devopsy.kinsta.cloud

Tag: midmarket

  • Morpheus Data Adds Midmarket Edition of Hybrid Cloud Platform

    Morpheus Data Adds Midmarket Edition of Hybrid Cloud Platform

    Morpheus Data announced today it is adding a more turnkey edition of its hybrid cloud platform aimed at midmarket IT organizations.

    Priced starting at $16,000, Morpheus Essentials can be deployed on VMware, Nutanix, Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP), with support for Kubernetes planned.

    At the same time, Morpheus Data is updating its core platform to add support for a Plug-in Framework that provides integrations with nearly 100 cloud services without requiring DevOps teams to write code. The company is also adding support for a shopping cart capability through which third-party applications can be automatically deployed as a service.

    Finally, Morpheus Data is adding scanning tools based on the security content automation protocol (SCAP) to make it easier to embrace best DevSecOps practices.

    Brad Parks, chief marketing officer for Morpheus Data, said the goal is to reduce the level of friction IT organizations encounter when trying to centralize the management of public clouds and on-premises IT environments. With more organizations than ever now managing two or more clouds alongside an on-premises IT environment, the need to unify the management of those platforms has become more pressing, he noted.

    The current state of the economy requires IT organizations to reduce the number of management consoles they need to master for each platform, which Parks noted reduces the cost of IT labor because organizations no longer need to designate a specialist to manage each platform employed. The Morpheus platform also enables IT organizations to set up guardrails that enable DevOps teams to self-service their own requirements regardless of platform within the context of policies defined by IT operations teams, he added.

    Of course, the Morpheus Essentials edition of the hybrid cloud platform might also appeal to smaller units within larger IT organizations that need to manage a range of platforms that as yet may not be as widely employed as the platform the rest of the enterprise has standardized on.

    It’s not clear to what degree IT organizations may finally be moving to centralize the management of IT just yet, but the rise of edge computing may finally force the issue at a time when most IT teams continue to work from home to help combat the spread of the COVID-19 pandemic.

    Nevertheless, IT teams are prone to be protective of their individual fiefdoms. As such, convincing them to give up a specific platform console in favor of a platform that can be applied more widely can be a challenge. There always will be a trade-off between the capabilities available in a management console that was created for a specific platform and a management console designed for multiple platforms. The issue IT leaders will need to determine is to what degree a missing capability might have a meaningful impact on the productivity of the IT team.

    Regardless of the platform selected, the one thing that is clear is as IT becomes more complex to manage the current status quo is not likely to hold.

  • DevSecOps: Changing AppSec for the Midmarket

    DevSecOps: Changing AppSec for the Midmarket

    The midmarket space has always been prime for innovation and opportunity. In the DevSecOps space, that is no different.

    If you look at this report or others about DevSecOps markets, two things stand out:

    1. The market is expected to explode to $14 billion by 2026 from today’s nominal $2 billion.
    2. The biggest driver of the increase is the rise of security adoption by midmarket enterprises.

    Software is eating the world, as everything is becoming digitized. In response, midmarket companies are rapidly cranking up web and mobile apps to better compete and serve their customers. Along with the increase comes a dependency on apps for critical business functions and a need to secure them from attacks, which explains the surge in security demand.

    Current AppSec Offerings Are Not Geared for the Midmarket  

    AppSec Expertise Required

    Most incumbent AppSec products were built at least a decade ago when only large enterprises cared about AppSec. Naturally, they were molded for the characteristics of those enterprises. They are unnecessarily deep and monstrously complex and require a team of AppSec experts to begin operations. Midmarket companies don’t have the skills, resources or willingness to hire a team of AppSec experts, especially given their short supply.

    Extraordinarily Expensive

    Incumbent AppSec products are dreadfully expensive for midmarket companies. Annual prices reach millions of dollars and it’s difficult to determine ROI, making decisions murky for budget-conscious midmarket companies. They want to produce and deliver secure apps and certainly want to mitigate risk, but they also have a lower ceiling they can afford to pay.

    A New AppSec Approach for the Midmarket

    Being Cloud-native Requires SaaS AppSec

    Midmarket companies are quicker to adopt a cloud-native approach. Unlike large enterprises, they don’t have the baggage of legacy tech and can move to the cloud more easily. Being cloud-native saves a lot of money and comes naturally to the midmarket—when it comes to AppSec, they are likely to require that products be cloud-native and SaaS. Most security incumbents started on-premises, and although some now have a parallel SaaS offering, they are clunky and not designed inherently for cloud-native architectures.

    Rise of DevOps and CI/CD Automation

    As cloud adoption increases, automation of deployment to the cloud becomes a key factor, resulting in the meteoric rise of DevOps. DevOps uses many tools to automate cloud integration and cloud deployment, with CI/CD tools consistently at the center. AppSec must be part of this automation process, preferably in the CI/CD. The manual waterfall approach cannot work with the new speed and volume of application development. If scanning is not automated in the CI/CD, scans simply don’t get run. Therefore, because the automation workflow starts with DevOps, AppSec needs to be DevOps-first.

    Traditional AppSec scanners were not built for DevOps. Sure, some have caught up and added DevOps to their marketing material. Several have even added some integrations, but their core product remains much the same and it’s not DevOps-friendly.

    One significant offshoot of DevOps-first AppSec for the midmarket is that the tool cannot require AppSec expertise, simply because most DevOps don’t have significant AppSec expertise. Requiring that knowledge to get the security automation workflow started is a non-starter.

    Open to Open Source Scanners … With Management

    Midmarket companies are typically willing to use open source primarily because it is free. Unlike large enterprises with their tendency to complicate anything, midmarket companies have fairly standard requirements that can usually be met with open source. It is no different when it comes to application security scanners, and midmarket enterprises are fans of these tools. Often the scanning prowess of these open source scanners is better than their commercial counterparts, as they are tailored and specialized to specific languages and architectures. They also cover all scan types (SAST, DAST, SCA, etc.) and a combination of them can provide an efficient and affordable level of security.

    This midmarket love affair with open source scanners comes to a screeching halt when it becomes apparent that it is grossly unmanageable. There are so many available open source scanners that it takes time to decide which are relevant for your organization, application and development status. They are also notoriously difficult to set up, upgrade and maintain. Each of them does things differently. The output or reporting formats are not normalized across scanners. Without an aggregation layer to consistently cross-reference, normalize and present a consistent view of the security risk, consuming the output is nearly impossible. This often results in midmarket companies choosing to select only one type of scan.

    Imagine a tool that adds a common SaaS orchestration layer that crosses all these scanners and scan types, using their superior scanning prowess, but removing the management headache. Midmarket companies would improve their security posture with an investment they can afford. This sort of “Open Source + SaaS” model is not new. Applying the model to application security changes the game for midmarket companies.

    One Tool for all Scanning

    The multiple types of application security scans make application security complex. SAST scanners scan the source code for vulnerabilities, DAST scanners scan running applications from the outside in, SCA/OSS scanners scan third-party libraries included in your application, container scanners scan containers, API scanners scan exposed APIs, Secrets scanners scan for open passwords in the source code, and so on. Mentioning all these distinct scanners can make heads spin for those inexperienced with AppSec. This complexity is worsened for midmarket companies. For most, it is nearly impossible to keep up with the new pace of application development with unaffordable, piecemeal scanners from multiple vendors or the multiple open-source scanners needed to address each area of vulnerability.

    Security is only as good as the weakest link. Even if you do an exemplary job with one type of scanning but leave out other types you leave gaping holes in your security and risk. What midmarket companies need is one tool that tackles application security comprehensively by automating and orchestrating the use of all types of scans while abstracting the user from the underlying complexities.