Tag: devops

  • Salvador Partners Bridges Global Gaps for DevOps

    Salvador Partners Bridges Global Gaps for DevOps

    Salvador Partners works on a global scale to help its customers grow their business. The company, which has its own set of products, also focuses on assisting startups in making their vision reality. Indeed, it bills itself as “experts at innovation and exploiting innovation.”

    The company started life as a subcontracted electronic components manufacturing company, slowly broadening its lineup to include security products and patents and evolving to become a provider of technology for banking, financial services (fintech), defense and mechanical systems, says Lewis Daniels, founder of Salvador Partners. The company also serves as an incubator and capital arm for new technologies.

    Salvador builds circuit boards and technology products, working across artificial intelligence (AI), augmented reality and blockchain technology, together with its other endeavors. Across its projects, wherever software is part and parcel with its products, Salvador Partners’ international team of developers are hard at work.

    The firm has built a DevOps culture across its organization despite geographical and language barriers. devopsy.kinsta.cloud explores the Salvador Partners devops culture that works in an umbrella fashion among these international developer groups.

    The Global DevOps Culture Challenge

    Salvador Partners works with development teams in Russia, China, India, the U.K. and the United States who build software prototypes, which can sometimes prove tricky: There are challenges to getting foreign teams to plug themselves more deeply in to existing domestic teams for future projects. “There’s an obvious value in their experience from the build of your prototype that you then want to tap. The question is whether they want to be a part of your longer-term vision,” Daniels says.

    The company also grapples with the location question—whether to consider moving some of its operations to those countries, closer to those teams, or move some or all of them to its domestic operations. “Perhaps the world has become small enough through the use of tools like Slack and [project management] tools that you can let the technology bridge any gaps,” says Daniels. The tools so far have helped disparate development teams make the leap, including addressing any time zone and language issues that appear.

    Delineating the Salvador Partners Culture

    Salvador Partners uses an agile approach. “If each client wants a unique tweak, we simply badge up a boutique offering where we can innovate, collaborate and deploy in an agile environment to suit the client requirements,” Daniels says.

    As development teams work together more frequently, they reuse code and proven approaches more often. “We often find tricks that get carried over to the next application or dashboard,” says Daniels.

    Tools are the answer. “Things have changed in recent years. In terms of a culture, I think it’s pretty easy to leverage tools such as Slack and Dropbox to make the team smaller, regardless of where in the world they are positioned,” he says.

    Salvador Partners developers also use Trello for sharing project plans and Skype and Uber conference for team collaboration calls. “We use a secure mobile app we developed internally to communicate on some of the new, high-tech or sensitive topics. WeTransfer is also pretty useful for sending larger files,” says Daniels.

    Though Salvador Partners looks at its DevOps culture as a whole rather than by region, there are some unique, regional aspects. “We have a real good team based in India and they just go get things done, whereas some of their counterparts we use sometimes get caught up in planning the plans. This can make it difficult to pull a number of pieces of a project together,” says Daniels.

    Other Solutions to Challenges

    Locations, languages and distances present other challenges as well. Because some projects work with encryption protocols that by law can’t be shared beyond certain countries, the development work can happens only inside the U.K., the United States, Australia, Canada and some European countries, Daniels notes. In these cases, the company simply keeps the work internal, within the countries permitted.

    Language barriers can also present issues. “Such was the case where Salvador Partners had Canadian companies working on something and had a French speaker cause a few problems for his English-speaking colleagues,” Daniels says. For language challenges, the company simply whiteboards the project or uses translators.

    Time zones can also trip things up. “It creates challenges when you have a New Zealand head office dealing with partners in Singapore and developers in Russia and California. We have had conference calls where participants are going for dinner and at the same time another having their first coffee,” Daniels says.

    However, time zones and geographies are less an issue as the available toolsets to solve communications barriers have evolved.

  • Faster, Smarter DevOps

    Faster, Smarter DevOps

    Whether you call it DevOps or not, if you are concerned about releasing more code faster and at a higher quality, the resulting software delivery chain and process will look and smell like DevOps. But for existing development teams, no matter what the velocity objective is, getting from here to there is not something that can be done without a plan.

    Moving your release cadence from months to weeks is not just about learning agile practices and getting some automation tools. It involves people, tooling and a transition plan. I will discuss some of the benefits and approaches to getting there.

    Waterfall to agile, agile to continuous integration, continuous integration to continuous deployment. Whatever your processes are, the theme is the same: Find a way to get code to users faster without sacrificing quality. But speed and quality are sometimes at opposition to each other. Going faster means things can break faster, and when we only think about DevOps as releases, it’s easy to fall into this trap.
    1*rySq9stz49paDvvLwEzLhg
    Established development shops cannot just jump from one flow to another. Unless you start out net new, the goal is to introduce new processes without delaying releases for three months or more to do transition in lump. This often is done using a pincer approach that addresses both bottom-up tactics and top-down oversight and culture at the same time.

    However, because adopting DevOps tools is so easy, the trend is to focus on tactics only and adopt from the bottom up without consideration of the entire pipeline. The outcome is release automation tools that dictate your delivery chain for you, and not the other way around.

    Structured Automation

    DevOps requires automation. But what is often not considered is automation that sustains and fits into the entire delivery chain. Governance, artifacts organization and inventory, metrics and security must be considered. If an organization establishes a vetting process for all new automation and how it fits into the pipeline’s orchestration, then new automation will support what exists today and in the future.

    For example, many organizations driving down the DevOps path have encountered challenges when trying to incorporate practices from security or governance teams. Historically, these teams have resided outside of the Dev and Ops echo chamber and their processes were asynchronously aligned to the work being done. The challenge for many organizations is to determine the best ways to bring the people, processes and technology supporting these initiatives into the fold without slowing things down. The best organizations are finding new ways to automate policies from security and governance teams by shifting away from artisanal, asynchronous approaches to synchronous processes earlier in the life cycle.

    Let’s take a look at an example of application security. A number of technology vendors in the application security arena are touting “automation” as key value point for their solutions to better fit them into a DevOps tool chain. In some instances, automation means that machines are now fully responsible for monitoring, analyzing and fixing security vulnerabilities for those applications at wire-speed. In other instances, automation implies facilitation of human-centric workflows that might represent hours or days of asynchronous analysis not fit for continuous operations. In both cases, the technologies may accomplish similar ends, but their approaches could be dramatically different.

    Also, one solution might be built to support asynchronous investigations by a security professional, while the other might provide synchronous support to a developer at the design and build stages of the software development life cycle. Establishing a vetting process can help determine if the automation levels required by a team or process can truly be delivered before investments are made. It is also worth noting that layers of obscurity frequently exist within words such as “automation,” “integration,” “configuration,” and “continuous.”
    1*qk2i46FT9JElqnoJKpnNfg
    There are other areas that also tend to get overlooked in building a DevOps  environment. The complete story can be found here.

  • Automic Recognized as a Market Leader in Ovum DevOps Research

    VIENNA & SEATTLE–(BUSINESS WIRE)–Automic, a leader in Business Automation software, today announced it has been named as a “leader” in the new “Ovum Decision Matrix: Selecting a DevOps Release Management Solution, 2016–17” research report. Automic is ranked as a key vendor, based on the organization’s ability to offer ‘enterprise-strength release management and automation features’.

    We’re proud to announce that @Automic has been named a #DevOps leader by @OvumICT bit.ly/21VBeQb

    Tweet this

    The report highlights the value DevOps release management solutions provide to organizations wanting to enhance the adoption of agile principles to accelerate application delivery by reducing manual errors as well as breaking down walls between IT silos. Ovum observes that tools used within the DevOps ecosystem, such as release automation, benefit businesses by increasing the frequency of release and assuring the quality of new customer facing apps and services.

    The report emphasizes the Automic Release Automation (ARA) capabilities and strengths as:

    • Enabling users to benefit from using a common UI, a common set of integrations, as well as a unified platform, that provides end-to-end visibility and control of all automation processing.
    • Delivering scalability, resiliency, security with full auditable tracking and reporting of activities.
    • Providing a robust deployment undo capability to return an environment to its pre-deployment state.
    • Offering the choice of agentless or agent-based deployment technologies.

    “We are delighted to be recognized as a Leader in Ovum’s latest DevOps Release Management report” stated Todd DeLaughter, CEO of Automic Software. “Application Release Automation powers the agility and speed demanded by clients undergoing Digital Transformation. Inclusion in this report validates our approach in providing a best-in-class Release Automation technology to meet their needs.”

    Ovum analyst Michael Azoff commented “Automic solutions go beyond the coverage of DevOps release management by enabling users to benefit from using a common UI, a common set of integrations, as well as the underlying platform, and achieving comprehensive automation in the IT operations space”1.

    Tweet this:

    We’re proud to announce that @Automic has been named a #DevOps release management leader by @Ovumhttp://offers.automic.com/ovum-decision-matrix-selecting-a-devops-release-management-solution

    Additional Information:

    You can download a free copy of the Ovum Decision Matrix: DevOps Release Management Research

    Supporting Resources

    About Automic:

    Automic, the leader in business automation, helps enterprises drive competitive advantage by automating their IT and business systems – from on-premise to the Cloud, Big Data and the Internet of Things. With offices worldwide, Automic powers over 2,600 customers including AMC Theatres, Bosch, Carphone Warehouse, eBay, ExxonMobil, General Electric, Netflix, NHS SBS, Société Générale, Swisscom IT and Vodafone. More information can be found at www.automic.com.

    1 Ovum Decision Matrix: Selecting a DevOps Release Management, Solution, 2016–17, Michael Azoff,

    Contacts

    Automic
    Courtney Glymph
    Global PR and Communications
    +44 (0) 7584058886
    Courtney.glymph@automic.com

  • RightScale Releases New DevOps and Docker Trends in Follow-Up to State of the Cloud Report

    SANTA BARBARA, CA — (Marketwired) — 05/11/16 — RightScale® Inc., a demonstrated leader in enterprise universal cloud management,today announced the results of the RightScale 2016 State of the Cloud Survey: DevOps Trends. The fifth annual RightScale State of the Cloud Survey was announced in February. This follow-up report provides new data and analysis in a deep dive on DevOps, Docker, and container trends. The RightScale 2016 State of the Cloud Report series is the result of a survey to 1,060 technology professionals at large and small enterprises across a broad cross-section of industries.

    The survey results are available in the RightScale 2016 State of the Cloud Report: DevOps Trends, which can be downloaded at www.rightscale.com/2016-devops-trends-report.

    “The survey shows that the vast majority of enterprises are adopting DevOps and this usage is being driven from the bottom up by projects, teams, business units, and divisions,” said Kim Weins, vice president of marketing at RightScale. “Companies are using a portfolio of DevOps technologies that include configuration management tools as well as containers. While Chef and Puppet are still the most widely used DevOps tools, Docker has seen extraordinary growth, more than doubling in the past year. Companies report a lack of experience with containers and have made educating themselves a top priority in the coming year.”

    Highlights of the RightScale 2016 State of the Cloud Report: DevOps Trends include:

    • DevOps is growing, especially in the enterprise: DevOps adoption increased from 66 percent in 2015 to 74 percent in 2016. DevOps adoption is strongest in the enterprise (81 percent of enterprises adopting DevOps compared to 70 percent in SMBs). Enterprises are adopting DevOps from the bottom up: Adoption of DevOps by projects or teams (29 percent) and business units or divisions (31 percent) is more common than company-wide adoption (21 percent).
    • Docker usage doubles while Chef and Puppet are neck and neck: Overall, Chef, Puppet, and Docker are the top three DevOps tools used by respondents (32 percent, 32 percent, and 27 percent, respectively). Among enterprises, more use Puppet (42 percent) vs. Chef (37 percent) and Docker (29 percent). Docker is the fastest growing DevOps tool, with adoption more than doubling year-over-year from 13 percent in 2015 to 27 percent in 2016. In the enterprise, Docker also saw more than 2x growth (from 14 percent to 29 percent) while Ansible nearly tripled (from 8 percent to 23 percent). Docker could soon be the most used DevOps tool in the enterprise as 38 percent of enterprises have plans to use it. This compares to 20 percent who plan to use Chef and 19 percent who plan to use Puppet.
    • DevOps users use multiple tools: Less than half (43 percent) of companies are using a configuration tool such as Chef, Puppet, Ansible, or Salt. Use of multiple configuration tools is more common (25 percent) than a single configuration tool (18 percent) and 67 percent of companies using Chef or Puppet also use the other tool. Configuration tools are also often used with Docker; 80 percent of Docker users also leverage at least one configuration tool.
    • Container adoption is maturing, especially in enterprises: Overall, 26 percent of respondents have workloads already running in containers (8 percent in development, 18 percent in production). 36 percent of respondents are experimenting with containers, while 25 percent are learning about containers. Enterprises are using containers more than SMBs. 29 percent of enterprises have workloads running in containers versus 24 percent of SMBs, and 41 percent of enterprises are experimenting as compared to 33 percent of SMBs.
    • Docker seeing greatest adoption in Europe, with tech companies, and with enterprises: Evaluating Docker adoption across different geographies, industries, and roles, RightScale found that current use of Docker is heaviest among tech organizations (32 percent), enterprises (29 percent), and developers (28 percent). Use of Docker in Europe (34 percent) is also well above average.
    • Significant interest in containers on bare metal. Containers are currently being deployed primarily on virtual machines (29 percent) versus bare metal (12 percent). There is significant interest in deploying containers on bare metal with 24 percent of respondents having plans to do so in the future. Most containers are built using traditional Linux distributions such as Ubuntu (43 percent), CentOS (39 percent), and Red Hat (37 percent). CoreOS (12 percent) is the most widely adopted of the minimalist operating systems, which are designed specifically for containers.
    • Biggest challenge with containers is lack of experience for newbies: For respondents who are not currently using containers, lack of experience was by far the top challenge (39 percent). The top challenges cited by respondents who are already using containers were security (29 percent) and immature technology (29 percent).
    • Container focus in 2016 is education and experience: The top container initiative in 2016 will be getting more educated (62 percent), followed by conducting more experiments with containers in dev/test (44 percent) and production (28 percent), as well as expanding container use in dev/test (28 percent).

    Survey Methodology

    RightScale conducted its annual State of the Cloud Survey and RightScale State of the Cloud Report: DevOps Trends in January 2016. The survey questioned technical professionals across a broad cross-section of organizations about their adoption of cloud computing. The 1,060 respondents range from technical executives to managers and practitioners and represent organizations of varying sizes across many industries. Their answers provide a comprehensive perspective on the state of the cloud today. The margin of error is 3.07 percent.

    About RightScale

    RightScale Universal Cloud Management enables leading enterprises to accelerate delivery of cloud-based applications that engage customers and drive top-line revenue while optimizing cloud usage to reduce risk and costs. With RightScale, IT organizations can deliver instant access to a portfolio of public, private, and hybrid cloud services across business units and development teams while maintaining enterprise control. RightScale Consulting Services help companies develop cloud strategies, deliver cloud projects, and optimize cloud usage. RightScale was named a “100 Best Places to Work in 2015” by Outside Magazine and was listed in “The Best Enterprise Cloud Computing Startups to Work For in 2015” by Forbes. Since 2007, leading enterprises including Audi, Pinterest, and Yellow Pages Group have launched millions of servers through RightScale.

    Contact:
    Bret Clement
    Email Contact

  • Rancher Labs Secures Series B Funding of $20M for Container Management Platform

    Led by new investor GRC SinoGreen, with participation from existing investors, funding will help Rancher Labs maintain momentum, and meet sales and marketing goals

    Cupertino, Calif. – May 10, 2016 – Rancher Labs, a provider of container management software, today announced $20M in Series B funding led by new investor GRC SinoGreen, with participation from existing investors, Mayfield and Nexus Venture Partners. As the container market continues to experience significant growth, Rancher Labs’ open source platform for managing containers is seeing demand grow exponentially. Last month the company announced the general availability of Rancher, a container management platform that supports both Kubernetes and Docker Swarm, making it possible for hundreds of organizations to run containers in production. This funding will be used in support of sales and marketing initiatives to keep pace with demand for the product.

    “We are seeing a lot of attention and demand for our Rancher platform and feel it is due to our unique approach to container management,” said Sheng Liang, CEO of Rancher Labs. “Containerization has enabled organizations to do amazing things to improve application performance, availability and cost. The next piece of this puzzle, which will really help to perfect container technologies, are the tools around the management of containers. We are excited to continue efforts in furthering our goal of providing users with the right tools to take advantage of container technologies, and the financial and organizational benefits they promise.”

    Unlike other container management platforms, Rancher is open source, easy to use and designed to make it simple for users to harness the power of containers. Rancher’s unique ability to rapidly spin up and manage Kubernetes and Docker Swarm environments, while maintaining a single management experience, makes it ideal for enterprise deployments. Rancher is the only container management platform to implement a cloud-agnostic infrastructure services layer that works across any public or private cloud, or traditional data center.

    “Containers are rapidly disrupting software development and IT operations,” said Dr. James Zhang, partner at GRC SinoGreen. “Rancher Labs has shown through its amazing open-source adoption, that organizations see container management as critical to accelerating software development, and running applications reliably and efficiently in production.”

    DevOps teams use Rancher to automate all aspects of running containers throughout the application lifecycle. From developers writing code on their laptops, to building and packaging software, deploying test environments, and deploying and upgrading applications in production, Rancher allows DevOps teams to improve development velocity and reliability.

    “We are thrilled to continue our support of Sheng and the team at Rancher as they enable enterprises to truly unlock the potential of software containerization and transform IT infrastructure,” said Jishnu Bhattacharjee, managing director at Nexus Venture Partners.

    “The success Rancher Labs has experienced since launch is incredible, and we look forward to our continued partnership,” said Ursheet Parikh, Mayfield partner and former CEO of StorSimple, which was acquired by Microsoft. “Their dedication and level of innovation is second to none.”

    Product Information and Availability

    For additional information on Rancher and to learn more about Rancher Labs and the company’s suite of open source products, please visit http://www.rancher.com.

    Supporting Resources

    About Rancher Labs

    Rancher Labs builds innovative, open-source container management software for enterprises leveraging containers to accelerate software development and improve IT operations. With native support for Docker Swarm and Kubernetes orchestration, our flagship Rancher platform allows users to manage all aspects of running containers in development and production environments. For additional information, please visit www.rancher.com.

    #

    Contact

    Mindshare PR
    Eleni Laughlin, 510-406-0798

    eleni@mindsharepr.com

     

  • PagerDuty Services Group Capability Simplifies Incident Management of Critical Applications and Services

    New Services Group feature simplifies how IT Ops and DevOps teams resolve incidents, delivering increased uptime and performance
    May 11, 2016 09:00 AM Eastern Daylight Time

    SAN FRANCISCO–(BUSINESS WIRE)–PagerDuty, the leader in modern incident management, announces the immediate availability of PagerDuty Services Group. Services Group fundamentally changes the way IT Ops and DevOps teams manage and monitor critical apps and services by mirroring the organization and components of these services in PagerDuty. Services Group aggregates all events related to these individual services from the monitoring stack and renders a comprehensive view of the organization’s application and service infrastructure. This new functionality delivers the fastest way to organize, monitor and manage critical apps and services as they relate to the business.

    “The PagerDuty Services Group feature makes it easier to resolve incidents as they occur in our critical applications and services,” said Andy Domeier, director of systems operations, SPS Commerce, the retail industry’s largest trading community with more than 60,000 customers in over 60 countries. “By re-creating a service in PagerDuty, as it exists in our systems, our team members are more aware of service-level health, allowing us to resolve an incident faster.”

    With the new PagerDuty Services Group, IT Ops and DevOps teams immediately benefit from:

    • Consistent Views – A service in PagerDuty is structured identically to how it is deployed in the IT infrastructure. Teams no longer view the monitoring and management layer of a service, instead they see a comprehensive view as it relates to overall service delivery, such as e-commerce portals, payment processing systems, websites or other key applications.
    • Simplified Management and Collaboration – The monitoring and management layers are aggregated into one view at the service level from multiple vendors. IT service management (ITSM), log management and application performance management (APM) tool views are consolidated, creating better collaboration between different teams and technologies required to support the service.
    • Faster Incident Resolution – Teams work together to resolve disruptions at the service level rather than in technology silos.

    “PagerDuty Services Group greatly simplifies incident management to better support business-critical services,” said Jonathan Wilkinson, vice president of product, PagerDuty. “By bringing together an organization’s application and service infrastructure in a central view, PagerDuty Services Group empowers IT Ops and DevOps teams to resolve incidents as quickly as possible.”

    PagerDuty Services Group is now available to all PagerDuty customers and to learn more, read our blog post.

    About PagerDuty

    PagerDuty is an agile incident management solution that integrates with IT Ops and DevOps monitoring stacks to improve operational reliability and agility. From enriching and aggregating events to correlating them into actionable alerts, PagerDuty streamlines the incident management lifecycle by reducing noise and resolution times. With hundreds of native integrations with operations tools, automated scheduling, advance reporting and guaranteed reliability, PagerDuty is trusted by over 7,000 organizations globally to increase business and employee efficiency. The company is headquartered in San Francisco and backed by leading venture capital firms Andreessen Horowitz, Bessemer Venture Partners, Baseline Ventures, and Ignition Partners. Try PagerDuty for free at www.pagerduty.com.

  • ELECTRIC CLOUD HELPS ORGANIZATIONS SCALE THEIR DEVOPS EFFORTS WITH NEW RELEASE OF ELECTRICFLOW

    New features give enterprises an easier way to scale DevOps initiatives across projects and teams with end-to-end automation, cross-functional visibility and consistent processes

    SAN JOSE, Calif., May 10, 2016 – Electric Cloud (http://electric-cloud.com), the leader in DevOps Release Automation, today announced the latest release of its industry-leading ElectricFlow DevOps Release Automation platform. The new release supports the company’s mission to advance DevOps in the enterprise by helping customers scale software delivery pipelines and DevOps best practices throughout the organization.

    “The industry discussion has evolved from ‘how do I get started with DevOps?’ to ‘how do we scale our DevOps initiatives while addressing security, compliance and governance?’” said Steve Brodie, Electric Cloud’s CEO. “We are laser-focused on helping enterprises turn their software pathway to production from a laborious, slow and painful process into a competitive advantage. ElectricFlow offers new features designed specifically for the needs of the largest and most complex organizations on the planet – with some of our customers releasing updates from 40,000+ developers across 20,000+ applications on a single platform.”

    In order to succeed with DevOps, large organizations need an end-to-end solution that allows them to standardize and automate their software deployment tools and processes as much as possible. This provides enterprises with consistent build, test and deployment procedures to speed up cycle times, eliminate configuration drift and bottlenecks in the pipeline, while also reducing IT capital expenditure and operating costs.

    ElectricFlow provides even greater enhancements to further improve the orchestration and automation of an organization’s ‘Pathway to Production.’ New features include new artifact staging, automated rollbacks and simplified manual steps creation capabilities. Click here to learn more about ElectricFlow (http://electric-cloud.com/products/electricflow).

    The platform’s proven scalability and extensibility, which allows organizations to automate any workflow and plug-in any tool or technology stack, has led many customers to set up ElectricFlow as a shared internal service that powers their software delivery across all teams and releases worldwide.  This is consistent with observations from leading industry experts and research analysts who recommend a centralized DevOps Release Automation platform. “Automation adoption in any form is good,” noted Robert Naegle and Ronni J. Colville in a May 2015 Gartner Research report*, “but, ultimately, to deliver significant business value automation initiatives must be centralized, with common governance, leadership and management constructs.”

    The industry is taking note. Recently, Ovum Research recognized Electric Cloud as a market leader for DevOps Release Management. Forrester Research also recognized Electric Cloud in its 2015 ARA Wave Report as a Strong Performer, with clear leadership in strategy as defined by vision, planned enhancements, scalability, extensibility, controllability and out-of-the-box, third-party plug-ins. The company recently announced record sales for its DevOps Release Automation solutions, and also has closed multiple large contracts over the last two quarters with several leading Financial Services firms, including a Fortune 10 bank, two leading electronic stock trading companies and one of the industry’s largest mortgage originators. It also secured a multi-year, multi-million dollar enterprise agreement with one of the largest networking companies in the world.

    To learn more about Electric Cloud, please visit: (http://electric-cloud.com).

    Share This: .@electriccloud hits stride with ElectricFlow, the leading #DevOps Release Automation platform for scaling DevOps http://electric-cloud.com/products/electricflow

    *Gartner, Survey Analysis: The Realities, Opportunities and Challenges of I&O Automation, May 27, 2015.

    About Electric Cloud, Inc.

    Electric Cloud is the leader in DevOps Release Automation. We help organizations developing enterprise web/IT, mobile, and embedded systems deliver better software faster by automating and accelerating build, deployment, and release processes at scale. Leading organizations like Cisco, E*TRADE, Gap, GE, HP, Intel, Lockheed Martin, Sony and Qualcomm use Electric Cloud solutions and services to boost DevOps productivity and Agile throughput, while providing a scalable, auditable, predictable, and high-performance pathway to production.

    # # #

    Contact:

    Jeremy Douglas

    Catapult PR-IR

    303-581-7760

    jdouglas@catapultpr-ir.com

  • SourceClear Launches Free Security Product for Development Teams Building with Open-Source Libraries and Frameworks

     Offering Supports Popular Languages and Connects to Leading Development Tools; Identifies and Prioritizes Vulnerabilities and Licensing Issues; Gives Detailed Fixes

    SAN FRANCISCO, May 9, 2016 – SourceClear, the security company for software developers, today announced a free security tool, SourceClear Open, for teams building with open source. Available immediately at no cost and delivered as a cloud service, the new tool enables developers to identify what open-source libraries they are using, what vulnerabilities exist, which vulnerabilities actually matter, and what needs to be done to fix them. SourceClear Open complements SourceClear’s products that are currently deployed by some of the world’s largest companies, including BAE Systems, The Gap, DataStax and Zendesk.

    “I have spent 15 years watching talented, hardworking developers reinvent the world and then roll their eyes when asked to use traditional security tools. Developers always want to do the right thing, but have been faced with tools that generate more noise than signal. It became increasingly hard not to be frustrated by the status quo, so I decided to do something about it,” said Mark Curphey, CEO of SourceClear. “We’ve designed the SourceClear products specifically for teams of developers. With this release, we are ‘giving back’ to the community that helps us all build amazing software.”

    SourceClear connects easily with existing tool chains (languages, frameworks and build tools), and is a critical component of modern development processes. Powered by data science, a dedicated research team and a community research program, SourceClear identifies vulnerabilities well beyond those found in public and government databases. Tracking thousands of threat sources and analyzing millions of open-source library releases, SourceClear detects disclosed and emerging security threats.

    “Open source and DevOps have transformed the way we build software, and developers are being held even more accountable for security. With that responsibility, developers want tools that bring immediate value and don’t slow them down,” said John Viega, author of many security books, including the first book for developers on how to write secure software. “SourceClear delivers the information that developers need to view, understand, prioritize, and fix vulnerabilities that matter. That’s a powerful value proposition.”

    Integrated with developer tools like GitHub and Jenkins and supporting popular languages such as Java, Ruby, Python and JavaScript, SourceClear can be connected to repos, build systems or a developer’s desktop in minutes. SourceClear offers teams the flexibility to look at their code base or drill into specific repos, builds, branches or tags. Teams can share data and send results to issue tracking systems like JIRA. Developers and their security teams always have complete control as source code never leaves their networks, and analysis and results are always encrypted when being transmitted and stored.

    In addition to GitHub and Jenkins, SourceClear integrates with other leading source control management systems, including Bitbucket Server, GitHub Enterprise and OSS Git. SourceClear’s native build plugins for Gradle, Jenkins and Maven, as well as package managers like Bower, Bundler, NPM and PIP, ensure complete coverage every time a build is run.

    In addition to Open, SourceClear includes:

    • Registry: A free database of security knowledge in the world’s open-source libraries and frameworks, including a complete list of all publicly disclosed vulnerabilities.
    • Pro: Combines all of the functionality in Open with additional premium features and support to help both developers and security teams prioritize, manage and fix real security issues – drastically reducing false positives.
    • Enterprise: Extends the features found in Pro for large enterprise implementations with complex requirements.

    About SourceClear

    SourceClear is the security company for software developers. We are a team of software and security engineers helping software engineering teams build software, safely. We take care of security for open-source and third-party code so our customers can focus on their business: shipping features and delighting users. Headquartered in San Francisco, California, and with an office in Singapore, SourceClear is backed by Index Ventures and Storm Ventures. For more information, visit us at: https://srcclr.com.

  • Hello, Security. Meet Agile

    Hello, Security. Meet Agile

    Illumio Chief Commercial Officer Alan S. Cohen recently wrote in his blog, “Go, Slow and No: Bringing DevOps Speed to IT Security,” “There are reasons why security and risk professionals often react with a ‘no.’ When you are tasked with assessing and reducing risk, going fast might not be the first instinct.”

    Many InfoSec practitioners adhere to accreditation and certification programs such as ISO27001, SSAE-16 SOC and PCI compliance. This ultimately means they follow strict policies and procedures for software development. These procedures go through many gates, including risk analysis, design and code reviews, penetration testing and ITIL-based change-management processes. InfoSec teams live in a world where they have to plan their changes months in advance, and this world often is in direct conflict with agile development and DevOps concepts.

    Agile is all about focusing on flow and end-to-end cycle time, releasing very small changes fast, early and often. It’s not about the number of things in each sprint, but rather what’s needed now for MVP and iterating. For agile and security to be in alignment, there needs to be a fundamental shift in the principles and values that enable the business over governance and process.

    In particular, security:

    • Embraces some uncertainty. You will never build a perfect piece of software. The key is to build guardrails and to have the required adaptive enforcement and monitoring in place to capture and correlate metrics that help you quickly respond, evaluate factors of compromise and leverage your deployment automation to remedy risk exposures quickly.
    • Is part of the project team, either embedded or as an adviser. There must be a dedicated resource that understands the team’s mission of delivering value. Somebody on the team should be wearing the security hat, helping to guide each project.
    • Is a risk adviser inside the organization. Don’t compartmentalize information. There needs to be a culture of trust, sharing and transparency about potential vulnerabilities to the service.
    • Trusts the decision-making of engineering teams. Informed and capable engineers aren’t reckless with security decisions.
    • Is part of everything. It’s the design of the entire service and therefore is the responsibility of the entire team, not just the security team.
    • Improvements do not add complexity to the user experience. Security that degrades the user experience will force people into insecure practices.

    Bringing Agility, Security Together

    Embracing agility and DevOps opens the door to new possibilities that can improve security posture without hindering the business. Security will quickly discover a new set of best practices:

    • Look to microsegmentation software that is adaptive and intelligent, to replace manual management of firewall rules and policy.
    • Decouple security from the infrastructure to gain a continuous enforcement pipeline that adapts to new hardware, with strong versioning that proceeds in lockstep with product releases, monitoring and infrastructure configuration.
    • Build security into the service stack; don’t bolt it on afterward.
    • For change auditing, don’t rely on the change management database alone. This is highly prone to error and discrepancies. Look at the the git history integrated with the automated deployment system. Change management databases should be integrated with the git pull requests and commit logs. Infrastructure automation tools such as Chef and Puppet keep logs for unapproved change drift. Make sure those logs are being captured and reported on.
    • In the area of developer support, DevOps is enabling the self-service/self-responsibility revolution by building wrapper abstraction layers for engineering teams to consume infrastructure across public and private data centers, using interfaces such as chat to trigger administrative actions and query metadata information on their instances. These wrappers can also be harnessed to present security grading for every server instance, promoting awareness and corrective action to each individual owner. You can quantify the grade by looking at patch vulnerabilities, images used to build, inbound/outbound port rules and configuration standards.
    • For data at rest, data in motion and data in transit, everything should be encrypted, everywhere. For example, use Illumio SecureConnect to encrypt data in transit via IPsec between workloads. Automation and the right secrets-management infrastructure can enable frequent rotating of SSL certs and keys.
    • Every time you commit to the code base, run a set of very basic security tests via your favorite continuous integration tool. Use automated tests to ensure common security mistakes don’t leak to production.
    • Perform red team exercises as an attempt to gain access to a system by any means necessary. Try to mimic the same processes that a motivated attacker would follow to map out an organization’s infrastructure, perform reconnaissance at key physical installations, and then test the physical, cyber and social defenses all at once through a staged exercise.

    Security can become an enabler. It no longer has to be stuck being the department of “No.” InfoSec can now be the team-building tools and systems that enable development teams to do what they want in a secure way.

    About the Author / Alfred Garcia

    alfredAlfred Garcia oversees DevOps for Illumio, where he is responsible for all preproduction and production cloud/infrastructure engineering and site reliability. A technology and operations executive with more than 18 years of experience, Alfred is an aggressive advocate of DevOps and of deep operations and engineering collaboration, from design to code/test and release to production support.

  • Balance: The Key to Successful DevOps

    Balance: The Key to Successful DevOps

    In the realm of IT buzzwords, DevOps is in a league of its own. The pervasiveness of the word is matched only by the variety of its definitions. Over time, much like the parable of The Blind Men and the Elephant, it has slowly taken shape out of the void, albeit in a backwards fashion. Associated terms such continuous delivery, integrated quality assurance and deployment automation have helped backlight the beast’s silhouette, but there is much more to discover.

    Generally, DevOps is defined by how it is used rather than what it is. This is helpful for those already familiar with the amorphous nature of the movement, but can be a confusing introduction for the uninitiated. To achieve a better understanding, it is important to grasp the underlying need driving the shift to a DevOps model.

    Currently, the world of IT is barreling toward a future dominated by increasingly specialized and inherently complex automated solutions. Software is taking a front row seat in ways never before possible. (Insert here)-as-a-service offerings and the demand for instantaneous and consistent deployment turnaround is at an all-time high. The days/weeks required to shuffle a solution between development and engineering is a luxury that most companies can no longer afford and is less tolerated by customers. This level of expectation is something that the traditional IT org chart was not designed to cope with. Tech companies everywhere have felt the strain of this increasing momentum, with many at a loss of how to handle it. Demanding that teams work harder, faster, longer will only get so far. And inevitably, increased intensity results in a rise in mistakes and an inferior product.

    Balance: Dev’s Yin to Ops’ Yang

    Clearly, change was and is needed. The path from development to operations needs to be streamlined at a fundamental level. However, dissolving the barriers between two longstanding departments is not without its perils. As any IT veteran will tell you, development and operations each have their own cultures, quirks and personalities. But the differences in each help create the perfect balance.

    In its purest form, development is the trailblazer, forging into uncharted territory and unearthing hidden gems. Ever the innovator, Dev values progress and change above all. This constant forward momentum is Dev’s greatest asset as well as its Achilles’ heel. The habitual urge to tinker, tweak and create can lead to frivolous or wasted effort. The results of this misguided effort can be seen in retrograde patch releases, hotfixes and other “band-aid” measures needed to undo the damage.

    On the other end of the spectrum, the operations mantra can be summarized with the idiom, “If it ain’t broke, don’t fix it.” Pragmatic to the core, stability and consistency are the guiding forces behind Ops. Change requests are usually met with a Treebeard-esque, “Don’t be hasty.” Taken to the extreme, this mindset can quickly lead to an environment running outdated, unpatched software and end-of-life hardware.

    On the surface, the differences between these two groups appear to be on the verge of irreconcilability. However, in this diversity the beauty of DevOps emerges as the strengths of each team balances out the weaknesses of their counterpart. Development is free to innovate and create knowing that their efforts will be guided by feedback from operations. Like stabilizers on a rocket, operations is able to focus on maintaining a reliable infrastructure with development providing the forward momentum. Working in unison, this duo forms a unit far greater than the sum of its parts. And with it, a company is left with an agile and stable launch pad from which to tackle the latest wave of IT challenges.

    Admittedly, the combining of development and operations into a single cohesive unit is just a piece of the entire DevOps puzzle. However, it is an important piece that is frequently overlooked. Understanding the forces and motivations at work within your teams is a pivotal step on the road to a successful DevOps transition.

    About the Author / Jared Perry

    Jared PerryJared Perry is a cloud engineer at iland, where he is responsible for maintaining the virtual infrastructure and a number of disaster recovery solutions. He holds a Bachelor of Applied Science in technology management and a Bachelor of Science in IT administration and management from Texas A&M University.