staging-devopsy.kinsta.cloud

Category: DevOps Toolbox

  • Upgrade SRE Performance Management With AI

    Upgrade SRE Performance Management With AI

    In my recent blog, Revolutionizing the Nine Pillars of SRE with AI-Engineered Tools, I indicated that AI could analyze application and infrastructure performance data to identify optimization opportunities and predict capacity requirements. In this blog, I explain in more detail how AI-engineered tools can be used to improve the pillar that I call performance management of apps and infrastructure.

    AI Use Cases for Performance Management

    Performance management in the SRE context generally refers to monitoring, analyzing and optimizing the performance of IT systems to ensure they are functioning efficiently and effectively to meet the needs of users and the business.

    Performance Monitoring and Analysis: With the complexity and scale of modern IT systems, manually sifting through performance data to find issues can be like finding a needle in a haystack. AI can help identify patterns and anomalies that might indicate a performance problem. Tools like Dynatrace and Datadog use AI to analyze performance data and automatically alert you to potential issues.

    Capacity Planning: Predicting future capacity needs is often more of an art than a science, but AI can help make these predictions more accurate. Machine learning algorithms can analyze historical usage data and predict future capacity needs based on patterns and trends in this data. A tool like Amazon Forecast can generate accurate capacity forecasts based on time-series data.

    Load Testing and Stress Testing: AI can enhance these testing techniques by dynamically generating realistic load and stress scenarios based on real-world usage patterns. AI can also analyze the results of these tests to identify potential bottlenecks. Tools like BlazeMeter with Taurus provide capabilities for AI-enhanced load and stress testing.

    Performance Optimization: AI can identify optimization opportunities that humans might miss. Machine learning algorithms can analyze performance data to identify inefficient operations or configurations that are impacting performance. Tools like Akamas leverage AI to automate the performance optimization process.

    Performance Modeling: Traditional performance modeling techniques can struggle to accurately model the behavior of complex, distributed systems. AI can analyze historical performance data to create more accurate models of system behavior. Tools like BMC’s TrueSight Capacity Optimization employ AI to enhance performance modeling capabilities.

    Overcoming Challenges

    Implementing AI in any area brings its own set of challenges, and performance management is no exception. Here are some potential challenges and ways to overcome them:

    Data Quality and Management: AI relies heavily on data to provide accurate predictions and optimizations. If the data is inaccurate, incomplete or not representative of the system’s behavior, the AI’s effectiveness will be limited. To overcome this, it’s important to implement robust data management and governance practices. Regularly review and clean your data to ensure its accurate and relevant.

    Skills Gap: Implementing AI often requires a specific set of skills in data science, machine learning and AI, which may not be present in existing SRE teams. Investing in training and upskilling for existing team members, as well as considering hiring or partnering with AI experts, can help fill this gap.

    Resistance to Change: As with any major change, there can be resistance from team members who are comfortable with existing practices. Open communication about the benefits of AI and how it can make their jobs easier and providing the necessary training can help overcome this resistance.

    Integration with Existing Systems: AI tools need to be able to integrate with existing systems to access necessary data and take actions based on its analysis. Choosing AI tools with robust integration capabilities and planning for potential integration challenges can help overcome this issue.

    Cost: Implementing AI can require significant investment in tools, infrastructure and skills. Careful planning and budgeting as well as calculating potential ROI from the improved performance management can help justify these costs.

    Security and Privacy: AI tools need access to a lot of data, which can raise security and privacy concerns. It’s important to choose AI tools that follow best practices for data security and privacy and to conduct regular security audits.

    Summary

    Performance management is a critical part of site reliability engineering, ensuring that systems function at their optimal efficiency and efficacy. With the integration of AI, this facet of SRE is getting an unprecedented boost. From using AI in performance monitoring to identify patterns and anomalies to employing machine learning for accurate capacity predictions, AI is redefining how SRE practices are carried out. Tools like Dynatrace, Amazon Forecast and Akamas, among others, are leading the charge in AI-fueled performance management, streamlining processes and delivering superior results.

    Yet, as promising as the future of AI in performance management appears, organizations must navigate challenges to fully harness its potential. From managing data quality to bridging the skills gap, countering resistance to change, integrating with existing systems, managing costs and ensuring security and privacy, the transformation involves overcoming significant hurdles.

    However, with robust data governance, investment in upskilling, open communication, careful planning and strict adherence to security best practices, organizations can fully leverage AI to revolutionize their performance management practices and elevate their SRE capabilities. This not only ensures optimal system performance but also positions the organization well for future growth and innovation.

  • New Relic Adds App Security Testing Tool to Observability Platform

    New Relic Adds App Security Testing Tool to Observability Platform

    New Relic today made available a public preview of an application security testing tool that will be integrated into its observability platform.

    Esteban Gutierrez, CISO and vice president of information security for New Relic, said the New Relic Interactive Application Security Testing (IAST) will provide DevSecOps teams with the context needed to identify the root cause of a cybersecurity issue down to specific lines of code.

    DevSecOps teams will be able to take advantage of IAST to identify vulnerabilities both in code as it is written and after it has been deployed in a production environment without any false positives, he noted.

    New Relic achieves that goal using deterministic testing techniques that surface an actual proof-of-exploit using observability data collected from both applications and the underlying infrastructure upon which they depend, said Gutierrez. DevSecOps teams are then provided with guided remediation suggestions, guardrails and tracking tools to both remediate the issue at hand and prevent it from reoccurring, he noted.

    New Relic IAST takes advantage of the agent software New Relic provides to collect observability data, which reduces the total cost of DevSecOps by providing IT teams that have adopted the New Relic platform with an integrated set of application security testing tools that doesn’t require them to acquire and manage a separate additional platform, added Gutierrez.

    That approach also ensures that application security testing is integrated with the continuous integration/continuous delivery (CI/CD) platforms that New Relic already observes, he added.

    The reason most vulnerabilities are not remediated in a timely fashion is the DevOps teams responsible for creating and deploying the required patches lack any context. They often don’t know, for example, how many instances of a vulnerability there might be or the actual level of severity. Without those insights, it becomes exceedingly difficult to prioritize remediation efforts, noted Guttierrez.

    As application security requirements become more stringent in the wake of forthcoming legislation, it’s now more of a question of when than if organizations will be required to better secure their software supply chains. The issue DevOps teams face now is finding a way to integrate application security testing tools into existing DevOps workflows without slowing down the pace at which applications are being developed.

    Of course, not every vulnerability discovered requires the same level of attention. Depending on its severity and likelihood of being exploited, DevOps teams need to prioritize which vulnerabilities need to be remediated first. There simply are not enough resources available today to fix every vulnerability an application might have. For the foreseeable future, there will remain technical debt involving vulnerabilities that will need to be addressed after an application is deployed in a production environment.

    The issue, of course, is that cybercriminals are getting more adept at exploiting those vulnerabilities. The amount of time any DevOps team has to resolve issues before they result in a breach continues to dwindle.

  • Harnessing AI for Automated and Toil-Free SRE

    Harnessing AI for Automated and Toil-Free SRE

    In my recent blog Revolutionizing the Nine Pillars of SRE With AI-Engineered Tools, I indicated that AI can help reduce toil by automating more complex tasks that were previously challenging to automate. Machine learning models can predict system behavior, enabling proactive responses. In this blog, I explain in more detail how AI-engineered tools can be used to improve toil reduction and automation.

    AI Use Cases for Toil Reduction and Automation

    In each of the following use cases, AI not only reduces toil but also contributes to improving system reliability, efficiency and scalability, forming a critical part of modern site reliability engineering (SRE) practices.

    Anomaly Detection and Predictive Maintenance: AI can monitor system logs and operational metrics to detect anomalies, predict system failures and schedule maintenance. This leads to fewer unexpected issues and lower downtime. Tools such as Splunk‘s Machine Learning Toolkit and Elastic’s Machine Learning features can be used for this purpose.

    Automated Testing: AI can be used to automate testing procedures, ensuring code reliability before deployment and reducing the toil of manual testing. Tools like Mabl or Testim use machine learning to create, execute and maintain tests, reducing the need for human intervention.

    Incident Triage and Resolution: AI can analyze incident data, diagnose issues, suggest solutions and, in some cases, automate the resolution process. Tools such as PagerDuty’s Event Intelligence or BigPanda help automate these processes and reduce resolution times.

    Capacity Planning and Resource Allocation: AI can predict system load and adjust resources accordingly to ensure optimal performance and scalability. Dynatrace and Datadog are examples of AI-driven platforms that can provide predictive analytics and capacity planning.

    Proactive Fault Isolation: AI can help isolate faults before they escalate into significant issues, reducing downtime and maintaining system reliability. IBM’s Watson AIOps and Moogsoft’s AIOps platform use AI to quickly isolate and remediate faults.

    Security and Threat Detection: AI can monitor system activity, detect threats and prevent security incidents, reducing the toil of manual monitoring and intervention. Tools like Darktrace and CrowdStrike Falcon use AI for cybersecurity.

    Network Optimization: AI can analyze network traffic and performance data to optimize network configurations and improve system performance. Tools such as Mist (from Juniper Networks) and Cisco’s DNA Center can provide these functionalities.

    Code Review and Technical Debt Management: AI can analyze code changes and identify issues and potential technical debt, providing guidance for incremental code improvements. Tools like DeepCode and CodeClimate can help manage and reduce technical debt.

    Overcoming Challenges

    Organizations must overcome challenges with their people, processes or technologies when transforming SRE practices to using AI tools for toil reduction and automation.

    Lack of Skilled Personnel: AI technologies often require a level of expertise that may not exist within current teams. This lack of skill can be a significant barrier to the successful implementation and usage of AI tools. Invest in training existing staff and consider hiring new team members with the necessary skill sets. There are plenty of resources and courses available online to train your teams on AI tools and technologies.

    Data Quality Issues: AI tools rely on quality data to deliver reliable insights. Data might be unclean, unstructured or siloed across different systems, which can hinder the effectiveness of AI. Implement robust data management and governance practices to ensure your data is clean, structured and accessible. AI tools can also be used to assist in data cleansing and structuring processes.

    Resistance to Change: People can be resistant to new technologies, especially when it comes to something as transformative as AI. This resistance can slow down or even halt the transition to AI-based SRE practices. Develop a strong change management strategy, which could involve regular communication about the benefits and importance of the change, provide training and support and gradually integrate AI tools into existing workflows to allow for a smoother transition.

    Integration with Existing Systems: AI tools need to work in tandem with existing IT systems, tools and processes. Integration issues can prevent AI tools from accessing necessary data or functioning as expected. Plan the integration process carefully, ensuring that the selected AI tools are compatible with your existing systems. Where possible, choose AI solutions that offer flexible APIs and other integration options.

    High Costs: Implementing AI tools can require substantial investment, including purchasing or subscribing to the tools, integrating them into your existing systems and training staff. Calculate the return on investment (ROI) before implementation to understand the potential benefits and savings the AI tools can provide in the long run. Look for scalable solutions that allow you to start small and increase your investment as you see value.

    Compliance and Security Concerns: The use of AI tools, particularly those that leverage cloud computing, may raise concerns about data security and compliance with various regulations. Conduct a thorough risk assessment before implementing any AI tool. Choose vendors that adhere to industry-standard security protocols and offer comprehensive security features. Consider working with a third-party auditor to ensure compliance.

    Summary

    As organizations journey toward greater operational efficiency and reliability through SRE, the transformative potential of AI is becoming increasingly clear. AI-driven tools are revolutionizing various facets of SRE, including toil reduction, automation and defining service-level indicators, objectives and agreements. These innovative technologies can automate complex tasks, predict system behavior, refine performance targets, optimize deployments and aid in effective incident management. For example, AI tools such as Datadog, Dynatrace and New Relic can provide actionable insights into your systems, while others like Nobl9 can use machine learning to define SLOs based on historical performance data.

    However, the road to this AI-infused future is not without its challenges. Teams might grapple with issues such as a lack of skilled personnel, data quality, resistance to change, system integration, high costs and security concerns. Yet, with the right approach, these hurdles can be overcome. By investing in training and hiring skilled personnel, implementing robust data management practices, fostering a culture receptive to change and carefully planning the integration of AI tools, organizations can leverage the power of AI. Calculating ROI before implementation and choosing vendors who adhere to stringent security protocols can further ensure success. The use of AI in SRE represents a powerful convergence of technology and practice that is reshaping the landscape of modern IT operations.

  • AI ‘is Getting Worse’ ¦ AI ‘Will Lose India Jobs’ (Probably Isn’t ¦ Probably Won’t)

    AI ‘is Getting Worse’ ¦ AI ‘Will Lose India Jobs’ (Probably Isn’t ¦ Probably Won’t)

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week, a conundrum: On the one hand, researchers say ChatGPT is losing the plot; and on the other, we hear outsourced coding jobs in India will be replaced by AI. (more…)

  • Postman Acquires Akita Software to Gain API Observability

    Postman Acquires Akita Software to Gain API Observability

    Postman today announced it has acquired Akita Software to gain access to a platform for monitoring and observing application programming interfaces (APIs).

    The first integration of the respective products offered by both companies will arrive in beta this fall.

    Postman CEO Abhinav Asthana said the acquisition of Akita Software will make it much simpler for organizations to discover what APIs are being employed across an enterprise. A recent Postman survey found that 28% of developers are now deploying APIs at least once per week.

    The Akita Software platform will make it simpler for organizations to discover both rogue APIs that have been created by a shadow IT project and zombie APIs that have been inadvertently left exposed long after they are needed.

    Akita Software’s CEO Jean Yang said the integration with Postman’s API management platform will provide a rich source of data that can be used to add artificial intelligence (AI) capabilities to Akita’s API observability platform. For example, generative AI capabilities should make it simpler to create summaries in natural language that explain the calls an API is making to specific data sources.

    In addition, the combined company will be in a better position to enable organizations to better secure their APIs after deployment by surfacing anomalous behavior indicative of an API that is being used to exfiltrate data, she added.

    The merger with Postman will, in effect, enable the combined entity to provide a complete ecosystem for managing APIs, noted Yang.

    Most APIs are used primarily to interconnect internal-facing applications and systems, with a subset used to integrate partners. Only a relatively small percentage of APIs are externally facing in the sense that they expose data to the internet. Many organizations, however, fail to appreciate how quickly an internally facing API can become externally facing over the course of its life cycle. As such, IT teams need tools and platforms that can manage and secure APIs as they evolve.

    As APIs continue to play a crucial role in advancing business goals, there is a clear need for increased visibility as the types of APIs employed also continue to expand. Most APIs in use today are based on the REST format, but there are also APIs based on GraphQL, event-driven architecture and various messaging platforms. None of these newer APIs will supplant REST APIs any time soon. Rather, they are being applied to drive additional processes alongside REST APIs.

    In the longer term, it’s not clear how many APIs will be managed by the developers that created them versus a centralized DevOps team. However, the more APIs that are deployed in a production environment, the less feasible it becomes for developers to manage their life cycle. The challenge is making sure there is some type of structured workflow in place that, at the very least, makes everyone involved in the process aware that a new API has been created and deployed.

  • Webb.ai Launches AI-Based Continuous Root Cause Analysis

    Webb.ai Launches AI-Based Continuous Root Cause Analysis

    Webb.ai today opened an early access program access to a Continuous Automated Root Cause Analysis platform that uses artificial intelligence (AI) combined with a knowledge graph to dynamically keep track of and analyze changes to IT environments.

    Manish Gupta, CEO of Webb.ai, said the platform uses a mix of machine learning algorithms and generative AI capabilities based on large language models (LLMs) to aggregate alerts into higher-order insights that are presented in natural language to members of a DevOps team.

    That approach differs from legacy approaches because it tracks causal relationships between changes versus relying on probabilistic models that tend to create a lot of false positives, he noted.

    Webb.ai is also taking advantage of Kubernetes clusters to enable its platform to scale up and down as needed when analyzing data, added Gupta. That platform is also more efficient than other approaches to observability that require IT teams to store massive amounts of data. In contrast, the Continuous Automated Root Cause Analysis automatically surfaces anomalous events that DevOps teams can choose to save rather than requiring them to save all the metrics, logs and traces that would otherwise need to be tracked, he noted.

    Most IT incidents can be traced back to the most recent changes made to an IT environment. The challenge is as IT environments have become more complex, it’s not feasible for humans to keep track of those changes without relying on AI and a knowledge graph, said Gupta.

    As businesses become more dependent on software to drive digital processes, the cost of downtime is exponentially increasing. The need to identify the root cause of an IT incident as fast as possible has become a critical requirement, he added.

    Webb.ai doesn’t see AI technologies replacing the need for DevOps professionals and site reliability engineers (SREs) for at least another 10 to 15 years. In the meantime, many tasks that today are completed manually will be increasingly automated, said Gupta. A DevOps engineer dragged out of bed at 2:00 A.M. to address an issue does not want to have to sift through alerts. Instead, generative AI tools will summarize the issue at hand with recommendations on resolving it, noted Gupta. In effect, DevOps teams will be augmented by AI so they can manage IT environments at even higher levels of scale, he said.

    There is always going to be some sense of fear and loathing when it comes to AI, but ultimately, AI should reduce the burnout rates that today adversely affects any organization’s ability to retain DevOps professionals. Far too much time is spent trying to identify the root cause of a slowdown in a cloud-native application’s performance that could be caused by any number of issues involving one dependency or another. The frustrating thing, of course, is that while it may take days to identify the root cause of an issue, it often takes just a few minutes to resolve.

  • The Role of AI in ITSM: SLAs, SLOs, SLIs and Error Budgets

    The Role of AI in ITSM: SLAs, SLOs, SLIs and Error Budgets

    In my recent blog Revolutionizing the Nine Pillars of SRE with AI-Engineered Tools, I classified SRE into nine pillars of SRE practices, a comprehensive framework that covers the full scope of SRE practices and suggested how AI can help with each of the pillars.

    For SLAs, SLOs, SLIs and error budgets—arguably the most important pillar of SRE—I indicated that AI can assist by providing accurate predictions of system performance and identifying potential bottlenecks. In this blog, I’ll explain in more detail how AI-engineered tools can be used to improve SLAs, SLOs, SLIs, error budgets and error budget policies within IT service management (ITSM).

    AI for SLAs, SLOs, SLIs, Error Budgets and Error Budget Policies

    Service Level Agreements (SLAs): An SLA is a contract between a service provider and the end user. It outlines the metrics by which the service is measured as well as remedies and penalties if agreed-upon service levels are not achieved. Setting the right SLAs is crucial, as they directly impact on customer satisfaction and the service provider’s reputation.

    The challenges in defining SLAs often involve understanding the trade-off between the cost of providing the service and the level of service that customers expect. AI can assist in this process by providing data-driven insights to inform these decisions. By analyzing historical performance data, customer usage patterns and feedback, AI models can predict the impact of different service levels on both customer satisfaction and operational costs. This can help service providers to set SLAs that meet customer expectations without unnecessarily inflating costs.

    AI can also be used to proactively monitor the agreed-upon SLAs. By continuously analyzing performance data, AI tools can detect potential SLA breaches before they occur, allowing the service provider to take preventative action. This kind of proactive SLA management can help to improve customer satisfaction and reduce the risk of penalties for SLA breaches.

    Service Level Objectives (SLOs): Establishing SLOs involves making informed predictions about system performance, defining realistic yet challenging targets that align with user expectations and business goals. A common challenge in defining SLOs is dealing with the complex nature of distributed systems and their interdependencies, making it difficult to predict performance and set appropriate targets. AI can assist in this process by analyzing historical data to model system behavior and predict future performance trends. This allows SRE teams to set more accurate, data-informed SLOs that reflect the system’s true capabilities. For instance, machine learning models could identify patterns in traffic and use this information to predict periods of high demand, allowing SRE teams to define SLOs that account for these peaks.

    Service Level Indicators (SLIs): SLIs are quantitative measures of some aspect of the level of service such as latency, throughput, availability, error rates, etc. The challenge lies in identifying the right metrics that accurately reflect the user’s experience and the system’s health. Traditionally, these decisions are based on domain knowledge, experience, and sometimes trial and error. AI can assist by analyzing a broad range of metrics across the system, correlating them with issues, incidents and user satisfaction levels to identify which indicators provide the most meaningful measure of service quality. By doing so, AI can help teams select the most appropriate SLIs, thus providing a more accurate picture of their system’s health and performance.

    Error Budgets: An error budget represents the acceptable level of risk or unreliability in a service, providing a balance between reliability and the pace of innovation. Determining an appropriate error budget involves an understanding of system behavior, user tolerance for errors, and business needs. The challenge lies in predicting future performance and understanding the likely impact of potential issues. AI can help overcome these challenges by simulating different scenarios and predicting their impact on the error budget. Machine learning algorithms can learn from past incidents and understand the correlations between different factors, helping teams predict future performance, establish an appropriate error budget, and make better-informed risk decisions.

    Error Budget Policies: These are policies that dictate actions based on the remaining error budget. These decisions often involve human judgment, like deciding when to freeze releases due to an exceeded error budget or when to allow more risk for a new feature rollout. AI can support these decisions by using predictive models to estimate the likely impact of different actions on the error budget. For example, it could simulate the impact of a new release on system reliability, providing insights to help decide whether to proceed with the release or hold it back. By doing so, AI can help teams manage their error budgets more effectively and make more data-driven decisions.

    Implementation Roadmap

    Implementing AI tools for SLAs, SLOs, SLIs, error budgets, and error budget policies must be well-planned and executed systematically. Here’s a practical implementation roadmap:

    Assess the Current Situation: Start by examining the current situation, identifying the areas of need and understanding the existing process of how SLAs, SLOs, SLIs and error budgets are being managed. Also, evaluate the data you currently have available and its quality because AI tools rely heavily on data.

    Define the Goals: Clearly outline what you hope to achieve with the implementation of AI tools. This could include better prediction of system performance, quicker identification of potential bottlenecks, more effective allocation of error budgets, etc.

    Select the Right Tools: Research and select suitable AI tools. Examples of AI-engineered tools that could be useful include:

    • Nobl9 for SLO management: It can assist with setting, monitoring and managing SLOs with AI-driven predictions.
    • Dynatrace: This tool uses AI to detect and diagnose system anomalies, improving observability and helping to inform SLOs and error budgets.
    • Datadog: Offers machine learning-based features that can help forecast future infrastructure metrics, contributing to better SLA and SLO management.
    • New Relic: Its applied intelligence feature can help with incident detection and resolution, helping to better manage error budgets.

    Data Preparation: Aggregate data from various sources, clean it and possibly format it in a way that’s suitable for the AI tools.

    Integration and Deployment: Integrate the AI tools with your existing systems to ensure that the AI tools can effectively communicate with your existing systems.

    Training and Calibration: Many AI tools require a period of training and calibration where the tool learns from your data to make accurate predictions and recommendations.

    Monitoring and Evaluation: Once the AI tools are in place, continuously monitor their performance.

    Iterate and Improve: Based on the evaluations, make necessary adjustments to the tools, your data or your goals.

    Training the Team: They need to understand how to interpret the results and how to take action based on the recommendations of these tools.

    Summary

    In the complex landscape of ITSM, AI is emerging as a transformative force, enabling organizations to manage their systems with unprecedented precision and proactivity. Through smart analysis of historical data and predictive modeling, AI tools are elevating how we define and handle SLAs, SLOs and SLIs. Gone are the days of generic, one-size-fits-all service-level targets. Today, AI empowers us to set realistic, data-informed goals that accurately reflect a system’s capabilities and align with user expectations, ensuring high customer satisfaction and operational efficiency.

    Furthermore, AI brings remarkable improvement to the management of Error Budgets and Error Budget Policies. By simulating different scenarios and predicting their impact, AI helps teams proactively manage risk, making well-informed decisions about error allowance and guiding actions when error budgets are threatened. AI enables us to strike the perfect balance between reliability and innovation, allowing IT teams to continue pushing boundaries without compromising service quality. As the era of AI in IT service management dawns, we stand on the cusp of a new phase of efficiency, control, and excellence in system management. So, join us as we delve deeper into this fascinating intersection of AI and SRE practices.

  • Splunk Adds Hub to Extend Observability to Edge Computing Platforms

    Splunk Adds Hub to Extend Observability to Edge Computing Platforms

    Splunk today launched a platform for ingesting data from sensors, industrial equipment and internet-of-things (IoT) platforms so that it can be analyzed alongside data collected from IT environments.

    Announced at the company’s .conf23 conference, the Splunk Edge Hub extends the reach of the troubleshooting platform Splunk provides that increasingly involves various types of edge computing platforms.

    Tom Casey, senior vice president for products and technology at Splunk, said Splunk Edge Hub is designed to be deployed in those edge computing environments and reduce the total amount of data that needs to be transferred back to an instance of the Spunk analytics platform running in a data center or in the cloud.

    That approach makes it possible to remotely monitor everything from environmental conditions to identifying anomalies indicative of an outage that might be prevented. The overall goal is to unify visibility across IT and operational technology (OT) environments as these systems and applications become more integrated, said Casey.

    It’s not clear how quickly that integration is occurring, given the historic cultural divide that has existed between IT and OT teams. But with the rise of digital business transformation initiatives, the data collected from edge computing platforms is increasingly being incorporated into a wide range of applications deployed at the edge, in local data centers and in the cloud.

    In general, observability tools are being used to not only improve processes but identify and block suspicious activity. Of course, OT teams have been monitoring edge computing platforms for decades, but observability platforms make it feasible to interrogate logs, metrics and traces to hopefully discover issues before there is a disruption to services. The challenge, of course, is that not everyone on either the OT or IT team necessarily knows how to shape the queries required to discover the root cause of a potential issue. The Splunk approach essentially leverages the skillset of IT professionals that have mastered its platform to address that issue; something most OT professionals are not going to be able to do using their existing tools and platforms.

    One way or another, DevOps teams will soon need to be able to remotely diagnose edge computing issues as the number of workloads deployed on these platforms expands. IT teams are not going to be able to travel to the physical location of every edge computing platform every time an issue arises. In many ways, the rise of edge computing will force a transition to observability tools that will enable IT teams to more proactively manage IT environments rather than responding after a metric that OT teams are monitoring has already exceeded its threshold.

    In the event there is still an issue, observability platforms should also reduce mean-time-to-remediation (MTTR) as visibility into IT environments, including edge computing platforms, is improved.

    It’s not likely that OT and IT teams will ever be completely unified, but as observability platforms continue to evolve, there will be much greater opportunities for collaboration.

  • Forking RHEL! Oracle and SUSE Join the Fight ¦ Silverman Sues AI Firms

    Forking RHEL! Oracle and SUSE Join the Fight ¦ Silverman Sues AI Firms

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: SUSE announces a Red Hat Enterprise Linux fork after Oracle said a similar thing, and Sarah Silverman says OpenAI and Meta have stolen her words. (more…)

  • JFrog Adds Curation Capability for Open Source Software Components

    JFrog Adds Curation Capability for Open Source Software Components

    JFrog today announced it is adding a curation capability for open source software to its portfolio that will use metadata generated by binaries to identify malicious packages and software components that have licensing issues.

    Sharan Hiremath, senior product manager for JFrog, said JFrog Curation is an extension of the JFrog Artifactory binary repository that the company provides to enable organizations to manage their software supply chains.

    JFrog Curation also validates software packages against JFrog’s Security Research library of recorded Critical Vulnerabilities and Exposures (CVEs) and publicly available information to help establish a trusted repository of pre-approved, third-party software components.

    That approach automatically employs the JFrog Xray scanning tool to eliminate the need to individually scan each package before developers employ them, said Hiremath.

    Making sure open source software components are secure is often problematic because developers download them from public repositories that are frequently targeted by cybercriminals. There have now been more than 100,000 instances of malicious software packages discovered in repositories in the last year alone, noted Hiremath.

    In addition, cybercriminals have become adept at creating fake repositories that mimic legitimate repositories; that can result in developers downloading software components infected with malware.

    JFrog Curation takes the shift left concept of application security to the next level by automatically blocking the use of risky open source software packages, noted Hiremath. The JFrog platform will also surface advice on how to remediate any vulnerability discovered, in addition to creating an audit trail to enable organizations to comply with various regulatory mandates.

    While open source software components reduce the cost of application development, from a cybersecurity perspective, it’s the wild, wild West, noted Hiremath. Organizations are trying to bring more discipline to the way software is constructed by adopting DevSecOps best practices, but they need an approach that doesn’t introduce any additional friction into the application development process, he added.

    JFrog Curation addresses that issue by addressing cybersecurity and compliance issues before any open source component becomes part of the build, said Hiremath.

    As regulations to hold organizations more accountable for the security of the software they deploy are being proposed around the world, it’s only a matter of time before organizations must revisit the security of their software supply chains. Cybercriminals have already proven how adept they are at injecting malware into software components that could be used in thousands of downstream applications. In the eyes of regulators, organizations that don’t scan open source software for malware and vulnerabilities are engaging in reckless behavior that will warrant stiff penalties.

    The challenge is that, after giving developers free rein to develop software any way they see fit, organizations are now faced with a challenge that is as much cultural as it is technical. Automated processes will naturally play a key role in curbing aberrant behavior in application development, but there is, as always, no substitute for some good old-fashioned common sense.