Tag: education

  • The Skills Successful DevOps Pros Need in 2023

    The Skills Successful DevOps Pros Need in 2023

    In the last decade, DevOps adoption has grown considerably. An increasing number of companies across a wide range of industries are embracing the benefits of DevOps, and we have not seen the end of the growth cycle yet. Indeed, the total DevOps market is expected to continue to grow significantly in the next few years, with one recent market survey projecting an annual revenue growth of no less than 24.7% from 2023 to 2030 (which will bring the market value to about 51 billion dollars).

    Further, DevOps is continuously integrating with and accommodating new technologies, which are themselves evolving quickly. This means DevOps professionals will have to invest more and more time each year to stay current and effective at their job. But, this predicament comes with a silver lining. By staying current and even ahead of the game, DevOps professionals are better able to differentiate themselves and deepen their level of expertise—and with that comes the ability to increase their income potential over time.

    In this article, we take a look at what knowledge, skills and abilities (KSAs) DevOps professionals should bring to the table if they want to keep up with the fast pace of change in the industry in 2023—and beyond.

    Knowledge – What Pros Need to Know

    As always, DevOps professionals are expected to have a baseline level of knowledge before taking on a new role, internally or externally. But, as DevOps adoption grows, professionals will need to make a concerted effort just to stay abreast of current trends.

    Platform Nuances

    Each platform places limitations on DevOps processes, and their successful implementation within a company will vary depending on the platform. It’s not uncommon to have to tailor your approach in particular circumstances. In the case of Salesforce, for example, successful DevOps processes must begin with improved deployment speed and accuracy. Only once this is achieved can Salesforce DevOps professionals move onto more mature processes such as automated testing and releases.

    Industry Standards

    DevOps professionals should understand the constraints of the technology they are working with. and within their industry. Both factors may place limitations on or add additional requirements to what they do. Any given technology platform comes with its own unique constraints, such as file sizes or limits on API usage. This is especially true of cloud-hosted systems like Salesforce, where there are multitenant architectures and resources are allocated to customers. Similarly, different industries are faced with differing constraints, such as the HIPAA requirements for companies handling health care data in the U.S. As a result, DevOps professionals will need to understand these tied to specific standards or processes of their given industries.

    Transferable knowledge

    As a final word on knowledge, it’s critical to make sure you are aware of DevOps trends and best practices on platforms other than your own. There are times, more often than we realize, that your knowledge of what has been successfully utilized on other platforms can be transferred to your own. Even if these practices are not directly transferable, they can point you in directions that can ultimately prove beneficial to your DevOps work on a completely different platform.

    Skills—What Professionals Need to Master

    While there are a huge number of skills that DevOps professionals need in order to stay current and further their career growth, I’d suggest paying particular attention to…

    Version control

    This skill is fundamental—you just can’t do the job without it. Make sure you thoroughly understand its nuances: Branching strategies, rebasing or merging, rollbacks, cherry-picking, etc. It’s also valuable to understand different approaches’ limitations and use cases.

    Automation

    Become well-versed in the differences between continuous integration and continuous deployment/delivery (CI/CD) and how they form the CI/CD pipeline. Knowing where and when to apply it and how to apply it are also critical skills to master.

    Successful teams also benefit from building automated workflows. A recent survey Gearset ran with Salesforce DevOps professionals showed that 85% of teams were either currently using or planning to use source control over the next year. Automated workflows are critical to optimizing ROI in DevOps, as they reduce manual processes and unlock some of the most valuable benefits of DevOps for teams of all sizes.

    Testing

    Test automation is increasingly central to achieving DevOps success. As such, you would be wise to develop expertise in environmental testing, unit testing (integrated with automation and release gating) and UI test automation.

    Monitoring

    Application monitoring for performance, errors, data anomalies and security is arguably as crucial as testing. DevOps professionals must apply the same level of diligence to routine system operations as they do to deployments. As DevSecOps becomes more prominent in 2023, it’s expected that there will be increased collaboration and integration with infosec teams.

    Backup

    It’s critical to master the backup and restore process, no matter which platform you work on. It should absolutely be included as part of a comprehensive DevOps skill set. This is because skill underpins the mean-time-to-recovery metric. DevOps professionals must be familiar with the processes and tools necessary for restoring systems and data to achieve a rapid and secure return to business as usual.

    Demonstrating ROI of DevOps

    Finally, it’s essential for team leads, or those hoping to advance their DevOps career, to effectively convey the performance of DevOps, which can be measured using indicators such as Google’s DORA metrics. This means translating DevOps metrics into quantifiable business value that can be easily understood. It is crucial for managers to not only motivate their teams but also to validate the return on investment (ROI) in DevOps to critical stakeholders. By connecting the performance improvements resulting from DevOps practices with tangible business outcomes and demonstrating the ROI, managers can secure continued support for the DevOps approach within their organization.

    Abilities—What Professionals Need

    This final aspect of KSA plays an important role in fostering the collaborative culture that is the hallmark of DevOps success.

    Communication

    DevOps is not just about the tools—you need to maximize communication effectiveness so that the team aligns their goals with the least amount of friction. If everyone is using the same model to reach the same goal, you will achieve success that much faster.

    Continuous improvement

    DevOps success is not a fixed goal. Rather, there are always elements of the process, or your team’s skills, that can be tweaked, changed or improved.

    Making training a priority

    As per the aforementioned Gearset survey, 45% of teams who train once a month rate their team’s collaboration as ‘excellent’ compared with only 13% of untrained teams. Teams that prioritize training outperform all others on a wide range of metrics, including but not limited to seeing fewer bugs and data loss incidents.

    This Challenge is an Opportunity

    There’s a huge range of KSAs that DevOps professionals will need to master if they want to thrive in 2023. Clearly, working in DevOps has never been more demanding than it is today. But, from this challenge, there’s also a tremendous opportunity for professionals to make themselves indispensable.

  • Dell Looks to Expand Pool of Available DevOps Expertise

    Dell Looks to Expand Pool of Available DevOps Expertise

    Dell Technologies has quietly launched a training and education initiative to significantly expand the number of IT professionals that have DevOps skills.

    Brad Maltz, senior director for DevOps and developer relations ecosystems for Dell, said the next era of IT will require IT professionals that understand how to automate the management of application development and deployment. Given its long infrastructure history, Dell is especially interested in helping IT teams to use a mix of graphical tools and command line interfaces (CLIs) to programmatically deploy software at much faster rates and at scale, he added.

    Dell has already hired more than 200 specialists to provide that training as part of a DevOps Transformation Services consulting services engagement, said Maltz. The primary area of focus will be working with IT organizations that are embracing platform engineering to centralize the management of DevOps and GitOps workflows, he noted. Many of those teams are now relying on declarative automation tools that ultimately make DevOps more accessible to a wider range of IT professionals, added Maltz.

    The number of IT professionals that employ graphical tools based on IT management frameworks such as ITIL still far outnumber the number of IT professionals that have DevOps skills. The ongoing debate between these two camps essentially comes down to the need to be able to consistently manage IT at scale versus being able to adroitly keep pace with the needs of organizations that are increasingly dependent on software. In the digital transformation era, it’s become clear that more of the organizations that hire IT professionals are placing a higher value on agility, said Maltz.

    Bridging the divide between ITIL and DevOps to address that requirement is largely a psychological challenge that requires IT teams to address a range of cultural issues in addition to mastering different types of tooling, he added.

    Regardless of whether organizations continue to manage IT infrastructure internally or rely more heavily on managed services provided by Dell, the need to continuously deliver secure software faster has become a business issue. The trouble is the level of DevOps expertise within organizations tends to vary widely. A recent survey published by the Continuous Delivery (CD) Foundation found only 22% of respondents are using both continuous integration (CI) and continuous delivery (CD) to automate all building, testing and deployment of code in a production environment. Most organizations that have adopted DevOps make extensive use of CI to build applications, but CD has proven to be more challenging to master. In fact, the CD Foundation survey found only 7% of respondents described themselves as DevOps engineers or specialists.

    The bulk of the managed services that Dell provides are focused on managing infrastructure rather than deploying software, but the company does have a managed DevOps offering based on the application development and deployment platform that an internal Dell DevOps team built to construct and deploy applications. Naturally, Dell has a vested interest in accelerating the rate at which software can be deployed on IT infrastructure it provides and manages.

    It may be a while before the overall size of the DevOps community expands, but the training initiatives such as the one launched by Dell will help. However, it may become a lot easier to find and retain that talent in the months and years ahead. In the meantime, organizations would be well-advised to invest in upskilling their own IT teams. After all, it’s less expensive to train someone that already works within an IT organization than it is to compete against thousands of other organizations willing to pay top dollar for the best DevOps expertise money can buy.

  • Techstrong TV: Closing the Diversity Gap in Tech Careers

    Techstrong TV: Closing the Diversity Gap in Tech Careers

    Charlene and Liliana discuss closing the gap in diversity in careers in tech. Learning to code can be a beneficial skill for traditionally underrepresented demographics, leading to more employment opportunities. The video and a transcript of the conversation are below.



    Recorded Voice:         This is Digital Anarchist.

     

    Charlene O’Hanlon:   Hey everybody, welcome back to Techstrong TV. I’m Charlene O’Hanlon and I’m here now with Liliana Monge, who is the cofounder and CEO of Sabio Coding Bootcamp. Liliana, thank you so much for joining me today, I really do appreciate it.

     

    Liliana Monge:           Thank you so much for having me. I’m super excited to have this conversation.

     

    O’Hanlon:   Excellent, excellent. Well we are happy to have you here, especially because I, I really do appreciate the efforts that you guys are doing through your coding bootcamp and really want to give you guys a little boost up if you will by a little bit of free promotion.

     

                                     But let’s talk about what you guys are doing. What, tell me a little bit about Sabio Boot, ah, Coding Bootcamp.

     

    Monge:       Yeah, so we started in the fall of 2013 in Los Angeles. Back then we had a very singular focus to make sure that the LA ecosystem was really going to be diverse. There was you know Los Angeles kind of at one point in time really lived in the shadows of San Francisco, of Silicon Valley and you know I would say in 2010, 2011 things really started to get heated up, more venture capitalists started to come into the state, a lot more companies started going public, such as Cornerstone OnDemand. So we knew what was going to happen in terms of all of this amazing wealth creation and jobs.

     

                                     So my partner and I, my cofounder, Gregorio and I, decided that we wanted to make sure that the ecosystem in California and Los Angeles was going to be diverse. So we set up a really innovative program that allows any adult who is smart and motivated to become a software developer within a very short period of time. So it’s very practical training. We were a hundred percent dedicated to helping women, more Latinos, more Black people, people who are underrepresented in tech like military veterans join this innovation economy.

     

    O’Hanlon:   That’s great, that’s great. And I’ve spoken with folks in other cities who basically have the same idea to, to really bring up the, you know rise up the traditionally underrepresented communities when it comes to technology. And it really surprises me how many start with these coding bootcamps or these coding classes. It seems like that is kind of the cornerstone of so many IT jobs these days. So I mean do you see a lot of folks entering the tech space using that particular avenue, the coding or, or is it do you think that it is kind of fundamental these days?

     

    Monge:       So I do think it’s definitely fundamental and it is a solution that can be applied pretty much throughout the United States or the world at this time, especially because we see the cost of hardware has come down significantly. That is a barrier to entry, right? You have to kind of have your own machine which is you know that, that needs to run VC software. As we all know software engineers run quite VC software. So you have to start with a price point of somewhere around you know $1500.00 to $2000.00 so that every person has the equipment they need, so that can be a barrier.

     

                                     However, once if you find a way to overcome the hardware barrier, you also have to make sure that there’s reliable internet, right, because all the information is on the internet, you’re posting to AWS Cloud probably your code and things like that. So there are two barriers.

     

                                     But then the last component, which is curriculum and practical training to become a software engineer I would say that is probably the most prolific. There is so much curriculum out there. So we decided to build our own custom curriculum. However, there are other organizations that release curriculum that’s available. There’s also a bunch of free stuff. Vendors many times have free resources. So it is a very wonderful solution to help any population.

     

                                     You know there’s so much going on right now. Like let’s say in Appalachia where the economy is changing and so people are like, “Is this a possible solution?” Miami is going through a massive transformation, right? They were known for hospitality, for travel, for leisure and now it’s just got this massive tech injection. So you can see how you can really take a coding bootcamp and kind of pluck it anywhere and if there is an ecosystem that’s going to support it, it can definitely create an amazing tech workforce anywhere in the country.

     

    O’Hanlon:   Yeah, I, I find it especially in, in urban areas that these coding bootcamps are, are cropping up. And I wonder if that’s also kind of I don’t want to call it a “substitute,” but maybe another avenue for especially kids coming out of high school that don’t really have maybe the means to go to a four-year college and then there are some people who don’t see the value in a four-year college, they just want to do the tech school route and get, get a basic understanding of what they need to do and then, and then go out and enter the workforce.

     

                                     So do you see these, ah, the important or the, the popularity of these coding bootcamps do you see them as more of a kind of a just a step for or these transitional and especially traditional under-represented communities a way for them to, to get the resources, to get the education they need without having to spend four years in college? Or do you see it more as they’re looking at it as, “I don’t want to go to college, but I do want to learn a trade and I want to…you know I see that there is value in coding because tech is the future.” So where, where are you kind of seeing people joining the bootcamps from?

     

    Monge:       Yeah, so that’s a fantastic question. When we began we thought we were going to be able to take students who graduated from high school and enroll in the program. However, we have found that 18-19-year-olds are a little bit too young to think about, “In three months I’m going to be a professional.”

     

    O’Hanlon:   Okay.

     

    Monge:       So we will enroll people who are that young and there’s always like 1 out of you know 40 that are 18 or 19, however, across the county and coding bootcamps you’re right did start in all the major metros had their own coding bootcamps.

     

                                     We see people who are more about 21 to about 25. So it’s individuals that have some type of life experience, maybe they’ve worked a little bit, maybe they did some community college, or maybe they got a degree that didn’t allow them to really participate in the economy in a meaningful way. So we’ve met so many music majors, so many psychology majors, even people who have you know a general business degree you know might have a hard time finding their footing in the economy.

     

                                     So we find that people who have some type of life experience, whether you’ve worked in retail and now are a little more mature you know and you’re really thinking about,” Okay, I want a career that’s going to offer me a lot of opportunities,” those are really the people that we’ve seen across the country decide to participate in the coding bootcamp. I would venture to guess that it’s the space that’s a little more mature, it might move a little bit younger, but right now we haven’t seen a massive demand from the 18- or 19-year-olds.

     

    O’Hanlon:   Okay. So I know when you got started it was really a focus on getting the underrepresented communities, the Latina community and you know just addressing a need that was going to exist in the LA area, but what, have, have you seen that demographic changing with your bootcamps as you’ve progressed? Has, has it been less about making sure that you know these traditionally underrepresented communities and, and, but it’s become more of a kind of a general population that have been attending the bootcamps?

     

    Monge:       Yes, definitely. So we did see that big shift and especially you know in 2020 when COVID hit Sabio had to go into a hundred present live remote environment, right? So starting in April and May we really were able enroll a person who was in Texas, a person who was in Chicago, because all you needed was your laptop and strong access to the internet. So we have seen that the demographics of our coding bootcamp have become you know they’re very diverse. Where we will have you know Latinos, African Americans, we have a massive women in tech scholarship, we do a lot to try to encourage ladies to come to the program and support them post-graduation.

     

                                     But one of the things that we weren’t aware of when we started was that there’s actually a large military veteran population that is very well suited for coding. That we discovered maybe two or three years into the coding bootcamp. So now a good percentage of the people in the program are military veterans. So we’ll have people who actually live around the world, because veterans I don’t know have seen the world and they, they discover beautiful parts. And so it’s become a really diverse community in a unique way that we weren’t really anticipating.

     

                                     But what we want is basically our training room to look like America, right? An America super diverse, super fantastic and that’s who should be participating in the innovation economy. We think everyone should give it a consideration, give it thought, try it a little bit and decide for themselves if it’s something that they want to do professionally.

     

    O’Hanlon:   I, I think – I love that, I think that’s, that’s amazing that you guys are doing that. It’s interesting to think about. I, I have a 12-year-old son and you know he codes every day and he doesn’t even realize that he’s coding it, that he’s doing coding. We’re, you know I’m in awe of what he’s able to do on, on a regular basis. It’s not anything – I mean obviously I could learn how to code at some point, but I think we’re gonna, we’re, we’re kind of reaching this, this point in time where it’s not really going to be a question of, “Do you want to learn how to code,” it’s just you know you’re gonna learn how to code, it’s going to be kind of ingrained like you know like math or English or anything like that.

     

    Monge:       Right.

     

    O’Hanlon:   It’s just going to be part of, you know part of our everyday lives.

     

                                     So do you, do you foresee in the future that you might see kind of a shift in the, in people’s attitude regarding coding and, and you know and then you know maybe have as a result maybe your curriculum is going to be shifting into maybe other areas?

     

    Monge:       Yeah, so I think there’s opportunities on both sides. I mean we’ve seen that you know there’s been a national movement for Hour of Code, right?

     

    O’Hanlon:   Mm-hmm.

     

    Monge:       So in December during Computer Science Week most elementary kids will sit down and actively say like, “I am coding today.” So they’re developing the digital proficiency from an early age, which is fantastic.

     

                                     There are also a lot of after-school curricular activities that are related to coding and robotics. So I think that there has to be like you said a general understanding of what code is, how it operates, have some kind of fluency in it.

     

                                     There are also a lot of tools that help people do low-code automation, right? So there’s that development. But then there’s the development on the other side of the dumbbell which is you’re going to have a lot of AI and machine learning. We’re doing a lot of stuff with autonomous vehicles. I think I’ve seen that they, they showcased the tractor that’s a hundred percent autonomous, right? That the farmer’s controlling just with his phone.

     

    O’Hanlon:   Mm-hmm.

     

    Monge:       So I think there’s really exciting things that are happening across the spectrum, the technical spectrum and so it is going to become more incumbent for people to have some type of digital literacy and I think it just depends on how much…

     

                                     Right, like you and I probably I don’t know how much – like I never finished calculus, I could, I tried it, I could never get there.

     

    O’Hanlon:   [Laughs]

     

    Monge:       And now as an adult running a business I’m like, “What even is it,” right? Like do, who really needs it?

     

    O’Hanlon:   Right, right,

     

    Monge:       Versus, “I need algebra,” you need spreadsheets, you need concepts of finance. So I think it’s going to be something similar. There’s going to be a big spectrum. Does that make sense? Did I answer that?

     

    O’Hanlon:   Yeah, no, no, it, it makes, it makes total sense. You know you brought up AI and machine learning and other areas where we’re going to be heading.

     

                                     You know I was just talking to somebody earlier today about the metaverse and, and you know now that, now that we’ve got these entire you know universes that are being constructed virtually and people can actually interact and, and it’s nothing like Second Life. You know if anybody remembers Second Life 20 years ago people thought that that was going to be the next big thing and that was a big bust. But you know the metaverse and, and now companies are, are talking about using holograms to, to have you know interactions with other people.

     

    Monge:       Yeah.

     

    O’Hanlon:   There’s so many things that are going to be coming that, that just are kind of mind blowing. That we are going to need this next generation of you know the kids today who they are the next generation of coders and they’re the ones who are going to create these new universes for us and all these technologies and capabilities. So I think it’s really, really amazing that, that they’re getting this foundation now so that they can start kind of… They don’t have to think about the actual idea of coding, you know getting over that hurdle, they can just think about all of the possibilities that are, that are open to them and that they can provide to, to, to their customers in the future. So good stuff there.

     

                                     I love the idea that you know we’ve got, we’ve got these coding camps that do really give a nice foundational base to anybody and that’s, that’s an important thing. And anything that we can do to, to really blur the lines between equity and parity when it comes to underrepresented populations in technology I think is a really, really good thing.

     

                                     So Liliana I do want to thank you very much for what you guys are doing. I think it’s a great thing.

     

                                     If folks are interested in finding out more about the Sabio Bootcamps how can they get it? Do you have a website you want to point them to?

     

    Monge:       Yes, certainly. So it’s just our name: S-A-B-I-O-.L-A, because we started in Los Angeles. If you go to the website you’re going to find a bunch of different resources. We have a lot of introductory courses that are absolutely free, so that people can dip their toe in the water and say, “Okay, is this something that might interest me?”

     

                                     From what I’ve learned a lot of people really describe getting a little bug when they wrote something and something happens and they’re just like, “Oh wow.”

     

                                     But I think a lot of people are you know we’re, we’re makers, right? We, we evolve to work with our hands, to have tools and to build things, so this is one of those ways that we can really be creative and build something that other people can use or maybe you just build a solution for yourself that you really need, that no one else has built.

     

    O’Hanlon:   All right, well that’s, that’s such great stuff. I do appreciate it. Again, thanks for joining me today on TechStrong TV. Liliana thanks again for your time.

     

    Monge:       Thank you for having me.

     

    O’Hanlon:   All right everybody please stick around we’ve got lots more TechStrong TV coming up, so stay tuned.

     

    [End of Audio]

     

  • Closing the Education Gap for IoT Developers

    Closing the Education Gap for IoT Developers

    The most common thing I hear from developers who are building internet of things (IoT) solutions is: It isn’t easy. And it’s not. Not because of a lack of skill—the developers I interact with are incredibly talented. There’s also no shortage of technologies to choose from for deploying an IoT solution. The challenge often comes down to a gap in available educational materials and learning support when in the development phase.

    We’ve moved from the early stages of the IoT when there was a lot of talk but not a lot of application. Now, we’re coming into the “reality phase” where cheaper, large-scale IoT solutions are feasible. In this phase, developers are tasked with identifying, building and deploying technologies that they’re likely having to figure out as they go. It’s a tall order to expect today’s developers to know the ins and outs of all of the moving pieces required for an IoT solution, including the wireless technologies that help to enable them. 

    While developers are renowned for being effective at independent learning, they still need better access to educational resources and tools when it comes to IoT technologies. This is especially true for newer technologies that you won’t yet find in a textbook or college course. 

    One example of this newer IoT technology is low-power, wide area networks (LPWAN)—specifically using the LoRaWAN standard. It’s an area that I not only expect to become increasingly relevant for IoT developers but also one that can greatly benefit from more robust educational resources. 

    IoT Development Is Relatively New 

    Modern LPWAN technologies have only been around for the past decade, and LoRaWAN became an open standard when the LoRa Alliance was formed in 2015. In the grand scheme of things, that’s pretty new. It’s not a concept that’s widely included in higher education curricula and, although we see more inclusion each year, it can be difficult for developers to find peers who have experience in building with LoRa devices. 

    ABI Research forecasts that by 2026, LoRa will be the leading non-cellular LPWAN technology. This means that over the next five years more and more developers will need to understand the basics of LoRaWAN but may not have foundational knowledge or experience to draw from. 

    From what I’ve seen, that gap can lead to teams biting off more than they can chew. Without enough training or support, developers risk building LoRaWAN deployments that may have inadequate coverage or go over scope or budget or that simply don’t live up to their vision.

    Complexity in Developing With IoT

    The other major reason IoT technologies operating with LoRaWAN need more robust educational support is due to their complexity. Developing an IoT solution requires several different skillsets that well-equipped teams either have to account for in their staffing or—as happens in many cases—rely on a single developer to figure it out and wear many hats.

    There are many aspects to building and deploying a LoRaWAN solution; for instance: Hardware engineering, device stack choice and application fit, gateway deployments and networking coverage, cloud considerations and application development involved for deployment. That’s a lot of moving parts.

    So, if enterprises and IoT vendors are expecting developers to make large-scale IoT deployments a reality, we have to provide the proper resources and training.

    Resources and Communities for LoRa Developers

    As the industry works on ways to better educate developers about LoRa technology, there are some good places to start for developers who want to hit the ground running. Here are some resources where you can learn the basics, build prototypes, get advice from other developers and test and certify solutions. 

    • LoRa Developer Portal—A hub where IoT developers can learn, connect with peers and accelerate their builds with resources like tutorials, dev kits and a free network server. Helpful for every level of expertise, from learning the basics of LoRaWAN to creating a network to rolling out a full-scale commercial solution.
    • LoRa Alliance—A nonprofit association where members collaborate and share experiences working with the LoRaWAN standard. They offers events, webinars, a resource hub and more. 
    • LoRa Basics Station —A GitHub Repository for the open source software that runs on gateways operating with the LoRaWAN standard.
    • AWS IoT Core for LoRaWAN—A guide for AWS IoT developers, spanning coverage development and deployment from connecting gateways to monitoring and logging. 
    • Azure IoT Hub—Guide for connecting the ChirpStack open source network server using LoRaWAN to the Azure IoT Hub.

    I expect higher education institutions to begin further integrating LoRaWAN into their curricula over the next several years, which will help to fill the education gap for the next wave of developers. At the same time, IoT vendors can step up and provide additional support to developers who are learning how to build with technologies like LoRa for the first time. This is critical for the success of large-scale deployments that all of us IoT believers hope to see across enterprise environments, cities, regions and beyond.

  • GitLab Survey Surfaces Advances in DevOps Education

    GitLab Survey Surfaces Advances in DevOps Education

    As more organizations clamor for employees with some type of DevOps education, higher education is responding in kind, according to survey findings.

    A survey of 843 students and teachers at various academic institutions who have had some exposure to the GitLab continuous integration/continuous delivery (CI/CD) platform suggests the number of individuals with DevOps skills graduating from these programs soon might increase significantly.

    The survey, which was conducted by GitLab, identifies the top four use cases for the platform as learning (28%), teaching (22%), research (20%) and information technology/professional use (19%). Nearly a quarter (22%) also indicated they had a secondary use case on campus.

    Certification (57%) was ranked highest in terms of interest, followed by e-learning (49%) and virtual instructor led-training (35%). Students and graduate students are more interested in certification at 58% and 67%, respectively, while administration, faculty and staff were more interested in e-learning.

    The primary benefit of teaching and learning GitLab was identified as the ability to teach operations competencies (57%) and the ability to teach with an end-to-end tool for learning DevOps competencies (51%). For students specifically, the top benefit cited was the ability to teach operational competencies (49%), followed by the ability to build a portfolio and record of contributions (45%). Workforce readiness was cited at 40% and 46% of students and faculty, respectively.

    Dr. Christina Hupy, senior education program manager at GitLab, said the teaching of best DevOps practices within an academic environment is critical because it takes on average six years for IT professionals to master DevOps in the workplace. To help increase the overall pool for DevOps talent, GitLab has been making its software available for free via individual licenses to students and teachers. That program is now being extended to include a GitLab for Campuses offer, which makes the GitLab platform available to multiple users at a reduced price.

    In general, higher education programs have not been meeting the needs of organizations that are looking to hire IT professionals with proven DevOps skills, noted Hupy. Since launching the GitLab for Education Program in 2018, GitLab is trying to help fill that void, issuing more than $2 billion worth of GitLab software licenses in more than 75 countries. In 2020, the organization added 340,000 seats across 250 institutions to the program.

    More than a third of survey respondents (37%) reported they had access to a GitLab subscription at their institution and used it. The most common use case for GitLab cited was source control management (55%); followed by verification, also known as continuous integration, at 36%; planning, at 30%; and management and release, also known as continuous delivery, at 27% each.

    There is also significant use of GitHub among survey respondents, with 85% reporting using it. A distant second was Jenkins (21%), followed by BitBucket (17%), Travis CI (11%) and GitHub Actions (15%).

    IT organizations, of course, have a vested interest in helping educational institutions develop DevOps programs as the number of application development projects being launched simultaneously continues to increase. Otherwise, they will find themselves paying top dollar for DevOps talent that is difficult to find and retain. The challenge, of course, is identifying the institutions that have access to the DevOps tools and platforms that are going to be a pre-requisite for a successful DevOps career those students might eventually enjoy.

  • DevOps Chat: ITIL 4 and Achieving High Velocity IT

    DevOps Chat: ITIL 4 and Achieving High Velocity IT

    In this DevOps Chat, Mark Smalley of Smalley.IT, and Lead Editor with AXELOS of the ITIL 4 High Velocity IT joins ASG CEO Mitch Ashley to discuss his work creating this new contribution to ITIL 4. Mark shares the 5 value investments important for organizations seeking to operate at high velocity and some of the insights gained from himself and others covered in this ITIL 4 module.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    Transcript

    Mitch Ashley: Well,  I have the pleasure today of being joined by Mark Smalley. Mark is Lead Editor of High Velocity IT, part of the ITIL 4 initiative. Mark, welcome. He’s also with Smalley.IT, I believe a one-person firm. Welcome, Mark. Would you please introduce yourself, tell us a little bit about you and the kinda work that you do?

    Mark Smalley: Sure, Mitch—thank you, thank you. Yeah, Smalley.IT, I’ve been on my own for about eight years now; previously, around 30 years at Capgemini and other managed application service providers. So, very much on the application side, very much on the service provision side. That’s really my background. The personal background—born in London, but have lived in the Netherlands, just outside Amsterdam, for about 45 years now, which is not a bad place to be.

    Ashley: No, not bad at all.

    Smalley: One of the recent—yeah, one of the recent initiatives I was involved with was the AXELOS ITIL 4 update, responsible for the emergence, I say deliberately the emergence of the high velocity IT module, because it was quite an interesting process, pulling in knowledge from various areas in IT service management, but also agile DevOps and out of the IT space completely. For instance, some people may have come across The Toyota Way, the management book about the Toyota manufacturing process. Professor Jeff Liker at Michigan University, he kindly contributed a bit to the book about the Toyota Kata, which is about an improvement method based on scientific thinking. So, drew in people from various fields to try and get this thing off the ground.

    Ashley: That’s gotta make it really fun and engaging, too. Why don’t we start out with what do we mean by it? What’s a good definition of high velocity IT? How would you give kind of a working definition of that?

    Smalley: I’d first qualify it by saying it’s not actually high velocity IT, but it’s more about higher velocity IT, because high would imply that there’s low and you say, you know, “High is good, low is bad”—well, that’s not the case. We’re on a gradient, on a spectrum from lower to higher velocity. We’re looking at the kind of organizations that you’d say would be more digitally enabled than most.

    So, the kind of organizations that use technology to do things significantly differently or even do significantly different things because technology enables them to do that. And that requires a different way of thinking, a different way of working than many people are used to. So, the book’s about different ways of thinking, different ways of working, and primarily the people in the IT service management space who are now confronted with this digital stuff and how do we deal with that? And trying to get them—it’s sort of a guided tour through the kind of things that you come across in these more highly digitally enabled organizations to encourage them to unlearn the old ways of working that aren’t effective any more and integrate new ways of working, new approaches in how they do stuff.

    Ashley: I think one of the really important and kind of fascinating parts of your work on this, Mark, is it’s not just about the bubble of IT or the bubble of my part of, my role in IT, it’s that high velocity for the whole organization and how you all work together. And I know it really—there are many places to start, but clearly, product management, there’s some outcome that we’re doing all of this work for, some product or service or offering that we have, and that’s a great place to really engage in kind of a systems thinking about this.

    Smalley: Yeah, very much so. It’s taking the end to end perspective. We’ve defined five objectives to give us a bit of guidance in this space, talking firstly about valuable investments—are you doing the right thing in the first place? Are you automating the right kind of business processes? Are you building digital products and services that are appealing to the marketplace? Are you doing the right thing? Fast development—are you doing it quickly? Resilient operations—once it’s up and running, is it resilient? And deliberately using the word resilient rather than reliable, because the kind of systems we’re dealing with are often complex and therefore unpredictable in their nature. They will fail.

    Ashley: Mm-hmm.

    Smalley: You know, these are fail-safe systems, these are systems that should be safe to fail, so it’s about the resilience—how quickly can you get the systems back up and running? Then the fourth objective is co-created value. Then again, you have that broader chain; that’s when IT starts engaging again, with the user community, in that intricate and even intimate dance that they do together that’s, you know, to help the users derive value from the investment. And finally, the fifth overarching or underlying objective is all of the above—assured conformance, it should be able to assure conformance to governance risk and compliance requirements, whatever they are in your kind of organization.

    So, it certainly is, what you said, the big picture, end to end.

    Ashley: Mm-hmm, very much makes sense. You know, it’s interesting—tell me if this jives with what you’ve experienced. Highly reliability, the best way to do it is don’t change anything, right? Make it very stable. But we live in a world where business needs to execute quickly, but also dynamically to react to changing market conditions—you know, pandemic being a great example of that.

    Smalley: Yeah, yeah, yeah.

    Ashley: A tragic one, but very much one that’s outside of our control—but also, you know, offensive strategies to go after markets and that, and the degree that the whole chain, the whole kind of supply chain of the organization working together can effectively do that quickly and reliably, but also resiliently, because you want to be able to experiment and try things. And maybe you need to fail to find the right answer for product mix or whatever.

    So, I’m sorry, I don’t wanna go on too long, but it seems like that’s an underlying driver behind all of why you took this approach, at least in part.

    Smalley: Yeah. Well, certainly, if you look at the dominant thinking behind most of the guidance there’s something behind it. There’s that concept of co-creation, realizing that you don’t do stuff and chuck it over the wall, you have to engage with other stakeholders—one of the things.

    The other main thing is dealing with, working in complex environments. Again, using that word complexity in the sense of complex adaptive systems, organizational systems where you simply can’t predict what’s gonna happen and where you, because of the volatility, the unpredictability of stuff, you can say that’s bad but from a research and development perspective, you want to be able to, you know, 10 initiatives will fail, but it’s that 10th one that’s gonna make you millions. You’re gonna benefit from that unpredictability.

    So, it’s really, it’s from the start, through the whole life cycle that you’re dealing with the—with the unpredictability which, for many people in IT service management, is a bit disconcerting, because if you go back—go way back, and you look at where people came from, IT service management people were very much concerned with the stability of systems and putting a wall around them with the best of intentions, with the belief system safe is good, whereas the developers had a different perspective—fast is good. So, you’ve got this fast versus safe. And seemingly, irresolvable, that conflict.

    But if you look at it creatively—and this is something that we’ve got a lot to credit the DevOps community for, and we reference extensively stuff that’s gone on in the DevOps world in the High Velocity IT book. The idea that if you—and it goes back to lean as well, lean in particular, agile a little bit—working with small batches of work, if you do work in small batches and more frequently, then you reduce the risk, ________ smaller changes and less risk in bigger changes. And the interesting thing comes along now—if you do changes more frequently, instead of saving them up for each, you know, masses of changes each quarter, no, do them every day, then you develop your capability to change effectively.

    So, paradoxically, you’ve turned it around completely. The more often you change—small changes—the better your change capability and therefore the more confident you can be that the changes will go through pretty safely.

    Ashley: Mm-hmm.

    Smalley: And it’s interesting, the groups that have to interact together, like, if you’ve got a DevOps group or a classic IT service management group, they identify with their own belief system, and often, the belief system is, you know, safe is fast—sorry, safe is good as opposed to fast is good. And how do you—you know, you’ve got to get these people together and talk about this stuff to resolve the apparent conflict. But it’s great stuff trying to build bridges between these communities.

    Ashley: Yeah, I’m totally with you and thinking of the sort of lean mindset and agile and iterative, which is very much where software product and organizations have moved to or are moving there. What are the—how do you deal with some of the legacy silos and sort of that self-protection of don’t change things or don’t, you know, let’s focus on keeping things stable or whatever the mantra of those individual groups are? How can this book, for example, this module help people start to expand their thinking around those issues?

    Smalley: Well, firstly, if you look at organizations, they will vary in velocity across the various divisions and departments. So, firstly, you’ve got to take a look at which part of the organization are we looking at? What is the appropriate velocity in the business there? What kind of cadence applies to their work? Interesting looking at the pharma industry that’s traditionally been highly regulated with very long periods in which they work. There’s no point speeding things up if you have to wait years before you move to the next stage. It’s like doing the Olympic games—you don’t want the stadium there earlier; there’s no point. So, it’s got to be very much aligned with the business velocity.

    So, look at the specific parts of the business and, depending on the kind of speed—and possibly, you’re dealing with legacy systems that don’t need to go that much quicker. And the advice we like to give in the guidance is, the first couple of statements, the guidance is not complete, and the guidance is not intended to be prescriptive. We don’t pretend to be able to dictate, proscribe how people should act. Rather, we’re trying to encourage them to take a look at the 9 concepts and models that we’ve adopted, the 25 techniques to see which techniques do you think would apply to you. So, be selective, pick and mix, take a few things out, experiment with them, see if it works in your environment.

    Because this is going back to lean, you mentioned lean, going back to the lean movement, you’ll probably know many of our listeners, audience will know that the Toyota production system was the precursor to the lean movement. And one of the grand figures in the TPS Toyota Production System, was Taiichi Ohno, who came up with some wonderful sayings, one of which is, “You should think for yourself and face your own difficulties. Don’t try to borrow wisdom.” So, in other words, how another organization has done something, that’s not gonna work for you. You have a different kind of organization, so you really do have to dig deep and look at the specifics of your situation and pick the various parts that you think apply to you and just experiment and see whether they work. So, it’s—

    Ashley: Really more of an adaptive approach versus prescriptive, right? It has to be done a certain way because one organization succeeded at it that way.

    Smalley: Yeah, no, and of course, it’s very tempting, but people are looking for the quick fix. There’s a fabulous cartoon, if anybody wants to look up a great cartoon, if you look up “Simple but Wrong, Complex but Right” it comes up with a great cartoon and you see people following—there’s a sign pointing in two directions of people, the masses are following the sign “simple but wrong,” because they’re looking for a quick fix.

    Ashley: Mm-hmm.

    Smalley: And what better than looking at how another organization’s done stuff and say, “You know, let’s do that.” It’s not a good idea, usually. [Laughter] So, you do have to be very, very critical, very selective.

    Ashley: Well, these are systemic changes, they’re not quick fixes or just change this one thing of how you’re working and suddenly you’ll get different results. And one of those is, we think about specialties or specialization of what we do, but we’re also now thinking, it’s specialty roles, but it’s also how those things work across the life cycle development operations, product teams. So, individuals and teams’ abilities to work cross functionally is a much higher order skill than maybe we valued in the past.

    Smalley: Yeah, look at the—I think we can kind of credit the DevOps community for something, but look at the agile community, how the concept of multi-functional, cross-functional product teams have emerged where you’ve got business analyst disciplines, development disciplines, testing disciplines all working together.

    It’s interesting to think about the definition of done that they often apply as a concept that you’ll come across in agile and scrum, you know, “When are we done?” It often, in the scrum world, it ends with a potentially deployable increment of software, potentially deployable. The key word is potentially—it hasn’t been deployed yet. So, it’s just asking for an extension of that domain of the team to not stop when it’s deployable but actually deploy it, so start involving the DevOps kind of competencies as well. Then you could extend it further to the service area, because product owners should be aware that the kind of product that they’re building, that needs to be accessed by people, and service is the vehicle that gives users access to your product. You built a great software product, but it’s only through the vehicle of service that people get to it.

    And is the product owner,  is the product team looking as much at service as they should be? And I think that’s often not the case, and I’d certainly like to, in the role of bridge builder, like to encourage product teams to take a closer look at service and think about the kind of characteristics the service experience as well that they expect their users to have. So, you can see a service substrate going through all of the life cycle, really, alongside the software and infrastructure artifact.

    Ashley: I’m curious, you mentioned design earlier and maybe this is what you’re referring to. I’m curious if design thinking or the design approach is something that also influenced your work on this module, the idea that you’re really, the outcome isn’t the car, the outcome is the experience that the customer, the user of that vehicle has and expects, you know, from whatever the product is that you’re creating. Did that influence this work, too?

    Smalley: Yeah, two things, there—design thinking, we’ve referenced more at the start of the process, thinking about the kind of specifications requirements that people have. But towards the end, thinking about the service experience, and you’ll be familiar with the concept of service level agreements, which are often unfortunately formulated. We talk in terms of availability and performance and security and stuff like that—all very technical.

    But how do the users feel about this? We’re slowly extending that domain service level agreement to include experience level agreements, looking at outcome and how people feel about their engagement with either their technology or the people behind the technology. So, again, that’s that human co-creational dimension that you see in high velocity IT, alongside the technology.

    Ashley: Mm-hmm. Yeah, the SRE world, I don’t know if we’ve talked about that, but it has this idea of service level objectives, which is a little less formal and restrictive as what we think of contractual SLAs of, each team really, you know, defining what they’re trying to strive for, for the service that they’re trying to deliver and the experience that people have. So another area, SRE, is a great one.

    Smalley: Yeah, no, that’s in there as well. SRE is certainly something that significantly contributes to more resilient operations, just like chaos engineering, another of the techniques that we reference. But speaking about agreements, certainly, you should measure stuff. Whether you—you know, the trouble is, once you put something into an agreement between two parties, people start to game the system. Things—I think it’s Hawthorn’s Law. It’s like as soon as you make something explicit, intrinsic motivation evaporates.

    Ashley: Mm-hmm.

    Smalley: Yet you do have to agree something with other parties. So, it’s really, it’s a delicate balance, you know, what’s gonna work in this situation. Also looking at the relationship that you have with your customers and other stakeholders—so, assessing what kind of relationship, what kind of agreements and measurements are appropriate for each particular situation.

    Ashley: I was thinking about, too, when you mentioned resiliency, and previously, you were talking about sort of the iterative nature, doing work in much smaller increments—that also gives more flexibility for change. So that, you may have a feature turned into a story that might be delivered over multiple iterations in an agile process, and somewhere in that process, you may have part of it released, but you may move on to other things or shift what you’re actually doing. So, it’s a way of dealing with some of the dynamic, changing needs of the business.

    Smalley: Yeah, it’s—we reference four characteristics of the approaches that you’ll find in these kind of organizations. We reference lean, agile, resilient, but also continuous, and I think that fits into this category.

    You know, things are changing all the time, so it’s interesting when you’ve got these traditional discussions between business people and IT people. You’ve got IT people almost blaming business people for the fact that the world has changed, who it’s the kind of the core values that you have, the belief system you have, if you have the belief system that things are changing all the time and that’s just part of life, that’s a given, then you don’t resist as much. We certainly try to encourage people to embrace and enable change as well. We used to talk about change—management change control, which seems to be a bit defensive. When now, it’s just language, but even then, we like to talk about change enablement—how can you get changes done as quickly and safely as possible?

    Ashley: Very interesting. Yeah, words do matter. What’s the state of the community, the ITIL community in the adoption of some of the principles around lean and agile and DevOps and SRE. Are most folks starting to become aware of or are they educating, are they practicing? Where would you say we are in this journey?

    Smalley: Yeah, well, I forget who said it. Somebody said, “The future’s already here, it’s not just evenly distributed.”

    Ashley: [Laughter] Yeah, that was Stephen Hawking or someone.

    Smalley: Yeah, that’s right, yeah. You know, some people are doing it. I’m very pleased to see on LinkedIn or Twitter a response from an organization in the U.K. that says, “This high velocity IT stuff, this reflects the things that we are doing.” This is a guy on the joint DevOps and IT service management come together. I mean, that’s his area of work.

    Ashley: Mm-hmm.

    Smalley: It’ll depend on the kind of products and services that people, organizations provide are the digitally enabled? How digitally enabled are they? So, it is very diverse. Lots of people for whom this is all pretty new, one of the things we, one of the objectives we have for the book is to familiarize people who know the old way of working, you know, working in silos, that kind of stuff, and get them used to—make them more confident, confident to engage in discussions with their DevOps, with their SRE colleagues about digital to get the conversation going.

    Ashley: It seems like that’s very important because, as things evolve, new things come into the picture—DevOps, et cetera, SRE. It’s really easy to be sort of overwhelmed of, “Now, what’s that, and how is that different and why should I care, or does it apply to me?” So, it seems that maybe taking that approach in this module of trying to bring that together from an ITIL perspective, from an operational perspective makes, maybe, those topics a little more approachable, a little easier to consume and understand?

    Smalley: Yeah, and one of the things we advise people is to look at the five objectives that I mentioned, from valuable investments to a short conformance, and discover, identify where the weakest link is in the organization or in that part of the organization. Because if you look at the theory of constraints, another body of knowledge that we reference, you should always be working on the weakest link.

    So, that helps you to focus on a particular part—don’t be overwhelmed. You can’t do all of this. You wouldn’t want to do all of this at once. Pick your weakest link, pick something that seems feasible that you can think, “Yeah, I can make an improvement, there,” and very much in the sentiment of continual improvement. Of course, one of the DevOps tenets, the third way of DevOps is continuous improvement—learning and improving all the time.

    Little steps. I think that’s the way we’d like to encourage people to go—just take it step by step. Because after each step, you refer to the systemic nature of this kind of stuff. After each step, you’ve changed the system, so you’ve got to look around and see what’s changed and then plan the next step. So, moving from what I call confirmatory ways of working in the high velocity IT books, you know, when you’ve got pre-determined plans and deadlines and milestones, because you can more or less predict what’s going to happen, you confirm that—during execution, you confirm that what you predicted in the plan happened.

    So, move—and we’re used to that in IT service management, predetermined process. So, moving from confirmatory ways of working to more exploratory ways of working, where you take things step by step—so, evolutionary. As Dave Snowden, who some people will know from the Cynefin framework, says—Dave authored a great piece about ethics for the book, by the way, but his core area is, he’s known from his complexity work—he says, “You’ve got to move to the adjacent possible in an organization.” So, sort of feel where the disposition of the organization is, in which direction are they moving naturally, and try and give them a nudge in that direction, zig-zagging towards, you know, whatever you want to achieve. That more—again, that’s that working in complex environments, reflecting the and respecting the unpredictable nature of the world we work in.

    Ashley: You know, we’re kind of borrowing from a lot of disciplines talking about this and one that comes to mind, I believe, it’s quantum mechanics that just observing something changes.

    Smalley: That’s it, yeah, the Heisenberg principle.

    Ashley: The Heisenberg principle, thank you.

    Smalley: Yeah, shine a light on it and it’s moved. You can either detect the velocity or the position, but not both at the same time.

    Ashley: Mm-hmm. Very good. Well, this has been really fascinating—yeah, go ahead.

    Smalley: I think Schrödinger’s cat came into it as well, didn’t he?

    Ashley: [Laughter] Very good. Well, you know, I think what’s fascinating about your work and the contributor’s work on this is, I venture to guess there wasn’t a lot of discussion about tools and technologies, because you’re really thinking about the how of how we do work, how we work together, how this leads to the creation of software toward  some co-created outcome.

    Smalley: It’s very much the people dimension as well. You see that just talking—I mentioned ethics, for instance. Ethics—people want to do the right thing. That’s an aspiration that people have. They want to trust and be trusted in the workplace—psychological safety. I’m delighted that our industry is talking about this kind of stuff more often. Talking about things like—I remember at a conference, you know, the good old days when we actually went to conferences, a conference in, I think it was New Zealand, in Wellington, where somebody was talking about social anxiety as a rather introvert engineer.

    Ashley: Mm-hmm.

    Smalley: And it’s great, because you know, people empathize with that, and it’s great to trust and be trusted, fostering an environment where people can feel free to express themselves without fear for their position or reputation. If you build that kind of a foundation in your organization—you know, all the tools fit into place.

    By giving people the confidence to—and the privilege, possibly a final thought, people just don’t work in IT. Some people say it, but you know, I’m sure some people don’t just work in IT, they have the privilege of contributing to the well-being and prosperity of digital service consumers, right down at the end of the chain. And I find that inspirational, thinking, you know, not just what happens in my silo, but at the end of the chain, you’re helping change somebody’s world. And that’s the kind of, that’s what I like to say about this book—it’s guidance that matters for people like us, who care.

    Ashley: Mm-hmm. It’s definitely inspiring to know that you’re helping people, right, in the work that they do.

    So, Mark Smalley, it’s been fascinating talking with you. I applaud you on the approach you took on this, a lot of great concepts that you’ve incorporated in the high velocity IT module, and I hope folks will check it out, because I think there’s some super valuable things. Again, changing the system is just by first observing it and I think just reading the module, checking out parts of it would be a step in that direction. So, appreciate your contribution, and it’s been great talking with you today.

    Smalley: My pleasure, Mitch. Thank you very much, indeed.

    Ashley: You bet.

  • Two-Part Training Required for Developers to Slay the Security Beast

    Two-Part Training Required for Developers to Slay the Security Beast

    Developers’ defensive qualities are only as good as the training they receive

    The playing field between the heroes and villains in cybersecurity is notoriously unfair. Sensitive data is the new gold, and attackers adapt quickly to circumvent defenses, exploiting security bugs large and small for potential paydirt.

    The volume of code being produced is too great for security experts—who are becoming increasingly scarce—to contend with, and the rising cost of data breaches is proof that something has got to give. Fortunately, for the sake of our digital safety and the sanity of CISOs everywhere, the DevSecOps movement is helping to bring developers on the security journey from the beginning of the software development process. They are being recognized as the first line of defense against cyberattackers, with the power to eliminate common vulnerabilities at their fingertips.

    However, their defensive capabilities are only as good as the training they receive, and that is yet another gauntlet for security teams to run. For many developers receiving on-the-job training in secure coding, their key challenge is staying awake during mind-numbing, hands-off activities that are neither effective nor inspiring them to keep security front of mind. Soulless video courses aren’t getting us there, token annual ‘tick-the-box’ events are a waste of time, and nobody is winning against the potential malicious threat actor waiting to jump on a small window of opportunity.

    At this stage in our industry, we have worked out that contextual, hands-on education that is delivered in relevant programming languages and frameworks, with challenges that mimic those a developer might come across in the real world, is a far more engaging approach.

    This is phase one of a developer’s quest to help AppSec gurus slay common vulnerabilities, but phase two is where scenarios must get real for a supercharged, security-aware defensive force.

    Scaffolded Learning Is Critical in Adult Education

    When it comes to extracurricular courses or on-the-job training, it is often overlooked that adults bring with them a certain level of experience and existing knowledge. Good training adds to this foundation and is structured in a way that allows for deeper understanding and faster autonomy in the learning process.

    Scaffolded education is a potent, positive method of learning that seeks to activate and enhance prior experience while continuing to build new skills—in manageable chunks—that allow the learner to tackle increasingly difficult tasks with more confidence. Typically, it is a methodology best served with healthy portions of demonstration, visual aids and student-led exploration.

    If we tie this approach back to developer security training, it comes as no surprise that the dynamic, learn-by-doing method has long been preferred over the drudgery that is theory-based static learning. They are free to be the masters of their domain and should see that their time is being well-spent.

    In that sense, learning to code securely in a hyper-relevant, contextual environment is key, but the ‘level up’ from this step is to see an exploit of vulnerable code in action. With the context of front-end and back-end views side-by-side, there is a tangible link between actions taken during the coding process and what an attacker can potentially do with cut corners, misconfigurations or accidents that are not caught and remedied.

    Move From Recall to Application for a Truly Preventative Security Approach

    Experiencing the impact of security vulnerabilities firsthand is a vital piece of the education puzzle, and it’s a fairly rare beast, even with the most modern security training options for developers. The foundational work spent on honing skills in spotting and remediating vulnerabilities and recalling that experience to eliminate the same bugs in code as it is being written is extremely important, but it’s not the whole picture. Seeing how vulnerable code is exploited by a malicious actor adds a powerful layer of context, one that really drives home the importance of securing code and applying hard-earned security knowledge to close every window of opportunity.

    It is generally accepted that developers don’t love security, and they have even less affection for security training. Their experiences with AppSec specialists can be very frosty, and the rework caused by the security team bouncing vulnerable code back to developers for remediation is the bane of their existence. To an engineering team that is already spread thin, security is someone else’s problem, not their priority, and a hindrance to their natural creativity and primary objective of building features. However, there is simply too much code, too many breaches and too much risk to the world’s data for this mindset to continue.

    A functional DevSecOps process has developers working in harmony with security teams right at the beginning of the software delivery life cycle (SDLC). Likewise, the opportunity for applied learning, where they can interact with a simulated exploit and see the impact of poorly secured code, goes a long way in getting developers on the same page as those pesky AppSec people (who aren’t so bad after all).

    Interactive Learning Prepares Developers for the Boss Fight

    At the time of writing, there were two major breaches reported in a seven-day period: Razer announced that more than 100,000 sensitive data records had been exposed, while office supplies retailer Staples also reported a similar data leak. More than a billion sensitive records have been exposed so far in 2020, and this worrying trend shows no signs of slowing down. Simply put, malicious actors have the upper hand and security-aware developers are sorely needed to serve as the front line of defense.

    Interactive challenges that focus on simulating such breaches move developers from passive recall, to applying skills that have an impact on the real boss fight: stopping attackers in their tracks.

  • Skills Every DevOps Professional Needs to Succeed

    Skills Every DevOps Professional Needs to Succeed

    At organizations of all sizes, DevOps is becoming immensely popular to harmonize operations between IT and software development units. The digital world is progressing rapidly, and with that, the need to upgrade skills has become a necessity.

    Based on research from Allied Market, the DevOps market worldwide revenue was $3.36 billion in 2017 and is forecasted to reach $9.4 billion by the year 2023. This has given rise to employing in-demand DevOps skills to streamline the operational business processes.

    Essential Skills in DevOps

    The current COVID-19 pandemic has brought about a significant increase in the demand for IT professionals who are well-versed with DevOps skills. Organizations operating remotely need engineers who can manage their ultra-advanced business automation software. For that reason, here are the must-have skills you need to work on to get an edge in your career within DevOps.

    Security Skills

    Acquiring security skills is imperative for DevOps engineers to comply with standard clean-code practices. Hackers are continually seeking new ways to breach security, and your system code is one way to attack your crucial data.

    Besides, to avoid data breach issues, you need to operate your system using a VPN and advanced security protocols. Moreover, learning to write secure code is essential as the operating system code is vulnerable to cyberattacks.

    Being well-versed in making secure code enables you to instigate a defense mechanism in your operating system, which further leads to lessening the chances of being hacked by unwanted malware attacks. Hence, DevOps engineers with proficient security skills are much more sought-after by companies looking to hire.

    Collaboration

    Becoming a well-equipped DevOps engineer requires you to master the skills of collaboration with IT operations and software development teams. The concept of working in association with other groups is vital to the practical implementation of the DevOps concept.

    An engineer who is adept at working in a cross-functional team will be more competent in managing DevOps processes seamlessly. Therefore, engineers must have to practice working in teams to gain an edge.

    Infrastructure Automation Tools

    In the tech industry, the concept of automation has revolutionized the traditional DevOps working system. Nowadays, manual tasks are replaced by automation tools to speed the development process.

    Getting a command on scripting languages such as Ruby, Bash, Python, Javascript and Node.js is essential for a seamless automation experience. Be it any stage of DevOps, an engineer of this field must be proficient enough to use it as necessary.

    Flexibility in Working Patterns

    DevOps requires an adaptable approach toward coding integration. Because coding is an ever-evolving process, an agile approach is necessary. To be a veteran engineer, the applicant must have the potential to keep learning how to integrate high-tech operations into the system code.

    Being flexible in your working patterns is now an essential skill. Additionally, engineers need to be able to work proficiently in each phase, including the integration of systems, testing codes and releasing to the deployment stage.

    Swift and Rational Decision-Making

    Working on code can be a daunting task to perform as it includes managing multiple technicalities simultaneously. In case you have to modify the previous system code, you need to make logical decisions on the spot to avoid any unwanted errors. The best DevOps engineer candidates possess the ability to make quick decisions to harmonize with ever-changing coding development practices.

    The Right Skills: Bottom Line

    Mastering DevOps skills is crucial to success in the highly fierce digital arena. Engineers need to ensure they continue to learn advanced technological frameworks and hone their expertise. Candidates with the right blend of technical and soft skills needed to tackle challenges are rare; however, today’s technological environment requires multi-faceted DevOps skills for greater success.