Category: DevOps Toolbox

  • Skillsoft Survey Sees AI Driving Increased Need to Retrain IT Teams

    Skillsoft Survey Sees AI Driving Increased Need to Retrain IT Teams

    More organizations than ever will need to invest in IT training as advances in artificial intelligence (AI) transform roles and responsibilities in the coming year.

    A survey of 2,740 IT decision-makers conducted by Skillsoft, a provider of an online training platform, finds two-thirds (66%) were already dealing with skills gaps in 2023. As AI becomes more pervasively applied to the management of IT, that skills gap is only going to widen given the limited pool of IT professionals that have any experience using AI to manage IT.

    Skillsoft CIO Orla Daly said it’s already apparent AI creates an imperative for training because there are simply not enough IT people with the requisite skills required. In fact, the survey finds nearly half of IT decision-makers (45%) plan to close skills gaps by training their existing teams. That training is crucial because the primary reason IT staff change jobs is a lack of growth and development opportunities, noted Daly.

    While there is naturally a lot of consternation over the potential elimination of IT jobs, in the final analysis, AI will add more different types of jobs than it eliminates, adds Daly. Each of those jobs will require new skills that will need to be acquired and honed, she notes. “Training is the price of innovation,” said Daly.

    In the meantime, there is much interest in finding ways to automate existing IT processes to create more time for IT teams to experiment with AI technologies, said Daly.

    The report also finds well over half of IT decision-makers (56%) expect their IT budgets to increase to help pay for new platforms and tools, compared with only 12% expecting a decrease.

    It’s not clear to what degree AI will transform the management of AI, but it’s already apparent that many manual tasks involving, for example, generating reports are about to be automated. The instant summarization capabilities that generative AI enables also promise to dramatically reduce the time required to onboard new members to an incident response team. Rather than having to allocate someone on the team to bring new members up to speed, each new member of the team will use queries framed in natural language to determine for themselves the extent of the crisis at hand.

    In addition, many tasks that today require expensive specialists to perform might become more accessible to a wider range of organizations as, for example, more DevOps processes are automated. That doesn’t necessarily mean that DevOps as an IT discipline disappears as much as it leads to the democratization of best DevOps practices.

    Each IT organization in the year ahead will need to determine to what degree to rely on AI to manage IT processes. It may take a while before IT teams have enough confidence in AI to rely on it to manage mission-critical applications but many of the tasks that today conspire to make the management of IT tedious will undoubtedly fade away. The challenge and the opportunity now is identify those tasks today with an eye toward revamping how IT might be managed in the age of AI tomorrow.

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    staging-devopsy.kinsta.cloud is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

    Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    CareerBuilder.com

    Belcan Federal
    Anaheim, California
    Lead DevOps Engineer
    $140,000 to $170,000

    Dice.com

    Trinity IT Services
    Remote
    DevOps Lead
    $115,000 to $165,000

    SimplyHired.com

    EMMES Corp
    Rockville, Maryland
    DevOps Engineer
    $115,000 to $145,000

    Indeed.com

    VyncaCare
    San Francisco, California
    DevOps Engineer
    $110,000 to $140,000

    LinkedIn

    L3Harris Technologies
    Colorado Springs, Colorado
    Senior DevOps/AWS Specialist
    $91,500 to $170,500

  • Shared Responsibility? Yeah.

    Shared Responsibility? Yeah.

    One of the things that the last decade or two of enhancements has brought about is an increasing reliance on everyone across the organization to be more secure. While users have long since thrown up their hands and looked for ways to minimize the fallout when a vendor they frequent is compromised, enterprises have to lock down their own things. And given the ever-increasing volume and sophistication of attacks, the demands are growing.

    Cloud brought us the concept of a ‘shared responsibility‘ model. It is necessary in a world where an org does not control the physical servers and supporting infrastructure that applications ultimately run on. The fact is, the shared responsibility model was really cloud vendors reminding us that we still have to protect our apps, no matter where they’re deployed.

    This model and DevOps together have driven us to demand more of developers and DevOps teams with regard to security. It has also driven ops to have to care more, as more is exposed and security demands are up while security staff isn’t.

    And I’ll just remind you of the obvious. If you are responsible for security at the organization, you can get help from everyone, but those people’s job and direct responsibility is not security. They’re lending a hand because everyone cares, and that is the current state of most enterprises – DevOps made everyone involved in the SDLC a bit more responsible for all the things that aren’t their jobs (often a very good thing, often … not), but they’re not specially trained for it. That’s what security teams are for. And high-quality development security/policy management tools offer Dev and Ops and everyone in between a bit of guidance to good security practices along the way. I’ve praised putting security feedback right in the IDE half a dozen times here and elsewhere, and as a security-conscious developer, will continue to do so until it is so pervasive that people start to worry I’m losing it by going on about it. That’s a great example of helping everyone be more secure without requiring a ton of security staff hours in training. Developers don’t purposely write insecure code any more than they set out to make buggy spaghetti code. Giving tools to help them make the code more secure is a huge bonus – to them and to the corporate security team. So, if you’re not using them, start. And look into all of the other options to help non-security staff lock down their bit. The number of available security people on the market is perhaps the largest it has ever been (It’s so bad I actually know a security researcher who took months to find a new gig – that is pretty much unheard of or a unique case before recent days), but budgets to grow the security team aren’t there – any more than they are currently there to grow most teams. So tools to help are still imperative because you’re not going to get double the security staff in 2024 unless there’s only one of you … and you threatened to quit if they don’t get you help, which no one recommends as a negotiation tactic, so even if you’re solo, no doubling for you.

    Just remember who is responsible for overall infosec. Make use of the specialist and their knowledge in their space by finding tools to help them secure in a manner that matches workflow. Then verify because the organization’s security posture is security’s job.

    And keep rocking it. We’ve got so much cool stuff going on at the moment in IT in general that there is plenty of opportunity to improve architectures that are even relatively recent. Check what you have, consider it from a security perspective, improve what you have and keep rolling along.

    But first, relax, take a breather, and enjoy the holiday period.

  • Opsera Leverages AI to Simplify DevOps Platform Migrations

    Opsera Leverages AI to Simplify DevOps Platform Migrations

    Opsera is leveraging a generative artificial intelligence (AI) model it built to enable DevOps teams to migrate from one platform to another.

    Gregg Holtzrichter, chief marketing officer for Opsera, said the Hummingbird AI model makes it simpler to migrate source code from, for example, a Bitbucket on-premises continuous integration/continuous development (CI/CD) platform to GitHub.

    Opsera originally developed Hummingbird as an orchestration engine that integrates DevOps workflows spanning multiple tools and platforms. The primary goal is to make it possible for DevOps teams to unify their workflows, said Holtzrichter.

    At the same time, Opsera is now making it possible to leverage a generative AI model to reverse engineer the source code a DevOps team may have developed to extend the capabilities of a specific platform. That new code then makes it possible to significantly reduce the total cost of switching DevOps platforms, said Holtzrichter. As part of such an effort, Opsera is also now providing support for organizations looking to specifically migrate to GitHub Copilot and GitHub Actions.

    It’s not clear how many DevOps teams might be looking to switch platforms, but with the rise of generative AI capabilities for writing code, interest in platforms such as GitHub has increased, noted Holtzrichter. In addition, support for platforms such as the on-premises edition of Bitbucket is being sunsetted by Atlassian as part of an effort to drive more customers toward the cloud edition of the CI/CD platform.

    Regardless of the underlying platforms involved, generative AI promises to reduce the ability of any vendor to lock customers into a specific platform. As DevOps teams extended DevOps platforms over the past decade, many of them have discovered that the integrations they created and maintained made it all but impossible to switch platforms. With the ability to refactor much of that code based on the insights surfaced by the Opsera platform using generative AI, the time and effort required to switch platforms has been substantially reduced, noted Holtzrichter.

    At its core, Opsera makes it possible to apply analytics to DevOps workflows as they become more complex. The number of dependencies that exist between various application modules, for example, makes it exceedingly difficult for DevOps teams to manually identify the impact a delay in one project might have on any number of other downstream projects.

    The Opsera platform surfaces that intelligence by scanning all repositories and branches, including commit history and generating alerts and notifications whenever KPI thresholds or compliance requirements are exceeded. DevOps teams can also use the platform to assess their overall DevOps maturity using, for example, the DevOps Research and Assessment (DORA) metrics defined by Google. In addition, many organizations are keen to discover what best practices should be adopted by other application development teams.

    Now that AI is being applied to that analytics capability, it’s become possible to extend the reach of the Ospera platform beyond analytics to include source code migration. Each organization will still need to determine whether such an effort is worth the remaining time and effort still required, but at the very least, most DevOps teams can take comfort in the fact they can now keep their options a lot more open.

  • Sonar Adds Secrets Detection to Code Analysis Portfolio

    Sonar Adds Secrets Detection to Code Analysis Portfolio

    Sonar has added a secrets detection capability to its portfolio of tools for analyzing code and DevOps workflows.

    Designed to be applied to both finding secrets in code repositories and as applications are developed using an integrated development environment (IDE), this capability is being added to SonarLint, SonarQube and the managed SonarCloud service to identify, for example, passwords, application programming interface (API) keys, encryption keys, tokens, database credentials and other private information.

    Sonar co-CEO Olivier Gaudin said the goal is to eliminate secrets that are accidentally or maliciously stored in source code to improve software supply chain security.

    While it’s important to discover secrets in codebases, Sonar is making a concerted effort to make it simpler for developers to discover secrets before they find their way into a codebase that is one step away from a production environment, noted Gaudin. The SonarLint static analysis tool the company provides can now discover secrets in microseconds using the syntactic and semantic analysis engines the company has now extended, he added. No developer is going to wait five to 10 minutes for a code scan to be completed, said Gaudin.

    A Learn as You Code tool also explains how each secret found in a code segment poses a security risk. The overall goal is not only to remove secrets but, ultimately, reduce the number of instances where secrets are discovered in code, said Gaudin.

    Most organizations today are at varying stages of embracing DevSecOps best practices to improve software supply chain security. It’s not clear how readily secrets management is being embraced as part of those modernization efforts, but as cybercriminals routinely scan for application secrets stored in clear text that can be used to compromise application security, the need to encrypt secrets becomes a higher priority.

    There is, of course, no shortage of tools for detecting secrets. Sonar is now simply making a case for managing secret detection as part of a larger effort to reduce vulnerabilities in code that cybercriminals can exploit. That approach should help reduce the total cost of securing a software supply chain at a time when forthcoming regulations are going to make organizations that deploy software more accountable for application security.

    In the meantime, thanks to the rise of generative artificial intelligence (AI), the volume of code that needs to be scanned will likely exponentially increase. The issue with general-purpose AI platforms such as ChatGPT is they were trained using code of varying quality that often contains vulnerabilities that are now sometimes incorporated into the code they generate. On the plus side, however, many developers have little to no application security expertise, so it’s just as feasible that ChatGPT will create more secure code than a human developer. Regardless of how the code was created, however, no one will know for sure how secure it is without scanning it first.

    Hopefully, as AI progresses, the quality of the code being generated will only continue to improve. Until then, DevOps teams should continue to assume all code is suspect until proven otherwise.

  • Five Great DevOps Job Opportunities

    Five Great DevOps Job Opportunities

    staging-devopsy.kinsta.cloud is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

    Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

    Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

    The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

    We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

    Indeed.com

    MedStudy
    Remote
    Senior DevOps Engineer
    $125,000 to $165,000

    SimplyHired.com

    Raytheon
    Tewksbury, Massachusetts
    Technical Fellow – DevSecOps/Cloud Native
    $122,000 to $155,000

    CareerBuilder.com

    State Street Corp.
    Quincy, Massachusetts
    Azure DevOps Engineer
    $120,000 to $202,500

    Dice.com

    USEReady
    New York, New York
    Senior Azure DevOps Engineer
    $120,000 to $160,000

    LinkedIn

    Northrop Grumman
    Dulles, Virginia
    Senior Principal DevOps Engineer
    $107,300 to $199,600

  • ScienceLogic Unveils Revamped AIOps Platform

    ScienceLogic Unveils Revamped AIOps Platform

    Via an early access program, ScienceLogic this week made available a Hollywood update to its artificial intelligence for IT operations (AIOps) platform that, among other capabilities, provides root cause analysis capabilities that can be invoked via a natural language interface.

    For the first time, this release of the ScienceLogic SL1 platform incorporates predictive and generative AI technologies the company gained with the acquisition of Zebrium in 2022.

    Michael Nappi, chief product officer for ScienceLogic, said Zebrium provided ScienceLogic with an AI model that surfaces insights in a way that is simpler for IT teams to understand and act on. In addition to recommending automated workflows to run, the platform gives IT teams the option to automatically run them when, for example, there is an IT incident that an existing workflow has been defined to address, he added. Each organization will need to determine its level of comfort in automating those processes based on the level of potential risk to the business, noted Nappi.

    In addition, the SL1 user interface displays IT operational information at the business service level to provide IT teams with a guided experience that makes it simpler to prioritize tasks based on their relevance to the business, noted Nappi. There is also now an SL1 toolkit that DevOps teams can use to build or customize PowerPacks templates for monitoring specific processes and services.

    Finally, SL1 is now integrated with Slack and WebEx to streamline collaboration across IT teams. Previously, the platform only supported Microsoft Teams.

    In effect, SL1 now provides IT teams with a cockpit through which they can invoke AI to autonomously manage a wide range of tasks, said Nappi.

    It’s not clear how much advances in AI might one day soon democratize the management of IT, but it is clear the level of expertise required to manage complex IT environments is declining. The overall goal is to reduce dependency on IT professionals, such as software engineers, who are hard to find and retain.

    The rate of change being made to complex IT environments is now also occurring faster than IT teams can track without the aid of AI, noted Nappi. ScienceLogic, in the longer term, is working toward making it possible to interact with a chatbot in real-time to enable IT teams to meet that challenge, he noted.

    Each IT organization will need to decide for itself how heavily to rely on AI to manage IT functions, but in time, many IT professionals are not going to want to work for organizations that don’t provide some level of AI to reduce the level of toil they regularly encounter today. Rather than having to manually perform a series of monotonous tasks, AI should enable IT professionals to act more like supervisors in an IT environment.

    It may be a while before that aspiration is fully realized, but in the meantime, IT teams would be well-advised to start identifying which tasks will soon be automated using AI because roles and responsibilities will evolve. The challenge and the opportunity now is determining how IT teams can add more value to the business as those transitions occur.