devopsy.kinsta.cloud

Tag: training

  • The Skills Successful DevOps Pros Need in 2023

    The Skills Successful DevOps Pros Need in 2023

    In the last decade, DevOps adoption has grown considerably. An increasing number of companies across a wide range of industries are embracing the benefits of DevOps, and we have not seen the end of the growth cycle yet. Indeed, the total DevOps market is expected to continue to grow significantly in the next few years, with one recent market survey projecting an annual revenue growth of no less than 24.7% from 2023 to 2030 (which will bring the market value to about 51 billion dollars).

    Further, DevOps is continuously integrating with and accommodating new technologies, which are themselves evolving quickly. This means DevOps professionals will have to invest more and more time each year to stay current and effective at their job. But, this predicament comes with a silver lining. By staying current and even ahead of the game, DevOps professionals are better able to differentiate themselves and deepen their level of expertise—and with that comes the ability to increase their income potential over time.

    In this article, we take a look at what knowledge, skills and abilities (KSAs) DevOps professionals should bring to the table if they want to keep up with the fast pace of change in the industry in 2023—and beyond.

    Knowledge – What Pros Need to Know

    As always, DevOps professionals are expected to have a baseline level of knowledge before taking on a new role, internally or externally. But, as DevOps adoption grows, professionals will need to make a concerted effort just to stay abreast of current trends.

    Platform Nuances

    Each platform places limitations on DevOps processes, and their successful implementation within a company will vary depending on the platform. It’s not uncommon to have to tailor your approach in particular circumstances. In the case of Salesforce, for example, successful DevOps processes must begin with improved deployment speed and accuracy. Only once this is achieved can Salesforce DevOps professionals move onto more mature processes such as automated testing and releases.

    Industry Standards

    DevOps professionals should understand the constraints of the technology they are working with. and within their industry. Both factors may place limitations on or add additional requirements to what they do. Any given technology platform comes with its own unique constraints, such as file sizes or limits on API usage. This is especially true of cloud-hosted systems like Salesforce, where there are multitenant architectures and resources are allocated to customers. Similarly, different industries are faced with differing constraints, such as the HIPAA requirements for companies handling health care data in the U.S. As a result, DevOps professionals will need to understand these tied to specific standards or processes of their given industries.

    Transferable knowledge

    As a final word on knowledge, it’s critical to make sure you are aware of DevOps trends and best practices on platforms other than your own. There are times, more often than we realize, that your knowledge of what has been successfully utilized on other platforms can be transferred to your own. Even if these practices are not directly transferable, they can point you in directions that can ultimately prove beneficial to your DevOps work on a completely different platform.

    Skills—What Professionals Need to Master

    While there are a huge number of skills that DevOps professionals need in order to stay current and further their career growth, I’d suggest paying particular attention to…

    Version control

    This skill is fundamental—you just can’t do the job without it. Make sure you thoroughly understand its nuances: Branching strategies, rebasing or merging, rollbacks, cherry-picking, etc. It’s also valuable to understand different approaches’ limitations and use cases.

    Automation

    Become well-versed in the differences between continuous integration and continuous deployment/delivery (CI/CD) and how they form the CI/CD pipeline. Knowing where and when to apply it and how to apply it are also critical skills to master.

    Successful teams also benefit from building automated workflows. A recent survey Gearset ran with Salesforce DevOps professionals showed that 85% of teams were either currently using or planning to use source control over the next year. Automated workflows are critical to optimizing ROI in DevOps, as they reduce manual processes and unlock some of the most valuable benefits of DevOps for teams of all sizes.

    Testing

    Test automation is increasingly central to achieving DevOps success. As such, you would be wise to develop expertise in environmental testing, unit testing (integrated with automation and release gating) and UI test automation.

    Monitoring

    Application monitoring for performance, errors, data anomalies and security is arguably as crucial as testing. DevOps professionals must apply the same level of diligence to routine system operations as they do to deployments. As DevSecOps becomes more prominent in 2023, it’s expected that there will be increased collaboration and integration with infosec teams.

    Backup

    It’s critical to master the backup and restore process, no matter which platform you work on. It should absolutely be included as part of a comprehensive DevOps skill set. This is because skill underpins the mean-time-to-recovery metric. DevOps professionals must be familiar with the processes and tools necessary for restoring systems and data to achieve a rapid and secure return to business as usual.

    Demonstrating ROI of DevOps

    Finally, it’s essential for team leads, or those hoping to advance their DevOps career, to effectively convey the performance of DevOps, which can be measured using indicators such as Google’s DORA metrics. This means translating DevOps metrics into quantifiable business value that can be easily understood. It is crucial for managers to not only motivate their teams but also to validate the return on investment (ROI) in DevOps to critical stakeholders. By connecting the performance improvements resulting from DevOps practices with tangible business outcomes and demonstrating the ROI, managers can secure continued support for the DevOps approach within their organization.

    Abilities—What Professionals Need

    This final aspect of KSA plays an important role in fostering the collaborative culture that is the hallmark of DevOps success.

    Communication

    DevOps is not just about the tools—you need to maximize communication effectiveness so that the team aligns their goals with the least amount of friction. If everyone is using the same model to reach the same goal, you will achieve success that much faster.

    Continuous improvement

    DevOps success is not a fixed goal. Rather, there are always elements of the process, or your team’s skills, that can be tweaked, changed or improved.

    Making training a priority

    As per the aforementioned Gearset survey, 45% of teams who train once a month rate their team’s collaboration as ‘excellent’ compared with only 13% of untrained teams. Teams that prioritize training outperform all others on a wide range of metrics, including but not limited to seeing fewer bugs and data loss incidents.

    This Challenge is an Opportunity

    There’s a huge range of KSAs that DevOps professionals will need to master if they want to thrive in 2023. Clearly, working in DevOps has never been more demanding than it is today. But, from this challenge, there’s also a tremendous opportunity for professionals to make themselves indispensable.

  • Dell Looks to Expand Pool of Available DevOps Expertise

    Dell Looks to Expand Pool of Available DevOps Expertise

    Dell Technologies has quietly launched a training and education initiative to significantly expand the number of IT professionals that have DevOps skills.

    Brad Maltz, senior director for DevOps and developer relations ecosystems for Dell, said the next era of IT will require IT professionals that understand how to automate the management of application development and deployment. Given its long infrastructure history, Dell is especially interested in helping IT teams to use a mix of graphical tools and command line interfaces (CLIs) to programmatically deploy software at much faster rates and at scale, he added.

    Dell has already hired more than 200 specialists to provide that training as part of a DevOps Transformation Services consulting services engagement, said Maltz. The primary area of focus will be working with IT organizations that are embracing platform engineering to centralize the management of DevOps and GitOps workflows, he noted. Many of those teams are now relying on declarative automation tools that ultimately make DevOps more accessible to a wider range of IT professionals, added Maltz.

    The number of IT professionals that employ graphical tools based on IT management frameworks such as ITIL still far outnumber the number of IT professionals that have DevOps skills. The ongoing debate between these two camps essentially comes down to the need to be able to consistently manage IT at scale versus being able to adroitly keep pace with the needs of organizations that are increasingly dependent on software. In the digital transformation era, it’s become clear that more of the organizations that hire IT professionals are placing a higher value on agility, said Maltz.

    Bridging the divide between ITIL and DevOps to address that requirement is largely a psychological challenge that requires IT teams to address a range of cultural issues in addition to mastering different types of tooling, he added.

    Regardless of whether organizations continue to manage IT infrastructure internally or rely more heavily on managed services provided by Dell, the need to continuously deliver secure software faster has become a business issue. The trouble is the level of DevOps expertise within organizations tends to vary widely. A recent survey published by the Continuous Delivery (CD) Foundation found only 22% of respondents are using both continuous integration (CI) and continuous delivery (CD) to automate all building, testing and deployment of code in a production environment. Most organizations that have adopted DevOps make extensive use of CI to build applications, but CD has proven to be more challenging to master. In fact, the CD Foundation survey found only 7% of respondents described themselves as DevOps engineers or specialists.

    The bulk of the managed services that Dell provides are focused on managing infrastructure rather than deploying software, but the company does have a managed DevOps offering based on the application development and deployment platform that an internal Dell DevOps team built to construct and deploy applications. Naturally, Dell has a vested interest in accelerating the rate at which software can be deployed on IT infrastructure it provides and manages.

    It may be a while before the overall size of the DevOps community expands, but the training initiatives such as the one launched by Dell will help. However, it may become a lot easier to find and retain that talent in the months and years ahead. In the meantime, organizations would be well-advised to invest in upskilling their own IT teams. After all, it’s less expensive to train someone that already works within an IT organization than it is to compete against thousands of other organizations willing to pay top dollar for the best DevOps expertise money can buy.

  • What a Dev Wants: Security Training for Today’s Developer Workforce

    What a Dev Wants: Security Training for Today’s Developer Workforce

    It’s no secret that developing a strong security culture is a critical component of the production of secure products, yet organizations often overlook the fact that their security training programs set the foundation on which this culture is built. When it comes to developer training, our goal should be to align the intrinsic motivations of a learner with the company’s strategy and objectives. But if either of these is misaligned, the training program, and ultimately the organization, will suffer because it is either irrelevant or perceived as a compulsory box that needs to be checked.

    Addressing the Interests of Developers Vs. the Organization

    Unfortunately, there is a gap between the buyer persona and the developers themselves, even though developers tend to have a fairly consistent response about the ways they want to be trained. Rather than implement a program that is doomed to be viewed as a time-consuming compliance requisite, organizations should rather ask this simple, yet pertinent question: What do developers really want out of their security training program?

    When it comes to today’s security training programs for developers, there’s often a separation between compliance-based training and developer-centric training; in other words, the interests of the organization don’t always align with the interests of the developers. In most highly regulated organizations, there is a mandated security training curriculum that all employees, including the development teams, are required to go through on a yearly basis. This leads to a drawn-out, painful process that leaves employees clicking through modules as fast as possible. Developers may then need to go back and look up security topics on a regular basis if they are looking to implement them into their code.

    While developers are certainly making an effort to adhere to security requirements, this greatly slows the ability to get the product to market in a secure and efficient way.

    What Training do Developers Really Want?

    Organizations should prioritize programs that will specifically target their development teams by asking what those developers are actually looking for. With so many training programs on the market, it can be difficult for an organization to determine which will resonate the most with their employees, specifically their development teams. The fact of the matter is that, when it comes to security training, the majority of developers want to do as little of it as possible. They are willing to check the boxes for compliance purposes, but they want it to be as seamless as possible. As the complexity of training tactics continues to evolve, an ideal curriculum is simple, like programs that can be embedded in the tools developers use on a daily basis.

    The most effective training programs are engaging and relevant. Managers tend to see better results from training that is hands-on, interactive, engaging and related to developer tasks. Gamification is also a great way to engage developers. For instance, organizations have started livening up their training curriculum with leaderboards. In fact, recent studies have indicated that developers would opt into shared company leaderboards with points for content consumed. Not only are these programs engaging for the developers, but they are also incredibly effective, as they motivate teams to view more content by leveraging individuals’ pure competitive drive.

    Security Champion Programs for the Win

    Organizations could also implement a security champions program. These programs vary depending on the organization, but in its simplest form, a security champions program designates a “champion” from each team. The champion is then tasked with leading the team as a subject matter expert as far as security goes. One thing to keep in mind here is that this program could be a major failure if done improperly. Remember, you don’t want to designate just anyone as the team security champion; you want to be sure you’re selecting an engaged employee that will prioritize secure practices and proactively communicate updates across the team.

    Regardless of what avenue an organization chooses, the name of the game is ensuring development teams are actively engaged with a relevant and realistic training program. The result of which will have an important downstream impact as organizations work to build a culture with a strong foundation in security. After all, “checking the box” can only go so far when it comes to developing a winning—and secure—solution.

  • Are You Feeling the Hiring Crunch?

    Are You Feeling the Hiring Crunch?

    After years of experience, we can now definitively say one thing about information technology: There is always a hiring crunch, and it will always be better soon.

    I first noticed this trend in InfoSec years ago. Everyone was short-staffed and looking for available candidates. Everyone wrote their recruitment text like there was no shortage and they could ask for the moon and everyone was certain that this temporary staffing shortage would end soon.

    It didn’t. It still hasn’t. And it has spread. DevOps in general, development in particular are acting exactly the same these days. And it’s not going to get better.

    So, my advice? If you absolutely must have a person, write your recruitment copy to reflect the actual skills you must have. No bells and whistles, no “We always include…” no “But what if we…” Hire for what you need. Or hire with an eye to training what you need. And offer competitive pay. No one here will argue that IT is underpaid, but when there is a shortage of people, or more are leaving than coming in, then the cost of employees goes up. That’s just the way it is. If you are only hiring the ones you must have, then you can afford to pay them a bit more.

    Meanwhile, invest in even more automation. Let’s face it; again, we can learn from InfoSec. They are doing more with less staff—even if “more” is not “everything that everyone wishes they could”.  They have at least partially conquered their staffing woes by increasing the use of automation. DevSecOps is automating even more of the space, so we really will eventually get over the InfoSec staffing shortage.

    We can do this for all of IT, too—just follow their lead. Invest in automation, take the risk and turn on automated actions. Start small, but get started. Relatively high turnover and lower qualified applicant counts are likely to be the status quo for the foreseeable future, so automating processes as much as possible is not taking away jobs at this point, it is improving response in light of a lack of people for the available jobs.

    So, to sum up:

    • Hire when you can, but be focused. Don’t ask for experience in all three big cloud providers if you’re looking for an Azure person. Don’t ask for fifteen years of experience in Go for that entry-level position. Be realistic, be laser-focused and get the person you need in.
    • Train when you can’t hire. Let’s face it, there are going to be people who are massively familiar with application security but who have never done DevSecOps specifically or never used your DevSecOps solution. Train them—whether they are internal or hired with an eye toward training.
    • For non-critical, long-term needs, explore automation options. That includes both things that are being done manually today and things that are not being done at all. Find a way to get it done in the absence of hiring someone.

    And keep rocking it. You are already getting the job done—I’m just recommending ways to stay on top of it and deliver more while you try to find the additional people you need. A balance of automation and hiring will help you sleep at night and make the rest of the org certain that IT is on the ball.

  • Learning ‘The First Way’ of DevOps – Continuous Flow

    Learning ‘The First Way’ of DevOps – Continuous Flow

    Many organizations are struggling to realize well-engineered DevOps, even ‘the first way’ of DevOps – continuous flow.

    DevOps is an evolving body of knowledge. There is no one-stop shop that covers all roles and the complete range of skills required for DevOps. A DevOps-competent workforce requires an ongoing commitment to DevOps skills development and mastery. Enterprises must approach DevOps training strategically to leverage training resources to their best advantage.

    Learning Continuous Flow

    The first way of DevOps, continuous flow, is the foundation for DevOps.

    Why Is Learning Continuous Flow Important to Engineering DevOps?

    A knowledgeable, skilled workforce is needed to meet strategic objectives. Without a solid understanding of DevOps concepts and terminology, communication between people and teams is inefficient and a source of bottlenecks and misunderstandings. Developing hands-on skills for the tools and workflows is needed to understand and implement DevOps pipelines. There is an industry-wide shortage of skilled DevOps candidates. New skills foster innovation. Knowledge workers reduce production costs and reduce mistakes. Having skilled coworkers makes for a satisfying working environment. Employee retention is better. Competitive advantages are derived from knowledge.

    How Is Learning Continuous Flow Accomplished?

    The following are recommended engineering practices for learning continuous flow.

    People are encouraged to be continuous learners with an ongoing commitment to DevOps skills development. DevOps training is approached strategically to ensure DevOps training is well aligned to business goals. DevOps skills gap assessments are conducted and used to define and refine the training strategy. Leaders and cross-functional teams are encouraged to take DevOps fundamentals training. Leaders define a training strategy that best fits the needs and priorities of the organization to meet critical skills gaps.

    The training strategy considers which skills and roles can be covered by inexpensive self-study resources. Determine which skills and roles warrant more costly training. DevOps training has a distinct budget. Compliance to DevOps training programs are tracked. DevOps leadership training is offered to management and staff that have a role relevant to DevOps. DevOps tools training includes the recommended engineering practices for using each DevOps tool in the Service Catalog. Staff are encouraged and supported to take DevOps certifications that are relevant to their assigned roles.

    A DevOps training program is defined and includes a recommended curriculum for each role including leaders, developers, QA, Ops, and infrastructure and security staff that are operating in a DevOps environment. Recommended DevOps training resources are cataloged, and the catalog is visible for all stakeholders. Merit and recognition programs encourage employees to master DevOps skills.

    All staff is allocated time for DevOps training. DevOps mentoring programs supplement formal training. Job swapping and immersive training is encouraged and planned. People are encouraged to attend external conferences and meetups and share what they learn with other team members.

    What Is Needed to Implement Learning for Continuous Flow?

    The following are recommended engineering practices for implementing a learning program for continuous flow.
    Assign roles and responsibilities for DevOps training leadership (e.g., DevOps Sensei, Training PM, evangelist). Conduct a DevOps skills gap assessment. Define a training strategy that best addresses the gaps and fits the needs and priorities of the organization. Define a training budget that includes expenses and time allocations per role and skill.

    Determine which skills and roles can be covered by inexpensive self-study resources. Determine which skills and roles warrant more costly commercial training. Identify training goals for each role. Ensure job recruiting profiles match skill requirements for DevOps skills that are most relevant to the organization strategic goals. Put in place the means to make training resources visible and available. Set training goals for teams and individuals. Put in place incentives and recognition programs for completion of training.

    Some of the best sources of DevOps training resources are listed below:

    1. The DevOps Institute
    2. Partners of The DevOps Institute, such as Learning Tree International and Xellentro
    3. Udemy
    4. Recorded talks and publications available through IT Revolution
    5. Books such as my own Engineering DevOps, by Marc Hornbeek.

    What this Means

    Organizations need a trained workforce to succeed with DevOps—even ‘The First Way’ of DevOps—continuous flow. Organizations need to approach DevOps training strategically to leverage DevOps training resources to their best advantage. To learn more about my blueprint for learning all things DevOps, refer to my book Engineering DevOps.

  • Linux Foundation Exam for Certified IT Associates Available

    Linux Foundation Exam for Certified IT Associates Available

    A while back I wrote about an upcoming certification people receive from passing the Linux Foundation Exam. Now that it is available, I’m circling back as promised with more information.

    For those unfamiliar, this certification is specifically targeted at people who are newer to their IT career or just launching it. The goal is to offer an onramp for people to show their basic skills and demonstrate to potential employers their ability to get the job done or learn what is needed. It fits in well with their other offerings, giving Linux admins a path to use the foundation’s certifications to reflect progress in their career.

    I have information about the beta test, more information about what is stressed in the testing, and availability information, so let’s dive right in.

    First off, for those like me who have a friend that might benefit from using this test, it is available for purchase now and can be scheduled in January 2021.

    Who is the Linux Foundation Exam for?

    This exam is aimed at entry-level IT folks or those who are contemplating a move to DevOps. Though it is not targeted at help desk people aiming at systems admin jobs, it is suitable for them also. Its goal is to provide employers with proof of a minimum set of skills in IT basics, with (unsurprisingly) a strong emphasis on Linux. An interesting application that Lee Marer of Outcert, one of the Linux Foundation’s partners, pointed out to us was interest from K-12 and colleges—it could be a benefit to people who are recently out of school to already have something that shows they know their way around.

    Specifically, Lee thought the following groups would benefit from the test, and sees interest from these groups:

    • K-12/College: Already mentioned. A good way to offer practical benefit to coursework and offer prospective employers a hint at an inexperienced student’s capability.
    • Those moving to DevOps: Because a lot of DevOps is open source, a lot of DevOps depends upon Linux. This test shows those looking to move have the background required.
    • Those who are intimidated by the more advanced tests available from the Linux Foundation and others. My friend fits into this category. The amount of prep required to pass some tests is not on par with the practical knowledge they test for. This test offers a stepping stone that allows users to study the basics before being asked to advanced tasks such as (for an extreme example) parsing packets.
    • Employers: This exam proves a basic understanding of the topics covered, allowing employers to say “Must have passed this exam” in place of “Must have Doctorate and 15 years of experience.” (I joke, but it does offer employers a bar for help desk or entry-level DevOps.)

    What’s in the Linux Foundation Exam?

    Specifically, Dan Brown, senior manager, content and social media at the Linux Foundation, told us that the test would cover the following topics:

    • Linux Fundamentals (20%)
    • System Administration Fundamentals (20%)
    • Cloud Computing Fundamentals (20%)
    • Security Fundamentals (16%)
    • DevOps Fundamentals (16%)
    • Supporting Applications and Developers (8%)

    We had hoped to have a couple of sample questions for you, as an example of what to expect from the test and from those who took it. As of this writing, answers to those questions are not available. We’ll keep you posted.

    How Can I Take the Linux Foundation Exam?

    As mentioned above, it is available for purchase now (at a good price for an exam), and the scheduling of exams opens in January 2021.

    Tests are delivered remotely, with a live proctor and monitoring used to ensure it is an evaluation of the test taker’s knowledge, as opposed to the test taker’s ability to look up answers.

    This will be a point of contention, as it is in interviews and other exams. Simply put, the ability to look up what you don’t know and apply what you find to answer your questions/fix your problems is a critical skill at this point in IT. But for an entry-level test, I think that proving you have the basis to even understand what you are looking up is more important. So while I believe that unfettered internet access should be available during higher-level tests, for this test it makes perfect sense to me that monitoring will detect searches for answers.

    So Why Cover it Here?

    I think that this industry has developed a kind of psychosis. We talk about skills being more important than formal education and for entry-level positions, ability being at least as important as experience. Yet, job postings read like wish-lists. No, I don’t have five years’ experience in that three-year-old tech, thanks. The Linux Foundation Exam offers an avenue for organizations to demand basic competence without going crazy on a laundry list of items. For help-desk, for admin, for DevOps, this test would prove basic competency in a swath of Linux applications and utilities that would simplify the hiring process. I think we need that. I think we need that across the board, but starting with entry-level is good for me. Priced to be available to entry-level people, gauged to judge their basic knowledge, and from an authority on Linux, this might just be the answer at the bottom end of the scale.

    In fact, combining this test with a demonstrated ability to look up and comprehend answers would be all that is needed for most entry-level positions. Employers get assurance that they’re making the right hire, applicants don’t have to try and figure out which of those “requirements” is actually a requirement. Everyone wins. But only if we’re talking about it. So I’m talking about it, to people who’ve laughed at job postings before and know something like this could help: You. Keep kicking it, and consider this another tool to get co-workers who can kick it, too.

  • Two-Part Training Required for Developers to Slay the Security Beast

    Two-Part Training Required for Developers to Slay the Security Beast

    Developers’ defensive qualities are only as good as the training they receive

    The playing field between the heroes and villains in cybersecurity is notoriously unfair. Sensitive data is the new gold, and attackers adapt quickly to circumvent defenses, exploiting security bugs large and small for potential paydirt.

    The volume of code being produced is too great for security experts—who are becoming increasingly scarce—to contend with, and the rising cost of data breaches is proof that something has got to give. Fortunately, for the sake of our digital safety and the sanity of CISOs everywhere, the DevSecOps movement is helping to bring developers on the security journey from the beginning of the software development process. They are being recognized as the first line of defense against cyberattackers, with the power to eliminate common vulnerabilities at their fingertips.

    However, their defensive capabilities are only as good as the training they receive, and that is yet another gauntlet for security teams to run. For many developers receiving on-the-job training in secure coding, their key challenge is staying awake during mind-numbing, hands-off activities that are neither effective nor inspiring them to keep security front of mind. Soulless video courses aren’t getting us there, token annual ‘tick-the-box’ events are a waste of time, and nobody is winning against the potential malicious threat actor waiting to jump on a small window of opportunity.

    At this stage in our industry, we have worked out that contextual, hands-on education that is delivered in relevant programming languages and frameworks, with challenges that mimic those a developer might come across in the real world, is a far more engaging approach.

    This is phase one of a developer’s quest to help AppSec gurus slay common vulnerabilities, but phase two is where scenarios must get real for a supercharged, security-aware defensive force.

    Scaffolded Learning Is Critical in Adult Education

    When it comes to extracurricular courses or on-the-job training, it is often overlooked that adults bring with them a certain level of experience and existing knowledge. Good training adds to this foundation and is structured in a way that allows for deeper understanding and faster autonomy in the learning process.

    Scaffolded education is a potent, positive method of learning that seeks to activate and enhance prior experience while continuing to build new skills—in manageable chunks—that allow the learner to tackle increasingly difficult tasks with more confidence. Typically, it is a methodology best served with healthy portions of demonstration, visual aids and student-led exploration.

    If we tie this approach back to developer security training, it comes as no surprise that the dynamic, learn-by-doing method has long been preferred over the drudgery that is theory-based static learning. They are free to be the masters of their domain and should see that their time is being well-spent.

    In that sense, learning to code securely in a hyper-relevant, contextual environment is key, but the ‘level up’ from this step is to see an exploit of vulnerable code in action. With the context of front-end and back-end views side-by-side, there is a tangible link between actions taken during the coding process and what an attacker can potentially do with cut corners, misconfigurations or accidents that are not caught and remedied.

    Move From Recall to Application for a Truly Preventative Security Approach

    Experiencing the impact of security vulnerabilities firsthand is a vital piece of the education puzzle, and it’s a fairly rare beast, even with the most modern security training options for developers. The foundational work spent on honing skills in spotting and remediating vulnerabilities and recalling that experience to eliminate the same bugs in code as it is being written is extremely important, but it’s not the whole picture. Seeing how vulnerable code is exploited by a malicious actor adds a powerful layer of context, one that really drives home the importance of securing code and applying hard-earned security knowledge to close every window of opportunity.

    It is generally accepted that developers don’t love security, and they have even less affection for security training. Their experiences with AppSec specialists can be very frosty, and the rework caused by the security team bouncing vulnerable code back to developers for remediation is the bane of their existence. To an engineering team that is already spread thin, security is someone else’s problem, not their priority, and a hindrance to their natural creativity and primary objective of building features. However, there is simply too much code, too many breaches and too much risk to the world’s data for this mindset to continue.

    A functional DevSecOps process has developers working in harmony with security teams right at the beginning of the software delivery life cycle (SDLC). Likewise, the opportunity for applied learning, where they can interact with a simulated exploit and see the impact of poorly secured code, goes a long way in getting developers on the same page as those pesky AppSec people (who aren’t so bad after all).

    Interactive Learning Prepares Developers for the Boss Fight

    At the time of writing, there were two major breaches reported in a seven-day period: Razer announced that more than 100,000 sensitive data records had been exposed, while office supplies retailer Staples also reported a similar data leak. More than a billion sensitive records have been exposed so far in 2020, and this worrying trend shows no signs of slowing down. Simply put, malicious actors have the upper hand and security-aware developers are sorely needed to serve as the front line of defense.

    Interactive challenges that focus on simulating such breaches move developers from passive recall, to applying skills that have an impact on the real boss fight: stopping attackers in their tracks.

  • Linux Foundation Adds Entry-Level Certification

    Linux Foundation Adds Entry-Level Certification

    The Linux Foundation has announced the development of a new entry-level certification exam to complement their existing Linux Foundation Certified Sysadmin (LFCS) and Linux Foundation Certified Engineer (LFCE) exams. This new certification, the Linux Foundation Certified IT Associate (LFCA), targets people just moving into systems administration.

    The certification will focus on the test taker’s knowledge of the fundamentals of system administration. We are in a complex world with a lot of systems administration options, and the LFCA intends to touch a little bit on each of the areas a new admin might run into. The test is still in development, but the areas that The Linux Foundation intends to focus on include:

    • Linux Fundamentals
    • System Administration Fundamentals
    • Cloud Computing Fundamentals
    • Security Fundamentals
    • DevOps Fundamentals
    • Supporting Applications and Developers

    The categories will be complementary, with Linux Fundamentals including user and password management, for example, but security going more in-depth on that particular topic.

    In keeping with being accessible for people with entry-level knowledge of the above areas, this certification will be a single exam. That means a user need not wade through dozens of courses and exams to get started in their chosen area of specialty, and the other two certifications are available when the user is ready to move beyond the basics.

    Currently, The Linux Foundation has the following learning path for these exams:

        Introduction to Linux (LFS101) Training
        Essentials of Linux System Administration (LFS201) Training
        Linux Foundation Certified System Administrator (LFCS) Certification
        Linux Networking and Administration (LFS211) Training
        Linux Foundation Certified Engineer (LFCE) Certification
        Linux Security Fundamentals (LFS216) Training

    The LFCA is designed to fit between “Introduction to Linux” and “Essentials of Linux System Administration” to make a pairing of courses and certification exams to carry a system administrator through their career.

    In the midst of business closings and social distancing both increasing the amount of working from home that knowledge workers are involved in, on-site proctored examinations have suffered. This is unfortunate, as there is a spike in the number of people looking to improve their position through certification.

    Since its first exam, the Linux Foundation has offered online exams through a partnership with a proctoring organization. The approach is simple: Webcam, screen-sharing and chat are available to the proctor to monitor the test taker’s activities. Further, the entire session is recorded, so any misunderstandings can be reviewed. The fact that remote proctoring is standard for The Linux Foundation and the organization has been doing it for years hopefully means that proctoring is unobtrusive, and the test-taker can generally just take their test with minimum technical issues.

    The rush to remote proctored testing has created problems for some organizations; having had years to work it out should mean this is not a problem for The Linux Foundation in general and LFCA specifically.

    So if you have friends/coworkers interested in moving in this direction but are unable or unwilling to work through four years of university to get started, point them toward the LFCA. There are a lot of options, but the LFCA has less overhead than many of the other options and will help them settle on whether they are ready to pursue their dream.

    We’ll circle back and do a more in-depth look when the certification is released because there are two parts to a certification—who it benefits and what prospective employers think. We’ll be interested in seeing how this fits with employers’ needs, and to delve into sample questions when they are available.