Tag: devops

  • Barracuda Networks Survey: DevSecOps Is Hard

    Barracuda Networks Survey: DevSecOps Is Hard

    Organizations that have adopted DevSecOps processes may be making progress when it comes to improving cybersecurity, but it’s far from easy. A survey of 618 IT decision-makers conducted by Dimensional Research on behalf of Barracuda Networks, a provider of IT security software and appliances, finds half have adopted either DevOps, DevSecOps or a continuous integration/continuous development (CI/CD) platform. A full 93 percent of those IT decision-makers said they faced challenges integrating security into those practices.

    Top challenges cited include: Existing security technologies don’t integrate with application development environments (63 percent), application developers are not comfortable with security (48 percent), and security processes have not evolved (48 percent).

    Much of the frustration can be tied to reliance on firewalls that don’t feature application programming interfaces (APIs) or are natively integrated with a public cloud, said Tim Jefferson, vice president for public cloud at Barracuda Networks. Each cloud service provider has a unique environment that requires providers of IT security software to write code that natively integrates with that platform. IT organizations can’t simply cut and paste security controls created for on-premises IT environments mainly because the cloud provider has already implemented its own controls at the infrastructure level. The IT organizations need to develop their own controls for the application layer, each of which then must be layered on top of the controls put in place by the cloud service provider.

    In the absence of those capabilities, developers get frustrated because a firewall running on a virtual machine on a public cloud presents them with a graphical user interface (GUI) rather than an API. Developers in the age of the cloud are not going to engage with any technology that they can’t programmatically invoke via an API, Jefferson said.

    Not surprisingly then, the survey finds the most requested firewall capabilities requested are cloud-native integration (74 percent), ease of deployment and configuration by cloud developers (59 percent), ability to regulate traffic flows between on-premises IT environments and public clouds (56 percent) and distributed policy enforcement (53 percent).

    Because many IT professionals don’t have these capabilities many of them conclude on-premises IT environment are more secure than public clouds. More than half the respondents (56 percent) say on-premises cybersecurity is still superior to a public cloud. Clearly, there a lot of technical and emotional factors that go into those assessments, but regardless of the truth, perception remains reality.

    Regardless of the approach taken, however, organizations that deploy firewalls in the cloud are expecting to pay for those services on a consumption basis, which doesn’t always align with taking a firewall running on virtual machine and then deploying it on a public cloud.

    Jefferson said that as cybersecurity in the age of the cloud continues to mature, expectations are rising regarding the capabilities a firewall should be able to provide—especially when it comes to controlling the flow of traffic coming into and out of a public cloud.

    Obviously, anything to do with DevSecOps these days is still evolving. But whatever the cybersecurity future holds the relationship between on-premises and cloud security is far more nuanced than many appreciate.

    — Mike Vizard

  • The Role of DevOps in Building an AI-Ready Infrastructure

    The Role of DevOps in Building an AI-Ready Infrastructure

    The successful application of machine learning for artificial intelligence (AI) requires several contexts to be addressed, primarily the technical, data and business considerations.

    The Technical

    From a technical standpoint, in building an AI-ready framework there are choices to be made such as which machine learning framework to select, the type and structure of learning function and the style of training algorithm to use. These decisions are normally based on the skill, experience and judgment of the computer scientist. A practitioner should be able to coordinate these aspects and focus on business outcomes without overly burdening the line of business with technical detail. The exception to this is when core design decisions in some way will impact business outcome.

    The Data

    Equally as critical to the efficacy of machine learning is the data available for use in development and training. A deployed algorithm is a function of the data inputs it received during training and testing; these inputs should be consistent and representative of the scenarios that will be subject to inference by the algorithm. It is difficult to accommodate so-called black swan events, as typically these require a level of adaptiveness beyond present machine learning technology.

    However, we can still hope to achieve an effective and enriched algorithm that is appropriately responsive to real-world events by collecting and building data sets and training libraries that are truly representative of the environment in which the algorithm will operate. Ideally, machine learning data should include as many data outliers as may occur naturally within the real world—we should not be improving or self-selecting data, though granted most applications will use some form of normalization.

    Speaking to data scientists and machine learning specialists, it is clear as individuals they have the technical skills and access to the core technology they need to do their jobs. However, more often than not it is access to and availability of real-world, suitably random data that is one of the biggest and most time-consuming challenges. Addressing this requires good engagement with the line of business, as access to sensitive data requires negotiation. But as matter of course, any business that utilizes data analysts to help inform critical business decisions and wants to benefit from machine learning should take the necessary steps to ensure it offers accessible and open data services to their machine learning teams. Having an open, accessible and agile data architecture is an essential prerequisite of being able to deliver an AI/machine learning-ready infrastructure.

    The Business

    On the business side, rather than address the how and what questions of technology and data, we also need to ask why. Certainly, as with any IT project, business does not want to engage machine learning or AI for its own sake. It is important to understand the business goals and seek new technology that will align with those objectives. This is where the application of DevOps techniques can greatly improve business outcome.

    By aligning software development with software operations, more emphasis can be placed on what is important to the business while also helping to support the effectiveness and usability of new machine learning functions. In their deployment and use, these new applications should also exhibit many of efficiency features of modern IT technology. Thus, we expect new deployments to be able to make effective and efficient use of container technology. And where a particular function is infrequently required, how much more efficient is it to use a serverless function, perhaps with the data resident on private storage, and the function being called on demand in the cloud.

    This type of capability is now readily available to machine learning thanks to the advent of virtualized GPUs provided by a choice of cloud services. This ability to dynamically and adaptively use infrastructure aligns well with the capabilities DevOps practitioners, who for a long now time have been used to managing the deployment of continuously developed releases of code. This agility, driven by the need for adaptability and innovation is very much what is required for successful machine learning and AI. But underpinning all of this is the need to maintain the conversation with the business around the open, yet appropriate accessibility to data.

    — Matt Watts

  • IBM Advances DevOps for AI Applications

    IBM Advances DevOps for AI Applications

    IBM today made its first foray into applying DevOps methodologies to building artificial intelligence (AI) applications. Announced at the IBM Think 2018 conference, the latest IBM tools and services for building AI applications include a Deep Learning as a Service capability that has been embedded with IBM Watson Studio development tools and Watson Data Kits that come prepopulated with data for specific vertical industries.

    IBM also announced it has extended its alliance with Apple to combine IBM Watson machine learning with Apple Core ML to make it easier to build AI applications employing machine learning algorithms developed and curated by both companies.

    Finally, IBM announced IBM Watson Assistant, a voice-enabled digital assistant that can be embedded into enterprise applications.

    Ruchir Puri, chief architect for IBM Watson, said IBM is delivering a combination of services and tools that collectively will create a set of DevOps processes for managing the both the development of AI models and managing the complex data pipelines that need to be created to feed data into those models.

    The IBM Deep Learning as Service offering is essentially a managed service that provides developers with access to hundreds of AI models based on neural networks that IBM has developed. IBM also revealed that the core technology employed to create the Deep Learning Service will be made available as an open source project called Fabric for Deep Learning (FfDL).

    IBM also announced an open source Model Asset eXchange (MAX) online service, through which developers can discover free machine learning models, and the Center for Open Source Data and AI Technologies (CODAIT), which expands the mission of its Spark Technology Center to include building such models.

    Puri noted that via all these offerings and services, IBM is moving to substantially lower the barrier of entry for building AI applications. Longer term, IBM also plans to make use of event-driven architectures enabled by serverless computing frameworks to make such models available on demand, he said.

    Puri added that AI models require DevOps processes because, over time, organizations will find a need to either update or change the models as new data becomes available. In addition, AI is giving rise to a DataOps discipline for managing data pipelines that needs to become integrated with a comprehensive approach to DevOps, he said.

    Puri said IBM expects AI models soon will be infused into every application being built or legacy application that needs to be updated. Given the scale of the task at hand, organizations will need to consider carefully how internal and external data flows into the models, which require continual access to data to learn. At the same time, organizations also will need to focus on ensuring the quality of that data to prevent machine learning algorithms from coming to the wrong conclusions.

    Adoption of DevOps processes has been spotty so far. But as organizations begin to incorporate AI into their applications, many will discover it’s simply not feasible to implement AI without a robust set of DevOps processes in place to support the models.

    — Mike Vizard

  • How to Get More Visibility Into Your Continuous Deployment Process

    How to Get More Visibility Into Your Continuous Deployment Process

    I know far too many developers who cringe at the thought of continuous deployment. Thoughts of broken code and an endless stream of customer support requests puts continuous deployment into the “nice to have, but not right now” pile.

    But, it might just be a case of clearing the fog on process so you get visibility into the deployment pipeline. If your team can get more visibility into releases, you will have more confidence your shipped code is quality. With more visibility, you’ll be deploying faster and earlier before you know it.

    What are the Results of an Effective Continuous Deployment Process?

    Shipping a big release is taxing on your QA and testing teams and the pressure to get every part of the build correct is huge. Continuous deployment allows you to deploy smaller chunks of code more frequently so you have more control over the release.

    Think “shipping responsibly.”

    With that in mind, it’s easy to see why a lack of visibility can hinder continuous deployment’s goal of shipping more code to a tight schedule.

    Why is Lack of Visibility a Problem?

    Best practices for your software development lifecycle (SDLC) demand that you know what’s going on in your code. And if you are responsible for your release process, you are probably held accountable for what customers receive.

    Production demands visibility into code quality; otherwise, you risk economic damage to your business in the form of bugs and crashes. With this in mind, understandably, many teams hesitate to continuously deploy thorough lack of confidence in the quality of shippable code through the build process. If more visibility means more confidence, let’s take a look at the stages in a build process and how to increase visibility at each stage.

    How to Get More Visibility Into Your Continuous Deployment Process

    Invest in modern architecture

    Continuous deployment will require resources and modern tooling initiated by your best people. Although budget often can be one of the biggest roadblocks to continuous deployment’s success, don’t withhold funds. Invest in the tools and people first, and the process will come. Modern tooling that is updated regularly will give you the best of what’s available, allowing you to effectively see what’s happening in each stage from source control to deployment and beyond.

    Allow for manual intervention

    You may not want your continuous deployment to be fully automatic. There are risks associated with continuous deployment, and to mitigate those risks you need a human to push the “deploy” button. It’s more about making your team feel accountable for their actions. The developer sees the change go live and is the first to test them.

    A viewable stage environment

    Do you have key stakeholders waiting for updates on feature releases? Rush boxes might be the answer. A rush box is a server used for work that is not ready for the QA process. This will give anyone to give feedback and authorize changes.

    Report

    Continuous deployment is certainly not without its risks. But, if you incorporate a culture of visibility into your processes, you can quickly identify where the gaps are so you can start to scale. Your toolkit will generate a huge amount of transactional data that will help to steer your company in the right direction.

    Monitor

    It amazes me how many companies still push out changes and rely on the end user to tell them whether the deployment was successful. Defects in production code have economic impacts on your company, and undiscovered bugs and errors can rack up into technical debt. But, you can’t change what you can’t see. Small changes are always going into production, so time for QA and regression tests naturally lessens. Therefore, you need to know what happened, and when, which is where a monitoring tool such as crash reporting can help. I’ve written before about the benefits of monitoring in continuous deployment, and it’s an integral step that is often missing. Monitoring can also help you make informed decisions about when to rollback a deployment.

    Rollbacks have an economic impact to your business, much in the way errors do. However, if a decision to roll back is data-driven, it’s an easy call for a senior developer to make.

    In Conclusion

    Don’t let the lack of visibility into your deployment pipeline affect your decision to implement a continuous deployment process. Invest in people and tooling first, and the process and scale will come.

    — Freyja Spaven

  • Is DevOps Really Necessary?

    Is DevOps Really Necessary?

    I spend my days discussing DevOps and digital transformations with companies of all sizes, from startups to some of the world’s largest enterprises. I’ve found that many teams are still at a very early stage in modernizing their technology, culture and practices. However, I’m surprised at the number of the organizations that don’t believe in change because they “have been doing just fine up until now.”

    This is a recipe for failure in the long term. Their competitors will likely be working in loosely coupled teams with shared responsibilities and increased collaboration. They will have adopted continuous integration, continuous deployments/delivery and automation, to name a few processes. In time, these competitors will begin to consume the laggards’ market share. To put it into perspective, you might still be talking about your next deployment coming up in six weeks time, while they are talking about deploying into production 12 times today alone.

    With their increased agility, stability and reliability, these more successful teams will be faster. They will not be afraid of failure and will have built fault-tolerant systems that can rapidly and automatically repair. These self-healing, well-tested systems and processes will free time for developers and other team members to focus on developing newer and better applications in response to customer feedback—all while the your team might continue “doing fine.”

    We aren’t just talking about buzzwords here; the data shows that those who are playing catchup are also potentially causing themselves more harm than good. Puppet’s “2017 State of DevOps Report” shows that the gap between higher- and lower-performing teams has narrowed as throughput has increased, meaning lower-performing teams are working faster, shipping more code to production and responding to changes quicker than they were the previous year. This is great in principle, but in 2017, change failure rate had also increased, showing that low performers were actually more likely to fail when making changes than they were in 2016. The data shows that low performers had a 3x change failure rate in 2016, which increased to 5x in the 2017 Puppet study. From a business standpoint, this means that those higher-performing teams are able to deliver more value to their customers by responding faster and more reliably to feedback and market demands.

    Companies should certainly be paying attention to what their competitors are doing, no matter what area or sector in which they operate. However, they also must not lose sight of the importance of quality, security or feedback during this journey. If you know you are at a much earlier stage in your transformation, focus on getting it right. There will always be setbacks and challenges, but as the old saying goes: This is a marathon, not a sprint.

    DevOps methodologies, when applied effectively, will make your organization more successful.

    — Conor Delanbanque

  • Sneckdowns In IT Operations

    Sneckdowns In IT Operations

    What IT operations professionals can learn from the actual paths people take through tools and processes, and the differences from the expected usage model.

    It has been a snowy winter across much of Europe, and although the snow is now beginning to melt in most places, there are still substantial sneckdowns to be seen across our cities.

    If you’re not familiar with the term “sneckdown,” it describes those areas of streets that are not actually used, as revealed by the unmarked snow that settles on them.

    Sneckdown example

    Transportation planners have even been known to use sneckdowns successfully as planning aids.

    The world of IT should learn from this example. We may not have anything as whimsical as snow to help us, but on the other hand, we do have enormous amounts of data. Let’s investigate some examples, starting with IT operations.

    Restate My Assumptions

    IT operations has a bunch of assumptions baked in, but just like with street layouts, some of them may be obsolete, leftovers from a previous generation of technology. My own hometown dates its founding back to Roman times-218 B.C., to be precise-but the sorts of design choices that Roman colonists might make to facilitate chariot and ox cart traffic have had to be updated significantly-first to accommodate motor vehicles, and then again to ensure that the motor vehicles did not crowd out other forms of transportation such as bicycles.

    Similarly, much of IT operations is based around the notion of a ticket, which describes and encompasses an atomic problem. This ticket has a single owner at any one time, and is processed sequentially through a series of steps. This is the operations equivalent to the waterfall model of development.

    These assumptions used to be reasonable in previous eras of IT technology, when a simple failure of a single piece of equipment was enough to trigger an incident. That incident ticket could easily be paired with the specific piece of equipment that was impacted, and from there a simple lookup would return the responsible group, who could then be assigned the ownership of the ticket.

    These days, that model is largely obsolete. Hardware, especially virtual hardware, is cheap enough to be made multiply redundant. Automated functions such as load balancing ensure that single failures are rarely enough to cause an actual incident. Instead, multiple failures have to occur in the right sequence—or the wrong one, depending on your point of view. Meanwhile, operators are drowning in a sea of red alerts, unable to find and focus on the few actionable ones because processes require them to respond to everything. Finally, when a real ticket does make it through the noise, it gets bounced around from team to team, as harried operators try to work out whether it’s their problem or somebody else’s.

    Operators are human, after all, and over time they develop their own paths through and around this rigid process, just as people walk and drive their own paths through the snow.

    Examples of IT Operations Sneckdowns

    Users Working Together

    One big IT operations sneckdown is collaboration. Instead of using the ticketing system and its rigid assumptions, operators work around it, using alternative methods to work together and share information with each other. The goal is to deliver full-stack operations for the entire complex business service that is being supported by the team.

    The problem with sneckdowns is that if there is no city planner watching and measuring, eventually the snow will melt and leave no visible trace of the paths that people take around their city. In the same way, the risk to the wider organization is that as people work and collaborate in alternative, unofficial tools—whether IRC or Slack—information gets stuck there and does not make it back into the official knowledge base, where it is available to be consulted and reused over time.

    Sneckdown Recommendation: Recognize that the nature of modern IT and network architectures means that there may be no single owner of a problem. The rapid rate of change, too, makes it almost certain that any owner will not be documented in a static database somewhere. Instead, modify processes to recognize this multiowner approach, and enable users to work easily with each other without having to play ticket ping-pong.

    The Right Tool for the Job

    This overlaps with another sneckdown: unofficial tool adoption. In the same way that operators might start using an unofficial collaboration tool to route around limitations in the official service desk process, they might look at Kanban to share task status, or start building libraries of automated diagnostic and remediation actions. The problem is that the rigid official policy often does not accommodate these extensions, and indeed has no mechanism to do so.

    Sneckdown Recommendation: Modern operations tools need to offer flexible interfaces to enable integrations and extensions to be done in a safe way. This way, if a particular integration does not work out or needs to be upgraded, that can be done without disruption to the wider process and to any other integrations that are working well.

    Look into the Shadows

    The final sneckdown—at least for this snow storm—is shadow IT. In the same way that much of our universe is theorized to be made out of dark matter, not visible to our current tools, a growing proportion of IT spending is happening outside the “official” IT budget. This also means that whatever is bought with that budget is outside the official IT operations and support process. That’s all very well on paper, but if the tool Sales or Marketing were relying on to do their jobs goes down, somehow, IT operations is still going to get the call to fix it.

    Sneckdown Recommendation: There isn’t an easy short-term fix for this one—no way to shovel it out of existence. Instead, IT operations professionals need to work on this issue from two angles. The first is to address the causes of shadow IT, those rigidities and frictions that make people look for outside solutions rather than engage with their in-house IT departments. When everything is properly aligned, the IT department has a lot to offer in terms of understanding of How Things Are Done inside the organization. The other angle is—yes—to make it easier to accommodate solutions that might have been procured originally as shadow IT. Figure out how to engage with support processes for SaaS solutions that people adopted on their own; if it’s working for them, it’s up to you to keep it working! The benefit is that this alignment will reduce the need for constant injections of energy by sysadmins and operators to keep things running: the Second Law of IT Ops.

    Conclusion

    Compared to city planners and transportation activists, we IT professionals actually have it pretty easy. We’re not reliant on particular weather conditions for our data, but rather, we have enormous amounts of data at our fingertips all the time. It’s up to us to look at the data with open minds and read the conclusions that are already there. The hard part, of course, is putting those conclusions into action, especially when that requires changes to widely accepted processes, but that is also an opportunity to revisit those processes and make sure they are still as fit for purpose as when they were first adopted.

     

    Game Day Chicago

    If you’re interested in what that process looks like, there is an interesting event series: Game Day ITSM & Incident Management Workshop. The next Game Day is in Chicago on March 21, but there is a whole series running, so there is probably an event near you soon. It’s a fun time, and also a great opportunity to rethink some assumptions and look at where some sneckdowns might be that could be incorporated into your planning.

    — Dominic Wellington

  • How the Cloud is Reshaping IT

    How the Cloud is Reshaping IT

    The cloud has been rapidly reshaping and redefining IT as we know it, from the language we use to describe it to the management models and infrastructure itself. Providers such as Amazon Web Services, Google Cloud Platform and Microsoft Azure have transformed cloud computing, giving businesses access to IT resources anytime, anywhere. At the same time, this rapid migration off-premises has been reshaping the needs and roles in the IT department.

    The Cloud and IT

    The following are four ways that the cloud is redefining IT roles and operations:

    Sysadmin vs. DevOps

    When you compare sysadmin vs. DevOps, you’ll find that they’re similar roles, but also distinct. A system administrator, or sysadmin, is the person responsible for configuring, operating and maintaining computer systems, servers in particular. This jack-of-all-trades IT role handles everything from installations and upgrades to security, troubleshooting, technical support and more.

    And then we have the evolution of DevOps, which could very well be the biggest game-changer to the IT process. Under the DevOps umbrella, a team of software developers, IT operations and product management people must combine strengths to effectively streamline and stabilize operations for rolling out new apps and updating code to support and improve the whole business.

    With the cloud taking over and without the need for physical, on-prem servers, a large portion of the sysadmin role has become lost to automation. As this change was occurring, sysadmins remained effective as their role shifted toward the support of developers, combining efforts and thus giving birth to the term DevOps. So, can you truly compare sysadmin vs. DevOps? Well, the roles are similar in the sense that sysadmins can do a lot of what DevOps guys do, but not the other way around, making DevOps the newer, bigger jack of all trades.

    IT Operations Management vs. Cloud Operations Management

    IT Operations Management is responsible for the efficiency and performance of IT processes, which can include anything from administrative processes to hardware and software support, and for both internal and external clients. IT management sets the standard policies and procedures for how service and support is carried out and how issues are resolved.

    Thanks to the cloud, IT management has also given way to automation and outsourcing. Cloud operational processes are now a more efficient way of using resources, providing services and meeting compliance requirements. In the same way IT operations and projects (ITOP) manages IT processes, cloud operations management is doing so in a cloud environment with resource capacity planning and analytics that provide vital intelligence into how to control resources and run them cost-effectively.

    IT Service Management vs. Cloud Service Management

    Traditional IT service management (ITSM) dealt with strategizing in the design, delivery, management and innovation of the way an organization is using IT. This involved developing, implementing, and monitoring IT governance and management using frameworks such as COBIT, Microsoft Operations Framework, Six Sigma and ITIL, for example.

    As the cloud became a better option for operational management, companies have turned to it to transform their business model via service providers including Amazon Web Services, Google Cloud Platform and Microsoft Azure to outsource IT for more efficient, scalable services.

    Since cloud computing resources are hosted as off-site VMs and managed externally, ITSM has grown more complex, introducing cloud service management (CSM) as an extension of ITSM, pushing in three core areas: automated service provisioning, DevOps and asset management. And as ITSM shifts toward CSM, the concerns lie in the adoption strategy and the approach for designing, deploying and running of cloud services.

    Finance and Operations vs. DevFinOps

    In a world where IT projects are known to exceed budgets and coming up with cost estimates is no easy feat, how can businesses break down a reasonable overall estimate for projects in which applications are developed, built and run on a utility? The answer is to make estimates little by little as parts of the work get completed, integrating financial planning directly into IT development operations. In other words: DevFinOps.

    IT asset management (ITAM) merges the financial, contractual and inventory components of an IT project to support lifecycle management and strategic decision-making. The strategy involves both software and hardware inventory and the decision-making process for purchases and redistribution. DevFinOps expands and builds upon ITAM by fixing financial cost and value of IT assets directly into IT infrastructure, updating calculations in real time and simplifying the budgeting process.

    What This Means For You

    Cellphones, self-driving cars, DevOps … cloud computing is yet another evolution in technology—albeit a huge one—and IT is simply going through a metamorphosis. The best way of looking it at is that cloud is not killing IT, it’s redefining IT. Enterprises are following suit as they make the shift and change or update traditional IT roles. As IT evolves, the cloud is paving the way for opportunities for those who adapt and evolve their roles with it.

    — Jay Chapel

  • DevOps: Bringing People, Process and Technology Together for Digital Transformation

    DevOps: Bringing People, Process and Technology Together for Digital Transformation

    DevOps principles are built on an effective, continuous cycle of improvements—key factors that help drive digital transformation for companies large and small. Inserting this agile mindset into culture and operations, however, can be challenging, as the approach sometimes conflicts with the more the methodical ways of IT. So how can people, process and technology be brought together for business success in this new paradigm?

    People and Process

    Digital transformation first must be defined. It’s a ubiquitous app or service that can be consumed from anywhere on any device at any time. Digital transformation aims to reduce the consumption barrier, which enables businesses to profit from every possible engagement while leveraging data-driven models.

    A DevOps culture supporting such digital transformation is about agility, availability and scalability with continuous integration and continuous delivery of services. These strategies require new technology skillsets, which begs the age-old question: build or buy?

    This question leads to more questions, which IT organizations struggle to answer. Should they “buy” new talent and build the capabilities with the existing team? Should they buy new talent and implode the existing team? Or, should they build up the existing team and enable them to bridge the gap from traditional ops into a DevOps culture?

    Organizations often overlook one of the most important considerations. Putting top engineers with topnotch development skills together does not always produce a successful team. DevOps calls for collaboration and cooperation, so organizations must pay attention to soft skills. People collaborating across traditional boundaries and silos are at the center of digital transformation. Progress only happens when the organization is moving forward as a whole with the same end goal and execution in mind.

    Digital transformation is a function of speed to market, and that’s where traditional IT and DevOps processes clash. IT follows the doctrine of trust but verify, a methodical process filled with rigor and discipline. On the other hand, DevOps’s modus operandi is continuous integration and continuous delivery while failing fast if needed, trying anything and everything to iterate and get as many data points as possible, as fast as possible.

    Blending these cultures and processes is a matter of stepping back and realizing they are actually more similar than different. Striking a process balance between IT Ops and DevOps empowers organizations to deal with the volume, variety, and velocity of change involved in digital transformation.

    Normalize the Right Technology

    Making the right technology choices means finding the right signal in the noise of all the possibilities. From programming languages to the automation engine, infrastructure services (virtual machines, cloud instances, containers and microservices, serverless) and more, when creating a DevOps culture, people will gravitate to solutions that are biased toward what they know best.

    The number of choices turns into an endless buffet with a tendency to overindulge, which creates bloat and starts accruing tech debt. Shouldering too much technology and being half-baked into “best-in-breed” solutions are not enough.

    Disruptive technologies surpass the bounds of “good enough.” The wrong technology choice will put an organization behind in a world that’s disrupted constantly. The organization may get disrupted into nonexistence. Choose the technology that will best enable normal consumption of services while you scale services, become more agile, and expand availability. That’s what digital transformation done right accomplishes.

    Customer-centric

    A transformative DevOps culture keeps the customer as the focal point. Some organizations view this as “the customer is always right.” That’s one way to look at it, but sometimes the customer doesn’t know what “right” is. It’s up to the organizations to demonstrate good and great.

    That means being less feature-centric and more solutions-centric—actually solving the customers’ pain points. Don’t get stuck in the “easy” to implement. Don’t assume your use case is the right use case without being certain of how customers would leverage and utilize the end results of the transformation. Remember, the goal is to reduce the barriers to consume for consumers.

    One of those barriers is having a bad experience with an application or a service. Users want it now and are willing to pay if the service is excellent, always available as needed, and easy. We’ve seen this with rideshare applications, Netflix and Amazon.

    Yet, the SolarWinds Digital Experience Monitoring Survey shows that 40 percent of respondents are suffering digital experience issues that negatively affect their businesses. They also report a lack of visibility into customer experience. Forty-four percent say end users are first to discover an issue, and 25 percent of those surveyed say they are the last to know.

    Best Practices

    Digital experience monitoring (DEM) tools help solve these problems. For example, when implemented as part of a rigor and discipline approach, the survey shows that 59 percent received fewer support tickets, 44 percent improved brand image, and 33 percent gained a better ability to retain customers. Among those who reported that DEM has driven increased revenue, 15 percent of revenue increase can be attributed to DEM.

    Observability and Control

    At the same time, a certain level of observability and control must be integrated into a successful DevOps strategy for digital transformation efforts. Observability is a measure of how well internal states of a system can be inferred from knowledge of its external outputs.

    Depending on who you ask, observability can mean logging for one IT professional, metrics for another, or tracing for a DevOps engineer. Despite these shades of grey, the reality is that application stacks are evolving with so much velocity, variety and volume that such that a combination of all three (metrics, logs, and traces) are needed to build a viable observability protocol.

    To achieve this level of observability—and, as a result, control—you must have a powerful integrated full-stack monitoring platform that enables analysis of key performance metrics, events and logs,and application code traces. This approach to monitoring as a discipline enables developers, DevOps engineers and IT professionals to better manage, optimize and troubleshoot the full stack at every layer—from the infrastructure services and application to the end-user experience—from a single dashboard.

    With observability and controllability enabled, you can successfully and continually integrate and deliver the applications and services enabled by your digital transformation.

    — Kong Yang

  • Integrating Security into DevOps: The Benefits and Drawbacks

    Integrating Security into DevOps: The Benefits and Drawbacks

    The efficiency of DevOps for your enterprise will depend on the level of security you integrate in it. The integration of security into DevOps is new to many enterprises, but is highly important because the speed of DevOps can make the apps in development vulnerable to malicious attacks. This can be prevented with the help of right security controls.

    Security and development teams must understand each other’s requirements and goals. Some might view security professionals as the ones who tap the brakes as the DevOps team moves forward. However, the job of security is to manage the risk effectively. To accomplish this, the security team must be integrated into the DevOps process.

    In many companies, this is a completely new methodology, and different structures are needed for different companies. The global security function is a component of the program management ecosystem by one security model. Security is integrated as an essential member of the development organization by another security model.

    Blockchain is the underlying technology behind cryptocurrencies such as Bitcoin and is used to secure the bitcoin wallet. The implementation of blockchain in a company’s DevOps process increases its agility and delivery efficiency, while the integration of security benefits an organization’s DevOps process in multiple ways. However, along with these benefits, few drawbacks do exist. Let’s dig deeper into both of them.

    The Benefits and Drawbacks of Integrating Security into the Program Management Ecosystem

    The program management function has a significant role to play in this model. It ensures that security is in place, and confirms that all the required specifications are documented and met. Security then carries out evaluations and determines what critical issues need to be addressed. In this security model, the security office can address the condition of a wide range of products that the organization delivers in a uniform manner.

    The drawback is that the issues related to security often are listed on a slide for review by executives and noted by the most important person in the development organization. Consequently, the list becomes a road map for “what we must fix” more than a prescription for “what we must make sure the product sticks to before it gets shipped.”

    The Benefits and Drawbacks of Integrating Security into the Dev Organization

    If the security team is a component of the development organization, they must maintain close contact with the global security office. But they can be much closer to the product development. This means they are closely working with feature teams and determining stories that should be planned into the sprints.

    These assessments cannot wait until the end—they must be planned into the first sprint that makes sense. Then, the resulting group of issues becomes technical backlog to prioritize into the following sprints. The goal is to produce applications that are safe for customers and have assessments that are known and can hold up to customer audit.

    However, the local security team must connect strongly to the global security office. Every security team that is a component of the development organization must rise to act as a single brain across all the products; companies cannot have any variance with respect to adherence to mandates, assessments, tools and standards.

    Where to Incorporate Security?

    To enable a continuous security mindset, security must be covered by automated test cases related to security in the continuous deployment/continuous integration process over the following phases:

    • Regular operations – near-real-time automated enforcement and utilization of continuous monitoring.
    • Integration phase – full sanity checks for external/internal endpoints, and make sure any new workloads do not break any of the security policies.
    • Infrastructure creation phase – test utilizing tooling such as serverspec/rspec.
    • Image creation and hardening – as part of the delivery pipeline, automate this phase.
    • Build phase – utilize code analysis.

    Securing QE and Dev Labs

    The final dimension is quality engineering (QE) and development, though they might be forgotten. Both of them have labs in which they make sure all the functionality performs, scales and works. These labs are good targets for intrusion, and security has a major role in the remediation and evaluation of the lab environment.

    Conclusion

    Adopting a DevOps methodology can instigate security vulnerabilities and new blind spots introduced by new systems. But fewer workplace silos and improved communication can help address issues much quicker. Today, security also can be integrated into DevOps using various technologies. It is highly essential to have security integrated into the process, no matter what method works best for your company.

    — savaramravindra

  • Can Agile and DevOps Get Along?

    Can Agile and DevOps Get Along?

    There is a common misconception that Agile and DevOps cannot work together, which does a disservice to everyone in the software development and delivery field. In fact, both approaches can significantly add to the Scrum pillars of transparency, inspection and adaption to better enable product teams to develop, deliver and sustain complex products. Both Agile and DevOps embody great ideas and enthusiasm that can add value to how teams work, ensuring the success of their organization in a world where business is both driven and disrupted by software.

    For businesses to take full advantage of the opportunities presented by Agile and DevOps, both communities—the Agilists and DevOps professionals—need to rectify the misunderstandings between the two approaches that amplify the differences between them. They must understand why these myths permeate and learn how to overcome these barriers so Agile and DevOps can finally play nice in the sandbox.

    Agile and DevOps: The Misunderstandings

    Both Agile and DevOps pursue the desire to deliver value to customers in a more effective way, but from different starting points—Agile with the developer, and DevOps from operations. Their emphasis also varies, leading people to believe that they are different things: Agile emphasizes team interactions, culture and values, while DevOps emphasizes delivery pipelines and flow.

    These apparent differences are further amplified by misunderstandings that do nothing but to pit the two approaches against each other:

    • Some Agilists think all process is bad, while DevOps is steeped in a history of stability through process.
    • DevOps uses tools and automation to increase speed, while some Agilists view tools as unavoidable at best and a distraction at worst.
    • DevOps uses holistic systems to solve problems, while Agile uses people to drive change and discover it through work.

    It is disheartening that these misunderstandings exist because Agile and DevOps share more in common than most realize. For instance, both include faster delivery cycles, smaller increments or releases and use feedback to improve and remove waste and impediments. Both approaches can also influence a cultural shift in an organization that promotes small changes that are easily manageable so they lead to bigger and better business outcomes over time.

    If they are more alike than dissimilar, then what exactly is holding these two methodologies back from getting along?

    Politics, Organizational Silos Widen the Gap

    Organizational changes, such as new hires and managerial moves, etc., attract strong personalities who get recognized for driving change and who get rewarded when those changes produce results. When their success is tied to the success of either their Agile or DevOps program, competing political goals are deemed a threat and lead to confusion:

    • Different tool strategies: How many times do you hear, “The Agile teams use JIRA, but the DevOps teams use Service Now”? These tools and the vendors selling them focus on a change initiative to drive purchases. This makes it even more difficult to integrate Agile and DevOps, as their data and processes are hidden within different tools.
    • Politics rather than value to make decisions: The saying, “It is not what you know, it is who you know,” is not just true in national capitals, but in any organization. Politics is the reality of most organizations and that means that the associated initiatives not only come with baggage of the work, but also with the politics of who is driving them.
    • Increased division and organizational conflict: Ironically, the DevOps and Agile movements call for unification and collaboration between different groups. However, when practiced, they can sometimes lead to even deeper gaps within traditional groups due to their different terminology and ideas.

    Different Cultures

    Agilists consider process to be “emergent” in response to the needs of the situation. This means teams are empowered to make decisions about how they work via a light framework (such as Scrum) and then add any other process they think are needed to achieve more value and faster feedback.

    DevOps traditionally takes a different tack, with a focus on systems thinking with flow models and value streams.

    Despite the culture differences, Agile and DevOps need consistent language and concepts to work together, or else communication breaks down and collaboration suffers. This leads to alienated stakeholders, increased fear and defensive behavior, poor product and service quality, lack of transparency and visibility and, more painstakingly, never getting anything done.

    Scrum Breaks Down the Barriers to Agile and DevOps

    Delivering value to customers through software requires elements from both Agile and DevOps coming together in a comprehensive process that is fluid and enables the teams to work in a dynamic manner. Through Scrum that empowers cross-functional, business-oriented teams to deliver software continuously, work flows seamlessly between all the right stakeholders, in real time.

    However, simply having cross-functional teams in your organization isn’t enough to make sure all involved are working in a holistic way to deliver customer value. Organizations need to make the right decisions about who should be in or out of a team, since different technologies require specialist skills and infrastructure to support it.

    A cross-functional team must have all the competencies needed to accomplish the work without depending on others who are not part of the team, as described in the Scrum Guide, to deliver a working product.

    As technology, market and environmental complexities and their interactions have rapidly increased, Scrum’s utility in dealing with complexity is proven daily—Scrum teams are highly flexible and adaptive so that they can deliver products of the highest possible value. When misunderstandings are put aside, and people learn to communicate with each other, cross-functional teams comprised of Agilists and DevOps with all the right skills can deliver done software, faster for your organization.

    — Dave West