devopsy.kinsta.cloud

Tag: devsecops

DevOps Deeper Dive: VMware Transformed
At the VMworld 2019 conference this week, VMware in no uncertain teams made it clear it wants to become a major DevOps force.

Following the acquisition of sister company Pivotal Software last week, VMware is moving to build out an application development framework for building and deploying cloud-native applications based on Kubernetes. That effort coincides with ongoing investments in its vRealize Suite of management tools, through which VMware is committed to automating IT operations across both on-premises IT environments and public cloud computing environments.

To advance those twin goals, VMware this week launched a series of Tanzu management tools for managing any distribution of Kubernetes while at the same time launching VMware hybrid cloud platform, which combines everything—from vRealize automation tools to the monitoring tools from Wavefront by VMware—to create a central console through which all of IT can be managed.

[su_box title=”The VMware DevOps Timeline”]
- October 2015 – Dell Acquires VMware along with EMC
- April 2017 – VMware acquires Wavefront monitoring service
- August 2017 – VMware shifts public cloud strategy via Amazon Web Services (AWS) alliance; VMware and sister company Pivotal Software unveil Kubernetes distribution
- November 2017 – VMware Launches VRealize Management Suite
- February 2018 – VMware acquires CloudCoreo to gain cloud configuration tools
- August 2018 – VMware acquires CloudHealth Technologies to gain governance tools; VMware launches AppDefense to provide a zero-trust framework
- November 2018 – VMware acquires Heptio for Kubernetes expertise
- December 2018 – Dell acquires all VMware outstanding shares
- May 2019 – VMware Acquires Bitnami for application packaging tools
- July 2019 – VMware Acquires Avi Networks to gain Web Application Firewall (WAF); VMware Acquires Bitfusion for machine learning algorithms and GPU virtualization software
- August 2019 – VMware Acquires Pivotal Software; VMware Acquires Carbon Black; VMware Launches Tanzu Platform to manage Kubernetes; VMware Unveils Hybrid Cloud Platform
[/su_box]

After deciding to launch a series of services through which it manages instances of its software on public clouds such as Amazon Web Services (AWS) and local servers from sister company Dell EMC, VMware has been slowly expanding its reach into the realm of applications. The most significant element of that thrust to date has been its acquisition of Pivotal, a provider of the widely used Spring framework based on Java and a platform-as-a-service (PaaS) environment based on open source software from the Cloud Foundry Foundation (CFF).

The CFF is in the process of migrating the application development environment created for Cloud Foundry to Kubernetes, a cloud-native container orchestration engine being developed under the auspices of the Cloud Native Computing Foundation (CNCF). Both the CFF and the CNCF are arms of the Linux Foundation. The rise of Kubernetes has resulted in many organizations shifting their application development strategies to a platform capable of supporting multiple application development environments.

Prior to announcing the deal to be acquired by VMware, Pivotal cut its revenue forecast for fiscal 2020 by $40 to $50 million.

VMware CEO Pat Gelsinger

Pivotal Software spun out of VMware in 2013, so to a certain degree VMware’s move to acquire Pivotal represents something of a homecoming that last week was valued at $2.7 billion. Pivotal currently has about 350 customers, many of which are hosting a distribution of the Cloud Foundry PaaS on VMware platforms. VMware also tapped Pivotal to jointly develop a curated instance of Kubernetes, dubbed Pivotal Container Service (PKS), that is optimized for VMware platform. As part of that effort, VMware is also developing an instance of VMware vSphere that will run Kubernetes natively.

At the VMworld 2019 conference, VMware CEO Pat Gelsinger made it clear VMware plans to leverage Kubernetes to bridge the historical divide between developers and IT operations teams. In fact, he told attendees Kubernetes was the most important technology to emerge since the virtual machine was created. As part of that effort, Gelsinger noted that the acquisition of Pivotal coupled with the recent acquisition of Bitnami, a provider of tools for packaging applications, means there are now more 5 million developers participating in the VMware ecosystem.

VMware is clearly hoping the developer ecosystem will expand as VMware makes it easier to launch virtual machines on every major public cloud as well as on-premises IT environments. VMware has faced a major challenge over the last several years as DevOps teams have bypassed internal IT teams to deploy applications on cloud services based on alternative virtual machines by AWS or Microsoft. Thanks to the inherent portability of Kubernetes, VMware is hoping organizations will now deploy cloud-native applications on VMware platforms. It remains to be seen, however, to what degree DevOps teams will embrace VMware on public clouds versus continuing to employ those virtual machines.

When it comes to cloud-native computing, VMware is clearly playing catchup. VMware has 250 PKS customers today, while rivals such as Red Hat (now an arm of IBM) have already redeployed their application development and deployment platforms on Kubernetes as an alternative to the Cloud Foundry PaaS. On the plus side, VMware now claims to be the third-largest contributor to Kubernetes, thanks in part to its acquisition of Heptio, a provider of Kubernetes tools.

In the meantime, there’s no question VMware is at the forefront of developing tools for automating the management and securing of IT infrastructure running its virtual machine software. Less clear is to what degree VMware will be able to translate that success to also unify application development and IT operations across multiple platforms a truly meaningful DevOps way, rather than merely bundling a suite of disparate tools together at a discount.

— Mike Vizard
August 26, 2019
Puppet Aims to Automate Vulnerability Remediation

Puppet today unveiled Puppet Remediate software, which makes it easier to prioritize and remediate software vulnerabilities automatically.

Matt Waxman, vice president of products for Puppet, said Puppet Remediate builds on existing automation capabilities in the Puppet platform to make it easier for DevOps teams to focus on addressing vulnerabilities. Most existing approaches to addressing vulnerabilities rely on manual processes that often result in vulnerabilities not being addressed in an especially timely manner, he said.

To accelerate that process, Puppet Remediate identifies vulnerabilities based on their potential severity and then gives DevOps teams the option to automatically remediate all known instances of that vulnerability, said Waxman. Puppet Remediate combines infrastructure data with vulnerability data gathered in real-time from Tenable, Qualys and Rapid7 to prioritize vulnerabilities.

Puppet Remediate will not automatically remediate a vulnerability without the express approval of the DevOps team. That’s critical because in many instances the patch being applied still needs to be tested and vetted by the DevOps team, noted Waxman. Once approved, Puppet Remediate includes four pre-built tasks that allow DevOps teams to address more than 80% of the typical remediation workloads—importance because once a vulnerability is discovered, it’s not uncommon to find that same mistake has been made across many other software modules that have already been built and deployed.

Deployed using Docker containers, Puppet Remediate relies on an agentless approach to vulnerability remediation that adds minimal overhead to either a Linux or Windows application environment, Waxman said. He added the goal is to make it easier for developers or cybersecurity teams to deploy Puppet Remediate on any platform.

Waxman said the primary goal is to help organizations embrace best DevSecOps processes. In the absence of automation, the amount of time allocated to addressing vulnerabilities manually within existing applications often gets short shrift as developers race to meet deadlines for new applications. The irony, of course, is that each new application only serves to increase the number of potential vulnerabilities that need to be addressed. To restore order to vulnerability remediation process, Puppet is making the case for applying a proven IT automation framework to application security management.

It may take a while for organizations to fully embrace automated application vulnerability remediation, but it would seem that, given the chronic shortage of cybersecurity professionals, adoption of these types of platforms is all but inevitable. There simply are not enough skilled cybersecurity professionals available to participate in every aspect of the application development and deployment process.

At the very least, automated vulnerability remediation tools should inform developers of the mistakes being made most often. Over time, the number of instances of those vulnerabilities being discovered should decline as developers realize they are addressing the same issue repeatedly. Once that becomes obvious, hopefully that long-awaited teachable moment that eliminates that particular vulnerability from the application environment is finally at hand.

— Mike Vizard

August 21, 2019
CircleCI Adds Security Orbs to CI/CD Platform

CircleCI has extended the reach of its automated package manager, known as orbs, to cybersecurity software that can be integrated into a pipeline constructed within the company’s namesake continuous integration/continuous deployment (CI/CD) platform.

Mike Stahnke, vice president of engineering for CircleCI, said extending orbs into the realm of cybersecurity will make it much easier for organizations to embrace best DevSecOps processes.

Designed to run on Amazon Web Services (AWS) and Google Cloud, the first set of orbs are being created by seven third-party cybersecurity vendors, including Alcide.io, NeuVector, Snyk, WhiteSource, Aqua Security, Anchore, Contrast Security, Probely and Twistlock, which is now part of Palo Alto Networks.

CircleCI has been making use of orb package managers to make it easier to integrate a wide variety of functions within a CI/CD pipeline. Thus far, approximately 900 orbs have been developed for the CircleCI platform. Stahnke said the goal is to give DevOps teams the option of employing orbs instead of having to manually implement tasks such as secrets management, vulnerability scanning or policy enforcement into DevOps workflows.

Stahnke said CircleCI doesn’t envision every element of a pipeline will become an orb; there will be instances where DevOps teams will want to exercise more granular control over some aspect of the pipeline. There are, however, going to be many situations in which DevOps teams won’t want to integrate the same functions manually over and over again.

CircleCI expects orbs will prove especially useful in advancing the adoption of best DevSecOps processes because many of the controls that need to be implemented are the same across multiple pipelines, said Stahnke. By making it easier to incorporate cybersecurity software within a pipeline, DevOps teams will not have to sacrifice speed and agility to ensure security.

Most organizations today are just starting down the DevSecOps path. Adoption of DevOps processes in many cases has been uneven at best. Trying to incorporate cybersecurity teams within those processes to ensure higher levels of security is the next great challenge. However, given the chronic shortage of cybersecurity professionals, cybersecurity functions within a DevOps pipeline somehow must be included automatically. In most cases, cybersecurity teams will continue to define policies and controls that increasingly are implemented by developers. Cybersecurity teams, however, still will need to validate that those controls have been implemented and tested before an application gets deployed in a production environment. Cybersecurity teams will then make developers aware of any vulnerabilities they’ve discovered and teams can decide to address them at whatever next stage of the development process they deem appropriate.

Of course, DevSecOps also means cybersecurity teams will have to learn to trust developers. Historically, that’s been problematic because many cybersecurity professionals have tended to view developers as the primary source of the cybersecurity problem. Nevertheless, the more vulnerabilities that get addressed before an application is deployed in a production environment, the better off everyone involved in building, deploying and securing that application will be.

— Mike Vizard

August 13, 2019
Helping Developers Win in the Shift-Left Revolution

The shift-left revolution is upon us. Just because it’s a cliche, doesn’t mean it’s not true. As software development organizations continue to implement DevOps culture, processes, and tools, developers are adopting the practice of testing and ensuring the security of their applications as early as possible in the DevOps pipeline.

This is quite a change from the traditional waterfall method. There, developers dealt with the design and creation of a product or application and security professionals came in after they were finished, to review and test security, flagging any possible issues and sending them back to the software teams to figure it out.

This fundamental change in the way companies are addressing application security affects many of the moving parts in a software outfit. It requires a new set of processes, practices and tools all to be implemented, all while keeping up with today’s fast-paced release cycles.

To gain an understanding and insight on how developers are handling this hefty challenge, we polled more than 600 developers in software organizations and asked them about how security figures into their day-to-day tasks and processes, and the tools that help them to address their evolving roles.

Developers: Owning Their Shift Left

The first thing that we wanted to learn is whether developers are on board with the shift-left approach that most organizations have adopted for security testing. Our findings showed that, for the most part, developers are taking ownership of the day-to-day operational responsibility for AppSec in their organizations, playing a more significant role on this front to secure their products.

When asked who owns the day-to-day operational responsibility for AppSec in their organizations, 23% answered that developers own those responsibilities, 21% said DevOps, 28% said software development team leaders owned it and only 29% said security teams in their organizations are the owners.

The fact that a whopping 71% of developers put the ownership of AppSec squarely on the shoulders of software development and DevOps folks means that developers are very much on board with the shift-left movement and have taken on the new security tasks that come along with that.

Breaking it down, we also found that in smaller organizations, more developers and DevOps professionals feel that they own their AppSec responsibilities, while those percentages go down with larger organizations. This can be explained by the fact that often smaller companies have less specialization, requiring developers to branch out of their professional comfort zone. Smaller organizations also tend to allow developers more freedom and flexibility to define their own processes.

Do these responses mean that in addition to their focus on innovation, functionality and quality, developers have also added security into their considerations when they are in the process of creating and building projects?

The answer would appear to be yes, according to 58% of developers in our survey, with an additional 39% saying that security figures into their consideration when issues arise (14%) or that they validate security before deployment (25%). Only 3% of developers said that security is none of their concern since it slows them down.

Are you taking security into consideration when developing software?

While their responses show that there is still a ways to go before security is completely baked into development processes, it’s clear that most developers are already in the right direction, making security a priority within their tight schedules.

The AppSec Process: Who’s On First?

How does making security a top priority or at least a consideration figure into the different phases in the DevOps pipeline? Practically, where is it being applied? We asked developers at which phase in the software development life cycle (SDLC) they started testing their AppSec.

Their answers showed once again that developers are taking on security where it traditionally was not a part of their workflow. In fact, many replied that they are integrating security testing tools as early as the pre-build stage, with 36% of the respondents saying that they are testing in their IDE and repositories.

Survey results also showed that along with the DevOps processes, they are also adopting tools that help them to shift security further left. 68% of developers report using at least one AppSec technology such as SAST, DAST, SCA, IAST or RASP. All of these automated solutions help security teams and developers detect potential security issues in their products, providing software teams with visibility and control over their AppSec.

A Question of Remediation

Until now, survey results show that developers have taken their place on the front lines of AppSec and the shift-left revolution, arming themselves with an impressive collection of automated detection tools. However, these solutions are creating a new set of issues that should worry stakeholders.

It appears that the much-needed security testing tools are threatening to bury development teams under a mountain of alerts, which they are now required to research and remediate while keeping up with their deadlines. It’s impossible for developers to keep up with all of the security alerts in their inbox, especially considering that many AppSec tools were developed for security teams and focused on widespread coverage (detecting all potential issues), rather than accuracy and prioritization.

This poses quite a challenge for developers, who say that they are spending a substantial chunk of their very valuable time dealing with remediation-related tasks. A full 42% of the respondents reported that they spend between two and 12 hours each month on these tasks, while another 33% said that they spend 12 to 36 monthly hours on them.

In light of these time-heavy statistics, it is clear that developers need new technologies and practices that will allow them to prioritize security without slowing down the development life cycle and costing them so many valuable work hours.

Helping Developers Win the Race to Remediation

The survey results showed that developers today are required to take the lead when it comes to application security, but need more backup to do so. Detection tools can take developers part of the way, but to empower them through to remediation, organizations must provide them with developer-focused solutions that can help them to close the loop from detection to remediation.

Once developers are alerted to a newly detected security vulnerability in their project, they need to validate it, assess its impact, research remediation options and perform the remediation path chosen. Currently, these are all time-consuming manual processes that require a level of skill and proficiency.

With developers poised to face security head-on, organizations expecting them to fully address AppSec need to provide them with the tools that will easily integrate into their native environments and help them take vulnerability management one step further, enabling them to prioritize security alerts so that they can get to the most burning issues first and even automate their remediation process.

— Ayala Goldstein

August 7, 2019
Software Compliance Teams Can Learn a Lot from DevSecOps
Many argue that application security should be the responsibility of a security team. However, while security professionals can contribute, developers are usually the only ones with the technical ability to fix software security vulnerabilities. The same goes for software compliance. When it comes down to it, only developers are equipped to build applications in compliance with specific software standards.

Considering the tight deadlines for development teams, giving them additional duties can present challenges. To help developers deliver secure applications without slowing them down, many teams have adopted DevSecOps—which encourages integrating automated security testing into the DevOps workflows for every release.

DevSecOps helps teams deliver more secure software faster, but what about more compliant software? Many teams trying to achieve software compliance encounter similar challenges as those trying to achieve software security. Luckily for them, they can use similar strategies.

What Does DevSecOps Do?

The fast, iterative software release cycles supported by DevOps workflows present hurdles for software security.

In traditional approaches to securing software, testing occurs toward the end of the software development life cycle (SDLC), after an application’s construction. As a result, most (if not all) of the application is tested at once, and a long, daunting list of security issues is sent back to developers.

However, many teams find this methodology incompatible with DevOps. Development teams don’t have the time—not to mention the budget—to stop whatever they’re doing to sort through a massive spreadsheet of issues.

To solve this problem, organizations can implement DevSecOps by integrating security testing into the shorter, higher-frequency feedback loops of fast DevOps release cycles. Rather than running one big test after developers finish building an application, DevSecOps calls for automated security testing performed early and often. By helping developers check in more secure code, DevSecOps helps reduce the volume of issues QA must identify and send back to them.

If development teams can integrate security testing into DevOps workflows, why not compliance testing?

How to Apply DevSecOps Practices to Software Compliance

While testing for security usually requires a different analysis than testing for compliance, development teams practicing DevSecOps can use a similar approach to compliance testing.

Like traditional application security testing, compliance testing typically happens in the QA environment. A very rough application development and testing workflow looks something like this:
1. Developers write the code for an application.
2. QA tests the code while developers move on to another project.
3. QA sends a list of compliance violations back to developers, requiring them to pause their current work to fix those problems.
There is nothing technically wrong with this compliance testing strategy. However, this approach is frustrating for developers and costly if the list of issues is especially long. To resolve more compliance issues before an application is complete, teams can implement practices inspired by DevSecOps to help developers commit compliant code earlier in the SDLC.

One of these strategies is to integrate automated compliance testing into DevOps release cycles. By testing the application in increments rather than all at once, teams can reduce the number of compliance violations per testing cycle. While it obviously requires higher-frequency testing throughout the SDLC, this approach has proven to be faster than waiting to find issues in QA.

Another approach is to create a sandbox environment in the integrated development environment (IDE) where developers can run tests themselves. Testing their own code as they write it equips developers to check in cleaner, more compliant code, so compliance violations are less likely to show up in QA—or worse, production. This approach has the added benefit of familiarizing developers with code that leads to compliance violations.

These strategies for identifying and resolving compliance violations are not meant to replace QA testing. However, by integrating compliance testing into multiple stages in the SDLC, teams will see fewer issues in feedback loops between QA and development—which better supports DevOps workflows.

What Does This Look Like in the Real World?

As with security testing, integrating compliance testing into DevOps release cycles requires new technologies and workflows, each with a different learning curve.

Regarding technology, static analysis is growing as a popular option to help development teams build compliant applications. Coverage varies between static analysis tools, but in general, the technology can find issues in code quality standards, such as MISRA and CERT C/C++, as well as security standards, such as OWASP Top 10 and PCI DSS.

The static analysis tool or any other technology that teams choose to address, software compliance plays an important role in the workflows they adopt. As discussed earlier, those hoping to keep issues out of QA will want to find solutions that can:
1. Integrate into the quick feedback loops between testing and development.
2. Scan code in the IDE as developers write it.
Creating a more continuous cadence of feedback between testing and development could represent a significant shift in a developer’s day-to-day.

While “DevCompOps” doesn’t quite have the same ring, development teams in regulated industries will find cost-cutting benefits by integrating compliance testing into DevOps release cycles.

— Charlie Klein
August 1, 2019
DevOps World | Jenkins World 2019 Training is Best in Class

Do you work on Jenkins pipelines? Are you responsible for implementing CloudBees tools in your development environment? Do you manage a DevOps team? Is your organization ramping up DevSecOps capabilities?

If you answered yes to any of these questions, you should be attending the training sessions coming up at DevOps World | Jenkins World, a premier global event for Jenkins users and DevOps practitioners. The event is devoting two full days to educating attendees on the finer points of these topics listed above. The conference itself is taking place Aug. 12-15 in San Francisco’s Moscone Center and the training is scheduled for Monday and Tuesday (August 12 and 13).

Conference attendees will have plenty to do throughout the week. The final two days will feature an agenda packed with keynotes, industry-focused thought leader sessions, an awards ceremony and, if that’s not enough, an after-party with a superhero theme. In-between sessions, there will be time to walk the expo floor, to get a glimpse of the latest and greatest technologies in the space and do some networking with some of the other 2,000 enthusiasts attending the conference.

Training will be front and center early in the conference. Professionals with varying levels of experience—those just getting started and those with a substantial background in their subjects—can take advantage of trainings targeted just for them. They can sharpen their skills, gain new perspectives and walk away with certifications that will help them advance in their careers.

Anybody who’s been in the business for a while will confirm: Well-trained teams are a big asset in DevOps. The field is expanding rapidly and changing every year, and DevOps practitioners need to devote themselves to continuous learning to keep pace with modern software development. At DevOps World | Jenkins World, they can learn about best practices ranging from authorization to security, build management and interfacing with cloud services.

While training sessions are available to purchase at a nominal cost, attendees can receive a free Jenkins certification exam voucher—a $150 value—for the Certified Jenkins Engineer (CJE) and Certified CloudBees Jenkins Platform Engineer (CCJPE) exams. Attendees can choose to sign up for an onsite exam at the conference or use it at a later date.

For a full rundown of the conference’s training offerings, check out the Training and Certification page.

Now, let’s take a quick glimpse at what’s being offered.

Jenkins Training

Jenkins, the world’s leading open source automation server, is celebrating its 15^thanniversary this year. A lot has changed during that time. A community has grown around the technology resource, adding new tools, new plugins and new best practices year after year.

While the community dedicates itself to sharing information and educating its members, the DevOps World | Jenkins World conference provides the perfect setting to get the targeted training members to get the most out of Jenkins in their work environments.

DevOps World | Jenkins World has four separate certification courses designed to build attendees’ Jenkins skills. There are introductory and intermediate courses that will position them to become more proficient in specific areas important to their own career development. Attendees can learn about Jenkins pipeline fundamentals—everything from the structure of a declarative pipeline to the use of features to finish the pipeline. They can also take advantage of an intermediate session with lectures about shared libraries and Docker agents and follow-up lab exercises. Jenkins Admin courses get learners started on the Jenkins dashboard and configuration practices and then branches out to cover more advanced concepts such as scaling Jenkins, managing different functions and more advanced uses of Docker and Kubernetes.

There’s a second track that covers concepts connected to continuous delivery with Jenkins X. The Jenkins X project, introduced by CloudBees, provides a resource to educate community members on cloud-native processes. This course explores ways to take advantage of Jenkins X, showing attendees how to create a fully operational continuous delivery pipeline using containers, Kubernetes, Jenkins X and many other tools.

CloudBees Training

If you work with CloudBees technologies in a DevOps environment, the CloudBees Core Fundamentals course is a great place to advance your skills. Attendees need to take Jenkins Admin Fundamentals and Intermediate classes to really leverage the concepts covered here. They’ll learn how to optimize the CloudBees Core product suite to successfully scale CD and DevOps in their organizations. They’ll also learn about key proprietary features in CloudBees Core to enhance the capabilities of Jenkins, including enhancements for authorization and security that provide the control and administration needed to master key aspects of the pipeline.

DevOps Training

This course is more advanced—a certification for DevOps leaders of all kinds. To take the course, you don’t have to be an official leader of a DevOps team. Teams need leaders of all kinds. Whatever your position on the team—be it tactical of strategic, as a designer, implementer or motivator—you can play a leadership role. This course will teach the finer points of managing people and situations in a DevOps environment. It will build leadership skills—showing how to align and collaborate to break down silos and evolve the organization. It will present real-life scenarios and case studies to prepare team members to thrive in a fast-paced DevOps and Agile environment. Completion of this certification positions learners to complete the DevOps Leader exam successfully.

DevSecOps Training

It took a while for organizations to start integrating security into DevOps environments. Security was once considered an afterthought in—or even a hindrance to—DevOps processes. But now, DevSecOps is taking hold, and organizations need to build the skill levels to make the discipline successful.

This course offers attendees the training they need to gain a DevSecOps Engineering Certification. It outlines DevSecOps as a concept, reviews key best practices DevOps teams need to adhere to and explains how DevOps security practices differ from other security approaches. The course will teach practical steps on how to integrate security programs into DevOps practices and highlight how professionals can use data and security science as the primary means of protecting the organization and customer. Completion of the course positions attendees to successfully pass the DevSecOps Engineering Certification exam, which is offered on the last day of class.

Learn more about the training and workshops available. Then register with code DWJW20 and get 20% off your registration.

— Jason Farmer

August 1, 2019
GitLab Research Reveals DevOps and Cybersecurity Disconnects
DevOps and cybersecurity teams have a complicated relationship, which impacts code quality, research shows

Finger-pointing has long been the name of the game when it comes to cybersecurity failures. After all, who should be responsible when so-called bad code or bad practices are blamed for the latest incident?

A recent survey by DevOps lifecycle tool company GitLab reveals a significant disconnect between application developers and cybersecurity professionals—a disconnect that could only lead to more security woes and additional finger-pointing. GitLab surveyed more than 4,000 app development and cybersecurity professionals and brought some light to the complicated relationship between both.

For example, some 49% of the cybersecurity professionals surveyed claimed they struggle to get developers to make the remediation of vulnerabilities a priority. Sixty-eight percent of those same security professionals believe less than half of the developers they work with can identify security vulnerabilities before new code moves into the test cycle.

While cybersecurity professionals like to point the finger at the developer community, there are two sides to the survey. Almost 70% of the developers surveyed said that while they are expected to create secure code, they get little help or guidance from the cybersecurity experts with whom they work. Perhaps the fault lies with the lack of mechanisms to make cybersecurity a priority in many organizations. “We don’t have clear guidelines about security, so the different services present different levels of security,” noted one developer in the report.

While developers and cybersecurity professionals may be at odds, the report also revealed there is plenty of additional blame to go around. Case in point is the revelation that many organizations don’t make cybersecurity a priority. Some 44% of those surveyed reported they are not judged on security vulnerabilities in their code. That creates an environment where developers don’t have to consider cybersecurity issues when writing code.

With developers, cybersecurity professionals and even the companies they work for all at odds about the responsibilities of proper cybersecurity hygiene, one has to wonder how tomorrow’s vulnerabilities will be prevented.

“Our research tells us that while most developers are aware of the dangers that vulnerabilities present and want to dramatically improve their security capabilities, they often still lack organizational support for prioritizing secure code creation, increasing secure coding skills and implementing automated scanning and testing tooling to make that happen sooner rather than later,” said Colin Fletcher, GitLab’s manager of market research and customer insights.

Solving the blind spots around cybersecurity is going to take a different approach, one that further tears down the silos created around cybersecurity teams and development teams. There is a little bit of irony in that observation; after all, DevOps is all about tearing down silos and creating functional teams.

It’s also an irony not lost on those at GitLab. The company promotes solving the cybersecurity issues by adopting a good DevOps practice, where cybersecurity becomes an integral part of the DevOps process. According to GitLab, incorporating cybersecurity into DevOps will have the positive result of the combined team being three times more likely to discover security bugs before code is merged into operations.

The report offers some significant conclusions that support GitLab’s claims. For example, some of the security top findings include:
- Sec teams are three times more likely to discover bugs before code is merged with a good DevOps practice in place, and are 90% more likely to test between 91% and 100% of code than in an organization with early-stage DevOps.
- Nearly half of security pros surveyed (49%) said they struggle to get developers to make remediation of vulnerabilities a priority.
- Half of security professionals said bugs were most often found by them after code is merged in a test environment.
- Mostly remote teams are 23% more likely to have mature security practices than primarily office-based teams.
- Only 44% report security vulnerabilities are a performance metric for developers in their organizations.
GitLab also revealed there is another consideration, one of ownership. According to the report:

No part of software development raises more issues about ownership than the subject of security. The idea that everyone is responsible for security might be the ideal but it can also be part of the problem as everyone can easily turn into no one. Security professionals often complain about being on the outside, while developers and operations teams can resent being told how to prioritize their work. Our survey responses indicate developers are taking more responsibility for security, but of course a lot of work remains. In fact, only 20% of those surveyed rated their organization’s security efforts as good, while 36% said they were fair and 24% said they were poor.

— Frank Ohlhorst
July 31, 2019
6 Reasons to Convince Your Manager to Send You to DevOps World |Jenkins World

This year’s DevOps World | Jenkins World will take place Aug. 12-15 in San Francisco, at the Moscone Center.

Now, chances are you don’t need any real convincing to attend this event. DevOps World | Jenkins World is, after all, the premier annual conference for DevOps- and Jenkins-related content. You’ve experienced it yourself, or heard others talking about past years’ events—how the conference is packed, year after year, with sessions given by experts, multiple keynotes from industry leaders, hands-on training, plenty of time for networking, a themed after-party and all kinds of other cool things to take advantage of. This year, the event is going to be bigger than ever.

But, maybe you need a little help convincing your manager to authorize your trip. If so, we’re here to help. We’ve pulled together a list of selling points you can bring to your manager to show the incredible value a trip to DevOps World-Jenkins World can generate.

You Can Turn Yourself into a DevOps Leader

As we all know, DevOps is more than a technology, more than a process; it’s a culture that needs to be nurtured and fed. It needs DevOps leaders to advance that culture. Sending you to DevOps World-Jenkins World can turn you into a DevOps leader.

You can start by taking a DevOps Leader course that will equip you with the skills and knowledge you need to successfully complete the DevOps Leader certification exam. But it goes beyond one specific course. There are other courses focused on DevSecOps, Continuous Delivery with Jenkins X and best practices connected with the use of CloudBees Core. There are sessions addressing topics ranging from DevOps culture to DevOps theory versus practice. Immersing yourself in all the DevOps content here will raise your knowledge level to new heights.

You’ll Sharpen Your Automation Skills

If your organization is using Jenkins, your manager knows how important is the role technology resources play in automating key aspects of the software delivery process. Management is constantly pushing teams to brush up on Jenkins and related DevOps tools—how they work, how to get the most out of them, how to fix problems, etc. Any resource that will help advance the collective knowledge of the group will be welcomed with open arms.

DevOps World | Jenkins World offers a treasure trove of educational sessions that will help you advance your CI/CD knowledge and Jenkins expertise. Training includes intro and intermediate sessions on Jenkins administration and Jenkins Pipeline. The courses build on each other and propel learners toward the expertise needed to pass the Certified Jenkins Engineer exam. You’ll be bringing back knowledge you can apply to your organization on day one.

There are also sessions on automated release orchestration and on a number of the DevOps tools and technologies widely used throughout the industry.

You’ll Hear From the Masters

It’s one thing to watch a video or read a book by one of the industry’s giants. It’s quite another to see the expert live and maybe even have a conversation with them during the show. DevOps World | Jenkins World offers this kind of access. Jenkins founder Kohsuke Kawaguchi (KK), CloudBees CEO Sacha Labourey and Redmonk analyst James Governor are some of the speakers who are sure to enlighten and entertain. Bring home stories of how KK challenged the crowd to think differently or what Redmonk’s Governor really thought of a commonly held DevOps practice.

You’ll Gain a New, Broader Perspective

With more than 100 sessions to choose from, it goes without saying that you can learn a lot of new things. Beyond the basic workshops and presentations, you can take in talks about everything ranging from DevOps in the public sector to machine learning in “continuous everything” environments. Want to hear the 10 attributes of the DevOps elite? How the auto industry is embracing continuous delivery? How Verizon followed a high-availability model using Jenkins? It’s all here. And you can bring the knowledge back to your organization, sharing it in one-on-one meetings, in presentations or in general thoughts about initiatives for next year.

You’ll Build Your Network

What happens when you put 2,000 or so DevOps enthusiasts in one place? They’re going to do the same thing sports fans and car fanatics do: talk loudly and animatedly about the topic they love. DevOps World | Jenkins World attendees will share stories about epic fails and debate a long list of best practices.

Know what else they’re going to do? Exchange Twitter handles or vCards. This can be hugely valuable, not just to you but to your organization. Imagine your manager, needing help, asking you if you know anybody who knows this technology, understands this issue or has access to some hard-to-find resource. You tell your manager you can help; you met someone at the show who knows all about this. You picked up dozens of Twitter followers now engaged with you or your company and would love to help.

You’ll Be Giving Back to Your Organization

Building on the last item: Your manager wants this trip to be valuable—for you, for her and for the organization. You want the same thing. It’s your job to highlight how you plan to use your time wisely at the show to directly benefit your company.

Get creative. Talk about frustrations, pain points, staffing needs, business opportunities—you name it, you can solve it. DevOps World | Jenkins World has the content and the structure to be a resource for your organization. Detail your expenses, and stress how this is a work trip designed to enhance the organization’s overall knowledge base.

When you have successfully made your case and received approval to attend, register with this code: DWJW20 and get a 20% discount off your registration.

— Heidi Gilmore

July 30, 2019
3 Reasons Why Ephemeral Access is Best for DevOps

Recently, we worked with a customer, MOST Digital, whose developers were struggling with a common workflow challenge we hear from many companies.

The company is in the software robotics automation space—it essentially makes little robots that automate all sorts of business processes for a company, such as HR report filing or routine emails. MOST Digital developers need access to customer environments to fetch data, often jumping in and out of on-premises and cloud platforms to do so.

The problem was developers had to use client-specific jump hosts and VPNs to transition between IT resources. The process was slow, complicated and difficult to manage, which made life more difficult for MOST Digital’s team. Projects were delayed as they had to wait to receive help from each client’s IT organization.

“This wasn’t what MOST Digital wanted for their team,” said Sami Säisä, director and head of strategic development at MOST Digital. “We want to provide them the best environments and best tools that there are available.”

It’s a common refrain we hear from many customers, and it makes sense. The easiest way to frustrate a developer is to throw obstacles into their workflow. Unfortunately, most common secure access solutions create obstacles, and it’s not just jump hosts or VPNs. Even privileged access management (PAM) solutions, which are supposed to simplify and centralize IT credential management, are traditionally too bulky, complicated or non-intuitive for modern workflows. That encourages developers to bypass PAM altogether, which creates a major security risk.

So, what’s the best way to overcome the complexity brought on by credential management? Well, why not just get rid of permanent credentials?

Ephemeral certificates are a modern form of secure access that are temporary, time-based and automatically expire. Here’s why they’re a better solution for companies that want to keep modern developers happy.

Ephemeral Certificates Offer ‘Just in Time’ Access

Developers are building and coding in a world that emphasizes speed, agility and elasticity. They’re taking advantage of state-of-the-art tools meant to make it faster and easier to do work. They’re taking advantage of modern, hybrid IT environments that combine multiple cloud infrastructures in an attempt to find the most effective mix of resources for development and deployment.

The last thing they want are processes that slow down workflow. Unfortunately, secure access today often means doing just that: slowing down and stopping to manually input credentials across environments. Developers might also share credentials among each other to try and speed up work, but that creates yet another security risk.

Traditional PAM solutions don’t make the process any easier. Those tools create a central vault to manage an organization’s secure credentials. Privileged tech users, such as developers, have to use them to access and authenticate their credentials. PAM grants access per user and per host, so a new, permanent credential needs to be created every time a new developer, contractor or contributor needs access to a new IT resource.

However, most PAM tools were not built with the workflow of the modern developer in mind, so they slow things down while also encouraging loopholes and workarounds that compromise organizational security.

Ephemeral certificates overcome all of this by eliminating manual credential inputs. Gartner refers to these as just-in-time access, because access credentials are created on-demand automatically and require no installation, configuration or updating. In other words, they free developers to focus exclusively on the work they do best.

Ephemeral Certificates Eliminate Bad Habits

Rather than deal with all of the typical secure access challenges, some developers will often bypass PAM solutions altogether, instead choosing to spin up their own SSH keys to access the IT resources they need. Those keys exist outside of the PAM solution—they are untracked and unmanaged.

Not only is it a policy violation to have developers find workarounds for IT-approved security practices (not to mention a huge waste of the investment in a PAM solution), but it also creates a security risk.

The best way to encourage policy adherence is to make your policy easy to follow. Developers won’t bypass your security solution if it’s easy to use, and ephemeral certificates are inherently simple.

There Are No Credentials to Misplace–Or Have Stolen

If every developer is creating their own SSH keys to access IT assets and no one’s keeping track of them all, what happens if one is lost or when that developer leaves the company? Suddenly, there are keys laying around that could be scooped up and used as an all-access pass to systems in your environment.

How do you monitor and audit this type of shadow IT access? How do you trace non-policy compliant access from development to production? How do you prevent developer access to sensitive data?

Ephemeral certificates are inherently more secure because they are temporary, only existing for the period during which access is required, and automatically expire as soon as you are done using them.

As a result, there are no credentials to lose, misplace or steal, leaving fewer old credentials lying around for someone to take advantage of down the road. On top of that, ephemeral certificates don’t leave user-specific access credentials stored on target servers, so if someone does get access to your target server, they won’t be able to find any credentials that could be used to hop to other systems.

Ephemeral Access Is a Step Closer to DevSecOps

From security to IT management, there are lots of reasons why ephemeral certificates are a better solution for businesses. But the single most impactful use case is making your team’s life easier.

Want to frustrate a developer? Throw some obstacles into their workflow. But if you want to keep your developers busy on value-driving activities, get rid of outdated and unmanageable workflows. They’ll thank you for it later.

— Markku Rossi

July 23, 2019
Product IT Operating Model: The Next-Gen Model for a Digital World

Digitization presents many new opportunities for businesses to create value. At the same time, it forces IT to rethink the way it operates. Modern CIOs need an operating model that understands the blurring lines between IT and business and is designed for agility and speed. The product-centric IT operating model is rapidly emerging as the answer.

What does the model entail? In the product IT operating model, product lines are funded based on their strategic value to the organization, from the top-down, and are supported by dedicated management and delivery resources. The entire product team is measured on a common set of goals, which include customer experience, time-to-market, efficiency improvements, quality of software and availability and reliability of production environments.

5 Dimensions of Product IT Operating Model

Adopting a product IT operating model requires organizations to take an integrated approach toward product-based development and embark on a journey of continual improvements. While scaling agile DevOps that aligns business outcomes with engineering effort, enterprises must focus on these five key dimensions:

1. Organizational Change Management (OCM): Successfully transitioning from the traditional IT operating model to a product-based development approach requires organizationwide change management. An experienced IT service provider, can prove to be a key ally in ensuring a smooth transition.

2. Culture: Culture is an intrinsic characteristic of any organization, and instituting small but effective cultural changes coupled with OCM is the right approach to transition, rather than a “big bang” change. That’s also what some of the well-known enterprises across industries are doing.

a. Teams and Collaboration: The alignment of large teams across multiple organizational groups delivers to a common plan on the pace of change and helps to continuously embed innovation and experimentation for improved services.

3. Structure: Product-focused and highly talented teams across design, architecture, DevOps and operations are key to enhancing business capability. By measuring the entire team on same set of goals, it is easy to enhance customer experience, efficiency and quality of software while creating a stable production environment.

Structure also means aligning traditional application portfolios to specific business outcomes and bringing together all the capabilities and resources required for an organization to deliver on its business outcomes.

4. Technology: If business models, organizational structures, people and ways of working are the gears that run the enterprise IT engine, technology is the grease that enables this engine to run smoothly, without friction. Two key aspects of technology include:

a. Application Programming Interfaces (API): API-based architecture provides an extensible framework of building blocks, which in turn can be used to build powerful applications or software products. Easy maintenance is a hallmark of API-based architecture, as it can be quickly migrated further to any other target architecture.

b. Cloud, Microservices and Containers: Modern organizations need on-demand scalability. Cloud and microservices enable just that without disturbing ongoing business operations. However, it is important to first understand an organization’s product vision and road map, business priorities, competition, pace of market transition in their area of business and industry trends before choosing cloud or container-based infrastructure.

5. Process and Automation:

a. Agile Delivery Model: This is a critical prerequisite to building a minimal viable product (MVP), ensuring rapid delivery of critical enhancements or delivering a suite of product features in appropriate increments. Industry-standard agile practices such as LeSS and SAFe should be used, as they allow complete flexibility to tweak the model on the fly.

b. DevOps and DevSecOps: A DevOps culture is fundamental to adopting a product IT operating model. Continuous integration and delivery (CI/CD) require DevOps to be fully interwoven into the software development life cycle (SDLC), along with the right tools and governance mechanisms. This ensures high-quality products are delivered within short deployment lead times, along with the ability to fix production issues with low mean time to restore (MTTR) and ensure minimal to no change failure rate. DevOps also enables new-age practices such as automated testing, self-service access to infrastructure and automated performance management.

DevSecOps goes hand-in-hand with DevOps. It ensures security aspects are built into the products across the delivery pipeline, so the products are not only fault tolerant but also fool-proof, to a large extent. An experienced DevOps team builds and integrates security tools, solutions and processes to safeguard the organization.

c. Test Automation and Test-Driven Development (TDD): By integrating test automation into the development process, the product IT operating model allows organizations to create high-quality and quickly deployable products. Additionally, TDD enables governance to be integrated into the delivery pipeline by developing quality code in line with test cases written to describe user requirements more precisely. Tests are fully automated to ensure quality of code.

d. Service Health: With KPIs focused on the financial health of engagement, it’s easy to set a budget based on business capabilities and product levels to meet business goals effectively. The KPI framework encompasses key KPIs such as business, financial, learning and innovation and employee engagement outcomes, while staying flexible enough for different contracting models.

Delivering Value in a Changing Business Environment

Digitization mandates that IT deliver on three important aspects: Improve time to market, optimize costs and increase quality. Adopting a product IT operating model helps IT deliver on the mandate by enabling a fail-fast way to deploy software quickly and cost-effectively, without sacrificing quality. However, given the extent of change involved in the shift, it is not something that can be achieved overnight. It must be underpinned by a journey of cultural change and continuous learning, using tools such as design thinking-driven, persona-based change journeys, alignment workshops and targeted campaigns and communication. Partnering with an expert system integrator can help organizations jump-start the process and ensure on-track transition with minimal disruption to business.

— Gagan Jain

July 22, 2019