devopsy.kinsta.cloud

Tag: work from home

  • Report: As WFH Took Hold, Few Adjusted Their Security Posture

    Report: As WFH Took Hold, Few Adjusted Their Security Posture

    In March of this year, how employees worked (if they were fortunate enough to be able to continue to work), changed dramatically following state-led shelter-in-place orders. At first, it was hoped the shift would be a matter of weeks. But as the pandemic continued and weeks stretched to months—and now with more organizations extending their work-from-home (WFH) policies well into 2021, there’s currently no real end in sight.

    What’s the impact of WFH been on security? Security firm Malwarebytes recently completed a report, “Enduring from Home: COVID-19’s Impact on Business Security,” that looks at precisely this issue. The report examines Malwarebytes’ malware data and a survey of 200 technology and information security decision-makers among large and small organizations.

    The survey found that organizations are confident in their ability to transition to an increasingly remote workforce successfully. Essentially, 73% rated their organization as a high or higher in their WFH preparedness. For those organizations with fewer than 700 staffers, 84% said they moved more than half of their employees to remote work. However, 84% of larger organizations, those with 700 employees or more, said they’d moved almost all their workforce home.

    Disappointingly, despite the profound changes to staff working situations, 45% of those surveyed did not conduct either security or online privacy analyses of their software tools.

    Since the beginning of the pandemic, 20% of respondents said they witnessed security breaches as a result of a remote worker, and 24% said remote worker security breaches created unexpected security expenses. Further, 28% said that they now use personal devices for work more than they did previously, and 61% of those surveyed said that their employers didn’t recommend staff install anti-malware on their personal endpoints.

    Not surprisingly, criminals are adapting to the new worker landscape, adjusting techniques to target poorly configured virtual private networks, cloud services and email. “There has also been a surge in phishing emails that use COVID-19 as a lure to cover up malicious activity. These emails contain commercial malware, such as AveMaria and NetWiredRC, which allow for remote desktop access, webcam control, password theft and more,” Malwarebytes said in a statement.

    The study also found that AveMaria malware increased by more than 1,200% from January to April. This malware targeted primarily large enterprises, the company found. In contrast, Malwarebytes detected a near-doubling in infections from NetWiredRC, which targets small and medium-sized organizations.

    What’s most concerning with these findings isn’t that criminals have shifted tactics due to a change in how staffers work; that’s to be expected and enterprises don’t have control over what attackers will do. But enterprises do have control over how they defend themselves. And as enterprises increasingly turned to cloud and collaboration platforms to make their WFH situations work, they should have updated their threat models to reflect the new reality. As this new reality continues, one can hope organizations better evaluate their current environments and adjust their security posture accordingly.

  • The IT Admin’s Checklist for a Newly Remote Company

    The IT Admin’s Checklist for a Newly Remote Company

    A few simple tips can help keep your remote workers productive and relatively stress-free during the new WFH paradigm

    Months into adjusting to COVID-19 impacts, organizations are now living in the day-to-day that was built on—let’s be honest—somewhat rushed plans to get everyone remote as quickly as possible. The image of repairing a bus while the bus is also driving its normal route comes to mind. Quick reactivity like this is vital in the moment, but it can be easy to miss a step along the way.

    Of course, IT is central to business continuity. This has only been made more true when so much of remote work relies on technology. Now is the time to make sure that your organization is truly set up to excel in remote conditions.

    But the mission for IT teams can’t just be to remain operational in the short term. We’ve got to look ahead and chart a course for long-term success: processes, tools, security measures and automation. We must ask, as IT admins, how can we help our teams thrive in this pivotal moment as well as the next?

    We’ve broken down the steps IT admins can take to ultimately set their entire team up for success as we all adjust to remote work.

    How an IT Admin Can Support Remote Work

    Step 1: Safety First

    With changes in every part of their life, your workforce is focused on one thing first: their personal safety and that of their loved ones.

    If you haven’t already shifted as much of your team as possible to a work-from-home model, now is better than never. This demonstrates to your people that you care about them and trust them, which is foundational for getting amazing work done.

    For organizations that are already remote, now is the time to dot the I in information and cross the T in technology. Do your due diligence as an IT team to ensure you have taken all of the necessary steps to make remote work a sustainable practice. Fortunately, you’re in just the right spot for that—just keep reading!

    Step 1.5: Professional Safety, Too

    Safety also encompasses job security. People fear for themselves and their families in this tumultuous time. Economic downturn brings anxiety, period. Even when your company has prioritized personal safety by going remote, there can still be uncertainty in whether someone’s paycheck is safe.

    You might not realize it, but as IT professionals, you have influence over job anxiety within your organization. Every time a tool or system functions perfectly, you’ve made what could have been a stressful day that much better. Simply put, you let people focus on their jobs instead of technology.

    Take pride in this! Give your team members comfort that you are going to make it as easy as possible for them to take care of their responsibilities. You’ll ensure that they have the tools and systems to succeed to help them retain their jobs. People who can focus on their jobs instead of stressing about tools are more able to make a big impact.

    Step 2: Make Remote Work Happen for Your Team

    Once safety is covered, it’s about the technology—hardware and software. There’s good news here: According to Buffer’s “2020 State of Remote Work,” 98% of employees would like to work remotely at least some of the time. That means that what we’re all going through to support the necessity of remote work now will hopefully set up organizations for higher employee satisfaction in the future.

    Whether you’re still in the process of streamlining remote work or you had to rush the process, let’s start at the beginning. You’ll need to ensure that everybody has systems that they can take home with them. If everyone doesn’t have a laptop, create a sign-out process for their desktop machines and any other equipment that they may need. (Psst … You can do this retroactively if your organization already let folks take technology home without a formal process.)

    In the beginning, it may have seemed like we could get through this time with the bare minimum, but making employees work harder because of a lack of resources simply won’t benefit the bottom line. It’s not too late to set up your team’s homes with high-quality monitors, printers, other peripherals and even chairs and desks, if necessary.

    Pro tip: Educate your team on how to adjust their screen resolutions, if that’s a feature on their computer. It’s not something the average computer user knows to do, but it can eliminate the need for a larger monitor and save a few headaches (literally!).

    Step 3: Provide Access to IT Resources

    The next tick on the checklist is to ensure that everybody knows how to access their IT resources. For better or worse, no one is walking over to your desk to ask how to login to their email anymore. (Actually, that’s almost certainly for the better.) Now is the time for education and self-serve training to benefit the entire team while we’re working away from the office.

    If your organization is accustomed to a mobile environment, your users should know how to VPN into the network or securely access applications in the data center or elsewhere. If not, now is the time to teach them.

    As with all times of change, there will be (and probably have already been) many questions. Tighten your process for accepting requests and answering questions. Survey the rest of the IT team for gaps and pain points that have come up in the initial months to ensure you can efficiently continue to support the adjustment period.

    And, most importantly, take the time to document all of the pathways for people to be productive and do their work. Regardless of your company’s familiarity, this will enable better training going forward and give you resources to use when colleagues have questions.

    Step 4: Manage the IT Fleet

    Now that your team is generally enabled to do their work, you need to ensure that you have visibility into the entire environment. Ask yourself these important questions:

    • Do you know all of the IT resources in use across your organization?
    • Do you have full control over access to all IT resources?
    • What about full control over their systems to ensure that you can fix issues, maintain security and configure and control their computer environment properly?

    Insight into these mission-critical questions doesn’t always come easy, but it enables your IT team to manage, control and secure all systems. It’s also foundational to being compliant with regulations and company security policies (which don’t stop, even when the whole world does).

    If any of the above questions gave you pause, we probably don’t have to tell you that something needs to change. Rogue IT resources threaten the organization legally and can be a financial drain—but the solution can be as simple as one tool to manage the whole suite. More on that later.

    Step 5: Secure Your Now-Dispersed Environment

    A key part of gaining control is securing the environment without making security the bane of your team’s existence.

    Security isn’t a new imperative, so let’s revisit the six core activities we recommend here:

    1. Enforce unique access and segment resources.
    2. Lock down computers and servers.
    3. Enable multi-factor authentication (MFA).
    4. Implement full disk encryption (FDE).
    5. Enforce password complexity and MFA.
    6. Conduct regular security awareness training.

    Don’t forget to train your team and provide strong guidance on how you would like them to operate to ensure security. Make compliance a team effort by explaining the why behind all of your security guidance to make it more tangible for people.

    Can Your Technology Support Remote Work?

    Your management tools will largely define your ability to operate securely. The right tool will make something essential like MFA seamless, ensuring end user security without adding friction to anyone’s day. If you’re not happy with your current system, now’s a great time to do the research to find one that makes everyone happy, from IT to the end users.

    Of course, the exact features you’ll prioritize in your search will depend on your specific organization. To get you started here’s a list of the basics of what you should expect your IT management tool to do for you in this remote work period:

    • Compliance-focused security. Look for password complexity management, multi-factor authentication (MFA), policy management, and SSH key authentication, plus whatever’s important for your individual organization’s priorities.
    • Easy integration with all of your current tools. Does your team use both G Suite and Microsoft 365? A good management tool shouldn’t make you pick.
    • A streamlined database that centralizes the IT environment. When all users and IT resources are integrated into a directory service, IT admins gain a controlled, automated environment.
    • Provides easy-to-use single sign-on (SSO) to web applications. Secure, convenient application access is essential and made simple with SSO.
    • Built to optimize your team’s productivity. Technology is only as important as the people who wield it. Choose technology that is intuitive and built with humans in mind.

    Final Thoughts

    While we may not have much certainty right now, one thing is for sure: Success largely will be built from home in the coming months and perhaps years. Being productive while also creating a healthy WFH culture is paramount, and IT teams have a huge role in accomplishing this task.

    The steps we’ve reviewed above are an effective way to help your team feel safe physically and be able to succeed at their jobs. Here they are again, a bit more boiled down:

    1. Prioritize employee safety.
    2. Support teams with the tools they need.
    3. Provide seamless, managed access to IT resources.
    4. Maintain and, if possible, increase security.

    Besides the supporting technology, the most important thing for these steps to be successful is the IT professionals guiding them! Remember how positive your impact can be during this stressful time and set your sights on not just reacting to this moment but proactively preparing your team for any remote working circumstance.

    Recommended for you: Want more on how to be your team’s IT key to successful remote work? For the A-Z handbook that covers everything from password policies to directory integration, download the IT Admin’s full guide to working at home here.

  • Has the Pandemic Made DevOps Tougher or Easier?

    Has the Pandemic Made DevOps Tougher or Easier?

    How has COVID-19 impacted the way DevOps professionals approach their work?

    The current, unpredictable economic climate as a result of the global COVID-19 pandemic has exposed a glaring need for organizations to be able to do more with less. They have fewer resources and even less margin of error now to maintain customer relationships, keep up the pace of innovation and stay ahead of competitors. This global crisis has shifted more end users toward digital services, increasing the pressure further on organizations to deliver robust digital services to both their customers and employees. Meeting that need in a short amount of time is, suffice it to say, extremely challenging.

    All of this has shaken up norms for DevOps professionals and created an even greater need to accelerate continuous automation, break down silos between teams and cultivate greater cross-team collaboration, to help their organizations continue business as usual—in other words, a greater need for DevOps, period.

    Let’s take a look at how today’s new normal has in some ways made DevOps transformations easier and more widely accepted, and in other ways made DevOps more complicated—and what leadership can do about it.

    Improved Trust and Collaboration Among IT Teams

    Trust and collaboration form the base of true DevOps cultures. Anything an organization can do to make collaborating easier and eliminate unfair advantages between teams makes DevOps easier to facilitate. If half your team is working in the office and half is working remotely, that is not an even playing field; there are advantages to sharing an office and being able to communicate in-person that those who work remotely don’t have.

    It’s also a matter of trust. Trust is not always assumed for employees working remotely. People in the office might feel skeptical that those at home just aren’t working as hard as they are. The advantage of everyone having to work remotely for the last several months is that we’re now all on a level playing field; we’ve all been in the same work-from-home boat. That has eliminated unfair advantages and helped boost trust among team members.

    The more you trust each other, the easier it is to collaborate and delegate work, which removes some of the typical hurdles for DevOps projects.

    Increased Use of Automation

    Alongside trust and collaboration, automation is another key pillar of DevOps. In the past, teams may have been skeptical about automating their work, figuring it was just easier to do it themselves.

    But, the massive spike in demand for IT services this year put a lot of pressure on traditional IT teams to get services up and running, provision machines and troubleshoot access problems, among other things. The only way to scale up to meet these demands without being overworked was to adopt continuous automation.

    Now automation skeptics have seen for themselves the value of automating tasks to make work more manageable during unexpected digital activity peaks.

    Growing DevOps Skills Gaps Around Automation, Kubernetes

    The good news is, DevOps projects have been excelling in the new normal thanks to these accelerations in collaboration, trust and automation. But the flip side of more automation is a greater need to pick up new skills for making automation work.

    Those working remotely without kids to look after might find more free time to spend on leveling up their automation skills, such as learning Python and other new script languages. But those who have to pull double-duty between their own job and other household tasks demanding immediate attention—such as homeschooling and looking after young children—might be less likely to have that opportunity. This could put many people at a long-term disadvantage as skills gaps continue to grow around automation. We may be looking at the possibility of certain demographics of employees (i.e. those who aren’t currently raising families or school-aged children) having more access to skills and educational opportunities than those who do.

    This is also an issue with Kubernetes. Enterprise adoption of Kubernetes is growing rapidly as the container platform of choice for managing dynamic multi-cloud environments. But adoption is moving so quickly that even the teams who work with Kubernetes can find themselves behind the curve before they know it. This Kubernetes education gap is getting bigger every day, and the people who may have time now to keep themselves informed about Kubernetes will be at a greater advantage than those who just don’t have the time for after-work training.

    The Role for DevOps Leaders in This Moment

    For all the instability going on today, DevOps projects seem to generally be in a good spot, thanks to growing trust and collaboration between teams and a greater acceptance of the need for continuous automation. But as we start returning to normalcy and heading back to the office, leaders must not allow their teams to lapse back into old habits.

    Leadership will need to come up with new rules of engagement for working in the office to eliminate unfair advantages that used to exist. For example, at my company, we’ve established that once offices are fully reopened, meetings will only be held in-person if everyone invited is present. If one person invited to the meeting is remote, then everyone will join remotely. Organizations should look to adopt similar rules, as the transition from working virtually to in-office is going to be a long and challenging one, with not everyone returning all at once.

    In addition, organizations and leadership teams need to dedicate more official work time to training and educating employees on new tech such as automation and Kubernetes to even the playing field, develop more highly skilled teams and close these skills gaps. Team leaders must ensure that everyone is on the same page and that it’s not just those who had the most free time while quarantining who are coming out ahead.

    The behaviors we’ve picked up during social distancing—new opportunities for continuous learning, wider adoption of automation, elimination of unfair advantages for remote workers—are making DevOps better. But these are practices we have to continue carrying forward in the new normal and beyond.

  • DevOps Chats: Easing WFH with strongDM

    DevOps Chats: Easing WFH with strongDM

    strongDM wasn’t founded to help with remote workers forced out of the office by COVID-19. They have been around for five years now. But, the company does excel at allowing you to manage and audit remote access to all of your assets including DBs, servers and clusters (as well as apps and services) anywhere from anywhere.

    In this DevOps Chat we speak with strongDM Justin McCarthy, CTO and co-founder about how the company’s technology works and how it is helping companies move to remote access given current conditions.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    Transcript

    Alan Shimel: Hey, everyone, this is Alan Shimel, and you’re listening to another DevOps Chat.

    Really happy to be joined on this chat by Justin McCarthy of strongDM. Hey, Justin, welcome to DevOps Chat.

    Justin McCarthy: Hey, Alan — thanks.

    Shimel: Pleasure to have you on here, Justin. You know, as we were talking a little bit off mic, I don’t know if we’ve introduced our MediaOps community, meaning DevOps and Security Boulevard and Container Journal, we haven’t introduced strongDM to them before. So, why don’t we start with that, Justin, and if you wouldn’t mind, in telling the story, talk about a little bit about your own personal journey.

    McCarthy: Yeah, sure thing. Alright, so, first, I guess I’ll just briefly introduce myself. So, I’m the co-founder and CTO of strongDM. And the product is actually, strongDM itself is the best way to manage and audit remote access to your servers and databases and really even Kubernetes clusters. So, that’s what we focus on. We are a remote access product.

    And the way we came to it is basically just a sort of typical startup story. We’ve been around for five years now, and at the beginning, it was scratching an itch just like so many other infrastructure and DevOps products out there. So, in my career, I’d always been involved in growing the teams that built the product and, inevitably, when you build a product and when you ship and when you have production data, you need to grant access to it. To analyze it, you need to grant access to it to administer it, to debug it.

    And that process always felt a little bit somewhere between inconvenient and scary, right? [Laughter] And so, basically, strongDM — yeah, is the response to all those feelings of, that it wasn’t quite as smooth as it could be, it wasn’t quite as safe as it could be.

    Shimel: Excellent, excellent. And you mentioned the company’s around now about five years.

    McCarthy: Mm-hmm.

    Shimel: That’s cool. Alright, let’s talk about — and you’re right, a lot of companies do grow out of one particular scratch to itch, and I’ve done my share of startups over the last 25 years. And what generally happens is, you find out that that particular itch may have associated itches, right, and there’s ancillary things — well, once I scratch that itch, the next itch pops up, right? To paraphrase “The Phoenix Project” or something and bottlenecks and the goal.

    Talk to us—what’s the itch, and then what have you guys found over the five years about kinda getting to that itch and associated itches?

    McCarthy: Yeah, yeah, definitely. So, at the core, the technical approach that it probably takes is that we are an identity-ware proxy, okay? And the first application of that was for database access. So, that’s where we started, right?

    Shimel: Mm-hmm.

    McCarthy: And in fact, at the beginning of time, we thought maybe that was all there was to it. But as we —

    Shimel: Hold on a second, though.

    McCarthy: Yeah, sure.

    Shimel: So, an identity-ware proxy, primarily for databases. For some of our audiences — our security … actually, our DevOps audience probably gets that, some of our security folks do. But break it down for me, Justin — what exactly do you mean by that?

    McCarthy: Sure thing. So, this is an architecture that I think a lot of folks might know as Zero Trust, a lot of folks might know as BeyondCorp, and there were a lot of examples of it out there in sort of an HTTP only case. When we originally conceived of and built the product, it was kind of even prior to a lot of that nomenclature existing.

    So, what an identity-ware proxy is, it is a proxy for a given type of service. Let’s continue to use databases as the example. So, if somebody needs to interact with a Postgres database or a Microsoft SQL Server database — so, let’s say Alan needs to connect your local copy of Tableau to one of those systems, right? So, Alan would log into strongDM and then strongDM would then conduct all of the traffic, essentially, forward it to the target systems. And the identity-ware aspect is that, essentially, we know it’s Alan the whole time and we’re proxying that traffic and we’re handling, essentially, all of the routing of that traffic.

    Shimel: Got it.

    McCarthy: And what’s interesting about that is that you kind of get a lot of the sort of — you get a separation of sort of Alan’s identity from, you know, the credentialing of the underlying system. So, you can actually credential that separately, which means you can rotate the underlying credentials without bothering Alan.

    Shimel: Now, in and of itself, can that be a security kinda setting up kinda almost a man in the middle type of situation?

    McCarthy: Yeah, so, in a lot of enterprises and environments, you at some point, you have to answer the question, how are we gonna audit this particular traffic stream, right? And so, there are also a lot of products out there that are dedicated to, for example, breaking TLS, right? Being the official man in the middle, right?

    Shimel: Yep.

    McCarthy: So, our product has an element of that built in, although it’s not a generic TLS breaker. What it is, is it’s a protocol specific way to answer the question, you know, given MySQL database selection, what would you want to know about what Alan did yesterday? And so, our product is focused on extracting that kind of rich information about what Alan did yesterday with respect to this MySQL connection.

    Shimel: Sure — great, great. Now, what made databases sort of, you know, the prime example of where to use this or as the first use case?

    McCarthy: Yeah, it was the first use case, largely because, again, we were scratching our own itch. [Laughter] So, that was the one that I most often encountered.

    Shimel: Okay.

    McCarthy: You know, and the appeal is, it’s phrased as, you know, “Can I please have access to this because I need to debug X?” Right? And that always, whoever is saying yes or maybe or no to that request, you know, there’s a lot of hope and trust that when you say yes it’s gonna be okay. So, what our product does is, it takes all that, the sort of emotions around that event [Laughter] and tries to give you an answer for how you make that convenient and how you make that safe for everyone.

    Shimel: Excellent, man — good. Alright. So, first ditch is the database and we figure that out and go from there, Justin.

    McCarthy: Sure. So, as I’m sure, as you found with many products, you know, why adopt 10 different products when you can get your existing vendor to do one more thing for you and then maybe reduce and concentrate more of your attention on one tool and so, that’s where our customers pushed us. And so, the next very strong demand that we saw was, now that all of our data systems are granted and revoked access through strongDM, could you also begin to do some of the interactive session and shell-based protocols? So, the first two there were obviously SSH and Windows Remote Desktop. So, that’s where we went next.

    And the theme, if you can sort of imagine it is, you know, everyone in my organization that maybe has engineer in their title or even analyst or scientist — essentially, all of those folks, they need more than just webpages to do their job, right?

    Shimel: They do.

    McCarthy: And so, if it were just webpages, then existing single sign-on would work great, right? But since it’s more than that, it’s deeper than that, it’s really that whole collection of use cases that our customers began asking us to take on.

    Shimel: Excellent. Good stuff. And so, let’s talk a little bit about — so, how, is this sort of distributed as a SaaS kind of thing or a web-based kinda interface? How does that work?

    McCarthy: Sure, yeah. I would say we are neither traditional SaaS, nor traditional on prem. So, in terms of how the product deploys, our customers end up running a bunch of it, but not all of it. So, with any system that involves credentials, any system that involves cryptography, operating it successfully and carefully is actually a huge part of getting it right, okay?

    Shimel: Mm-hmm.

    McCarthy: So, what we’ve tried to do is, we’ve tried to unify the sort of operation configuration. So, if you think of it like centralizing the policies, centralizing the key management.

    Shimel: Yeah.

    McCarthy: So, that’s the part that we host. But the part that actually runs the proxies and therefore essentially the actual conduits for all the data, that runs entirely in customer environments.

    Shimel: And what kind of environment are you talking about?

    McCarthy: Yeah, so, I would say our average customer, the answer is, like, several. [Laughter] So, there are very few environments where you have just one cloud, where you have just one prem data center. So, it ends up actually being several. And so, that’s another strength of our architecture and our approach is that our product, from day zero, was designed with that in mind, so you can run our proxies in Azure and in AWS and in your existing legacy data center. They all unify into one sort of access plane, and it doesn’t matter the product. The same grant access gesture applies to all of those environments.

    Shimel: Oh, okay. Very cool. Very cool. And, you know, from what you’re describing, to me, it doesn’t really make a difference whether I’m a cloud native company, let’s call it, right, or maybe an old line company that had my database running in the closet, right? This kind of identity by proxy is still something I can utilize to make my life easier.

    McCarthy: Yeah, absolutely. And of course, we would hope that it’s especially suited to a hybrid environment like that, because the ability to, from an end user point of view, from one of your data scientists, they just know the three logical things they need to access to do their job. They definitely don’t care what cloud it’s hosted in. They don’t care what data center it’s hosted in, but from the point of view of that end user, it just looks like one thing.

    Shimel: Okay. Now, let’s look at it from the lens of COVID, which we kinda always have to look at everything today through this lens — it seems like this would be a help, right, if I just had to move my whole workforce home, you know, remote. What have you guys been seeing on that?

    McCarthy: Yeah, I think our story there is pretty similar to what a lot of companies that are part of the sort of next generation of IT and — we’re sort of seeing the same trend that everybody else, more people moving remove, therefore any remote access products are, there’s a lot more interest at the moment.

    So, we were always about granting access remotely. It was always a workforce that was going to be distributed. That was our typical customer, anyway. So, it’s definitely the same theme, but just more than we were seeing pre-COVID.

    Shimel: Excellent, man. Now, one thing — it’s funny, I just had a conversation with another company within the IDM space, kind of in like an ED directory service, let’s call it, and this popped up. With the people working from home, with the explosion of how many apps and SaaS services, you know, we’re all accessing right now, it’s great to be able to have just a single proxy, if you will. So, I only have to worry about really going once and then on the back end, it connects to all of these services, let’s call them, or apps.

    And so, from my point of view, that’s a great thing. From your point of view, Justin, right, now you’ve gotta hook into all of these different, new apps and services. How do you do that? Is that via API? Is it a one-off for every one you’ve gotta go into? You know, what’s involved there if I bring you — you know, some app you guys haven’t encountered before?

    McCarthy: Yep, sure. So, I do, there is an important distinction here. There’s a generation and a category of products that you might call them cloud brokers, right? So, cloud access security brokers, that category where you have a workforce that needs to access Salesforce, needs to access another SaaS application. We consider that sort of part of the market to be something that’s necessary but not our specialty.

    Shimel: Not your place.

    McCarthy: Yeah. So, our specialty is, again, it’s that staff where there’s probably an engineer or somehow technical, there’s a technical name in their role somewhere, and they need access to things that aren’t webpages. And so, for that, the procedure is — hey, I’ve got this maybe let’s say even legacy database or I’ve got this type of terminal access that we do that, let’s say we’ve got a lot of machines that are connected via VNC or something. So, and let’s say that’s not on our official supportive protocols list yet. It’s as simple as, we do an intake, we understand the protocol, we add it to the product — that’s it.

    Shimel: Okay. So, you guys do that. I don’t do that myself. I don’t have to kinda write to an API or something and make —

    McCarthy: Yeah, no, exactly. Any system that feels like any sort of client server access paradigm, we can model it in our, essentially in our platform, and then begin granting access to it.

    Shimel: Okay. Almost out of time, Justin. One more area I wanted to hit on this one, though, and that is — talk to me about what to set up here, right? Whether I’m doing it on the cloud, prem, a little of both — how big a job is it to get this thing up and running?

    McCarthy: Yeah. So, we also, of course, have the advantage of — like I said, we’re five years old, but that means we’re only five years old. [Laughter] So, we knew it had to be easy, right? Yeah.

    So, yeah, the act of deploying our proxies is essentially roughly turning it on. Because what then the proxies do is, they take over, for example, topics like discovery. So, they discover what host names they can access and they begin exposing it back to it in the administrative console. So, that’s the one aspect that, you know, deploying it is pretty much turning on the software.

    Additionally, because so many of our customers rely heavily on automation for their DevOps, another way to think of it is, if you already have, if you already have a great Terraform setup that you’re happy with, you have a great cloud formation setup that you’re happy with, we are gonna integrate natively with that setup as well. So, it’s going to be, you’re essentially the overlay, your proxy overlay on your existing infrastructure is gonna go in and it’s gonna feel exactly like anything else that you’re familiar with deploying via Terraform or inside your Kubernetes cluster, for example.

    Shimel: Perfect, man. All good stuff. Justin, I promised you we were gonna do 15 minutes, but I blew it — but not too bad. We’re not too bad. Well, we’re gonna have you back on. It’s gonna be a little bit of a continuing series, right? So, look forward to our next conversation.

    You know what I realized? We didn’t even mention the website, though. So, for people who want more information, it’s strongDM, S-T-R-O-N-G-D-M-dot com, right?

    McCarthy: Yep.

    Shimel: And then can get, if they wanna go check stuff out there. And we’ll have you back on real soon and continue this, man. Sounds great.

    McCarthy: Great. Alright, thanks a lot, Alan.

    Shimel: Alright. Justin McCarthy, CTO and co-founder of strongDM here on DevOps Chat. Hey, this is Alan Shimel, and you’ve just listened to another DevOps Chat.

  • How DevOps Can Save Your Business from COVID-19

    How DevOps Can Save Your Business from COVID-19

    COVID-19 drastically changed the landscape of the American workforce. Remote work went from something of a niche field to a way of life for millions of people. In fact, research shows that roughly half of all employed Americans began working from home as a result of the COVID-19 crisis. 

    While some employers struggle to adapt to this new way of life, others adapted quickly. Looking forward to the future, the ability to adapt in this way could mean life or death for many businesses. 

    It does not look like this trend will end once a vaccine is found for the disease. Many major companies, including Mondelez and Barclays, have said that working from home may become a permanent fixture of their business models. It is easy to see why. In such an advanced age of technology and communication, people can talk to each other over the phone or computer as easily as walking to someone’s desk. 

    Very soon, a business could utilize 1,000 home locations instead of just one. But all of this comes down to the abilities of IT departments nationwide.

    A recent report from GitHub came out focusing on new software development in the era of COVID-19. While there have inevitably been disruptions in numerous industries, IT professionals have more than met the challenge. The report’s author, Nicole Forsgren, was even quoted as saying, “Developers have continued to contribute and show resilience in the face of uncertainty.” So going into the future, what could be every organizational team’s best friend? 

    If you look at where the market is heading, then it certainly seems like DevOps is in for a massive boom. 

    The Resilience of DevOps

    The need for reliable software has only increased as more and more people attain smartphones and other essential pieces of technology. Five billion people now own mobile phones, which is going to result in speed problems across the globe. This is where DevOps steps in to pick up the pieces. 

    DevOps has the ability to sync, organize and automate the pace of new software releases. By design, it is made for remote operations. However, it also remains viable for operations that take place in the office or any other location. DevOps has the capability of adapting and changing along with the world around it. 

    In the era of COVID-19, that is an incredibly advantageous model as companies may want to work in an office building one week and from home the next. It is the software you need for the world you live in. 

    However, DevOps is only as good as the people utilizing it. It can be a challenge for individuals at companies, who already have so much on their plates, to adapt to the DevOps model. That is why the company has come out with the DevOps Institute. At this point, it just comes down to companies finding the right people who have the necessary technical prowess and soft skills to bring the benefits of DevOps to their workplaces. 

    According to data collected by DevOps, it certainly seems like many businesses face shortages of people skilled in information technology and other skills that could help them adapt to a more remote way of working. 

    The report shows that 48% of respondents were not entering the workforce with the skills needed to manage modern IT environments. Out of all of the people surveyed, only 28% said they believe new workers came in with essential skill sets. 

    These skills will only grow more vital as more businesses begin working from home. For example, the ability to communicate rapidly is essential when people are not in the same location. And it may not come down to human errors either. Faulty technology could result in people not seeing messages or emails on-time, delaying crucial projects. 

    The perfect DevOps engineer will be an individual who has the perfect balance of hard and soft skills. It is someone who knows how to correct a network error promptly but has the communication skills necessary to reach out when issues arise. The ideal DevOps engineer for a company is someone who understands how VPNs work inside and out but also communicates in a manner other people outside of the IT department can understand. 

    Additional Considerations for Implementing DevOps

    There are extra considerations that need to be brought to the table for companies interested in utilizing DevOps. For starters, people in a company need to get started pushing technology and DevOps toward the cloud. In a situation like the COVID-19 crisis, there is no clear timeline of when things will get back to normal. If your company is not already utilizing the cloud, then it is high time to get started. 

    Next, companies need to begin implementing automation as far as possible. Delays in communication can set back company timelines by weeks or even months. Plus, when people are aware, you are going to realize how much time is actually spent performing various tasks that could be done through software. 

    Instead of having a person check for malware, you can have everyone install malware scanners onto their computers so that their safety is being examined in the background as they focus on more important tasks. Detecting malware is only the beginning as businesses can also use automation to test functionalities and deploy to several environments simultaneously. 

    Lastly, as employers turn to DevOps to meet their companies’ obligations, it is critical to keep an eye on potential burnout. With more people working from home, they need to juggle work, family and other obligations in closer corners. 

    DevOps can be a huge lifesaver, but you want to make sure you give your employees sustainable workloads your team can handle. This time is also good to establish clear boundaries between people’s personal lives and work. It can be a good idea to set clear hours for when employees can communicate with each other. Outside of that time frame, it is important to let people relax and focus on other aspects of their lives. 

    Conclusion

    The COVID-19 crisis will pass, but the American workforce may never look the same. Many organizations may end up deciding there are more benefits to working from home than renting an office space. People will get through this, and DevOps will be there to lend a helping hand.

  • Work from Home: Changing Enterprise Risk and Careers

    Work from Home: Changing Enterprise Risk and Careers

    In recent weeks, there have been a slew of organizations announcing that their work from home policies will be extended through the end of the year such as is the case with Google and Facebook, or perhaps indefinitely such as Twitter and Square.

    It’s good news to many technology workers who, according to a recent CNBC|SurveyMonkey survey, prefer remote work (25%). Also, a recent survey, produced by Cybersecurity Insiders on behalf of Pulse Secure, found that 38% of U.S. companies experienced gains in productivity. In this survey, 84% of respondents believe they will institute broader and permanent work from home policies beyond the novel coronavirus crisis.

    What does the work from home policies mean for organizations going forward? When it comes to security and compliance, it means quite a bit. According to the Cybersecurity Insiders survey, 69% of respondents are concerned about work from home (WFH) risks, especially due to low user awareness training, poorly secured home and public WiFi networks, use of personal devices and sensitive data leakage.

    A full 78% of respondents expressed their desire to enforce the same level of security controls for remote users as they do for on-premises users. While 65% allow access from personal, unmanaged devices, two-thirds of security professionals anticipate malware, phishing, unauthorized user and device access, and unpatched/at-risk systems to be the most exploitable WFH attack vectors.

    “Sixty-three percent expressed that remote work could impact compliance mandates that apply to their organization; especially GDPR, PCI-DSS, HIPAA and those with data breach notification,” the report found.

    Interestingly, about three-fourths of those organizations surveyed said they have more than 76% of their employees working from up — that’s up from 25% in 2019. Still, a third of those surveyed said their organization is ill-prepared or not prepared to support remote working. Yet, 75% of businesses transitioned to remote working within 15 days.

    “Surprisingly, less than a third expressed cost or budget problems, demonstrating the urgency to support their business. Additionally, more than half (54%) expressed that COVID-19 has accelerated migration of users’ workflows and applications to the cloud,” stated the report.

    How are survey respondents securing their staff who work from home? The survey found the most common to be endpoint security, firewalls, virtual private networks and multi-factor authentication.

    The 2020 Remote Work-From-Home Cybersecurity Report is based on a survey of 413 security decision makers, conducted in May of this year, within multiple industries, including financial services, healthcare, manufacturing, high-tech, government and education.

    Interestingly, the work from home movement may also give a boost to the gig economy, as gig economy work moves from lower-paying taskwork to professional gig work. A recent report, How the Gig Economy is Reshaping Tech Careers and IT Itself, highlighted data that shows 72% of all gig projects were in large enterprise and professional services firms throughout 2018 and 2019, compared with 52% two years prior.

    “This rapid growth is spurred by workers’ interest in flexible careers as well as businesses’ interest in convenience and efficiency. There are signs that the gig economy is finding many adherents overseas as well,” stated the report.

    Whether or not the work from home movement is real or long-term is no longer the question, it’s for how long and how far the trend goes. Enterprise technology leaders had soon prepare for a much more remote and loosely connected workforce.

  • Report: Software Delivery Slowed During Pandemic

    Report: Software Delivery Slowed During Pandemic

    A survey of more than 500 IT and development professionals conducted by Atlassian finds two-thirds of respondents have slowed down the frequency of software delivery since the advent of the COVID-19 pandemic.

    Patrick Hill, head of reliability process at Atlassian, said while developers may be creating more code than ever while they work from home, IT operations teams working from home are struggling to keep pace.

    In fact, the survey finds more than half of respondents (51%) reported incident response times have been slower since they began working remotely. At the same time, there’s been a 73% increase in demand for the digital services being provided, the survey finds.

    It’s too early to say to what degree slowing down the application delivery process might be a byproduct of the “new normal.” It’s more likely that IT operations teams need more time to re-engineer processes to return to the software release levels typically achieved prior to the pandemic, said Hill.

    In many cases, IT teams may also need more time to shift toward cloud-based frameworks for managing application release cycles that can be accessed from anywhere. Hill said Atlassian has seen a significant increase in the use of its IT management platforms since March. New signups have increased by approximately 125%, he noted.

    It’s also unclear to what degree an application release backlog may be building inside organizations. While developers may be launching more projects, Hill said many of those projects may be only to address bug fixes. As such, it may not take that long for IT operations teams to recover from the disruption caused by the pandemic.

    Nevertheless, Hill said most organizations are still coming to terms with the human impact of the pandemic. Many organizations, for example, might not decide to bring IT teams back into the office at all. In fact, there may not be any office to return to—many organizations might conclude there is no need, especially if productivity levels have not declined substantially. No doubt many organizations consequently will be closely monitoring application release cycles in the weeks and months ahead to determine to what impact working from home is having on IT productivity.

    Of course, not every member of the IT team is cut out to work from home. While many IT professionals may be introverts by nature, there are also a great many distractions at home that adversely impact productivity. Conversely, some IT professionals might even discover they have begun to work longer hours.

    In the meantime, Hill said IT managers would be well-advised to focus more on outcomes than metrics. The amount of code being released in a given week is not likely to be as important as making sure the right code is being released at the right time. With more demand than ever for application services, the greater the need there is for DevOps teams to focus their efforts on the components of an application that make the most critical difference to the business.