staging-devopsy.kinsta.cloud

Category: Application Performance Management/Monitoring

  • AppSec in the Cloud: What DevOps Teams Should Know

    AppSec in the Cloud: What DevOps Teams Should Know

    Cloud application security refers to the measures and controls that are put in place to protect cloud-based applications and data from cyberthreats, unauthorized access and data breaches. These measures can include technical controls such as encryption, access controls and secure networks, as well as operational controls like policies and procedures for managing and securing data in the cloud.

    Cloud application security is important because it helps to ensure the confidentiality, integrity and availability of data and applications in the cloud. It is especially critical for organizations that store sensitive or regulated data in the cloud, as a security breach could have serious consequences for the organization and its customers.

    There are many different approaches to cloud application security, including the use of security protocols, identity and access management (IAM) systems and security information and event management (SIEM) tools. Some organizations may also choose to use cloud security platforms, which provide a range of security services and tools that can be used to protect cloud-based applications and data.

    How DevOps Secures the Cloud

    DevOps is a software development approach that aims to optimize the collaboration and communication between development and operations teams to deliver software more quickly and efficiently. It involves using automation, continuous integration and delivery and other tools and practices to streamline the software development process.

    Cloud security operations, or CloudSecOps, refers to the practices, processes and tools used to secure and manage cloud-based applications, systems and data. CloudSecOps is a key aspect of DevOps, as it helps to ensure that cloud-based applications and systems are secure and compliant, while also allowing for rapid deployment, scaling and management of applications in the cloud.

    There are several key ways that CloudSecOps can be implemented in the cloud as part of a DevOps approach:

    • Automated security testing: CloudSecOps can be implemented using automated security testing tools, which can be integrated into the CI/CD pipeline to continuously test and validate the security of code changes.
    • Identity and access management: CloudSecOps involves using identity and access management (IAM) systems to control and monitor access to cloud-based resources. These systems can be integrated into the DevOps process to ensure that access to cloud-based systems is properly managed and secured.
    • Security as Code: CloudSecOps can be implemented using security-as-code practices, which involve writing security policies and controls in code and integrating them into the CI/CD pipeline. This allows organizations to automatically enforce security controls as part of the software development process.

    4 Cloud Application Security Best Practices

    Understanding and Monitoring Dependencies in Cloud Applications

    Application dependency mapping is a technique that can be used to visualize and understand the dependencies between different components of a cloud application. This can help organizations identify and manage the risks associated with dependencies and ensure that all application components are up-to-date and secure.

    There are several key benefits to using application dependency mapping as a cloud application security best practice:

    • Improved visibility: Application dependency mapping provides a clear and comprehensive view of the dependencies between different components of the application, which can help organizations to better understand the risks associated with these dependencies.
    • Improved risk management: By understanding the dependencies between different application components, organizations can identify and prioritize the most critical dependencies and take steps to mitigate any associated risks.
    • Improved security: By regularly monitoring dependencies for updates and vulnerabilities, organizations can ensure that all application components are secure and up-to-date.
    • Improved compliance: By understanding and managing the dependencies between different application components, organizations can ensure that they meet compliance requirements for storing and processing data in the cloud.

    Cloud Database Security

    Cloud database security is a critical aspect of cloud application security, as it involves the measures and controls that are put in place to protect data stored in the cloud from cyberthreats, unauthorized access and data breaches. 

    Ensuring the security of cloud-based databases is important because these systems often store sensitive or regulated data. A security breach could have serious consequences for the organization and its customers.

    There are several key best practices for ensuring the security of cloud-based databases:

    • Encryption: Encrypting data at rest and in transit can help to protect against unauthorized access to data stored in the cloud.
    • Access controls: Implementing fine-grained access controls can help to ensure that only authorized users have access to data stored in the cloud.
    • Security monitoring: Monitoring for security events and anomalies can help to identify and respond to potential threats to data stored in the cloud.
    • Compliance: Ensuring that cloud-based databases meet compliance requirements for storing and processing data is an important best practice to protect against data breaches and ensure regulatory compliance.

    Apply Cloud Governance Policies

    Cloud governance refers to the practices, processes, and controls used to manage and govern the use of cloud-based resources and services. Some of the key ways that organizations can apply cloud governance policies to improve the security of their cloud-based systems include:

    • Establishing policies for access and use: Organizations can establish policies that define who has access to cloud-based resources and how they can be used. This can help to ensure that access to sensitive data and systems is properly controlled and monitored.
    • Implementing security controls: Organizations can implement security controls such as encryption, access controls and secure networks to protect data and systems in the cloud.
    • Ensuring compliance: Organizations can establish policies and procedures to meet compliance requirements for storing and processing data in the cloud.
    • Monitoring and auditing: Organizations can establish policies for monitoring and auditing the use of cloud-based resources to ensure that they are being used in accordance with established policies and procedures.

    Identify, Categorize and Protect Sensitive Data Stored in the Cloud

    Sensitive data refers to information that is highly confidential or regulated and that requires special protection to ensure its confidentiality, integrity, and availability. There are several key steps that organizations can take to identify, categorize and protect sensitive data stored in the cloud:

    1. Identify sensitive data: The first step is to identify the sensitive data stored in the cloud. This may include personal data, financial data, intellectual property and other types of sensitive information.
    2. Categorize sensitive data: Once the sensitive data has been identified, it is important to categorize it based on its level of sensitivity and the potential risks associated with it. This can help organizations to prioritize the protection of different types of sensitive data.
    3. Protect sensitive data: There are several different measures that organizations can take to protect sensitive data stored in the cloud, including encryption, access controls and secure networks. It is also important to implement policies and procedures to ensure that sensitive data is handled and processed securely.

    Conclusion

    In conclusion, application security in the cloud is a critical concern for DevOps teams, as it involves the measures and controls that are put in place to protect cloud-based applications and data from cyber threats, unauthorized access, and data breaches. 

    To ensure the security of their cloud-based systems, DevOps teams should implement a range of best practices, including understanding and monitoring dependencies, implementing security controls, managing identities and access, and ensuring compliance. By following these best practices, DevOps teams can help to ensure the security and integrity of their cloud-based systems and protect against potential threats.

  • Broadcom Survey Reveals Spike in VSM Adoption

    Broadcom Survey Reveals Spike in VSM Adoption

    Value stream management (VSM) is gaining traction as organizations look to find ways to engage customers more efficiently via digital business transformation initiatives.

    A survey of 500 executives, IT and business leaders conducted by Dimensional Research on behalf of Broadcom published this week found 39% of respondents implemented a VSM platform with another 16% having some equivalent capability. Another 31% said their organizations is moving in the direction of adopting a VSM platform. A total of 60% of respondents indicated that they will be using VSM to deliver products in 2023, with 95% of organizations that have adopted VSM also engaged in digital transformation.

    Laureen Knudsen, chief transformation officer for Broadcom, said the primary goal is to close the divide that has emerged over the years between software development teams and the rest of the business. More than two-thirds of respondents (68%) reported there are disconnects between the business and software development.

    Overall, the Broadcom survey identified increasing customer value (58%), improving product quality (55%), reducing costs (51%), adding more customers (50%, increasing profits (49%) and increasing speed to market (45%) as the top strategic issues organizations face in 2023.

    The top benefits derived from investing in VSM were increased transparency (42%), improved organizational alignment (39%), faster solutions to customers (38%), data-driven decision-making (37%) and improved access to data (36%).

    VSM traces its lineage back to lean manufacturing methods, which called for each step of a manufacturing process to be continuously measured. As software development has evolved and organizations realize how dependent they are on software, there is a growing appreciation for the value of monitoring things such as the impact of missed software development deadlines on the business. At their core, VSM platforms aggregate DevOps metrics and then match them to a set of key performance indicators (KPIs) defined by business leaders. Once those metrics are gathered and correlated, organizations can apply advanced analytics. The goal is to apply algorithms and other forms of predictive analytics that will enable organizations to more easily identify the precise impact software development processes have on the business.

    Knudsen said the survey makes it clear a lack of discipline when it comes to software engineering now needs to be addressed as organizations realize how dependent they are on applications to engage customers. Many organizations have, for example, adopted flawed approaches to agile development that wind up creating chaos across the software development life cycle, she noted.

    Many organizations, for example, are unsure how much time development teams are spending on retiring the technical debt accrued within legacy applications versus actually working on developing new applications, Knudsen added.

    Business conditions tend to change rapidly, so aligning software development with corporate goals is difficult. Nearly three-quarters (72%) of respondents said they are frustrated by the state of the business and constant changes to strategy. Digital business transformation initiatives, however, will require organizations to adopt a more structured approach to software engineering, said Knudsen.

    The issue, of course, is the pace at which businesses are already being digitally transformed. The accelerated pace requires almost immediately re-engineering software development processes for them to succeed.

  • Cloudflare Adds Digital Experience Monitoring to CDN Portfolio

    Cloudflare Adds Digital Experience Monitoring to CDN Portfolio

    At an online CIO Week event, Cloudflare today added a digital experience monitoring capability to a portfolio of services layered on top of its core content delivery network (CDN).

    Corey Mahan, director of product management for Cloudflare, said the Cloudflare Digital Experience Monitoring service extends a Cloudflare Zero Trust platform based on agent software dubbed Cloudflare WARP. The solutions delivers a wide range of software-as-a-service (SaaS) offerings spanning everything from data loss prevention (DLP) to email security.

    He added that the overall goal is to reduce the total cost of IT by delivering SaaS application services more efficiently using a single agent rather than having to deploy multiple agents for each service.

    The Cloudflare Digital Experience Monitoring service, available as a private beta, will enable IT teams to leverage the Cloudflare CDN to measure and analyze controlled data flows to public or private resources by emulating traffic flows using synthetic data. Via integration with the Cloudflare Zero Trust platform, IT teams can also access real-time data visualizations highlighting anomalies in connectivity or performance that might, for example, be indicative of a security breach, noted Mahan.

    While there’s no doubt IT organizations are looking to streamline the number of IT vendors they need to manage, it’s not clear what the center of gravity will be for achieving that goal. Cloudflare is making a case for using the same global CDN that many organizations already rely on for networking services.

    The Cloudflare Digital Experience Monitoring service leverages the company’s CDN to make it simpler to understand, for example, why users in one geography experience sub-optimal application experiences compared to another, said Mahan. That’s especially critical when more organizations than ever have employees working from home across multiple geographies, he added.

    In the longer term, more networking and security functions will be consumed as a service. The challenge then becomes integrating those services into the DevOps workflows that are employed to deploy applications across a highly distributed computing environment. In many cases, what might initially appear to be an application performance issue winds up being a network connectivity problem that is more easily solved.

    One way or another, the management of IT services in the months and years ahead will continue to converge. Organizations of all sizes will need to determine whether it makes economic sense to acquire platforms they need to manage versus consuming a service that is managed on their behalf. Most of the time, a service will be easier to consume and free up resources that can be applied to other IT functions, such as application development.

    Of course, organizations will also need to take care to avoid locking themselves into a specific services provider. Ultimately, however, the question is whether managing a specific IT function provides enough differentiated value to be worth the time and effort when there is so much more to do.

  • Survey Sheds Light On Cloud, API Expertise Skills Gap

    Survey Sheds Light On Cloud, API Expertise Skills Gap

    Enterprise IT faces a three-pronged onslaught: Digital transformation, open APIs and security threats. First, most organizations are still navigating ongoing digital transformations and cloud migrations. Second, development teams continue to increase their use of open APIs, leading to sprawl concerns. And third, we’ve witnessed a slew of cybersecurity threats that appear to be growing in sophistication. Tech leaders are attempting to govern this influx of new tools and risks, yet it can be challenging to innovate quickly while ensuring that sensitive data is always protected.

    The Axway 2022 Open Everything Survey shed light on some of the above challenges and attitudes of those invested in API development and API-enabled managed file transfer (MFT). Most notably, the survey found that 86% of respondents feared an expertise gap in the coming years, in which their organization won’t have the skilled software and IT infrastructure talent they needed to innovate. Below, we’ll review other findings from the survey, focusing on the responses from those who indicated they’re invested in API development.

    Cloud Migrations Are Still Underway

    Digital transformations are still underway in the vast majority of organizations. Only 12% reported being wholly digital and leading innovation. The rest were either just beginning transformations, were midway through or were still largely brick-and-mortar. More than one-third (38%) also said their company’s digital makeup is a hybrid of old and new technology.

    The most-adopted computing environment is the public AWS cloud, at 47%. Yet other options trailed close behind, including hybrid (37%), managed cloud services (32%), Azure (28%), private (25%) and Google Cloud Platform (18%). Other reports substantiated how modern IT is becoming increasingly hybrid and multi-cloud. As digital journeys continue to shift and evolve, some organizations are embracing multiple fit-for-purpose clouds.

    Although multi-cloud offers unparalleled flexibility, the primary drawback is security. Just over half (55%) of respondents said that tracking and controlling the flow of personal data into and through the cloud is a key hurdle to a multi-cloud strategy. And 53% reported that dealing with different security requirements for regional instances of cloud infrastructure was a top challenge. This concern is warranted, as companies doing business internationally must carefully navigate many specific regional data regulations.

    Open Data Strategies Abound

    As the Open Everything name indicates, many different sectors are becoming more “open.” The report highlighted the adoption habits of APIs within supply chains, where they are most often used to configure applications, operate and monitor applications and integrate internal data sources. Popular use cases here included payment and tracking systems. APIs also have a significant role to play in the financial world—41% of those working in finance said open banking is an opportunity to discover new business models. But nowhere is the need for more open data more crucial than in health care, which was found to be the area most in need of digital transformation.

    We’d like to think of the API revolution as being driven by API-first startups and SaaS services. While these trends get attention, it’s not the most common use case for APIs. In fact, 44% of the time APIs are used to support IT consulting and system integration requirements. This is followed by providing cloud applications for customers (35%), developing a partner network (35%) and offering cloud services for customers or partners (34%). Although there are certainly business use cases for generating revenue through APIs, they are most often adopted to supplement existing platforms or to glue together internal services and data.

    Most Technology Leaders Fear API Sprawl

    Security is an encompassing concern for all walks of IT, but is especially top-of-mind when opening up data. Respondents said security is the most important concern when creating APIs (30%). This concern is warranted, as attacks on APIs have increased exponentially in recent years. Other top concerns are API adoption or consumption (15%), customer experience (14%), ease of API management (14%) and design and development (11%).

    As APIs and microservices become more abundant within an organization, it’s easier for sprawl to set in. Unbridled technology sprawl can have a deteriorating effect on design standards and lead to unknown shadow APIs that may pose a security vulnerability. As a result, over two-thirds of respondents said the prospect of API sprawl worries them.

    To mitigate sprawl and address other concerns, most companies are investing in tools to help manage the growing number of APIs. The majority (83%) said their budget for API management has either increased or stayed the same over the last two years. For 18%, this budget has risen by over 25%. Operationalizing API life cycle management capabilities can have benefits such as standardizing design style and increasing the discoverability of internal services.

    API Security Must Still Mature

    In a perfect world, we could share data without fear of misuse. But in reality, APIs are a common target for hackers. Publicly exposed endpoints with broken access control or missing object-level authorization can be easily abused for things like privilege escalation and data exfiltration. And although these risks persist, many APIs don’t adopt industry best practices regarding API security.

    Although most APIs use authentication and token schemes, under half (43%) implemented OAuth. Furthermore, only 30% implemented policies with an API gateway. OAuth 2.0 and gateways have become best practices in serving APIs, as there are too many vulnerabilities to rely solely on HTTP Basic Authentication and API keys. As such, we will likely see these adoption rates increase as API security matures.

    As with other cybersecurity endeavors, it’s really about taking a holistic perspective and applying defense-in-depth. Thankfully, most technology professionals understand this point—developing a more holistic approach to security was ranked as the top strategy for protecting personal data. Other strategies, like data encryption, advanced multifactor authentication, data loss prevention tools and highly-secured data transactions will also be necessary to protect cloud-native assets.

    Final Thoughts

    The Axway 2022 Open Everything Survey asked 1,000 IT leaders, architects and developers about their top concerns. Above, we focused on results from technology leaders engrossed in cloud and API development. For more insights and the findings from those using managed file transfer (MFT), readers can pick up a copy behind an email gate here.

  • Southwest Airlines: ‘Shameful’ Technical Debt Bites Back

    Southwest Airlines: ‘Shameful’ Technical Debt Bites Back

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    20 Years of Neglect Led to ‘Meltdown’

    Last month’s débâcle of canceled flights was caused by decades of technical debt. That’s the analysis of Columbia University professor Zeynep Tufekci. (more…)

  • Intel Expands Scope of oneAPI Initiative

    Intel Expands Scope of oneAPI Initiative

    Intel has expanded its effort to drive adoption of a set of open compilers, libraries, analysis and porting tools and frameworks for artificial intelligence (AI) applications, collectively made available via a oneAPI initiative, to include support for its latest generation of processors.

    The oneAPI initiative was launched more than three years ago to create a set of multi-architecture tools for building applications that could be deployed on any CPUs, graphical processor units (GPUs) and field programmable gate arrays (FPGAs). Processors that now support oneAPI include forthcoming 4th Gen Intel Xeon Scalable processors, Intel Xeon CPU Max Series and Intel Data Center GPUs.

    James Reinders, chief evangelist of Intel Software Products, said there is now a clear need for open tools and frameworks that provide equal access to multiple classes of processors. As part of that effort, the latest 2023 version of oneAPI, for example, adds support for plug-ins for Nvidia and AMD GPUs developed by Codeplay, a unit of Intel, to simplify writing SYCL code in a way that makes code portable across additional processor architectures.

    There is also a CUDA-to-SYCL code migration capability that supports more than 100 CUDA application programming interfaces (APIs) using the Intel DPC++ Compatibility Tool based on an open source SYCLomatic project. Intel is also providing tools to identify imbalances at scale using Intel VTune Profiler, and an Intel Advisor tool now provides automated roofline analysis for Intel Data Center GPU Max Series to identify root causes of memory, cache or compute bottlenecks along with insights for optimizing data transfer costs involving CPU-to-GPU offloading.

    As IT continues to evolve, it will become more routine for developers to invoke heterogeneous classes of processors within the same application, but it’s been challenging to convince providers of other types of processors to support the oneAPI initiative, noted Reinders. Processor providers have historically relied on compilers and libraries to lock developers into specific classes of processors.

    However, it’s becoming more common for developers to build applications that invoke multiple types of processors. The Intel oneAPI initiative is intended to simplify access to heterogeneous processors, also known as XPUs. That’s critical, because the pace of processor innovation has accelerated to the point where developers need to be able to invoke additional capabilities without waiting for specific compilers and libraries to be updated by multiple providers. Once oneAPI is more widely adopted, it then becomes possible to significantly lower the cost of application development and deployment, noted Reinders.

    It’s not clear whether the oneAPI initiative will become more widely adopted, either under the auspices of Intel or by some type of industry consortium that provides a neutral venue for building a common set of compilers and libraries. The one thing that is certain is that DevOps teams are vested in trying to standardize compilers and libraries across as many platforms as possible. The challenge, of course, is making sure developers only invoke compilers and libraries that can span multiple classes of processors versus ones that may have been optimized for a specific type of processor architecture.

  • Why SREs Are Critical to DevOps

    Why SREs Are Critical to DevOps

    Although a relatively new concept, site reliability engineers (SREs) have become crucial for DevOps teams, helping to solve an array of operational problems such as network availability and user experience. However, in previous years, some people have questioned the longevity of such a role. 

    This article will discuss several reasons why site reliability engineering roles are here to stay and why they have become critical to DevOps. 

    What Are Site Reliability Engineers (SREs)?

    A site reliability engineer helps connect development teams and IT operations by completing tasks previously assigned to operational roles. SREs use a range of automation tools for troubleshooting purposes, creating software systems that are both scalable and reliable.

    The role revolves around automation and standardization, as cloud systems become increasingly prevalent. SREs also play a vital role in ensuring the user experience of systems is of the highest standard.

    Why Site Reliability Engineering Roles Are Here to Stay

    Let’s take a look at two of the primary reasons SRE roles are here to stay. 

    User Expectations

    The key reason for the rise in popularity and the expected longevity of site reliability engineering roles is user experience. In the modern climate, user expectations are very high and more dedicated roles are required to help deliver a service that is not only acceptable but attempts to exceed user expectations.

    Even back in the 2010s, users were much more patient in terms of website load speeds and how quickly they could access information. Even crashes and load failures were tolerated without the user exiting a website.

    However, that has all changed due to the competitiveness of the market, as well as the growth of remote working, which has increased dependency on online resources. This means that if a service is unavailable for any period, users are unable to do their job. 

    An SRE’s role includes optimizing systems, ensuring they perform at the required level and that resources are always available to those that need them. This makes SREs critical to DevOps teams that may not have the capacity to focus on meeting user expectations sufficiently. 

    The Complexity of Software Architectures

    Another factor that has added a lot of value to the role of an SRE is their ability to provide much-needed support for software environments and architectures that continue to develop in terms of complexity. Kubernetes is one such architecture that requires dedicated attention. 

    Applications that are distributed across systems such as Kubernetes and other cloud-native platforms require specialized personnel that have the necessary knowledge and experience. Machine learning is also becoming more prevalent and requires special focus from a performance perspective. In 2020, just more than 22% of companies had machine learning models in production for one to two years.

    This level of complexity is only expected to grow further over the coming years as cloud-native systems become the norm. This is why new roles must be created that go beyond that of a normal IT engineer. 

    Challenges for SRE Roles

    Like any IT role, the role of a site reliability engineer always faces challenges that have led people to question whether SREs are a long-term solution or whether it is a niche specialization. 

    A Lack Of Opportunity Away From Hyperscale Companies

    The role of an SRE was created by hyperscale companies like Google that manage extremely large IT systems. For companies that do not have such a wide and varied IT infrastructure on a global scale, there are questions about whether such a role is necessary. 

    However, as previously mentioned, the growth of cloud-native technology shows no sign of slowing and, with this growth, opportunities for SREs at smaller organizations may arise. 

    The Role of an SRE is Considered Obscure

    The ambiguity of an SRE role can be considered a downfall in some cases, with many businesses unsure of what these professionals offer when compared to a traditional systems engineer. In many cases, SREs are deemed to be a hybrid of a software engineer and an IT operations role. 

    Fortunately, DevOps has realized the potential of SREs and their ability to provide an important bridge between developers and engineers, helping to achieve dedicated tasks to a high standard. 

    SREs Vs. DevOps

    Although both roles are connected and share some similarities, there are some clear differences.

    • Processes – DevOps has full visibility into the development environment which allows them to make changes from the initial development stages through to production. SREs, on the other hand, only have visibility into the production process, allowing them to make suggestions to ensure performance levels are maintained.
    • Implementation – The task of implementing new features on a system falls on the DevOps team. Meanwhile, SREs are tasked with ensuring the new features do not cause any system failures or impact performance during the production stage.
    • Key Focus – The primary focus of a site reliability engineer is to ensure the system’s reliability, availability and scalability. DevOps focuses on how quickly product development is completed, as well as its continuity.
    • Structure – The structure of an SRE team and a DevOps team have obvious differences. SRE teams are made up of individuals who have similar skill sets relating to development and operations. Whereas DevOps teams consist of professionals who have specific roles related to individual aspects of the project. These roles can include the team leader, product owner, cloud architect, software developer, QA engineer, system administrator, release manager and more.
    • Tools – DevOps teams often use tools such as integrated development environments (IDEs) when developing a product. These can include Jenkins (continuous integration and continuous development), JIRA (change management), Splunk (log monitoring) and GitHub (distributed version control). SREs commonly use tools such as Prometheus and Grafana (collection and visualization of metrics, such as CPU usage and available disk space), OP5 and PagerDuty (incident alerts), Ansible and Kubernetes (container orchestration) as well as a range of cloud platforms.
    • Bug Reporting – DevOps debug code whenever a bug is reported in the end product. SREs are not involved with debugging from a development perspective and are only required to perform such tasks if there is a production outage, there are infrastructure issues or perhaps if they are dealing with common AWS misconfigurations.
    • Measuring Performance – The typical metrics that DevOps uses to measure performance are deployment frequency and deployment failure rate. SREs measure service level objectives (SLOs), service level indicators (SLIs), service level agreements (SLAs) and error budgets.
    • Incident Handling – In the case of incident handling, DevOps teams work to mitigate an issue based on the feedback provided. SREs then analyze the issues post-incident, including the root cause of the issue. This is then documented and provided to the developers to fix. 

    Why SRE Roles Are Critical to DevOps – Conclusion

    As you can see, the two roles differ significantly but SREs can play a critical role in ensuring the DevOps team delivers a product that offers maximum performance. 

    The core benefits of employing professionals in a site reliability engineer capacity are high levels of product performance and reliability to meet user expectations while helping to manage complex IT architecture. 

    In the future, organizations that manage a large amount of cloud-based IT assets may struggle to deliver efficient products without such professionals. As such, demand for SRE roles is likely to grow. 

  • DevOps Must Embrace Automation in 2023

    DevOps Must Embrace Automation in 2023

    A survey of 500 engineering and software development professionals in the U.S. suggests more DevOps teams than ever need to resolve to embrace automation at a deeper level in the new year.

    The survey, sponsored by Chronosphere, a provider of an observability platform, found engineers spend, on average, more than 10 hours per week attempting to triage and understand incidents. That equates to a quarter of a 40-hour workweek.

    Overall, 96% of respondents said they spend most of their time resolving low-level issues, with 88% reporting that amount of time negatively impacts them and their careers because so much time is spent troubleshooting IT issues.

    Over a third (33%) said those issues disrupted their personal life with 39% of respondents admitting they are frequently stressed out. Just under a quarter (22%) said they want to quit.

    Chronosphere CEO Martin Mao said much of the stress DevOps teams encounter results from reliance on DevOps platforms that organizations built themselves. Platforms built and supported by a vendor today typically provide higher levels of automation that reduce overall stress levels, he added.

    The survey found that 40% of respondents frequently get alerts from their observability solution without enough context to triage the incident. A total of 59% said half of the incident alerts they receive from their current observability solution aren’t actually helpful or usable, with 49% reporting they struggled with inconsistent performance using their current approach to observability. Nearly half (45%) said their current observability solution requires a lot of manual time and labor.

    Overall, 42% of those using a vendor solution said they experienced high-severity incidents quarterly or more compared to 61% relying on a platform they built. Among organizations not using a vendor solution, the majority said they would consider doing so to enhance team productivity (61%) or improve reliability (54%).

    Stress levels are likely to increase as organizations deploy emerging cloud-native applications. A full 87% of respondents said cloud-native architectures had increased the complexity of discovering and troubleshooting incidents.

    During challenging economic times, it’s more critical for DevOps leaders to understand the total cost of building and maintaining platforms, said Mao. Many organizations decided to build their own platform at a time when there was no other viable option. The manual processes required to support those platforms result in a higher cost of labor that impedes the ability to scale workflows cost-effectively, he noted.

    It’s not clear how big an appetite for change any organization that has built their own DevOps platforms may have in 2023. The challenge is that the initial cost of swapping in a commercial platform may appear high given the fact that the legacy platform is already deployed. However, the cost of the acquisition of a new platform needs to be weighed against the total cost of ongoing operations. A lot of soft costs show up in, for example, higher turnover rates for DevOps professionals that are likely to find a more rewarding job elsewhere that is less tedious. One way or another, at the start of 2023, it’s apparent there are more hard DevOps questions than ever that need to be asked and answered.

  • Best of 2022: 6 Top Technology Trends to Watch

    Best of 2022: 6 Top Technology Trends to Watch

    As we close out 2022, we at staging-devopsy.kinsta.cloud wanted to highlight the most popular articles of the year. Following is the latest in our series of the Best of 2022.

    Technology trends simply cannot be ignored in today’s dynamic environment. As the world enters a post-digital era, organizations are exploring disruptive technology trends. Artificial intelligence, machine learning, intelligent process automation, advanced analytics, and robotic process automation (RPA) are among the top DevOps technology trends to watch. According to a survey by Accenture, 94% of IT and business experts reported that emerging technologies have accelerated firms’ innovation pace in the last three years. 

    Winning This Decade in the Context of the Next Normal

    This decade continues to witness further development in technology, as innovation transforms industries such as insurance, banking, and healthcare. It is crucial to look beyond seeking operational efficiency and decreasing cost — particularly as customer expectations, regulatory requirements and business landscapes are rapidly evolving. 

    Take a look at six vital technology trends that have gained momentum in today’s hyper-digital world: 

    Trend 1: Artificial Intelligence (AI), Machine Learning (ML) – Integrating Intelligence 

    Technologies like AI and ML have existed for some time, but only now have they started maturing from their perception of “interesting” to “organizationally effective.” Artificial intelligence and machine learning are digital transformation catalysts, and some of the capabilities that fall under this technology include pattern recognition, natural language processing and sentiment analysis. Artificial intelligence has become increasingly important because it provides companies with a competitive edge, is cost-effective and allows them to future-proof themselves. 

    Trend 2: Predictive Analytics – Harnessing New Opportunities 

    In this digital-savvy environment, it has become crucial for organizations to employ tools like predictive analytics.  An advanced form of data analytics, it’s used to extract information and predict trends, behavior and activities with precision. It is increasingly being introduced across industries as it optimizes productivity, helps understand customers better, identifies revenue opportunities and areas of attrition. Financial institutions have already begun to deploy predictive analytics, helping them customize the product offerings, detect fraud and identify new opportunities for cross-selling.

    Trend 3: Low code – Accelerating Innovation 

    Gartner forecasts that low code application platforms will be responsible for 65% of application development activity by 2024. Organizations are rapidly leveraging low code to cater to the growing needs of the digital-first customers, deliver mission-critical and enterprise-grade applications quickly and respond rapidly to unforeseen scenarios. 

    Trend 4: Intelligent Process Automation (IPA): Unifying Processes

    Another technology trend that has paved its path in the digital world is intelligent process automation (IPA). IPA is a group of technologies that work together to organize and digitize the end-to-end business processes and the customer journey. The key drivers of IPA are the need for continuous improvement, retaining data consistency and bridging existing silos.  The technology offers several benefits to an organization, such as reducing error rates, unifying operations, and accelerating processes, but more importantly, assisting in streamlining employee and customer-facing journeys.  

    Trend 5: Contextual Content Services – ECM: Leveraging Context in Content

    Contextual content services, an evolution of traditional enterprise content management (ECM), play a key role in powering automation initiatives. The right tools in ECM like intelligent taxonomy and cognition can bring context to business processes. Empowering users to make smart decisions with relevant information ensures accurate data extraction, and mitigates risks by managing the overall content lifecycle. 

    Trend 6: Robotic Process Automation (RPA): Improving Productivity 

    Robotic process automation is rapidly becoming an integral cog in the wheel of the end-to-end digital journey of organizations. RPA can be the last mile of process automation — or in between — but is key to streamlining and optimizing customer-facing and back-office tasks. The use of bots helps automate repetitive tasks and liberate knowledge workers to focus on other value-added tasks.  The capabilities of RPA offer several benefits, including faster turnaround times, process optimization, sustaining consistency and increasing employee productivity.  

    Future-proofing the Enterprise

    A close eye on the different technology trends can help enterprises leverage the right tools to optimize their business processes and adapt to the changing market needs. Technologies like low code platforms, advanced analytics, AI, and ECM are already being implemented by some organizations to stay ahead of the competition. Ensure your enterprise is tapping into these technology trends to thrive in the next normal.

  • Best of 2022: Day in the Life of a Site Reliability Engineer (SRE)

    Best of 2022: Day in the Life of a Site Reliability Engineer (SRE)

    As we close out 2022, we at staging-devopsy.kinsta.cloud wanted to highlight the most popular articles of the year. Following is the latest in our series of the Best of 2022.

    By now, most of us are familiar with the concept of site reliability engineering (SRE). The term was originally coined by Google and SRE has been gaining traction in recent years as a role dedicated to increasing the resilience of digital ecosystems. To accomplish this, a big part of the SRE doctrine is “automating your job away.”

    Observability and monitoring tools are extremely important to DevOps and for SRE. But what is the day-to-day experience actually like for your average SRE? What activities does an SRE do? And what percentage of their time does an SRE spend on particular tasks?

    I recently met with James Curtis, lead site reliability engineer at a large multinational company. According to Curtis, the SRE approach takes a certain type of person—someone with Ops in their blood and a passion for eradicating repetitive tasks. Below, we’ll use his input and the input from other sources to better understand what it’s like being in the shoes of an SRE.

    Understanding the SRE Role

    Organizations have interpreted the role in different ways. But in a general sense, SREs attempt to maintain high reliability and availability for software applications and respond to incidents as they occur. To aid their efforts, an SRE tries to streamline and automate as many operations as possible to remove opportunities for human error.

    A hallmark SRE goal is to reduce “toil.” Curtis defines toil as “tedious actions that really have no enduring value.” For example, say an admin must manually restart a service in Microsoft Exchange every time a triggering event interrupts the service—this action could certainly be automated away. SREs spend much of their time eliminating toil by coding automation and configuring internal tools to better interact with software infrastructure.

    SREs usually are also in charge of logs and setting benchmarks using a tool like Splunk or Datadog to observe and ingest data. Curtis himself uses Cribl, which offers an observability pipeline to parse and route log data. Since SREs oversee internal service-level indicators, they are typically in charge of normalizing behavior and setting SLOs and SLAs.

    Common SRE Activities

    An SRE juggles a lot of tasks. For proof, read the hour-by-hour day in the life by Yonatan Schultz, SRE at New Relic. Schultz’s average day is spent configuring infrastructure, jumping from project to project, and, of course, hopping into many meetings. Here are some other tasks an SRE might perform on a daily basis:

    Monitoring service-level indicators (SLIs). An SLI could be the number of successful requests out of total requests. Having a high SLI, in this case, would be a target. SREs track other metrics such as availability, uptime performance, latency, error count and throughput. Regularly monitoring systems is essential to ensure proper resource utilization of containers and to avoid out-of-memory (OOM) errors.

    Setting SLOs and SLAs and determining error budgets. Once you have determined baseline system performance, you can set service-level objectives (SLOs). These are typically internal targets like 99.99% availability. While SREs typically oversee functional metrics, some teams set goals for non-functional metrics, as well. SREs help determine service-level agreements (SLAs), which are more legally binding and typically partner-facing.

    Responding to incidents. On-call SREs will be tasked with finding the root cause of issues as they arise. When triaging an incident, it’s helpful to have all the necessary logs and tools immediately at hand. This is one area where automation can assist by pulling relevant details to instantly build a case, said Curtis.

    Writing postmortems. After an incident has been dealt with, it’s important to learn from it. Postmortems are common in cybersecurity practice and often fall under the responsibility of an SRE. These reviews seek to answer set criteria to get to the heart of an incident and identify the root cause(s) of an issue to prevent it from happening again.

    Automating other system tasks. SREs will spend significant time coding and building tools for engineers to interact with infrastructure. For instance, an SRE might generate reliability reports that consider performance over long time periods.

    Cross-department collaboration. SREs don’t tend to own application code. Instead, they support multiple software divisions. This means checking in with other developers, disseminating best practices and reviewing new architectures to represent the reliability side of the equation.

    As you can see above, the SRE role might blend many different activities, and keeping track of them all may be part of the job itself. Anika Mukherji, an SRE at Pinterest, shared that, at Pinterest, there is a weekly meeting where SREs share what they spent time on. For another helpful “day in the life” story, take this account of an average OpenShift SRE’s day. Nikita spends her day responding to open JIRA cards, handling incidents, pushing code to GitHub and syncing with SREs in other regions when shifts change.

    Time Well Spent

    So, how does an SRE allocate their time? As Curtis explained, the ideal goal is a 50/50 split between time spent in work mode and time trying to automate that work away. Of course, this is more like a sliding scale, he admits. When things are broken, attention naturally shifts toward more manual work, says Curtis. While there may be less automation upfront, the scale balances out the more you build.

    This is similar at other institutions too. For example, in an interview with DZone, Paul Greig explained that half of his time is spent on service reliability upkeep and half on toil reduction. John Turner, SRE at Squarespace, said some 70% of his time is spent writing code—much of it automation code.

    Who’s Fit to Be an SRE?

    As mentioned above, the SRE job requires a specific attitude toward solving operational problems. Curtis described this person as “someone who hates the monotony of doing something over and over.” This person should have a drive to continuously solve new problems because as soon as you’ve automated one thing, you move on to the next, he said.

    Don’t assume a role with high automation equals an easy paycheck. We’ve all heard the story of the system admin who secretly automated their job away and never told a soul. While this may fly in other roles, the job of an SRE is never finished. “You’re never going to run out of stuff to optimize,” Curtis said.

    Again, the SRE role is a blend of many different activities. You will likely interface with different developer teams, too. Since the role involves this type of interaction, communications skills and understanding are a must.

    Final Thoughts

    The SRE practice is wide and varied—each company may have its unique flavor. Looking to the future, there are plenty of use cases for machine learning to further empower SRE practices, said Curtis. This is especially relevant in security automation, where algorithms could be trained against real attacks to flag suspicious behavior. Or, with the right amount of data, predictive analytics could be applied to anticipate high CPU peaks, informing server utilizations.

    In both scenarios, Curtis stressed the importance of observability. “It really gives you the ability to look at data and to ask a question later you didn’t realize you needed to ask,” he said. This power hinges on easy data transformation to make things speak the same language. That’s why his team opted for Cribl, that allowed them to normalize that data on the fly and replay it later. “The ability to change data and morph it—that’s the power observability gives you.”