterprises will need to find ways to leverage existing cloud investments and redefine best practices and what it means to have agility and resilience in IT.

    Current Challenges

    Businesses have traditionally been designed around managing costs, increasing efficiency and streamlining operations, but lean IT teams find themselves under new pressures to support the challenges we’re facing today. The pandemic forced organizations to prioritize implementations and view the public cloud as a quick solution for everything without proper due diligence at the expense of optimization. This approach lacked focus on strategic business outcomes, and ultimately led to increased complexity, higher costs and less flexibility. According to the study, 87% of respondents agreed that multi-cloud success requires simpler management across mixed-cloud infrastructures.

    Enterprises also continue to rank improving security as a top IT priority, yet managing security was among the top multi-cloud challenges cited. Additionally, the majority of respondents (80%) say that moving apps can be time-consuming and costly, and 77% agree that workload portability is a significant challenge. This underscores the need for uniform management and operations across different cloud environments to avoid costly and time-consuming efforts to move applications.

    “Cloud-Smart” approach to IT

    Current cloud thinking is that there’s a “best” cloud environment for each workload or application, but there is no one-size-fits-all approach to the cloud. Organizations will start to move away from blanket cloud-first approaches to IT, and instead, be more thoughtful about which workloads run where. It is no longer a foregone conclusion that taking every app or workflow to the cloud permanently is the best course of action. The adoption of this “cloud-smart” approach, leveraging the most appropriate cloud environment for each use case, is likely a primary driver behind the proliferation of multi-cloud.

    The use of IT infrastructure by organizations is becoming more strategic over time. Nearly three-quarters of IT professionals (72%) feel that the IT function in their businesses is seen as more strategic now than it was a year ago. While businesses are now viewing and using IT more strategically than ever before, the complexity of multi-cloud is creating challenges that are standing in the way of cloud success. Despite challenges, a strong case is made for why the future of IT is hybrid multi-cloud, a model that enables more operational consistency across clouds. In fact, 83% consider it ideal.

    Multi-Cloud Supports New Ways of Working

    The pandemic has changed how nearly all organizations operate, and the top reasons cited by businesses for changing their infrastructure and deployment models are improving remote work and collaboration. While an organizations’ remote workforces may fluctuate, they are here to stay for the foreseeable future and IT will need to be nimble to support a remote, hybrid workforce and keep people productive and connected regardless of location.

    Over half (61%) of organizations are focused on offering more flexible work setups because of the pandemic, and multi-cloud supports this new way of working. It offers the most agile IT environment for supporting this kind of flexibility by distributing data and allowing remote access to business applications from diverse geolocations for user proximity and business continuity, and enabling organizations to implement technology that helps retain and attract talent.

    Multi-cloud is here to stay—and is the only operating model that is expected to increase in the coming years. 2022 will bring about a shift towards hybrid multi-cloud deployment as organizations look to take advantage of what each cloud has to offer while still having the flexibility and freedom of choice around their applications and data. This would deliver on the flexibility and agility that most organizations seek to compete in today’s digital world while enabling enterprises to significantly simplify operations. Future-proofing cloud strategies is the key to building IT resilience.

  • Wi-Fi 7 Chips Ahoy | Google ‘Gone Downhill Fast’ | Real-World ‘Severance’

    Wi-Fi 7 Chips Ahoy | Google ‘Gone Downhill Fast’ | Real-World ‘Severance’

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: The first silicon for Wi-Fi 7, Google’s search quality “is” failing, and what Severance tells us about The Great Resignation. (more…)

  • Encore Platform for Running Distributed Apps in the Cloud Arrives

    Encore Platform for Running Distributed Apps in the Cloud Arrives

    Encore has made generally available a namesake backend development engine for rapidly building scalable distributed IT environments across multiple cloud platforms.

    Fresh off raising $3 million in seed funding, Encore CEO André Eriksson said the Encore platform analyzes source code to eliminate the need to manually configure, connect and set up portable cloud computing environments.

    In addition to being able to automatically setup and manage cloud infrastructure based on the metadata surfaced by static analysis tools, Encore provides access to a built-in continuous integration/continuous delivery (CI/CD) platform, previews of environments, live reloads of cloud environments, authentication, secrets management and automatic distributed tracing capabilities.

    Eriksson said the development of the Encore environment was, in part, inspired by how developers of games today routinely use an engine to build application environments rather than presenting developers with a set of text-based editing tools to build those environments using low-level boilerplate code that has to be written by developers for each application instance.

    Written in the Go programming language, Eriksson said Encore platform is based on an open source Encore Go Framework that prevents IT organizations from becoming locked into an Encore platform that today can be deployed on Amazon Web Services, Google Cloud Platform and Microsoft Azure cloud services.

    The building and deploying of distributed applications has always been a major challenge. Encore is designed to automate most of the routine tasks that DevOps teams today need to manually perform for each distributed application they support. As the number of applications being deployed across various cloud computing platforms increases, the challenges associated with managing those environments increase. Encore is designed to enable developers to easily build and deploy application code in a way that can be centrally managed by a DevOps team, noted Eriksson.

    It also takes advantage of the concurrency capabilities that the Go language enables to make it simpler to build and deploy distributed applications in a cloud-agnostic manner, said Eriksson. DevOps teams can also employ Go to extend the Encore environment within the boundary of certain limitations, he added.

    Essentially, Encore is making a case for an opinionated distributed computing environment that, in return for less flexibility, promises to make it simpler to deploy complex applications. Eriksson said Encore doesn’t see many DevOps teams looking to deploy distributed applications that span multiple cloud services, but they are being required to deploy more applications on different cloud platforms. Each cloud platform a DevOps team needs to support only serves to make the overall IT environment that much more complex to manage, he noted.

    It’s not clear to what degree IT organizations are ready to embrace a more opinionated approach to managing cloud computing environments. However, the concept of relying on one is hardly new. Platform-as-a-service (PaaS) environments have been employed for years. However, with the rise of microservices-based applications that are inherently distributed, the issue may soon be forced as IT organizations find simply no other way to keep pace with the rate at which applications are being developed and then continuously extended after they are deployed.

  • Quali Adds Control Plane to Platform to Manage IaC

    Quali Adds Control Plane to Platform to Manage IaC

    Quali has added a control plane to its Torque platform to give DevOps teams the ability to consistently provision and orchestrate infrastructure across a heterogeneous distributed computing environment.

    Amir Rosenberg, vice president of product for Quali, said the control plane allows DevOps team to centrally manage the provisioning of infrastructure via reusable blueprints accessed via a self-service portal, which individual developers can access. That approach eliminates a bottleneck that occurs when DevOps teams manually provision infrastructure on behalf of development teams, he said.

    The latest release of Torque also adds enhanced visibility and cost control capabilities such as the ability to set limits for maximum duration and number of concurrent environments and limits for the total cost of an environment. Also included are cost reporting tools for Kubernetes clusters and improved forecasting and resource consumption policies that can be applied to blueprints, sandboxes and spaces.

    Security enhancements include new customizable role-based access to blueprints, API Token Controls and integrations with secrets management platforms.

    Through its software-as-a-service (SaaS) platform, Quali makes it possible to access Torque via either a cloud account or a user interface that connects to a GitHub account where blueprints are stored. The goal is to enable DevOps teams to maintain some control over how infrastructure is provisioned without impeding developer productivity, said Rosenberg, noting at a time when more organizations than ever are launching multiple application development projects, there is more sensitivity concerning developer velocity than ever.

    It’s a fact that infrastructure misconfigurations happen because developers make mistakes. It’s not uncommon for a port to be left open, for example, which cybercriminals later exploit to exfiltrate data. Quali is offering a DevOps platform that makes it possible to centrally apply policies that act as guardrails to prevent developers from making provisioning mistakes. An alternative to scripts created using tools such as Terraform, the blueprints can deploy complete application environments automatically. That approach also provides more visibility into how resources are being consumed.

    Every minute a developer spends managing infrastructure theoretically is one less minute they could be spending writing code. As application environments become more complex, Rosenberg noted it’s becoming that much more challenging for developers to cope with managing infrastructure as code. The issue is that DevOps teams who could provision infrastructure for developers are being overwhelmed by the number of projects they need to manage. As a result, DevOps teams are becoming bottlenecks. Naturally, that only encourages more developers to provision infrastructure on their own, which, Rosenberg noted, leads to more mistakes being made.

    It’s not clear when or even whether IT organizations will look for an alternative to provision infrastructure in a way that doesn’t rely on developers as much, but most seem to agree that developers have far better things to do with their time.

  • SBOMSs for DevOps: EP 26

    SBOMSs for DevOps: EP 26

    Software Supply Chain and SBOMs for DevOps – Bad actors are constantly looking for ways to gain access to networks, steal data and corrupt systems. As supply chain attacks continue to be one of the most persuasive threats that companies face, organizations across all industries have been increasingly adopting the Software Bill of Materials (SBOM) to identify vulnerabilities in their software and enable a rapid response.

    Hosts Alan Shimel and Mitch Ashley are joined by Tracy Ragan (DeployHub), Caroline Wong (Cobalt) and Stephen Hendrick (Linux Foundation) to discuss how to mitigate software supply chain risks and how SBOMs play an integral role in securing the supply chain.

  • The Importance of Customer Experience Observability

    The Importance of Customer Experience Observability

    Ask anyone to name their favorite brand, and they’ll often respond with minimal hesitation. Prod a little further and the importance of customer experience (CX) is sure to play a major role in their response. In fact, 96% of consumers say CX is a key factor in their choice of loyalty to a brand. This sentiment is even more powerful post-pandemic, with 58% of consumers saying they place more importance on CX when making purchasing decisions than they did pre-pandemic.

    Will the importance of CX only increase? That’s a safe bet. So how does a business get to Apple, Disney or Amazon-level CX? Reliability is a good place to start.

    Reliability—in the context of a digital-first business—is the ability to quickly identify and resolve issues before they reach the customer. Reliability is a critical demand of both consumers and enterprises as they pursue digital transformation, especially cloud migration and automation.

    Achieving reliability may sound rather straightforward, but many factors in DevOps often work against reliability. For instance, many DevOps teams focus solely on technical performance metrics but turn a blind eye to CX metrics like churn rate or net promoter scores (NPS). Some business leaders fix this with advanced AI and machine learning technology, but too often those solutions don’t live up to expectations enough to provide a return on investment (ROI).

    Observability, on the other hand, is an approach that collects and analyzes data on every component of a system, application and infrastructure—from performance to security to accessibility. This information allows DevOps teams to glean insights on the reliability of actions performed within a unique business environment, such as an interactive voice response (IVR) system or a contact center.

    Gartner defines observability as the evolution of monitoring into a process that offers insights to speed innovation and enhance CX. To establish digital observability, DevOps teams should consider the following components.

    Enable Automated Testing of Digital Technology Functions

    Every day, companies are losing revenue due to a lack of customer experience observability. Forrester reported that more than $1 billion in potential revenue is being left up for grabs. This is largely due to poor comprehensive customer experience technology investment decisions. As DevOps teams work to deliver new CX innovations—like personalized VR shopping experiences or advanced AI-based chat support functions­­—they do their best to foresee potential flaws or bugs. However, flaws will inevitably creep in. That’s why consistent observability is crucial. Observability helps DevOps practitioners see these issues quickly and gives them optimum time to respond before it becomes a costly threat to customer experience.

    To provide this level of observability, data must be available, accurate and analyzed in real-time. This requires automated solutions because the faster a data set can be analyzed, the more value it will deliver. Automated testing tools work by generating thousands of synthetic omnichannel interactions to test the customer journey from the outside-in—from the network through IVRs to digital apps and routing systems, all the way to agents at their desktops. Automated testing of elements such as connectivity, responsiveness, quality and functionality can help DevOps teams ensure quality is achieved throughout the entire CX development life cycle.

    Determine How Test Data Will be Used to Improve Reliability

    Detecting issues early also requires precision and intentionality that answers questions like: What data will be collected? Who will own and examine the data? Why does that data matter to our business? Being able to analyze, organize, manipulate and share test data helps DevOps teams have greater ownership and oversight over information that’s constantly coming in.

    DevOps organizations benefit from using a platform that centralizes all voice call test data for the entire team so that nothing is missed, and the data can cover a wide array of use cases. Typical test datasets might include information on factors such as customer persona labels (for example, Gold, Silver and Bronze customers or labels by Line-of-Business), order status or payment methods. A centralized monitoring and testing platform allows DevOps teams to create and import comma Separated Values (CSV) files to create a test dataset for a specific IVR and then use it to test the organization’s other IVR systems to save time by not re-creating it manually. It’s also important for internal teams to be able to track who is modifying test data, when it’s being modified and which test cases are using specific datasets.

    Dedicate an Executive Champion of Customer Experience

    Eighty-four percent of businesses that focus on improving CX report an increase in revenue. Executive investment in CX is critical here and considering the ROI, should not be a difficult sell. To go even further, businesses should consider establishing a leadership role that is responsible for proactively addressing CX and reliability.

    For CX digital transformation initiatives to succeed, they must be led by an executive leader who can champion the need to drive cultural change and strategic investments. Appointing an executive to this role will ensure that CX initiatives aren’t siloed from DevOps teams, but also from the rest of the enterprise, including sales, marketing, operations and more.

    Some organizations choose to create an entirely new chief CX officer role so that the leader can give their full attention to CX transformation initiatives, processes and technologies. Others, depending on the company’s organizational structure, may decide to appoint these responsibilities to the current COO, CIO or CMO. Whatever the decision, the digital transformation leader must have broad authority that covers budget, people and processes in order to be effective in their role.

    Focusing on observability within customer experience technology will help organizations improve their reliability as a brand. With greater observability and automated testing capabilities, DevOps teams will be empowered to innovate faster and deliver higher-quality solutions that will improve customer interactions and solidify brand loyalty for years to come.

  • DevSecOps in Azure

    DevSecOps in Azure

    DevSecOps is everywhere, and chances are your organization is shifting toward this convergence of development, security and operations. In an on-premises environment, you build your own DevSecOps process by mixing and matching existing and new tools. However, in the cloud, much of the environment is determined by your cloud provider. Microsoft’s Azure cloud is known for its robust security capabilities. Specifically, Microsoft has developed a set of capabilities and services that can help you ease into a DevSecOps workflow without much effort. The tools are pre-integrated and support everything from CI/CD to identity management. Let’s see how they work.

    What is DevSecOps?

    Security is an important part of DevOps. But it can be challenging to ensure that software developed in a CI/CD process is really secure.

    DevSecOps is an organizational pattern that can make this possible, even at high development velocity. It is an approach the DevOps team can use to prevent security issues from the outset of the development life cycle, ensuring their software is not only high quality but also secure and resilient to failure.

    DevSecOps is a discipline that combines application development, security, operations and infrastructure-as-code (IaC) with an automated continuous delivery cycle. Here are three practices that can help a team move towards a DevSecOps process:

    • Focus on average detection and recovery times—These metrics show how long it took to detect a breach and how long it took to recover. This can be tracked through continuous field testing. Improving these indicators should be an important consideration when evaluating potential policies.
    • Defense in depth—Every component in the architecture should be secure so that if and when attackers manage to compromise the system, there are multiple security measures and controls holding them back. This puts an end to the notion of a ‘secure perimeter’ that the organization must defend at all costs. Each component must have its own secure micro-perimeter—this is a zero-trust approach.
    • Continuous learning—Teams should conduct regular assessments of security practices and their environment, especially after security incidents. Every time a security incident is discovered and resolved, the team must evaluate what went wrong in the development life cycle, explore how it enabled the incident and identify ways to improve the process.

    Features and Services That Enable DevSecOps in Azure

    The Azure cloud provides several built-in capabilities that make it possible to adopt a DevSecOps process.

    1. Azure DevOps

    Azure DevOps provides developer services that enable teams to plan tasks, collaborate on code development and build and deploy applications. Azure DevOps supports a collaborative culture and process in which developers, project managers and contributors work together to develop software. You can use Azure DevOps Services in the cloud or Azure DevOps Server on-premises.

    2. Build and Deploy Containers With Azure Pipelines

    You can integrate Azure Pipelines, the Azure cloud’s CI/CD solution, with your Kubernetes clusters. Use the same YAML document to build multi-stage CI/CD pipelines.

    Azure Pipelines lets you track metadata, such as commit hashes and issue numbers, from Azure Boards into container images. This provides direct traceability from any security issue to a specific change made in development. It also provides clear, easy-to-read documentation that can improve the feedback loop between development, operations and security teams.

    3. Run and Debug Containers with Dev Spaces

    When developing Kubernetes applications, there is a need to test applications locally and understand how they interact with dependent services. You may need to develop and test multiple services in collaboration with other developers or teams.

    Azure provides Bridge to Kubernetes, which lets you run and debug code on your development machine while connecting to your Kubernetes cluster. You can test your code end-to-end, set breakpoints on code running on the cluster and share your development cluster among team members. This makes it possible to test and resolve Kubernetes security issues in a realistic environment before deploying to production.

    4. Manage Identities and Access with Azure AD

    The Microsoft Identity Platform takes the Azure Active Directory (Azure AD) developer platform one step further. It allows applications to accept logins from any Microsoft identity, and obtain tokens that can be used to call Microsoft APIs or APIs created by other developers. This creates a large, interoperable ecosystem.

    Azure Active Directory B2C provides B2C identity services—customers get single sign-on (SSO) access to applications and APIs using their preferred social, enterprise or local account ID. Another option is to integrate Azure AD with on-premises Active Directory for hybrid and Azure migration scenarios.

    You can also use Azure Role-Based Access Control (RBAC) to manage access to cloud resources. RBAC lets you manage who can access your Azure resources, what they can do with them, and which regions can access them.

    You can also use the Microsoft Identity Platform to protect DevOps tools themselves, including native support for Azure DevOps and integration with GitHub Enterprise.

    5. Manage Keys and Secrets with Azure Key Vault

    Exposed secrets are a severe security issue that is very common in modern applications. Azure Key Vault lets you manage the distribution of secrets by storing them centrally in Azure Key Vault. Key Vault greatly reduces the chance of accidentally disclosing secrets. With Key Vault, application developers no longer need to store credentials or other sensitive information in their application code.

    6. Azure Policy and Azure Security Center

    Azure Policy lets you specify a default allowed configuration that is automatically applied to all cloud resources. This can avoid misconfigurations that violate security policies. Azure Policy works on the basis of desired state configuration (also known as declarative configuration), letting you specify to what degree resources and services should be secured and whether to alert or block/modify deployments in Azure if they don’t meet the policy.

    When using Azure in multi-tenant mode, policies can be applied at the management group, subscription or resource group level. You can define specific policies and enforce compliance requirements for test, staging, and production environments.

    The Azure Security Center (ASC) and Advisor can also be easily integrated into the DevOps process. ASC makes it possible to augment event streams in Azure with threat intelligence or analysis by third-party security tools.

    7. Penetration Testing

    Penetration testing is the recommended method for examining your environment for infrastructure or application configuration vulnerabilities that could create vulnerabilities that an attacker could exploit.

    An Azure penetration test should check for vulnerabilities on endpoints, apply fuzzing (malformed input) to discover business logic vulnerabilities, and perform port scanning to identify network vulnerabilities.

    Microsoft provides specific guidance for penetration testing in Azure with recommended products and penetration testing service providers.

    8. Configuration and Infrastructure Scanning

    To ensure security for cloud subscriptions and resource configuration across multiple subscriptions, you can use the tenant security solution part of the Secure DevOps Kit for Azure (AzSK).

    In addition, you can leverage Microsoft security technologies like Microsoft Defender for Cloud and Microsoft Sentinel. These solutions provide monitoring and security features designed to detect and alert on unusual events or configurations that require investigation and possible remediation.

    Conclusion

    In this article, I introduced DevSecOps and showed how the Azure cloud provides a range of services that let you easily implement DevSecOps practices. These include:

    • Azure DevOps: The venerable toolset with strong support for DevSecOps environments.
    • Azure Pipelines: The home-grown CI/CD product.
    • Azure AD: A comprehensive zero-trust identity management solution.
    • Azure Policy and Security Center: Enables unified control over security policies for cloud automation and security visibility over cloud workloads.

    I hope this will be useful as you take your first steps to practice DevSecOps in the cloud.