devopsy.kinsta.cloud

Tag: fail fast

Embracing the Journey to Public Cloud

One of the fascinating competitions in today’s business world is the one between the digital disruptors—companies whose business vision is rooted in technology and driven by the cloud—and the so-called incumbents.

One sector where this competition is particularly intense is financial services. In this sector, the digital-first companies typically don’t compete with banks and other financial institutions directly. Instead, they target specific functions based on a clear—and often data-driven—understanding of what customers want. This strategy has proven particularly successful with millennials. For example, until recently the norm for giving money to a friend or family member was to write a check. Now, almost two-thirds of 20- and 30-year-olds use payment apps, such as Venmo.

In healthcare, a different pattern is emerging, one where digital-first giants either buy or innovate their way into the sector. Examples include Amazon’s billion-dollar acquisition of the online pharmacy PillPack and the new Apple Watch, which is capable of taking electrocardiograms.

Whatever the sector, digital disruptors have one characteristic in common. They leverage the capabilities of the cloud to the maximum extent possible. A shift in power toward digital-first companies is underway, and the cloud plays a major role in helping these companies establish themselves.

Many incumbents are just now taking their first steps on the journey to the cloud, and still working on the challenges involved in migrating their existing legacy applications to more scalable and agile public cloud environments. While they’re engaged in this process, digital insurgents are already exploiting the full potential of the cloud to deliver solutions that meet emerging customer needs associated with today’s evolving lifestyles.

In highly regulated industries, such as financial services and healthcare, major brands will not necessarily see an immediate decline in their customer base, nor profits. Nonetheless, digital-first companies are capturing millions of customers annually, and this growth poses a considerable challenge over time. Embracing the journey to public cloud is crucial for legacy enterprises.

The most successful cloud-based disruptors use experimental sandboxes as a critical component of development. The public cloud can drive progress toward almost any business goal involving IT—operational transformation, new market penetration, new product launches, automation.

Digital transformation to the public cloud is also the only way companies can leverage storage scalability and the essential innovations of the open-source community. There are still lingering concerns among executives in highly regulated, data-sensitive industries concerning privacy and regulatory compliance, and these can lead to hesitation. The face is, public clouds have been in place for over two decades now, and their security is often superior to older on-premise security. Incumbents can, therefore, tap into the public cloud to ensure safety for mission critical workloads.

To accelerate the transition to the public cloud, consider the following best practices.

Learning to Fail Fast and Learn from Experience More Quickly

The Silicon Valley maxim to fail fast may run counter to incumbent corporate culture, but it is the best path to success in the new digital reality. The key is being able to learn from failures quickly and adjust accordingly.

Partnering for Progress

A digital native approach to business is often lacking in the corporate culture of incumbents. Cloud partners that have a digital disruption in their DNA can play an important role in driving cultural renewal at every level of the organization. A reliable cloud service partnership can accelerate concepts, pilots, staffing and other mechanisms designed to deliver value quickly and securely.

Re-Examining Compliance Processes

Operations should be streamlined to transform enterprise IT to be well-suited for the cloud. Companies can apply artificial intelligence to supplement human intervention, and encourage cloud adoption among employees. First, building a solid foundation, then working your way up, enables businesses to make important changes that transform the enterprise into an environment that is compliant by design.

Successfully competing with digital natives means using the cloud to find new opportunities to streamline and better comprehend customer needs and behaviors. It also means being unafraid to change time-honored business practices. At the same time, in highly regulated and data-sensitive industries, compliance and security must be prioritized. Cloud transformation has quickly become vital for companies in all sectors and represents an essential foundation for future business success.

April 17, 2020
Fail Fast: How Shifting Security Left Speeds Development

How DevSecOps can help organizations increase security, move faster and save money

With developers under constant pressure to create more software in less time, the last thing you need is for your code to fail at the end of the development lifecycle. No developer wants to create inoperable or insecure code.

We know that most software products reach the market with flaws or vulnerabilities. On average, more than 85 percent of all software applications have at least one vulnerability, and more than half of flaws remain unaddressed for one to three months after first being discovered.

The sooner a developer can identify, view and correct a flaw, the more efficient it becomes to fix in the software development life cycle (SDLC). That is the underlying philosophy of DevOps. Despite the somewhat negative connotation, failing early in development can be beneficial in deploying software to market more quickly.

The most advanced organizations today employ a DevSecOps model, which tends to incorporate more frequent security scans, incremental fixes and faster rates of flaw closures into the SDLC. More importantly, it allows security teams to shift left to test software products against security standards earlier in the development process.

According to Gartner, more than 80 percent of development teams will implement DevSecOps by 2021. In 2017, that number was around 17 percent.

In Veracode’s latest “State of Software Security” report, we discovered companies that adopt a DevSecOps approach to development are addressing software vulnerabilities more than 11 times faster than companies that use a more traditional software development method. In the process, DevSecOps companies are innovating faster, saving money and becoming more efficient in how they identify and resolve new risks.

By integrating developers with IT operations and focusing everyone on making better security decisions, DevSecOps can help deliver safer software with greater speed and efficiency.

Introducing security earlier in the development process creates a sort of blueprint for teams to build within the specifications of major IT regulation and helps reduce risk by fixing vulnerabilities before they can be exploited. Think of it like building an apartment complex according to city codes with inspectors integrated in the construction crew.

In practice, DevSecOps can add some friction and hinder the development process. Traditional tools for testing code and assessing application security risk simply weren’t built for the speed that DevOps testing requires.

To make DevSecOps successful, development teams need to start with automated testing tools, as relying on manual processes can’t possibly keep pace with accelerated development timelines. Tools that can be used in an integrated development environment (IDE) are key, as they allow developers to integrate security into their workflow rather than having to launch a new environment whenever they need to test code. Solutions that check for flaws during the coding process enable developers to address vulnerabilities early on when fixes are the most cost-efficient. And because DevSecOps is equally concerned with security when software is in production, development teams need tools for testing applications after release. Development teams, meanwhile, must be comfortable with changing the way they work.

Business leaders must recognize the importance of integrating security with development and communicate that priority to development teams. New regulations such as the EU General Data Protection Regulation (GDPR), which can fine companies up to 4 percent of their revenue for failing to disclose processes related to data breaches, are now in place. All businesses must be motivated to operate with a security-first mentality that permeates through the business, including within development teams. Veracode data shows that customers taking advantage of DevSecOps’ continuous software delivery are closing their vulnerabilities more quickly than the typical organization.

DevSecOps doesn’t always require security personnel to be physically involved in the development process. Companies can and should train developers on basic security techniques and offer security resources to help developers become responsible for the security of the software they build.

As the DevOps movement has unfolded, security-minded organizations have recognized that embedding security design and testing directly into the continuous software delivery cycle of DevOps is necessary. This is the genesis of DevSecOps principles, which offer a balance of speed, flexibility and risk management for organizations that adopt them.

— Mark Curphey

February 8, 2019
Gain a Competitive Edge with DevOps
DevOps has attained mainstream status. It is no longer a cutting-edge concept that only startups and progressive companies embrace—it’s a business imperative that delivers a significant competitive edge. If you want evidence of the impact of DevOps, take a look at the 2016 State of DevOps report.

But what is it about DevOps that gives companies a strategic advantage over competitors?

“A DevOps approach enables companies to respond much more quickly to customer needs, competitive pressures and realize faster time to innovation,” says Sacha Labourey, CEO of Cloudbees. “Because DevOps is all about a culture of shared goals, and processes that accelerate software delivery through smaller, incremental releases, issued more frequently.”

However, Labourey cautions that DevOps doesn’t work to its full ability if the entire company is not on board. There needs to be strong communication and internal education within an organization to successfully implement a DevOps culture. You have to educate staff at all levels in the enterprise of the cultural and structural shift. Essentially, you have to break down barriers and get teams working together that haven’t typically worked together before. In fact, you need teams that may have been at war before, to now work together.

Struggles between teams often are driven by opposing goals and measures of success. DevOps empowers teams and individuals to work together and collaborate toward common goals more effectively. It’s a synergy that fosters cooperation rather than conflict.

Labourey says any company has the potential to transform to a DevOps culture. But there are some crucial questions organizations must answer before planning a DevOps transformation:
- Can the enterprise commit to putting the time and hard work in that is required to effect internal change and behaviors?
- Does the company environment support a DevOps culture and the values it brings with it?
- Is the executive team fully supportive, and maybe have even mandated, the change to DevOps?
“In order for DevOps to truly work, there must be a commitment to enable the change. This only happens with a lot of hard work, diligence and support from the top,” Labourey says. “Any company that needs to deliver quality software—and deliver it quickly—should care about DevOps and the supporting practice of CD.”

DevOps, and the culture of teamwork it instills in organizations, delivers significant benefits:
- A decrease in time to market—innovation is delivered rapidly. Additionally, experiments can occur, with a “fail fast” mindset.
- Internally, satisfaction with the overall software delivery process attracts and retains better IT talent.
- Employees can innovate quickly and just as quickly see the results of their innovation.
- Software is of higher quality, since releases are smaller, incrementally produced and have less impact on the overall application and infrastructure.
I know that this isn’t news to many companies and individuals, and that, to some extent, I am preaching to the proverbial choir. For those just climbing onto the DevOps bandwagon, though, or those who may have lost their way and have become frustrated with their DevOps experience, I think it’s important to remind everyone what the benefits of DevOps are supposed to be if you get it right.

— Tony Bradley
February 9, 2017
DevOps Leaders Share 2017 Reflections, Predictions
As the New Year kicks off, it is a time for reflection and a chance to look ahead and plan for what is to come. While many are making personal resolutions pertaining to their physique, job performance or travel plans, there is a lot of chatter in the software delivery space around what DevOps will look like these next 12 months.

Looking back on 2016, suffice to say it was a big year for DevOps. There was no lack of resources for those in any phase of a transformation, with global conferences touting its name to weekly (if not daily) podcasts and webinars designed to share the latest expertise with the community. However, as DevOps moves from buzzword to phenomenon, it will be held to even higher standards and scrutiny, becoming ever-more polished and perfected as challenges are faced and overcome. But don’t just take my word for it.

Electric Cloud recently hosted a live, online video podcast featuring notable DevOps luminaries discussing their own reflections and conjectures. The panel included Nicole Forsgren, CEO and chief scientist at DORA; Robert Stroud, principal analyst at Forrester; Chris Riley, analyst at fixate.io; Manuel Pais, author at InfoQ and SkeltonThatcher; Alan Shimel, editor in chief at devopsy.kinsta.cloud; Sam Fell, VP of Marketing at Electric Cloud; and yours truly. This article highlights 16 different insights from our discussion with these great minds in DevOps. Here’s to what has been, and what is to come!
- Expect to see a trend toward strategic DevOps transformations in 2017, according to Forsgren: “I think there’s going to be a huge trend moving forward to do really careful and strategic assessments about where you are, intentional prioritization and strategy about understanding what your constraints are, so that you can do strategic capabilities development moving forward.”
- Riley hopes 2017 will be the year we stop talking about DevOps and start doing it: “In 2017, we’re going to stop defining DevOps, and we’re going to hopefully use the word a lot less. We’re going to be real about what it is and getting it done. It’s going to be a lot less talk and more doing.”
- I emphasized that having good architecture in place is crucial to successful DevOps: “What’s starting to happen is that you’re going to have a really hard time doing DevOps well with a crappy architecture, whether that be a crappy architecture for your pipeline or crappy architecture for your application. Application architecture matters in your ability to do DevOps well.”
- Stroud emphasizes the importance of experimentation in DevOps: “Organizations [will] look to drive mainframe R&D in a DevOps methodology—not just mainframe development, but also supporting velocity in rolling it out to production, with organizations moving from one or two major releases a year, to now experimenting with both quarterly and monthly releases using DevOps practices and experimentation and techniques.”
- While tools and processes play a major role in a DevOps transformation, we must not forget to maintain a culture of empathy, emphasizes Shimel: “Have empathy for your fellow workers, empathy for your fellow humans. Don’t think because you’re the dev, that what you’re doing is more important than what the ops guy is doing.”
- DevOps certifications are the future, according to Pais: “I think we’re seeing more and more DevOps education and certifications. I know, for example, there’s an IEEE standard for DevOps being worked on.”
- Sweat the small stuff, advises Fell: “It’s never been truer than in this accelerated cycle that we’re seeing with productivity and all this awesome value being created from relatively minor, incremental improvements in process, in tooling, and all the stuff that we do, and the feedback that we’re getting.”
- I believe 2017 will bring major disruption in the FinServ community: “We will see some, hopefully, interesting disruption in the financial technology area, because the financial institutions have always treated technology as a key differentiator. Now, the problem they have is that their culture, by and large, sucks.”
- Some wise words from Stroud: “Strategy without execution is wasted time. We have to execute. We have to be prepared to fail. We have to be prepared to come and share our experiences.”
- Measure, measure, measure is Forsgren’s DevOps focus in 2017: “What’s going to be my goal is having all of us think about measuring in smart ways, so that we can actually do these experiments that are small, that allow us to fail, because big massive failures are scary, but those are the ones that are easy to measure with crap measurements. Because when you fail big, you know you failed big.”
- In 2017, we will see a breakdown of DevOps tools’ silos, per Shimel: “It’s really ironic that in something like DevOps, where the idea was to break down silos between dev and ops, dev and QA, and QA and security, but what we’ve done is we’ve built new silos of DevOps tools.”
- Pais on the trends he sees in early adopters of DevOps: “For the majority of organizations that have already been doing DevOps for a while, they’re now focusing on what’s the best way to organize teams. Moving, often, from having just specific people who know about continuous delivery, DevOps and so on, to actually getting platform teams that embed all the services that they want the development teams to use.”
- Oddly enough, development teams are still more likely to adopt DevOps than operations teams, explains Stroud: “One of the data stats we pulled has to do with DevOps adoption in development versus operations. Isn’t that ironic? Because the name DevOps is dev and ops. We still see significantly more DevOps adoption in development than operations, but the good news is the gap is closing, based on the Forrester data.”
- Containers will continue to be a major player in 2017, says Riley: “Where I believe there will continue to be growth is container-native tooling, container-native security and container-native release automation.”
- The reality is, there are still a lot of organizations not doing DevOps, remarks Fell: “We are living in this bubble, happy bubble, of everybody gets DevOps and we’re all Agile. But we talk with folks that we talk to who are just like, ‘Yeah, we do nightly builds, and we’re really looking forward to doing continuous integration.’ Your jaw drops, like, ‘Wow. Yeah, that’s a good idea. You should do that.’”
- And, finally, I share some sage wisdom to keep in the back of our minds: “If what you’re doing on any given day isn’t moving that ball forward, what is the point? I think we need to focus a little more on that.”
Bonus 17^th quote for 2017, from Shimel: “I think the story of 2016 is DevOps has gone mainstream. We’re seeing pockets of DevOps come together as bubbles, but we still have the majorities in front of us, going forward.”

For more reflections and predictions, watch the full episode:

About the Author/Anders Wallgren

Anders Wallgren is Chief Technology Officer of Electric Cloud. Anders brings with him more than 15 years of in-depth experience designing and building commercial software. Prior to joining Electric Cloud, Anders held executive positions at Aceva, Archistra, and Impresse. Anders also held management positions at Macromedia (MACR), Common Ground Software and Verity (VRTY), where he played critical technical leadership roles in delivering award winning technologies such as Macromedia’s Director 7 and various Shockwave products. Anders holds a B.SC from MIT. Connect with Anders on LinkedIn or Twitter.
January 10, 2017