devopsy.kinsta.cloud

Tag: gamification

  • What a Dev Wants: Security Training for Today’s Developer Workforce

    What a Dev Wants: Security Training for Today’s Developer Workforce

    It’s no secret that developing a strong security culture is a critical component of the production of secure products, yet organizations often overlook the fact that their security training programs set the foundation on which this culture is built. When it comes to developer training, our goal should be to align the intrinsic motivations of a learner with the company’s strategy and objectives. But if either of these is misaligned, the training program, and ultimately the organization, will suffer because it is either irrelevant or perceived as a compulsory box that needs to be checked.

    Addressing the Interests of Developers Vs. the Organization

    Unfortunately, there is a gap between the buyer persona and the developers themselves, even though developers tend to have a fairly consistent response about the ways they want to be trained. Rather than implement a program that is doomed to be viewed as a time-consuming compliance requisite, organizations should rather ask this simple, yet pertinent question: What do developers really want out of their security training program?

    When it comes to today’s security training programs for developers, there’s often a separation between compliance-based training and developer-centric training; in other words, the interests of the organization don’t always align with the interests of the developers. In most highly regulated organizations, there is a mandated security training curriculum that all employees, including the development teams, are required to go through on a yearly basis. This leads to a drawn-out, painful process that leaves employees clicking through modules as fast as possible. Developers may then need to go back and look up security topics on a regular basis if they are looking to implement them into their code.

    While developers are certainly making an effort to adhere to security requirements, this greatly slows the ability to get the product to market in a secure and efficient way.

    What Training do Developers Really Want?

    Organizations should prioritize programs that will specifically target their development teams by asking what those developers are actually looking for. With so many training programs on the market, it can be difficult for an organization to determine which will resonate the most with their employees, specifically their development teams. The fact of the matter is that, when it comes to security training, the majority of developers want to do as little of it as possible. They are willing to check the boxes for compliance purposes, but they want it to be as seamless as possible. As the complexity of training tactics continues to evolve, an ideal curriculum is simple, like programs that can be embedded in the tools developers use on a daily basis.

    The most effective training programs are engaging and relevant. Managers tend to see better results from training that is hands-on, interactive, engaging and related to developer tasks. Gamification is also a great way to engage developers. For instance, organizations have started livening up their training curriculum with leaderboards. In fact, recent studies have indicated that developers would opt into shared company leaderboards with points for content consumed. Not only are these programs engaging for the developers, but they are also incredibly effective, as they motivate teams to view more content by leveraging individuals’ pure competitive drive.

    Security Champion Programs for the Win

    Organizations could also implement a security champions program. These programs vary depending on the organization, but in its simplest form, a security champions program designates a “champion” from each team. The champion is then tasked with leading the team as a subject matter expert as far as security goes. One thing to keep in mind here is that this program could be a major failure if done improperly. Remember, you don’t want to designate just anyone as the team security champion; you want to be sure you’re selecting an engaged employee that will prioritize secure practices and proactively communicate updates across the team.

    Regardless of what avenue an organization chooses, the name of the game is ensuring development teams are actively engaged with a relevant and realistic training program. The result of which will have an important downstream impact as organizations work to build a culture with a strong foundation in security. After all, “checking the box” can only go so far when it comes to developing a winning—and secure—solution.

  • The Problem With Security

    The Problem With Security

    As an IT professional with decades of experience at every level of technology and organizations—from cell phone prototyping to banking enterprise architecture, from entry-level to CTO—I can state definitively that I have spent an inordinate amount of time dwelling on and dealing with security. And I know I’m not alone. This is a common theme. You could almost make a sitcom out of it. “What are your developers doing?” Uhhh … writing code? “That’s security!” I could go on, hitting on everything from users to cloud instances and you could fill in the “That’s security!” punchline every time.

    That’s a problem. But not in the way you might think. I spent many years thinking I was somewhat unique in that I always rose to the occasion and approached security issues head-on. Most of the organizations I’ve worked for didn’t have dedicated security (I’ve probably written about that before), so some of us rose to the occasion.  Nowhere near all of IT, but enough to feel like we were protected.

    I now realize that I’m not all that unique; that more of us are doing the “learn security to be secure” thing than are not. I see it in modern organizations all the time. And I think that the real problem is this: Most of these people, like me, did not see themselves as security staff—but they are. Most organizations don’t recognize them as security staff—but they are.

    We’ve long harped on cultivating security recruits from this pool, and I’m now going to suggest that you go even further. Make these people part of your planning. If you know that person X on the ReallyCoolApp team is ferreting out security stuff, ask them to just send an email to update InfoSec once a week. Don’t make it a huge burden, and don’t try to force them into a pure security role if they don’t show the aptitude and interest (you really don’t want unwilling security staff) but make use of their talents and drive. Certainly, if this person is doing a good job of making certain ReallyCoolApp is mostly locked down and DevSecOps tools are running against it for a secondary validation, then your limited InfoSec resources can be directed elsewhere.

    Replicate this throughout the organization, and “That’s Security!” becomes a benefit rather than a hassle to try to lock down. You already do some of this—since the automation of passwords, most identity management is handled by operations staff, with security merely providing policy and being available to ops if needed. I’m simply suggesting that you expand this type of approach to include every IT department (and some non-IT departments in distributed environments). Don’t recruit everyone to be InfoSec, but recruit them to do a little bit of InfoSec in their area of specialty.

    People have always said “Security is everyone’s problem,” which is true, but it’s far too vague to be useful. This is a workable intermediate. “Security is every team’s problem” and recruiting the people on each team most interested in InfoSec to formalize their involvement is a better approach.

    And keep rocking it. We need security everywhere, because ne’er-do-wells have made everywhere a part of the InfoSec battleground. So recruit people everywhere without moving them from their current roles/responsibilities. Don’t let the sweet systems you’ve nursed through the years get whacked by attackers when a little recruiting and nurturing will fill the gap.

  • CSS-Tricks Sells Out | Peloton Spins Out | ARM Axes 1,000

    CSS-Tricks Sells Out | Peloton Spins Out | ARM Axes 1,000

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: CSS-Tricks gets bought by DigitalOcean, Peloton pedals while its business burns, and Arm lays off up to 15% of staff. (more…)

  • The Gamification of Everything

    The Gamification of Everything

    Cross-pollination, for the non-scientific, is one of the key foundations of biodiversity on Earth. It is evolution in action—responsible for reinforcing the traits that make plants stronger and ensuring the survival of many species.

    On a far smaller scale—but equally crucial, from a business point of view—technology applications that move across industry delineation generally gets stronger. The traits that make great tech awesome in one domain combined with the unique use cases and experience of another domain result in more powerful and more flexible technology. And it’s not just a one-way street. Tech often moves back and forth across industry segments, and each time it crosses the line, its DNA improves. That means that, ultimately, the original domain tends to be strengthened by cross-pollination, too.

    This is exactly what’s happened with gaming development technology in recent years. And I’m not just talking about best practices. I’m talking about actual purpose-built gaming development technology that’s spread across and penetrated into industries like automotive, e-commerce, entertainment, architecture, real estate and more.

    This cross-pollination has left top-tier gaming tech players like Epic’s Unreal and Unity in a vastly superior position. In fact, it seems that cross-pollination is becoming an integral part of the growth strategy for these and other gaming tech companies. They’re not only betting their tools will shape the next generation of user experience in multiple industries–they’re also making strategic acquisitions that will make this happen.

    What Does Cross-Pollination Look Like?

    Cross-pollination of gaming tech takes a number of forms–some quite overt, others more subtle. For example:

    • The gamification of mobility–Gaming tech is bringing a new level of interactivity and visualization to the automotive industry. For visualizing self-driving, safety testing, visualizing automotive components, creating online showroom visualizations of vehicle interiors and more–gaming tech is deeply integrated into automotive development, manufacturing and retail.
    • The gamification of entertainment–Game development tools are revolutionizing the way entertainment companies develop content. From scene development based on a gaming methodology and gaming engines, to an entire popular series shot in one location using Unreal–gaming tech has radically changed the scene and series development pipeline.
    • The gamification of business software–The gamification of business software is streamlining processes, training and workflows. From companies like Invrsion, which offers game-like virtual reality tools for retail, to Salesforce, which adopted a game motif for key training—business functionality augmented by gaming tech and gaming user experience enhancements are becoming standard.
    • The gamification of education–Learners learn best when they’re having fun–and also when they have goals, targets and achievements to reach for. Sites like Khan Academy and apps like Duolingo have brought gaming tech and methodologies into the virtual classroom, changing paradigms for educators and learners alike.
    • The gamification of everything else–Shopping for clothes online during lockdown? The functionality that lets you “try on” garments is based on gaming tech. Designing a new pharmaceutical molecule using VR augmentation? Gaming tech. Urban design? Yep—gaming tech. And the list goes on.

    Why Gaming? A Unique Technology Incubator

    The question that companies in any industry should be asking is: why is gaming able to create such powerful, flexible and inspiring tech that lends itself so well to cross-pollination?

    The answer is multifaceted. First off, gamers are out-of-the-box thinkers, to say the least, and game developers–well, they broke the box before the gamers even got there. Gaming tech was born in a development environment on steroids—tight schedules, computing intensive processing, insane competition and frequent release cycles. This makes for a space that’s both receptive to new tech and open to new ways of doing things.

    Secondly, gaming is a ridiculously dynamic industry that is undergoing incredible growth, and the pandemic has only accelerated this trend. More money coming in translates to more investment in developing, improving or acquiring tech, as well as to launching more and more new games.

    Finally, in the gaming world, human resources cross-pollination is built in. Game developers move between studios all the time. This spreads tech advancements like–pardon the sensitive reference–a virus. Because if something worked well for you in one job, you’re going to want to use it in your next position.

    The Takeaway

    In both the natural and business worlds, cross-pollination is necessary for survival. Gaming tech is leaking into other industries for one key reason: it is frequently superior. And this cross-pollination of gaming tech benefits both the industries that adopt it and the gaming industry itself.

  • Cortex Taps GitLab to Help DevOps Teams Manage Microservices

    Cortex Taps GitLab to Help DevOps Teams Manage Microservices

    Cortex, a provider of a platform for tracking ownership of microservices, this week announced its platform can now import services from the GitLab continuous integration/continuous delivery (CI/CD) platform.

    Anish Dhar, Cortex CEO, said the company’s platform is now integrated with more than 30 tools that are regularly employed by DevOps teams, including offerings from GitLab, Datadog, Sonarqube, Snyk and PagerDuty, as well as open source platforms such as the Kubernetes container orchestration engine and the Istio service mesh.

    Designed for site reliability engineers (SREs) and other DevOps professionals, the Cortex platform eliminates the need to rely on spreadsheets to manually track ownership of microservices. Instead, Cortex imports data residing within the tool employed by developers to surface who within an organization is responsible for maintaining which microservices.

    In addition, a Cortex dashboard enables DevOps teams to see which developers are on-call in the event of an unexpected incident, the latency rate microservices are experiencing and which vulnerabilities have yet to be remediated.

    Grades can also be assigned to specific microservices based on metrics that are associated with a specific microservice. That approach allows DevOps teams to apply gamification techniques using a scorecard to encourage developers to continuously improve their microservices, noted Dhar. That approach will also make it apparent to other developers which microservices running in a production environment can be most reliably employed, added Dhar.

    Cortex

    At the core of the platform is Cortex Query Language (CQL), a domain-specific language that allows DevOps teams to define granular rules that can be applied to, for example, on-call rotations, security vulnerabilities, package versions, service level objectives (SLOs) and the overall health of the microservice. Engineers can employ code in the form of YAML files to set reliability standards across teams and types of services through direct integrations with a variety of tools. In effect, Cortex provides a reliability-as-code platform, said Dhar.

    As responsibility for applications shifts further left, each development team is being held accountable for the life cycle of any microservice or application they create. The challenge enterprise DevOps teams are encountering is that when there are hundreds, even thousands, of microservices, it’s difficult to determine who on the development team is responsible for a specific microservice. Rather than trying to keep track of the relationship between development teams and microservices using a spreadsheet, Cortex is making a case for a tool that automates that discovery and tracking process.

    Most organizations today are embracing microservices to build and deploy more flexible applications at varying rates. However, it’s only a matter of time before they find themselves trying to navigate a web of interdependencies between microservices that can’t be managed using spreadsheets. DevOps teams, of course, might be inclined to use their skills to create their own tool for tracking microservices. However, given all the tasks at hand, maintaining a custom platform for discovering and tracking ownership of microservices is likely something better done by a vendor willing to maintain and support a purpose-built tool.

  • Game On: Gamification for the Win

    Game On: Gamification for the Win

    Staying competitive in today’s fast-moving digital economy is easier said than done. Operating in a digital environment requires a significant shift in company culture and an agile software environment that accelerates time to value. Creating a DevOps environment helps companies keep pace, but it requires a workforce that is empowered, excited and motivated.

    Gamification offers a unique opportunity to continuously engage your workforce by applying game-design elements and game principles into a corporate setting, making work more fun. Companies can develop a team-oriented Pod model that incorporates gamification to improve employee engagement and productivity, enable team members to work more efficiently, accelerate the learning curve and deliver more sophisticated products to market faster.

    When I joined Cognizant Softvision as CEO, I wanted to empower our teams and promote a continuous delivery mindset by developing a delivery model that was customer-centric, differentiated and unique to each client without being prescriptive. Thus, Game of Pods was born.

    The global, Game of Pods gamification program is designed to provide timely and superior customer service. At a high level, Game of Pods inspires and measures team performance and delivery while encouraging and monitoring individual performance. During competition, the Pod and its members are recognized and rewarded for their collective and individual contributions with badges and trophies.

    We typically focus on the output of each pod, rewarding collective behaviors and achievements that help the pod reach higher efficiency and quality targets. Collective badges are awarded to the pod while personal and peer-to-peer badges are awarded to the pod members. Pod badges are earned as a team and are focused on the health of the project, performance of the pod, quality of delivery and alignment with client objectives. A leader board displays the badges each pod earns, their experience points and their trophies. Pod and individual recognitions are celebrated over email and across Facebook Workplace, and shared with all employees.

    While perhaps not as intense as “Game of Thrones,” Game of Pods is the epitome of gamification in action and enables organizations to reach a higher level of efficiency and professionalism while challenging employees to achieve personal goals in a fun, team-oriented process. In addition, Game of Pods offers other benefits such as:

    • A flexible model that can work in any client environment.
    • Team empowerment that incentivizes teams and individuals to achieve more.
    • An approach that encourages diverse thinking that recognizes and rewards teams and individuals for improvement.

    Game of Pods is most effective in organizations that embrace an agile mindset and understand the need for flexibility in today’s fast-moving environment. While gamification has come a long way, successfully incorporating it into the workplace can be challenging. However, integrating gaming into your organization can empower and excite employees, motivating them to overcome obstacles that might otherwise stand in the way of success and sustainable innovation.

    — Andres Angelani