staging-devopsy.kinsta.cloud

Category: DevOps Toolbox

  • TechStrong TV: strongDM With Betterment

    TechStrong TV: strongDM With Betterment

    Betterment is a goal-based financial advisory company that provides robo-advising services to help customers make the most of their money, taking away all the complexities of investing and saving.

    In this interview for TechStrong TV, strongDM co-founder and CEO Elizabeth Zalman and Chris Becker, SRE manager at Betterment, joined us to discuss how strongDM helps make things faster, automated and easy at Betterment by tracking and auditing all changes on their system.

    Chris was the project lead for implementing strongDM at Betterment. During this segment, Chris shared his journey of becoming manager of the SRE team at Betterment and the reasons why they chose strongDM to secure access to their data.

    Check out the interview below and follow along with the transcript to find out more.

    Transcript

    Alan Shimel: Hey, everyone. We’re back here at TechStrong TV, and for our next segment. For this segment, we have one of our semi-regulars back here, Liz Zalman of strongDM. Hi, Liz—how are you?

    Elizabeth Zalman: Hi, Alan. I’m well, thank you.

    Shimel: Good, thanks for joining us. And joining Liz and I today is Christopher Becker, SRE with Betterment. Is that correct, Chris?

    Chris Becker: Yep, SRE manager at Betterment.

    Shimel: Very cool. So, Chris, you know, I got a little background on Betterment before we started recording today, but why don’t you share with our audience—what’s Betterment? What do you guys do?

    Becker: So, yeah, the elevator pitch for us is that we’re a robo-advising platform that helps you make the most of your money. So, the idea with us is, we take away all the complexities of investing and saving and we’ve turned it into a goal based platform that lets you invest your money, save for what you’re going for, and try and make the most on top of the market and everything like that.

    So, we—yeah, we try and take all the trouble of saving and all that, we dynamically balance portfolios and things like that for you and, as Liz said, it kinda removes all the distracting stuff with money.

    Shimel: Very cool. And, you know, what’d kinda unique about it is, it’s very goal based, right? So, you gotta tell Betterment what are your goals, what are you saving for, here? I wanna buy a house, I wanna buy a car, I wanna put money away for retirement.

    Becker: Mm-hmm.

    Shimel: I wanna go on—I wanna take 180 days off and cruise around the world. That would be mine, but anyway. [Laughter]

    Zalman: [Laughter]

    Shimel: You know, so, it’s a pretty unique kind of thing like that, and it’s—I guess it’s kinda uniquely situated for, I’m gonna assume, a lot of your customer base is sorta Millennial, Gen Z kinda folks, or do you get, you know, old people like me?

    Becker: [Laughter] We have everyone, all over the gamut. I think—yeah, like, you mentioned the goal based investing, and that’s what’s super important to us. And it helps us sort of like—it helps us make the calculations about how we balance everything.

    Me, for instance, I have a goal that’s like saving for a house, and that’s a much different trajectory than something like retirement for me, based on my age and my income and everything like that. And what Betterment helps you do is just save in the best way to hit those goals. So, if you’re trying to get X amount of dollars by Y date, there’s sort of a formula that does that, and if you’re saving for retirement, there’s a different formula that works with that. It’s all kind of within our platform.

    Shimel: Cool. So—and, of course, the website, let’s get that out of the way, B-E-T-T-E-R-M-E-N-T dot com?

    Becker: You got it.

    Shimel: Okay.

    Zalman: And there’s a mobile app.

    Becker: And there’s a mobile app. [Laughter]

    Shimel: [Laughter] There’s an app. And we should also—hey, full disclosure, Liz has told me not only is Betterment a customer of strongDM but Liz is a customer of Betterment, so.

    Becker: [Laughter] Exactly.

    Zalman: It’s a great product. [Laughter]

    Shimel: Take it with a grain of salt—take it with a grain of salt. [Laughter] Anyway, Chris, let’s talk a little bit about your background, though, now. So, you are manager SRE there, and our audience is very, very familiar with SRE and SREs in general. But how does one become a manager of the SRE team?

    Becker: Absolutely. My background is particularly interesting. I guess, rewinding the clock a little bit, I was—I got into sort of computers and computer management and server stuff, like, way back in high school. I come from a pretty, I guess you could say, classical IT background. I actually have, like, a Microsoft MCP, if you can believe that, like, from back in the day.

    Shimel: I do.

    Becker: [Laughter] Yeah, Server 2003 Active Directory, so.

    Shimel: Mm-hmm.

    Becker: That’s—yeah, I went to a high school with a really great computer program that let a lot of the students get hands on access to stuff, and by my sophomore year, me and my other classmates were sort of managing our computer labs and learning about how to do all that kinda stuff.

    So, that’s like—yeah, I guess I was fortunate in that I got into this really early and it was something that I was really excited about and I was kind of like, you know, that guy in high school with my buddies, we built computers and things like that as well.

    But yeah, and then right out of high school, I went to college and studied Information Technology as well. And one of the things that, like, for me, I’ve always sort of been, I guess, the jack of all trades when it comes to technology—everything server management, a little programming, and things like that. And then out of college, I actually got a job at Warby Parker doing office support, so like, IT support.

    And that’s kind of, for me, where, I guess you could say the automation bug, I got bit by that. Because we were doing a lot of software installations and things like that on people’s machines and we wanted a way to, like, with our two person IT team scale out to support, like, you know, 300 people at Warby at the time.

    So, it was like investigating, you know, more things that we use in the SRE world today, like, things like Ansible and things like automation scripts and stuff like that. I was kind of, like, getting introduced to that as a way to just make it so that our small team could manage and automate installations on a bunch of work stations.

    And then from there, actually, within Warby Parker, I had the opportunity to change to what they called an infrastructure engineer role which, looking back on it now, it was essentially, like, DevOps, right? You know, because DevOps is, I guess, the big umbrella that covers a lot of different disciplines and stuff like that.

    So, from there, I really—I leveled up a lot of my programming skills as well, writing automation scripts and stuff to set up developer work stations. But what was important, I think, in that role for me is that I had a really good relationship with sort of internal customers, as I like to call them, for my IT role where my sort of stakeholders of the things that I built weren’t people that were the traditional customers of the business but rather those that, people that worked or the business.

    So, I think a lot of—like, one of the reasons why I like DevOps and SRE and things like that is because it allows you to have a really close relationship with your customers, because they’re in the same company as you are a lot of the time, so.

    And yeah—and then after Warby Parker, I got a job as an SRE at Betterment and our team was similarly very small. There was, I think when I started, there was four of us and we were supporting an engineering organization of around 80 folks and then, from there, our engineering team grew as well as our SRE team. And now, I’m the manager of that team and so, having been on that team for two years and change before becoming the manager, I had a really good sense of what we liked to do, things we wanted to build or our engineers and platform things as well. So, now, I’m kind of like at the helm and get to control that, which is really, really cool.

    Shimel: Excellent, man. Great story. You know what, Chris, I don’t think your journey is that unusual, to tell you the truth. I mean, I spend my life talking to people like you and Liz and—I mean, what’s different is, you know what, my high school didn’t have a computer lab, my college had punch cards. But, you know, my children, for instance, our local high school here in West Boca Community High, they actually do have, they have actually a Microsoft Certified program. So, a lot of—you know, you become Office certified, big deal, as a freshman. But by the time you graduate, you are Microsoft Certified.

    They might have, I don’t know if they’ve moved over to Google stuff now and more cloud-based kinda things, but there’s a cyber security area of concentration they call it, which is pretty cool, too. And, you know, it’s good. I mean, because so many people of my generation who—look, we took the Internet commercial, right, and built what you see here. But so many of them are self-taught, especially in things like DevOps or cyber or, you know, those kinds of things. And so, it’s good to hear people with real academic backgrounds in this stuff. I think it bodes well for the future.

    But, you know, part of what you guys are doing, obviously, is, you called it infrastructure engineering or at Warby Parker, DevOps. But the real thing here is that we’ve moved, in your lifetime, right, in your career—I don’t know if they ever had the concept of the server closet and the data center on prem. Everything is SaaSOps, right, or cloud or some sort of hybrid of that, right? There might be some third party data center you use where you’re running, let’s say, a private cloud kinda thing. You mentioned Ansible—well, that was back at Warby, so I don’t know if you’re using OpenShift or anything like that.

    But clearly, right, it’s not—this is today’s infrastructure, today’s kinda new stack as I like to call it. What about Kubernetes, cloud native, any of that stuff?

    Becker: Yeah. So, that’s like, at Betterment, we’re using Kubernetes. We’re on top of AWS as well. And I think it’s—I like that you mentioned sort of like old server clouds and stuff. I think the last time I interacted with a physical rack server was probably in college. But, I mean, I grew up punching Ethernet cables and racking and stacking and configuring, you know, Ratarays and things like that. And I think what—

    Shimel: Fun times. [Laughter]

    Becker: Yeah, right? [Laughter] Well, not with Ratarays, but I think—yeah, what I really like about sort of my, I think where my background has been really helpful for me is like, you know, when you enter this new world of AWS and cloud configurations and Kubernetes and stuff like that, like, it’s all still based on the fundamentals. And I feel like I got a really good sense of, and a really good education in networking fundamentals and things like that. Which, if you look under the hood, Kubernetes abstracts a lot away from you, but you still might have to do some kind of site or notation calculations, right? Or figure out, like, some [Cross talk]—

    Shimel: It’s been a long time since did CIDR.

    Becker: [Laughter] And it’s—and things like, yeah, and figuring out, like, we were debugging an issue with network connections and being able to Wireshark and look at the TCP handshake and figure out why we were dropping packets or getting RSTs or something like that. Like, being able to sort of zoom into those things that we don’t necessarily think about a lot these days when we sort of turn on a server in AWS and we don’t really think about—like, being able to sort of lean on that knowledge is incredibly helpful in those head scratching debugging moments and stuff like that.

    Shimel: Yeah. No, no, it’s always good to understand what the underlying technology is about. But part of what—and this is really something strongDM does, right? Part of what we’re doing here is, we want to make it chimp simple. We want it to be fast, automated, easy. That’s a big part of the SRE kinda mantra as well, right?

    Becker: Yeah.

    Shimel: And so, let’s talk a little bit about strongDM over at Betterment, right? How did—was it there when you got there? It sounds like you’ve kinda built the thing, though, you brought it in. Talk to us about the use case, here. What made you go with strongDM, why, what problem were you trying to itch, here—or, yeah, what scratch were you trying to itch?

    Becker: Absolutely. Yeah, no, for us—so, I was actually the Project Lead for implementing strongDM at Betterment. So, I absolutely love it, first of all. It’s one of my favorite apps because I don’t have to think about it ever, and that’s like—if I forget, like, it’s something so seamless and it is so well run that I forget about it, those are my favorite kind of pieces of software. [Laughter]

    Shimel: Well, no, that goes to what we just said. We wanna make it that simple, man.

    Becker: Easy, simple, automated.

    Shimel: I don’t wanna do CIDR calculations.

    Becker: [Laughter]

    Shimel: [Cross talk] [Laughter]

    Becker: Yeah, no—so, for us, we had a need at Betterment, obviously, we’re a financial institution, we have regulations that we abide by and these things, one of these things is auditability and we need to make sure that any changes to any systems that we have and that we run and we operate are auditable, it’s tracked, it’s logged.

    So, for us, strongDM was sort of like the perfect picture, because it allowed us to use that platform to get auditability, we could track and log everything as well as push everything with SSH at the time through one system, which was really nice. And it also had the added goal of not being dependent on our VPN, which we’re trying to get rid of as well, for a lot of reasons. [Laughter] strongDM, yeah, allowed us…

    And also, the thing that I’ve said amongst my team and one of the reasons why I really like strongDM is, it sort of abides by what I like to call the Unix philosophy, right? Like, it does one thing and it does it well. And it’s very predictable in its command line, it’s very predictable in the way that—its interface and it interacts with other servers and things like that. And it was really easy for us to build out this entire system with, you know, literally running two EC2 instances and they’re able to get into hundreds and hundreds of servers every day and have never had an issue, so.

    Shimel: So, Liz, five interviews—this is the longest I’ve ever heard you go without speaking. What’s up? What can you tell us about this?

    Zalman: What I can tell you is that Betterment, I think, is, I’m gonna say top three in terms of forward thinking customers that we have. They’ve pushed the envelope in a variety of ways. They were using SSH, I think, where they had requirements for how they wanted engineers to interact with SSH that we didn’t yet support in the platform. I think the same thing went for kubectl as well or usage of Kubernetes. They were the first to really stress our system—not stress our system in terms of, like, we went down, but stress in terms of, “I wanna automate stuff like this, and you’re doing this, and I need you to get to this.”

    I can’t count the number of times that Chris asked for a REST API. Have you used it yet, by the way?

    Becker: [Laughter]

    Shimel: Tell the truth, have you?

    Zalman: Have you used it yet?

    Becker: Oh, yeah—no, we have. Yeah, we used it.

    Zalman: Okay—good, good, good. [Laughter]

    Becker: Yeah.

    Zalman: They had requirements in terms of directory syncing—yeah, so, it was a pleasure to work with them. And I actually don’t recall—did we meet when you were at Warby, or were you just sort of aware of that relationship?

    Becker: You actually, I think you came in to meet the infrastructure team, like, the Ops team at Warby at one point.

    Zalman: Yeah.

    Becker: Because I remember we were piloting strongDM at one point. I don’t think I was there when the implementation happened or anything like that.

    Zalman: Oh, yeah.

    Becker: But I was familiar with the product from Warby, actually.

    Zalman: Yeah. And Alan, it’s actually interesting—Chris is part of a, Chris used to be based in New York City and in New York, there is this group of infrastructure folks that stays within sort of the B2C world in my opinion and goes to the unicorns. And it was almost borne out of Warby, some went to, like, Harry’s for shaving, some went to Peloton, some went to Betterment—I’m sure I’m missing a couple companies. And they’re almost more forward thinking than our traditional B2B clients are. It’s a very interesting trend.

    Shimel: Yeah. You know, one of my good friends is a guy named Brad Feld out of Boulder, and Brad, he founded TechStars and Foundry Group. He used to be—he’s a big VC. But he’s also an author and he’s written this whole series around what they call startup communities, and it really talks about, Liz, what you were just saying, right? Generally, you get a pool of talent, right, in a geographic region—within a community; it doesn’t have to be geographic, actually, but within a community. And that talent, it’s almost like the six degrees of separation, right? You can see a company has a liquidity event, people make money and they start other companies. Or they develop some really great expertise—in this case, kinda B2C, using real edgy kind of…I gotta stop using the word edgy, because it’s now meaning The Edge. But, you know, kind of cutting edge is what I mean—technology players.

    And they do, that—you can almost trace the DNA, if you will, right, from company to company to company because it’s that same, the same roots of people. And that’s what makes a startup community, because along the way, right, more people get added into the tribe, if you will, right? And that tribe continues to grow. And that’s how—I mean, that’s how tech centers are born, right? You can trace—like Boulder, for instance; Boulder, Colorado—you can trace a lot of what came out of, what’s coming out of Boulder by from when the storage folks were there and IBM had a big facility there and the University of Colorado and Brad coming in and investing a lot of money. There were a handful of companies that had really great outcomes or liquidity events, and it gave rise to this whole—Austin the same way, I mean, by the way.

    Anyway—strongDM. So, Chris, what are you guys using it for? Liz mentioned some REST APIs and stuff like that, but how—what are you using it for, how is it working out, what do you see?

    Becker: Yeah, so, we’re using it for, our sort of highest level use case is any time a developer needs to access a server or a database or a cluster, a Kubernetes cluster that we run and operate, they go through strongDM. And for us, like I said before, that was super important, because we want to make sure that all of the changes to our systems are tracked and audited.

    So, we have—we actually started out just implementing sort of the SSH back end, and like Liz alluded to, we had some very interesting requirements around directory services. So, we use Okta as our identity provider and directory service.

    Shimel: Sure.

    Becker: And strongDM helped us wire that together so that a person on the team, their e-mail address and their Okta identity is used by strongDM so that we can sort of tie all those things together.

    We also had, like, another thing that Liz alluded to was sort of like, we had a ton of servers and one of our unique use cases was, at the time, we were heavily using autoscaling groups within AWS. So, one of the big things with us and strongDM was that the server inventory was extremely dynamic, depending on load of our servers, depending on deployments and things like that. We might have 100 servers in inventory, we might have 200 servers. And they were coming up and down sort of all day.

    So, for us, one of the other interesting requirements is, we needed some kind of automation so that when an AWS would turn on a new server to handle extra server load that that server was automatically enrolled and registered in the strongDM platform.

    So, yeah, again, we worked with strong a lot on sort of nailing down that interface and we’ve written some automation scripts and things like that to get it to register and everything like that, and their admin, their admin token API and everything like that made that a breeze. And then our most recent implementation is actually, we use strongDM for Kubernetes. So, we basically have a, when you need to get access to our Kubernetes cluster or debug an application in our cluster, we actually live provision a container and then your proxy through strong, like, right into that container and all of that is audited as well.

    And all of our developers, actually, they don’t even—the best part is, they don’t even understand, like, they can connect to an old system or a new system and for them, it’s completely transparent. But yeah, it all runs through strong and it all is—and for our compliance reasons, that’s all audited and tracked and logged, which is great.

    Shimel: That’s nice. Two things I wanna highlight here and then Liz, I’m gonna ask you to expand on it. Number one is that, by using strong, what Chris’ team is able to do, as he mentioned, they use Okta—they don’t have to worry about hooking up this person’s identity maybe via e-mail with their Okta identity for purposes of IAM, right, across their disparate network infrastructure, right?

    strongDM here, as part of the proxy process, is lining up that person’s real identity, right, their e-mail or whatever you wanna use as their real identity with their IAM identity—I call it an IAM because it could be Okta it could be others, right? And then—but the person doesn’t have to think about that, and quite frankly, Chris, neither do you or your team, right? strongDM just makes that—again, chimp simple, easy, done.

    Becker: Yep.

    Shimel: That’s number one. Number two—and Liz, this is where I really, I’d like you to comment in—the idea of using it in this Kubernetes system and containers, as Chris is referring to, is that the norm now, or do you think this is kind of an advanced use case?

    Zalman: It’s an interesting question. And yeah, I think to your first point, it’s, we’re acting as an infrastructure API, right? We don’t care what Chris is using as his identity store. We don’t care where his infrastructure is, we’re just connecting the dots.

    Shimel: Yep.

    Zalman: Kubernetes was—I mean, we’ve seen different instantiations of Kubernetes over the years, right? Docker tried with Swarm and it didn’t stick and Kubernetes did. And maybe people were using it, they were trying it on. And I remember, like, the month that it hit production workloads, because I think we got seven or eight requests in one week. It’s like—why don’t you have support for this protocol? And we said, “Okay, time to build kubecl support.”

    Shimel: Time to do that, yeah.

    Zalman: Yeah.

    Becker: Yeah, guilty. [Laughter]

    Zalman: Yeah, you were one of them. [Laughter] It was like plain, plain, plain, plain, plain—mainstream. And so, I think everybody is trying to find some way to systematize and puppeteer everything that’s going on and abstract away a lot of complexity.

    So, no, to me, Kubernetes is certainly here to stay. I see everybody using it.

    Shimel: But is their—because it sounds like their Kubernetes installation, if you will, the way they’re using strongDM is maybe a little different than—is that the standard way that people are using strongDM and Kubernetes or is theirs a little different?

    Zalman: I think Betterment has a particular approach to locking down access which is, you literally get this much access or this much access or this much access or over here, maybe this much access. It’s highly tailored and fine-tuned, and I think that is the—that’s sort of the forward thinking way. Like, people talk about lease privilege and Betterment has actually implemented it across the board for every single thing that somebody needs access to.

    Shimel: That’s great, man. That’s—and Chris, kudos to you and your team for that, right? Because that is—look, you’re in the financial industry, you’ve gotta do what you’ve gotta do there, but that’s an excellent thing.

    Guys, we’re over time, to tell you the truth, but I kind of enjoyed the conversation today, so I let it go. But we need to break out of here. Chris, enjoy—I know you’re about to take, you said, like a week off over that at the shore and enjoy it. I see maybe you’ll get that oar off the wall and actually do something.

    Becker: [Laughter] Some paddle boarding.

    Shimel: Yeah, that sounds cool. Anyway, I’m just thinking, I’m supposed to be going out on the boat tomorrow, but it’s also supposed to rain, so I’m not sure. But anyway, enjoy your week off. Thanks for joining us, thanks to Betterment for allowing you to tell your story here today.

    Liz, always a pleasure to have you on and hear more about strongDM and this whole kind of—you know, these new companies, not necessarily new like today new, but a new way of doing things and a new way of making it easy to bring people on and access assets wherever the infrastructure is, so—fantastic.

    We’re gonna wrap. This is Alan Shimel for TechStrong TV. We’re going to be right back with our next guest.

  • Microsoft Advances DevOps Agenda

    Microsoft Advances DevOps Agenda

    Microsoft, at its online Ignite 2020 conference, has launched a bevy of updates that collectively further adoption of best DevOps practices on the Microsoft cloud platform, including for the first time a preview of an ability to store artifacts created using low-code Power Apps tools on GitHub.

    In addition, Microsoft announced a preview of an update to Visual Studio 2019 16.8 that will add support for GitHub Codespaces, a previously announced capability that automatically creates repositories on GitHub. GitHub Codespaces is currently available in beta and soon will be accessible directly from within Visual Studio.

    Microsoft also revealed it has enhanced the Git tooling experience in Visual Studio to enable more asynchronous collaborations. A GitHub extension for Visual Studio Code enables developers to work with GitHub Issues and Pull Requests directly in the editor. Development teams that need to work in real-time alternatively can employ Visual Studio Live Share.

    A publish experience in Visual Studio also now has the option to generate a GitHub Actions workflow for continuous integration/continuous delivery (CI/CD) environments in Azure resources using the deployment secrets configured in a GitHub repository. GitHub Actions for Azure can now also scan Azure resources for policy violations and vulnerabilities in container images and issues involving Azure Resource Management (ARM) templates.

    Microsoft CEO Satya Nadella told conference attendees the velocity at which applications are developed and deployed has become even more critical as organizations embrace digital business transformation in the wake of the economic downturn brought on by the COVID-19 pandemic.

    GitHub support for Power Apps is especially significant because it will make it easier for so-called citizen developers to collaborate with professionals developers as they jointly develop applications, he said.

    Other notable updates to the Microsoft tools portfolio include a preview of an instance of the Azure Logic Apps workflow platform that can be deployed as a containerized runtime.

    A .NET 5 Release Candidate is also now available, with general availability expected next month. This update adds support to smaller, faster single-file applications that use less memory when employed within microservices and containerized applications. It also includes significant performance improvements, support for Windows ARM64 and new releases of C# 9.0 and F# 5.0 languages.

    Microsoft also announced several updates to App Service to make it easier and more cost-effective to migrate and modernize .NET web apps on the Azure cloud. A new Premium v3 (Pv3) App Service Plan can handle large-scale web apps, supporting more apps per instance and larger, memory-intensive apps with up to 32GB per instance. Microsoft is also making Windows Containers support in App Service generally available and will soon make Reserved Instance (RI) Pricing for App Service available to reduce costs.

    Finally, Microsoft made several Kubernetes enhancements, including a preview of a start/stop cluster feature that will be added to Azure Kubernetes Service (AKS), and announced general availability of an Azure Policy add-on for AKS, which makes it possible to audit and enforce policies across Kubernetes clusters. Microsoft also made generally available Bridge to Kubernetes extensions for Visual Studio and Visual Studio Code that allow teams to develop against microservices within a running AKS cluster to enable debugging existing services without having to reconfigure or deploy a new cluster.

    Nadella said keeping track of developer velocity and overall “tech intensity” within an organization is critical to success. It’s not yet clear how many organizations have put the metrics in place to measure either. However, it is clear that organizations that have yet to fully embrace best DevOps practices are already being left behind.

  • 3 Ways Traceability Boosts Decision-Making, Accountability

    3 Ways Traceability Boosts Decision-Making, Accountability

    Traceability can be a key tool to allow for a streamlined process of complex decision-making

    New software is being developed at an incredible pace to help make our lives easier. This doesn’t change the fact that humans are still held accountable for product development decisions, whether these are made with or without advanced analysis tools. To make informed choices, product development professionals need tools that allow them to see comprehensible information in real-time as change is happening, both within the team’s structure and throughout the system in which their product exists.

    Modern traceability makes it possible to both manage and respond to change in a systematic, auditable and confidence-enhancing way. Below, we will discuss three ways traceability has evolved to support key decision-makers in a number of industries.

    Modern traceability captures when you make a decision

    Decisions often have varying levels of durability. Sometimes, when you make a decision, you know then and there it’s final. Other times, you make what seems to be a minor choice and you end up dealing with the repercussions for years to come. With this level of uncertainty, it is essential to have mechanisms that allow you to see when decisions are made. As I discussed in a previous article, “5 Ways Traceability is Changing to Bolster the Remote Workforce,” this process can be compared to a map. By leading a team through every step of their processes, modern traceability helps product developers reach their goals without any surprises.

    Often, products are expected to be maintained for years. This is significantly more challenging when you can’t properly track where a ruling originated or a change was made. While the team may move quickly in the development process, the record should always live on to provide future context where it’s needed.

    Modern traceability provides people the context of what they’re working on as they go, not after the fact

    Rather than rely on sharing often lengthy and disparate documents or running time-consuming general meetings, traceability allows teams to streamline their collaboration. Mapping out work items, including owners and contributors, gives people a reason to care and to trace those items carefully. It helps everyone know why they’re there, what they are discussing and how to address it.

    Many smaller companies are fortunate to get by using Word documents and other legacy tools for their traceability measures. However, as these companies grow, so do the complexities. That’s why traceability has been evolving to account for the multi-dimensional nature of requirement, test and risk management. For a company that is seeing major growth to be truly successful, all related variables must work together continuously, at scale and across teams. Legacy tools simply do not provide the agile capabilities that modern traceability does.

    Traceability captures and tracks past decisions and allows users to access them

    Traceability is all about relationships. Each product in development has its own particular set of customers, stakeholders and internal team members associated with it. Therefore, traceability is only possible if these individuals can be accurately connected to the items for which they are responsible.

    Knowing who made a decision and what information they accessed is equally as important as the information itself. If you can’t quickly piece that together, your traceability is incomplete. The responsible thing to do is to ease the process by keeping useful records. It doesn’t need to be forced behavior if it’s captured along the way as a byproduct of doing your job.

    Overall, accountability is incomplete and past decisions can’t easily be seen, learned from or built upon without robust, modern traceability tools. It’s much harder to legitimately hold someone accountable when they’re working in the dark. However, when done correctly, traceability can be used as a key tool to support genuine liability and allow for a streamlined process of complex decision-making.

  • TechStrong TV: How strongDM Helps Fintech MANTL With Access Management

    TechStrong TV: How strongDM Helps Fintech MANTL With Access Management

    The fintech space is growing by leaps and bounds, as more consumers shift their financial transactions online for both convenience and necessity during the COVID-19 pandemic. MANTL is a fintech startup providing banks and credit unions with the technology they need to meet the demands of their customers who want to do their banking from anywhere and on any device.

    In this TechStrong TV interview, we speak with Ben Conant and James Qualls of MANTL and Elizabeth Zalman of strongDM to understand how strongDM’s technology is helping MANTL with access management for its backend systems to enable a strong user experience.

    Check out the interview below and follow along with the transcript to find out more.

    Transcript

    Alan Shimel: Hey, everyone. Thanks for joining us for another episode of TechStrong TV. In this segment, we’ve got three people, as you can see, and let me introduce them to you. I’m gonna start with the lady, Elizabeth, Liz Zalman of strongDM. Hey, Liz—welcome back.

    Elizabeth Zalman: Thanks, Alan. Great to be here.

    Shimel: Okay, and then we’ve got two guys. The guy up in space there is Ben Conant—he’s not really up in space, he’s in Tenafly, New Jersey, but hey, you know, with the magic of Zoom, he could be anywhere. Hey, Ben, welcome to TechStrong TV.

    Ben Conant: Hey, Alan, thanks for having me.

    Shimel: My pleasure. And then last but not least, we have James Qualls. James, I didn’t even ask you pre-hand—where are you from? Where are you coming in from today?

    James Qualls: I’m in Harrison, New Jersey.

    Shimel: Okay, so, we’ve got a bunch of Northeast—Liz is up in New York and I probably have the biggest New York accent of all of you guys, so, there you go.

    But anyway, so, we have not—I don’t think we’ve ever covered MANTL on our show or even in any of our staging-devopsy.kinsta.cloud, Security Boulevard, Container Journal, I don’t think we’ve covered MANTL before. So, let’s start off with a little bit about who MANTL is and then, as part of that, James and Ben, tell us what your roles are at MANTL.

    Conant: Sure. So, I’ll start. I’m Ben Conant, I’m the CTO and co-founder of MANTL, and MANTL is a fintech startup that provides banks and credit unions with the technology they need to meet the demands of modern customers. So, you can kinda think of us like Shopify, but instead of helping sort of medium-sized retailers have an online store without an engineering department, we do the same thing for American banks and credit unions.

    So, like, there’s actually 13,000 financial institutions in America, and 96% of those financial institutions are not Chase or Bank of America or SoFi that pump millions if not billions of dollars into technology. And these financial institutions really don’t have access to technology vendors that they like, want to work with, or provide them with what they need.

    So, that’s why MANTL exists. We are trying to reimagine what it can be to be a small bank, medium-sized bank in America or a credit union by providing technology that meets what they need.

    Shimel: Very cool. James, do you wanna—what’s your role at MANTL?

    Qualls: Yeah, so I’m the Director of Engineering here at MANTL and primarily responsible for infrastructure or liability engineering. I have the pleasure of architecting everything that MANTL runs on and we have the opportunity to run on a very modern cloud infrastructure. So, we use Kubernetes, everything’s configuration as code, running as Terraform. You know, we take advantage of as many cloud products as we can.

    Shimel: Excellent. And then Liz, we’ve had strongDM before, but for people who may not be familiar, give us the strongDM story.

    Zalman: The strongDM story is that the way people manage access to infrastructure has fundamentally changed since cloud. You’ve got an explosion of servers, database management systems, cloud providers. Kubernetes came into existence, and so doing it by hand or relying only on Active Directory, it doesn’t work anymore, and so strong creates a single control plane for you to both manage and audit the access of anybody who works for you—a contractor, an employee, service account to any infrastructure that is yours.

    Shimel: Cool. So, for purposes of setting up the discussion of how strongDM works with MANTL, Ben, I’m gonna ask to give us an example of some of this technology and apps that you guys are creating or helping maintain and power for your fintech clients, for your small and medium banks, credit unions, stuff like that.

    Conant: Yeah, so, the first product that we decided to develop for this market of sort of medium-sized banks and credit unions is a way for those banks to have a kind of open an account dot bank dot com website that was completely white-labeled and personalized to their brand, but really felt like signing up for Robinhood or Acorns or one of the sort of big fintechs that have a really slick sign up ________. Because a lot of these banks, you know, they don’t—in order to achieve the kinda deposit growth that they want to achieve, they have to go online, but they’re really suffering from not having a website that anyone would want to sign up for a bank account on, right? So, that was a very specific product, but there’s a huge market for it, so we decided to start with that.

    And then, you know, from a technical perspective, what does that mean? It means, for us, we have node microservices running in a Kubernetes cluster. We’re also talking to post press data stores in GCP, and then we need to control access and have firewalls and UAT environments for the banks to test stuff out using Cloudflare.

    So, you know, strongDM kind of ties into that, because as we grew and as we scaled, we needed to manage internal access to different pieces of our infrastructure, and we were actually thinking about building out our own little app to do this and have SQL access provisioning stored up in a database, but then, you know, through looking at vendors and finding strongDM, it seemed way better to sort of go with a company that was dedicated to providing that.

    Shimel: Very cool. Now, it would seem to me and, you know, I’m not the expert here, you guys are, but Liz, you know, when they’re setting up this sort of account opening app or online account opening app, that seems like something that strongDM would definitely be of much help to, no?

    Zalman: I think it was. I remember, James, I think, in our first conversation, you had very, I think the interesting thing about the MANTL team—whatever, it’s interesting about all my customers, but MANTL has a very clear point of view on the way that they want to do something in order to honor what their customers need. And so, James has always had a very clear point of view of, “We need something implemented like this, for these business reasons. I’ve tried on these other solutions. They don’t work for reasons X, Y, and Z, and so actually, MANTL is one of our most sort of forward-thinking, pushing the boundary customers that exist.

    I remember, James, when it came to setting up HTTP access for your internal employees and talking about header redaction and—I think it was Vault?

    Qualls: Vault.

    Zalman: The hosting of Vault, yeah. I was like, “Alright!”

    Shimel: Secrets.

    Zalman: “Gotta upgrade that.” [Laughter]

    Shimel: Yeah, no—Vault’s huge, right? I mean, you know, Vault is a little-known power—not little-known, but to those in the industry, it’s little-known, but outside of it? I mean, Vault may be HashiCorp’s biggest, you know, product, and they have some great products.

    But so, James, you know, Elizabeth’s kinda thrown you under the bus here, a little bit—it all comes to you. [Laughter] So, you know, how did the mission—you know, what else did you look at? What are the kinds of things, right, and how did you come on strongDM?

    Qualls: Yeah, so, I would say that we have, I would say the top three resources that we needed to gain access to—one, obviously, Vault, which, you know, it’s an HTTP based product, but you know, we could’ve gone with Cloudflare Access, ______ we could’ve gone with Google’s Identity-Aware Proxy. But the bottom line is that it’s much easier to manage and provision access if the system that you’re using is consolidated into one product, and I don’t want to have to manage access to these resources across three or four different products.

    So, we continued to look around and when we found strongDM, the first thing that we provisioned access for was databases. That’s something that no other product on the market does better than strongDM. strongDM covers a number of database protocols, we happen to be obsessed with Post Press. But strongDM supports things like Cassandra, things like BigQuery—so, you’re not necessarily limited in terms of protocol.

    There was an alpha that they were running where we got immediate access to the ability to not only proxy to databases through strongDM but also to proxy to HTTP based workloads. Vault happened to be the use case, and the e-mail that Liz is referring to is when I was talking about the audit logs and strongDM actually logging the Vault tokens in the early alpha and I requested that we have some kind of header redaction. And her team took our feedback immediately and within a very short period of time, they had implemented a fix or that. And to be honest, even in the alpha, the product was very usable. We were able to use it immediately and no one really knew that we were in an alpha, the product just worked. So, essentially, we were able to consolidate access to resources that we had actually been using private tunnel, a Pritunl, to run a VPN to those resources.

    After migrating to strongDM and after finally providing access to all of our resources, we use Post Press, Kubernetes, Vault, and there are some other internal resources that we provide access to all through strongDM, we were finally able to kill that VPN. So, we are an entirely identity-aware system at this point, purely because of strongDM. And then we have an added benefit when COVID hit, we were able to entirely go remote, because we didn’t have to scale a VPN. And this product is super high performance. We haven’t run into any bottlenecks, either, so you know, we’ve quickly grown over the last two years from 11 to almost 50 people now. And we’re all—all of us are presently remote, and all of us are using strongDM.

    Shimel: Very cool, very cool. And I don’t know the answer to this, and I hate asking questions I don’t know the answer to, but is there an application to use strongDM outside of MANTL’s own internal workforce for some of these banks, credit unions, you know, small to medium banks and credit unions as they—because, you know, there’s all kinds of financial regulations that you’ve gotta deal with here from q compliance standpoint and everything else. So, do you use strongDM beyond the internal MANTL team?

    Qualls: Liz and I have had a conversation about that, about potential applications for strongDM’s technology. I would say that probably MANTL’s biggest technical hurdle, when we’re integrating with a new bank is setting up network connectivity. And traditionally, that is, it’s by and large, it is usually an ________ VPN that we’re connecting to. And I see a potential application for strongDM there, although we haven’t attempted to see if it would work, or if one of our customers would actually be—or find that acceptable. [Laughter]

    Shimel: Ben, I’m curious what you think about that.

    Conant: Yeah, I think there is a huge market of banks that, you know, beyond just connecting to MANTL and allowing MANTL to operate with their sort of legacy systems, there is a huge market within banks where they have exactly the same problem, right? Like, people who are analysts at banks need to access lots of different data that’s all siloed in different data sources and different sort of network resources. We’ve heard a lot of our customers really struggling to set up or scale their own VPN solutions. And we’ve also worked with them to kind of, like, try and help mitigate those issues.

    But I think that strongDM is definitely a product that banks themselves should consider adopting, right? Because in the same way that it helps MANTL employees have highly compliant and secure and easy to manage access to the resources they need to do their jobs, banks have that problem but almost way larger than MANTL because they are 500 person organizations or 1,000 person organizations instead of a 50 person, you know, software company.

    Shimel: Yeah. I mean, because that was my thought on it, too, is these banks—I mean, the kinds of issues you’re talking about, James, that you guys are dealing with at MANTL and why you would use a strongDM kind of solution, you know, the small banks, community banks, credit unions—they got this, they have the same issues, right? Maybe some of them still are, you know, on legacy infrastructure, but if anything, I would imagine this whole COVID thing is accelerating their transformation there as well.

    Qualls: Absolutely. When COVID initially hit, you know, we had several banks, you know, just scrambling to scale their VPN infrastructure or bank—you know, some people were not actually even able to go beyond a certain point and they had to reconfigure their entire network topology as everyone was forced to go remote.

    In terms of, you know, in terms of how strongDM can be applied, I think that with COVID being a driving force behind that, I think that there’s definitely an opening for banks to start adopting newer technology, and strongDM is so easy to operate. It’s literally a don’t even think about it product. When we deploy it, we have the pleasure of deploying it on Kubernetes, so, we literally don’t even think about it. Scheduling and everything happen automatically. But strongDM is very well packaged. It’s a small binary, you give it a token, and you start it on any server you want. Yeah.

    Shimel: You know what, Liz, it sounds to me like James is giving you your new sales channel.

    Zalman: I actually just wrote that down. “Kubernetes—we literally don’t think about deploying it.” [Laughter]

    Qualls: Yeah. [Laughter]

    Zalman: No, customers have the best way—customers are the best from a product marketing perspective because they perceive the industry as they perceive it as a practitioner, and I’m—well, we’re practitioners, we’re also vendors. And so, their language is always the best. And they always know the right way to do things, I think.

    So, I can actually think of two product changes that James had requested. One was the header redaction in Vault, but the other thing was when strongDM deployed support for Terraform. The very first thing that James asked for was, “So, it’s great that you have a provider, but I need to be able to read in all of my configurations before I go and add strongDM to it, so when are you gonna support Terraform import?”

    And so, it’s very similar, right? You have practitioners, you have very forward thinkers for, like, “This is the right way to do things, and can you help me align to that?”

    Shimel: Excellent. Hey, Ben, I got a question for you. You know what? I love doing interviews with people like James and Elizabeth and we knock around things like, you know, Kubernetes and Terraform and Istio and maybe Cloudflare and stuff like that.

    But Ben, you know, you’re CTO and co-founder, you’re going to talk to these small community banks and credit unions, and even their IT departments, do they, you know, when you start bandying about stuff like this and this is—you know, does that resonate with them, or do they just say, “Hey, that’s why we have you here. You deal with that stuff. We’re not interested in what Kubernetes and strongDM is”?

    Conant: I think that there’s a very real sense in which the banks that are our customers are really purchasing as a service a large part of their company’s technology stack, right? So, if I’m the CTO or the CIO of the bank, you know, I’m trying to figure out, how do I move to the cloud in a way that is gonna make sense, right? And one big way to do that is to simply purchase MANTL. Because now your entire account opening stack is actually hosted on GCP, and you get all of the security benefits of that. And in the same way, you know, your—you want to be very involved with the decisions of, like, “Well, what technology is my vendor actually running?” Right?

    So, I think that the forward-thinking banks really do take it seriously and ask a lot of questions about our stack. I think maybe more importantly, you know, there is a very intense vendor due diligence process that even the smallest banks in America go through before allowing themselves to work with a technology vendor, right?

    And so, one thing that strongDM really helps us do is, you know, maintain a state of what we call perpetual compliance, right? So, we have an amazing Director of Security at MANTL, and we undergo SOC 2 audits, PCI audits, and other types of security audits every year. And, you know, having the capabilities that strongDM comes with out of the box allows us to, at a moment’s notice, produce the documentation that’s required for a SOC 2 audit for a lot of the stuff that we do. And that keeps our customers very happy. Because not only are they concerned with, “Oh, wow, you guys are on GCP, you’re using Kubernetes, you’re way ahead of the curve relative to the other vendors that we could go with,” but they also like the fact that we sort of breeze through these audits and are able to provide them with answers to the tough vendor due diligence questions that they do ask in the sales process.

    Shimel: Excellent stuff, man. Liz, I’m wondering if what Ben says he’s seeing kinda is parallel to what you guys see as well that, you know, especially dealing within the financial industry and fintech, there is sort of a high bar of due diligence in terms of is strongDM really secure, compliant, no back doors or—you know, I’m not creating a bigger problem by solving, trying to solve another problem.

    Zalman: Certainly. I think it’s twofold. So, companies get to a certain size where—and we’ve experienced this in fintech where they’ve rolled their own for some time, and then it gets to the threshold with respect to security RFIs they need to answer or they’ve hit a threshold in terms of employee base where they say, “Okay, I actually don’t wanna develop a core competency in identity and access management, and I want to offload that to a service provider.” Similar to how MANTL solves, essentially, a hosted web app and flow for credit unions to come into the 21st Century.

    And then, certainly, as part of any diligence process with us, we get asked, “What are your security—you know, what do you attest to? What are the results of your pen tests?” We did SOC 2 type 1 when we were eight people large, because it was such a core part of the sales process. I think customers want to be able to buy something that they have confidence in every aspect—that it provides the services, that it’s high availability and doesn’t go down and that it is as secure and people do what they say. So, certainly, that’s been a big part of the software since 2016.

    Shimel: Wow. That’s a while. Alright. Guys, we’re about out of time, but I realize MANTL, for people who want to get more information on a hot fintech startup out of Jersey there, where can they go on the web?

    Conant: Well, MANTL.com, M-A-N-T-L dot com, and you can actually see on James’ shirt it has the correct spelling of our name. But that—

    Shimel: Nice billboarding, James—good work.

    Conant: [Laughter] If we were both wearing that shirt, then it would’ve been a little bit weird, but I’m glad that it’s James and not both of us.

    Shimel: It wouldn’t go on the ISS anyway, so you know, you’re dressed appropriately, Ben—we’ll let it go.

    Conant: MANTL.com is a great place, there’s also been a number of industry publications about us, talking about how we’re helping in American Banker and others, helping community banks really become fintech companies, which we believe is their future, right? We think that all these fintech companies are trying to become banks. If you look at SoFi or you look at Simple Bank or any of these up and comers—really, you’ve got these small banks that, if they just had a platform to move and really innovate from a technology perspective, they are going to become the fintech, you know, [Cross talk] of the future.

    Shimel: It’s funny, they just, from both sides of the spectrum, converging on a common market is what you’ve got there. But Elizabeth, strongDM, for people who may not know, where do we go to get more information?

    Zalman: strongDM—S-T-R-O-N-G-D-M. Here at strongDM, the DM stands for Dragon Matrix. [Laughter]

    Shimel: Okay.

    Conant: I did not know that. That’s awesome.

    Zalman: Yeah, it came up at our last on-site—although, I gotta say, everybody wants T-shirts, and I’m like, “No, no, no. No T-shirts, I want a trucker hat.” But then that would look weird on camera—James’ shirt is much more effective on camera, so.

    Conant: [Laughter]

    Shimel: Yeah, no—the shirt works, James. Good work. Hey, guys, we’re gonna call it a wrap on this segment here for TechStrong TV. James Qualls, Ben Conant—did I mispronounce it? yeah okay—from MANTL, and of course, Liz Zalman, from strongDM. Thanks for joining us. This is Alan Shimel—we’ll be right back with our next guest.

  • How Logs Can Empower Your CI/CD Delivery Pipeline

    How Logs Can Empower Your CI/CD Delivery Pipeline

    Change is the currency of software success. This need to change and grow is the basis for continuous integration and continuous delivery (CI/CD). Each year, new industries embrace this philosophy of constant change, but without the necessary data underpinning their decisions, every deployment is a risk. When you enrich your software delivery with log data coupled with best practice log management, you mitigate this risk and enable rapid, safe change in your organization.

    Logs are often the most common source of information about an application’s behavior. They provide context as well as result, opening up far more information than a simple count metric will. Despite the immense insight that they can offer, organizations regularly overlook them. Many leave their logs in files on servers, far away from the CI/CD pipeline that needs them. It doesn’t have to be this way; with some best practices, every part of your business can collect, analyze and utilize the hidden knowledge within your logs.

    Add Life to Log Data With JSON

    Logging in an unstructured format dramatically increases the complexity of detecting patterns in your logs. By logging your application output in JSON, you open up the possibility of analysis of all of your logs. This gives you a top-down view of your entire system while still maintaining readability. This empowers your CI/CD pipeline by allowing you to query and filter your logs, which then enables you to focus in on the problem and precisely diagnose any unwanted side effects of your latest change.

    Create Actionable Alerts

    If alerts are defined and channeled correctly, have context and can be interpreted easily, they will be actionable, add context and offer greater value. It is difficult to provide context when a single metric exceeds a threshold, but log lines are more sophisticated. They can include additional information to provide context and allow us to pinpoint the source of the issue fast. This is an essential capability for a company embracing CI/CD.

    Prioritize Your Logs

    Structured logs often come attached with a severity, which indicates how seriously we should investigate an event. An INFO level log signals business as usual, but an ERROR demands immediate attention. Once your logs have these tags, you can make intelligent, automated decisions that will automatically respond to unwanted changes in your system.

    Benchmark Each Version to Understand ‘Normal’

    “Normal” is a complicated idea when working in a microservices architecture. It may be safe to ignore a minor slowdown of a single service, but an unfortunate combination of events can lead to disaster. Benchmarking enables us to see these disasters well before our users. Benchmarking is the act of recording what the normal behavior of an application is. After each deployment from your CI/CD pipeline, compare your new behavior with your previous benchmark. If something is out of the ordinary, logs provide the information you need to act decisively. They provide an outstanding baseline signal for your benchmark.

    Analyzed Logs Can Level up Your CI/CD Pipeline

    Building a CI/CD pipeline is not the most difficult part. Neither is the deployment of new features. In fact, the greatest challenge facing any organization wanting to deliver their changes via a CI/CD pipeline is observability. With a best-practice approach to the preparation, curation and analysis of application and system logs, we can overcome this challenge and confidently change at a pace that propels us to the forefront of our market.

  • PagerDuty Applies AIOps to IT Incident Management

    PagerDuty Applies AIOps to IT Incident Management

    PagerDuty, at its online Summit20 conference today, unveiled a bevy of updates that apply machine learning algorithms across a wide range of workflows across the PagerDuty incident response platform.

    In addition, PagerDuty today announced it will acquire Rundeck, a provider of an IT automation platform that auto-remediates incidents by enabling playbooks to automatically execute whenever there is an issue, for $100 million.

    Jonathan Rende, senior vice president of products for PagerDuty, said the overall goal is to make IT teams more efficient by applying AIOps at a time when organizations are trying to reduce to the total cost of managing increasingly complex IT environments.

    At the same time, Rende said PagerDuty is also moving to reduce the fatigue that inevitably ensues when trying to determine the relationship between the thousands of alerts that all the elements of an IT environment can now generate. The goal is to provide IT teams with more context and actionable intelligence, said Rende.

    As part of that effort, PagerDuty is now integrating change events that occur in code repositories via new integrations with GitHub, Puppet and Evolven. The bulk of IT incidents stem from changes made to the IT environment so via these integrations it will become easier to identify the most likely root cause of an issue, said Rende.

    PagerDuty has also added new capabilities to its Service Directory that employs machine learning algorithms to dynamically surface dependencies between people, changes, incidents and services in real-time. As IT environments become more complex thanks to the rise of microservices, he said it’s now more critical than ever to track relationships across workflows spanning multiple IT teams. The challenge is that existing manual processes can keep pace with the rate of change now occurring in IT environments, Rende added.

    PagerDuty is also moving to reduce the number of alerts that are generated by enabling the PagerDuty Event Intelligence module to surface recommendations generated by machine learning algorithms that suggest ways to group alerts to better streamline incident responses. In addition, IT teams can now pause alerts if they decide to allow systems to auto-remediate before they decide to intervene.

    The company is also extending the reach of an application programming interface (API) for analytics it created to enable IT teams to launch queries against the data collected by PagerDuty. In addition, PagerDuty is making available an Analytics Maturity Model that provides access to benchmark data from more than 13,300 customers to both compare their efforts with other IT teams and discover additional best practices.

    PagerDuty today also announced one-click integration with the Zoom video platform to enhance collaboration, as well as extending its existing integration with Microsoft Teams to include a similar one-click capability.

    Finally, PagerDuty also launched an instance of its platform for customer service teams that also provides enhanced integrations with Zendesk and Salesforce Service Cloud. With more organizations dependent on digital business processes to survive, Rende said the need to automate customer service processes has never been more pressing.

    At the same time, IT teams are struggling to keep pace with the rate of tickets being generated by employees who are now working from home. Put it all together and it becomes abundantly clear that continuing to rely on legacy approaches to IT incident management will simply not suffice.

  • The 2020 DevOps Dozen² Awards Nominations Are Now Open

    The 2020 DevOps Dozen² Awards Nominations Are Now Open

    The DevOps Dozen Awards are back for their sixth year and open for nominations. We are excited to celebrate the hard work and continued success of DevOps leaders, whose achievements over the past year deserve recognition. This year, we have expanded our awards program to include two different DevOps Dozen sections; hence, the name DevOps Dozen² (Squared).

    There are a dozen awards for each section this year:

    • DevOps Dozen Tools and Services Awards — 12 awards recognizing the companies that develop and deliver outstanding solutions to empower developers, DevOps and IT operations teams.
    • DevOps Dozen Community Awards — Closer to the original vision that we had with the DevOps Dozen when we instituted the awards five years ago, these 12 awards honor the leaders who have made a positive impact in the DevOps community.

    Nominations are made by the audience. However, it will work a little differently for the Tools and Services Awards categories than it will for the Community Awards. While anyone can nominate a tool or service for the final phase this year, there is a $250 fee for each Tools and Services nomination. This is meant to cut down on the spam and superfluous nominations we have received in the past.

    We are interested in serious tools/services in the DevOps space. Nominate only those you think are truly deserving of an award. Commercial tools/services are not eligible for the Community Awards and will not make it through to the finals.

    Winners will be chosen from among the finalists, with general public voting accounting for 40% of the final total and our judges’ selections for 60% of the total.

    The last day to submit your nominations is Oct. 15. To vote, follow the steps outlined on the DevOps Dozen² website.

    Meet the Judges

    Who are this year’s judges? You may already be familiar with their names. The 2020 panel will be lead by:

    • Alan Shimel, founder and editor in chief, staging-devopsy.kinsta.cloud
    • Jayne Groll, CEO and co-founder of the DevOps Institute
    • Mitch Ashley, CEO and founder of Accelerated Strategies Group
    • Charlene O’Hanlon, managing editor, MediaOps Inc.

    The 2020 DevOps Dozen² Categories

    DevOps Dozen Tools and Services Awards

    1. Best End-to-End DevOps Tool/Service
      Consolidation in the DevOps space has led to a greater selection of platforms offering end-to-end solutions. This award honors the platform with the most diverse and robust solution for DevOps teams.
    2. Best DevOps Repo/GitOps Tool/Service
      Git has led to GitOps, which has become an integral part of the DevOps toolbox. This award is presented to the most outstanding Repo/Git/GitOps tool.
    3. Best CI/CD Tool
      This award recognizes the best CI/CD tool that helps teams to deliver quality code better.
    4. Best Value Stream Management Tool
      Value stream management has come into its own as an important tool for measuring the business value of DevOps and application development. This award recognizes the value stream management tool that most effectively helps visualize the value stream, track metrics and measure improvement.
    5. Best Observability Solution
      This award recognizes the best observability solution for observing and monitoring to understand the performance of individual components and systems and entire applications.
    6. Best DevSecOps Solution
      This award honors the best DevSecOps solution, which enables security to be included earlier and continuously throughout the SDLC.
    7. Best Testing Service/Tool
      Testing is a mainstay in the DevOps toolchain, and this award recognizes the best testing tool for ensuring the quality of code.
    8. Best Kubernetes Platform/Service
      The adoption of containers has paved the way for an entire solutions ecosystem supporting and enhancing the container technology. Kubernetes is perhaps the most widely recognized and utilized tool in the space. There are many platforms and services that offer Kubernetes-based solutions. This award honors the best Kubernetes platform/service available.
    9. Best Cloud-Native Security Solution/Service
      The cloud-native movement has taken the IT world by storm due to the depth and breadth of the solutions available and the benefits of building applications and services specifically for cloud-native environments. This award recognizes the best tools, solutions and services considered cloud-native.
    10. Best DevOps for Mainframe Solution
      Mainframes are far from being the dinosaur of the IT world, and a variety of solutions are available for enabling DevOps practices in mainframe environments and hybrid environments. This award recognizes the best of them.
    11. Best DevOps for DataOps/Database Solution
      Databases often have been left out of the DevOps conversation, but that is changing. Recently, the whole concept of DataOps has started gaining traction. This award recognizes the best solution in the database for DevOps and DataOps categories.
    12. Best New DevOps Tool/Service Provider
      This award recognizes the best new service provider or tool that has brought innovation to the DevOps space in the past year (must be less than 24 months old).

    DevOps Dozen Community Awards

    1. Best DevOps Industry Implementation
      This award honors organizations that have successfully adopted and implemented DevOps principles and practices.
    2. Best DevOps Survey/Analysis/Research
      This award recognizes research that has significantly and positively impacted the DevOps community.
    3. Best DevOps-Related Video Series (video)
      This category highlights the most entertaining, educational and inspirational DevOps video series—those with the most engaging and highest-quality content.
    4. Best DevOps-Related Audio Podcast Series
      Which is your favorite DevOps podcast from this year? There are many great DevOps podcasts sparking some interesting discussions on a multitude of topics from CI/CD and testing to DevSecOps, Kubernetes, containers and more.
    5. Best DevOps Book/eBook of the Year
      Each year sees a plethora of well-crafted DevOps-related books and ebooks. This category highlights the most popular and best read of the year.
    6. Top DevOps Evangelist
      This category is one of our favorites. There are so many great evangelists who spread the DevOps gospel and we want to know who does it best. Nominees can work within the DevOps space or outside of it.
    7. Best DevOps Transformation (non-vendor)
      In a year in which digital transformation became a must-have for survival, which organizations stood out in their efforts to transform their business through DevOps?
    8. Best DevOps Virtual Event of the Year
      COVID-19 has changed the game when it comes to hosting events. In 2020, virtual events have become the new norm, reaching a global audience while everyone stays safe at home. Which DevOps virtual event stands out from the others?
    9. Most Innovative DevOps Open Source Project
      Open source projects are meant to promote innovation and increase efficiency, velocity and quality. While there are many great open source projects out there, the best ones are those that create a community of people who work on and with the technology and support each other.
    10. DevOps Executive of the Year (non-vendor) This category celebrates excellence among DevOps leaders at the C-suite (or equivalent) levels.
    11. Best DevOps Presentation of the Year
      This category recognizes the best DevOps-themed presentation from the many (virtual) conferences during the year.
    12. Best staging-devopsy.kinsta.cloud Article of the Year
      staging-devopsy.kinsta.cloud publishes multiple new articles every day. Which was the best article from 2020? Let us know so we can recognize the author.

    All the solutions nominated to the Tools and Services Awards will automatically be registered into the DevOps Tools Guide authored by MediaOps and Accelerated Strategy Group. This initiative is our effort to create a comprehensive listing of tools and tools vendors to help end users better understand the DevOps market landscape.

    With so many talented and passionate leaders in our community, choosing a winner is no easy task. Though not everyone can take home the award, I truly believe every single person who is a part of this great community and has done some remarkable work to empower and support other members of the DevOps community is a winner. By acknowledging them in our award process, we want to highlight their work and show how important they are in the DevOps space.

    For more information on the awards, please visit the DevOps Dozen² website. If you have any questions regarding entry process, awards, timing or any technical issues regarding the website, please contact us at DD@devops.com.

  • TechStrong TV: Credentials Management, with strongDM and Software.com

    TechStrong TV: Credentials Management, with strongDM and Software.com

    Now more than ever, businesses around the world should pay close attention to how they manage their credentials and control access to their sensitive data, in order to protect it from being hacked or compromised in any way.

    During this interview for TechStrong TV, Mason McLead of Software.com and Elizabeth Zalman of strongDM, discuss the great responsibility of safeguarding credentials and how strongDM has proven to be an effective credentials management tool, helping Software.com to control access and keep their data safe, even when working from a remote environment.

    Software.com is a data platform dedicated to help developers and engineering teams learn from their data, increase productivity and improve their coding routine.

    Check out the interview below and follow along with the transcript to find out more.

    Transcript

    Alan Shimel: Hey, everyone, thanks for joining us on another episode here of TechStrong TV. We’ve got our recurring guest friend, Elizabeth Zalman, of strongDM joining us, here—hey, Liz.

    Elizabeth Zalman: Hey, Alan.

    Shimel: And joining—hi—and joining Liz and I is Mason McLead of Software.com. Hey, Mason, welcome to TechStrong TV.

    Mason McLead: Hey, thanks for having me.

    Shimel: Alrighty. So, Mason, you’re the new kid on the block, and we’re gonna give you a chance to lead things off. I think a lot of our audience has certainly heard of Software.com if they’re not really, really familiar with it. But for those who aren’t, you know, why don’t we give them a little background?

    McLead: Sure. I mean, high level, Software.com is a developer data platform, and our aim is to create and provide insights for productivity for individual developers as well as engineering teams. And we do this by gathering telemetry data from inside of code enders and then layering on contextual data from other parts of the software development life cycle, like how many hours you’ve been at meetings, what kind of music do you listen to while you code, do you code during work hours, after work hours, at the office, remotely—and then really pain the full picture of where your time goes and how it’s impacted by these external inputs. And that’s what we provide back to developers as kind of the product there, so you can really see how your time is impacted and what you’re doing throughout the day in order to improve.

    Shimel: Very cool. And then, Mason, we should tell people or at least give them a little background—what’s your role at Software.com?

    McLead: Yeah, so, I’m the CTO here at Software, just joined this year. And you know, it’s an exciting time to join in. The product’s been out for a while, and so, there’s a lot of proven track record and it’s just taken to that next level, and I’m excited to be here.

    Shimel: Very cool. And, you know, we do have Liz from strongDM here, so the obvious question is, you guys are using strongDM, I’m gonna assume. Talk to us—why? What’s happening that strongDM was a solution for you?

    McLead: Yeah. I mean, the main thing—and this is actually the second time that I’ve signed up to use strongDM. I used them before at my previous company I worked at, Fair, it’s a fintech company. And the real premise is that, you know, at Fair, it’s in fintech, so we gather a lot of personal information. At Software, it’s a lot of information about your behaviors and all of that stuff.

    And it’s just personal information, and I feel like, in the role that I have of being CTO, I have a responsibility to protect that, and I really, personally, feel like it’s a moral obligation to protect my users’ data. And strongDM helps me do that in a number of ways. And so, it’s been a rock steady foundation that I always build into the tech stack whenever I go and build something now.

    Shimel: Excellent. So, you know, you opened the box, we gotta see what’s packed inside—what are the number of ways why, you know, you can’t just leave us hanging there.

    McLead: Sure. [Laughter] Yeah, I’ll enumerate. So, for getting access to developers—and the classic way that you do it for databases, right, is you have credentials that you share amongst however many developers need access to that database. Which means, as soon as you rotate that password, if you do, then you’ve gotta update everyone else. And now you’ve got copies of passwords everywhere on people’s local machines. And not everyone stays at a company for their entire life, so whenever they leave, you must do something about that. Like, that credential is now out in the wild, and there’s not very many good tools to manage that.

    So, strongDM really fills that gap really, really nicely, that use case. So, we can issue credentials automatically for people as they come on. We use Gusto for our HR stuff. So, if they’ve got an API, we can just—as soon as someone comes online, we can issue them credentials to data stores immediately. And then, if they go offline to their contractor, they’re immediately revoked. And the perimeter of the security just gets really tight and really well controlled, which is such a relief for me.

    And then on the other side, securing access to servers via SSH, and we’re also deploying a new Kubernetes cluster, controlling QTTL access, and having all of that be auditable, because we also have some contractors working on our database so we can see what commands they’re running, what queries they’re running, and be able to trace that all back. And being—like, most of the time we’re not, of course, looking at the audit trails. It’s really, like, knowing that it’s there if something happens, we’ll know exactly how to trace that back.

    Shimel: Love it—very, very good stuff. And, you know what, I applaud your personal, you know, taking this, I’m gonna call it fiduciary duty or responsibility for safeguarding people’s really personal data—you know, for taking it personally like that, no pun intended. And, you know, maybe if more people did, we’d be better off.

    Though, look, no one ever raises their hand and says, “I wanna be breached,” right? And even sometimes doing everything you can, it’s still not enough in order to prevent these things, but you can certainly take precautions, you can make it harder by using tools like a strongDM and so forth. So much—I had a friend of mine call me last week, an old client of mine from my security days who, unfortunately, they got to pretty bad. They got into his Charles Schwab account, they got into his payroll account, they got into all of his e-mails. And he’s in the merchant processing business, so there was merchant applications—it was crazy. And, you know, he was beside himself. On the other hand, he didn’t use a password manager—you know, typical kinda things you hear. So, it happens.

    Anyway, but it’s interesting, you know, that across verticals, right, from fintech to what you do now at Software.com, though the mission may have changed in terms of the business, you know, goal, the mission in terms of protecting data hasn’t, is still relatively the same.

    Liz, is this—is Mason’s experience, Mason’s motivations typically, you think, for strongDM customers across the board?

    Zalman: I think our customers feel deeply that there is—our customers feel deeply that there is a right way to do things. I think Mason, as an early customer of ours and at Fair, I think came in it from day one, just had a very particular point of view on how things should be done. I think he was actually one of the first customers to even be deploying Kubernetes in a production environment.

    And so, our buyer is the head of infrastructure or infosec or DevOps as a way that they want to do things, it’s always very forward thinking. And finding a way to do them in an automated fashion that sort of fits into these, you know, Infrastructure 101, the ABCs of how to set something up in a way that helps them scale is probably a core precept that they have. I mean, Mason, how big are you guys now at Software when you inherited the team?

    McLead: When I inherited the team, there were five other engineers and we’ve grown that up by about 50%. So, it’s still small and growing, but you know, I think no matter the size, the problem is still the same. And, for me, the solution’s been the same, too.

    Zalman: Yeah. Yeah, so, at Fair, I think you guys were maybe 100 people who were touching some form of infrastructure, and here, Mason’s starting, he started at six. So, yeah, certainly, it’s like, when you know that there’s a good way to do something and a right way to do something, you start it right at the beginning.

    Because, to do that when you’re a thousand people is—you can do it, but it’s a two year process of rinse and repeat sort of work group by work group. You do it right from the start and you’re off to the races.

    Shimel: Well, if we all had the luxury of starting in a green field, right, and starting it from the beginning as it grows—what a wonderful world it would be, as they say. But unfortunately, we don’t, right? There’s a lot of brown field—muddy brown fields out there.

    Mason, let’s talk a little bit—and Liz as well—let’s talk a little bit about, you know, so, this whole COVID thing comes up now, right? We’re all here, you guys are in your houses doing this interview—what, if any, effect has that had on the business and has strongDM helped, hindered, not been a factor in that?

    McLead: Yeah. So, actually, Software.com was fully remote from the very beginning. So, internally, it hasn’t made a big difference in how we work. I think it’s an upgrade—like, going to strongDM for access control is an upgrade, no matter how you work. I think it’s probably more important whenever you’re remote—I mean, people have central VPNs and those sorts of things, but it’s still, building that defensive wall in strength and depth is still the right move there.

    And so, internally, it hasn’t affected us too much, just because of the way the company is set up. For the business itself, though, it actually highlights a big advantage that we can provide as part of our products, of being able to see productivity metrics between remote and in office. Because people are gonna have a big choice coming back in from COVID whenever this is resolved of how much office space do I actually—do I need an office? And then how do they actually guide that discussion and that decision when you don’t have data around it? And that’s where we can really fill a gap there between knowing how people are working remotely and how they’re working in the office, so you can have a real comparison.

    Shimel: Wow, what a great use case that is. I’m sure that was one of the use cases they drew up when they were starting the company, right? If there’s a worldwide pandemic and everyone’s working from home, wouldn’t it be great to know how well they’re working from home?

    McLead: Yeah, it’s amazing the foresight we had. [Laughter]

    Shimel: Yeah. But, nevertheless, it’d be nice to have there. You know, I wonder about that issue, question myself, though. I mean, here, you know, we’re a small company, we’re about 23, 25 people, and everyone’s remote now except for me and my video director and, you know, we’ve—we have three and a half years left on our lease. Actually, September, it’ll be three years, so three years left on the lease. So, I’m stuck with, you know, this for three years. But I don’t see people running back, and if they do, they might just come in a day or two a week.

    And, you know what? That’s fine. As the CEO here and founder, it’s fine with me. We’re working fine remotely. No one needs to necessarily be here to do their job, though I do think there is—there is some good you get from having people in the same office, whether it’s the water cooler or hallway talk or what have you. But that is—you know, that’s the new normal, that’s the new now, and I think we need to get used to that.

    Liz, you know, again, in any situation there are winners and losers. But this whole COVID thing has—you know, not your fault, obviously, right, but it’s given people a reason to say, “Jeez, I need something like a strongDM,” right? “I want to spin up my remote force” or, “I want to—we need to secure it better” or what have you. What are you hearing from companies? You know, Mason’s a two time user already—but first time people, what are they saying when they come by?

    Zalman: Yeah, Alan, I am the mastermind behind COVID, you just—

    Shimel: Yeah, exactly. [Laughter] Dr. Evil, okay—we got ya! [Laughter]

    Zalman: No, yeah, Mason is certainly in a subset of companies that enjoys being remote from the start and being able to build that way. We saw a doubling down of an existing customer base where even if they had remote or satellite teams, now everybody became distributed. But also, new people reaching out because traditional companies, you can’t rely on the corporate network as a perimeter any more. It’s dead. It’s just—it’s completely gone and you had to switch on a dime, and what do you do?

    And I can’t even imagine—you know, by deploying strong, oftentimes, you can just throw out the VPN. Many customers choose to do that. And I can’t even imagine what these poor IT folks were dealing with in old companies who, you just had to go into the office, there was no other way of working, all of a sudden getting all these requests, “I can’t connect to the VPN” or any sort of IP-based white listing. Oh, my God, to get access to privileged systems? My heart goes out to them.

    Shimel: Yeah. No, you know what, I actually did an interview last week from an analyst based up in Canada who just put out a report about, you know, how COVID caused a short term increase in people buying concentrator licenses and more VPN capacity, but how long-term, that’s probably throwing good money after bad in terms of out the window. I mean, you gotta just—you gotta re-architect is the bottom line, there.

    But it’s hard to do an engine transplant in the middle of the race. And so, people get stuck, you know, in those situations.

    Zalman: Well, as one of my investors is fond of saying, “You gotta build the Ferrari while you’re driving it.”

    Shimel: Yeah, and that’s—ain’t it the truth? I hear ya. Mason, what about you guys at Software.com? I mean, are you just ready for the new normal here and you were remote, anyway? Because there’s a part of—look, we can function in this environment, that’s fine. But are your customers functioning in this environment? Because ultimately, if they cease to function, no matter how high functioning you are, you know—big deal.

    McLead: Yeah. I mean, developers are customer based, so we’ve got to make sure that is continuing to function, yeah. You know, we’ve actually taken surveys on this for our customer base, which is nearing about 100,000 and the majority actually said that they would want to do a bit in the office and a bit remote. So, kind of a mixed use case, there. And I think that that fits really well to get the advantages of being able to control your own schedule and control where you are with the in person being able to white board together, being able to really come together and think of new ideas and I remember all the hours that I spent in the office at Fair with a tight group of people developing all the stuff that we did there, and there are definitely some advantages to just being able to randomly yell out to the person in the other room to go and fix something.

    So, you know, I think that it’s gonna be a mix of that, and you’ll have some people that’ll wanna go full remote once they’ve had the taste of it. Like, I really enjoy it. Like I said, and you can tell by the bare room behind me, I’m moving this week, actually, and it’s really interesting to start to feel the effects of being able to live anywhere and work the same job. Like, having it completely disconnected is a new feeling for me, and it’s weird, but I like it. And so, you know, I think [Cross talk] –

    Shimel: I think we’re gonna see it.

    McLead: Yeah.

    Shimel: Yeah, no, I think—look, I read an article, I forgot what percentage rents in San Francisco are down, right? I think we’re gonna see rents going down in a lot of the cities because people are realizing where they work from physically is not necessarily tied any more to where the company is based.

    Now, you still want to hire people with skills in places like New York and San Francisco or Austin or Boulder. They still have high concentrations of people with skills, so it pays to maybe put an office there. But, you know, I’ve had this conversation with Sid Sijbrandij, the CEO/founder at GitLab. They got, like, 1,200 people in 1,200 offices, because they don’t have an office. Everyone, including Sid, works from home, and his thing is, you know, for newer companies, it just doesn’t pay, because you know, once you put an office down, you’re saying, “That’s it, I’m only gonna—I’m confined to that talent pool.” Where, if you wanna swim in—you know, have choices in a wider talent pool, you’re not big enough to open an office wherever you’ll find talent.

    And so, you know, a remote force is probably the way to go. I mean, good for Liz and the strongDM team, right? But that’s—I think that’s part of where we might be headed.

    McLead: Yeah, and I think if you limit yourself to one specific geographic region to hire from, you’re limiting the upside of your entire company.

    Shimel: Yep.

    McLead: And incurring costs along the way. [Cross talk]

    Shimel: Absolutely.

    McLead: For the corporations that can do it.

    Shimel: Right, I think that’s an outdated look.

    McLead: Yeah, I think so.

    Shimel: You know, I think that’s where we’re headed. Anyway, guys, we’re about out of time. Mason, I told you the 20 minutes goes quick, because usually Elizabeth talks so much, she takes over the whole conversation—no, she doesn’t. We’re just kidding.

    But I’m gonna give you each a chance to say something before we log out, here. Mason, you’re the new kid on the block, so why don’t you go first?

    McLead: Okay. Well, again, thank you for having me on, and it was a pleasure to talk about what we do at Software where it’s a developer data platform designed to help developers individually to see where they’re spending their time, look at productivity metrics, and improve, as well as helping manage the entire software development life cycle from input all the way through output. And thanks to Liz for strongDM and strongDM for a great product that helps us secure our data. It’s definitely a huge benefit that I put into every stack that I build now.

    Shimel: Very cool. Elizabeth, I’m giving you the last word.

    Zalman: I think Mason just summed it up for me, although I think my hair is better than his, so, I’m gonna retain that for me. [Laughter] [Cross talk]

    Shimel: I think both of your hair is better than mine, and we’ll leave it at that. [Laughter]

    Zalman: I don’t know how his looks so tight—dude, who’s cutting your hair?

    McLead: I cut it. I learned how to—I watched YouTube. I missed this part here, but—

    Shimel: Yeah, no—you know what? I think that’s been a thing. I mean, yeah. It’s easier for guys than it is for gals, I will say that.

    Zalman: I commend you, Mason, both on your haircut and your choice of infrastructure technology products. [Laughter]

    Shimel: Very cool. [Laughter] Guys, on that note, we’re gonna call it a wrap. This is Alan Shimel for TechStrong TV. Elizabeth Zalman from strongDM, Mason McLead from Software.com—thanks for being our guests. We’ll be right back with our next interview.

  • Tricentis Extends Testing Reach to ServiceNow Applications

    Tricentis Extends Testing Reach to ServiceNow Applications

    Tricentis has extended the reach of its portfolio of testing tools to now include software-as-a-service (SaaS) applications from ServiceNow.

    Martin Klaus, vice president of product marketing for Tricentis, said testing has become a larger issue because in addition to patch updates ServiceNow is now on a cadence to deliver to two major updates to its platform a year.

    More IT organizations are now leveraging the ServiceNow platform to build and deploy custom applications. Rather than build an entire application from the ground up, many organizations are accelerating digital business application deployments by extending functionality already provided by a SaaS application provider. All the updates regularly made to those applications create a testing automation challenge that can be addressed using Tricentis Test Automation for ServiceNow, said Klaus.

    Deployed natively on the ServiceNow platform, Tricentis Test Automation for ServiceNow provides access to capabilities such as point-and-click recording, real-time playback of tests and automatic test case creation, he said. The goal is to speed up the testing process for ServiceNow applications by running hundreds of tests generated by machine learning algorithms in seconds versus what previously would have required days to complete, Klaus added.

    At present, there are more than 6,200 enterprise customers running ServiceNow applications, many of which are employing DevOps processes to build and extend ServiceNow applications. ServiceNow has also extended its DevOps focus via alliances with providers of DevOps platforms.

    The bulk of the use cases for ServiceNow involve IT service management (ITSM). However, ServiceNow as of late has been expanding its focus on digital business applications by, among other things, adding additional workflows applications, including a workplace contact tracing application aimed at human resources (HR) teams.

    The more ServiceNow applications an organization adds, the more complex the testing challenge becomes, especially as workflows start to extend across SaaS applications from different providers. For example, it’s not uncommon for organizations to build and deploy custom applications spanning ServiceNow and SAP platforms, said Klaus. Tricentis provides a set of testing tools that can be applied across both multiple SaaS application platforms as well as the custom applications a DevOps teams builds and deploys on their own, he noted.

    As organizations depend more on digital business applications, disruptions caused by updates to the underlying software components upon which a workflow depends becomes a bigger issue. In many cases, it’s not employee productivity that is affected. Organizations are now driving revenue through digital business applications that can’t be generated if the application isn’t available. As a result, there’s a growing focus on testing updates to digital business applications.

    It’s hard to say to what degree SaaS application platforms will become part of a larger DevOps pantheon. However, the number of applications being built and deployed using low-code/no-code tools that extend these platforms has increased. There might even come a day soon when the backlog for deploying these applications becomes a bigger issue than it is today. In the meantime, it’s clear many DevOps teams are going to have to expand their definition of what constitutes a deployment platform.

  • TechStrong TV: strongDM Helps Kustomer Go Remote

    TechStrong TV: strongDM Helps Kustomer Go Remote

    For a procurement process to be effective, the relationship between the customer and the product team is almost as important as the functionality and features of the product itself.

    During this interview for TechStrong TV, strongDM CEO Elizabeth Zalman and Steve Flinchbaugh, senior SRE at Kustomer (a customer support CRM platform for managing high support volume effortlessly), talk to us about the strong bond between the Kustomer team and the support team at strongDM.

    Steve explains how Kustomer uses strongDM to empower its remote teams, how it fits into their development workflow and how strongDM has made his and his team’s lives easier.

    strongDM allows remote teams to easily manage access to databases, servers, Kubernetes clusters and web apps.

    Check out the interview below and follow along with the transcript to find out more.

    Transcript

    Alan Shimel: Hey, everyone, thanks for joining us for this next session here on TechStrong TV. This is gonna be a really good session; it’s something we haven’t done before. I have two guests, which we’ve done before, but we’re really gonna zero, we’re gonna take two different companies and see how they interact and how that helps, especially given everything that we have going on around us.

    Let me introduce my two guests to you first. First of all, we have Elizabeth Zalman. Elizabeth is the CEO of strongDM. We’ve done—I think we’ve done at least a podcast and so forth with strongDM before. Liz—hey, welcome, thanks to TechStrong TV.

    Elizabeth Zalman: Thanks, Alan. Nice to be here.

    Shimel: Thanks for joining us. Okay, and then joining Liz and I is Steve Flinchbaugh. Steve is with a company called Kustomer, and that’s spelled with a K, and he’s gonna tell us about it, as well as his position and background there.

    Steve, why don’t we start off with you, okay? Kustomer with a K—what do you guys do, and what do you specifically do at Kustomer?

    Steve Flinchbaugh: Sure, Alan. Thank you for having me. So, I’m a senior SRE at Kustomer, and what Kustomer is, is a CRM for customer support. And we really are built off of our platform. There’s a lot of intelligent automation that allows our customer service teams, our customers, to give the best possible customer experience they can and accomplish their customer service goals through, ideally, less staff and less effort using our platform.

    My goal as the senior SRE is to ensure the reliability of our platform, the kind of implicit trust that everyone expects, and to make the job for our developers as easy and seamless as possible.

    Shimel: Cool. So, a real, live SRE right here on our show—very cool. You know, there’s a lot—I don’t know if you guys have seen, there’s been a lot of articles written lately in the press around, you know, are we overblowing the whole SRE thing, right? And is it real, how real, and where does it fit in and all of these other things.

    But anyway, Liz, we gave Steve a good chance to tell us about Kustomer with a K. Let’s give you your chance—tell us about, remind our audience about strongDM.

    Zalman: Yes. Steve is one of my favorites, by the way—so is Kustomer with a K. They’re one of the most forward thinking customers with a C that we have. [Laughter]

    Shimel: Okay. Very good play on C/K, there. [Laughter]

    Zalman: strong is a—it’s a proxy, it’s a control plane, it’s insert whatever word you want there and it lets you manage and audit access to servers, to databases, to Kubernetes clusters, to whatever infrastructure you’re running that is firewalled. So, typically, that access is managed by hand, or keys are sitting in a box or a vault somewhere, and we let you collapse all of that down into a single control plane for both the management and auditing of that access

    Shimel: Yep. And I just—look, I feel like we have to mention that, you know, given the whole COVID situation and working from remote, you know, strongDM has been a real godsend to a lot of companies who had to kind of flip a switch and empower remote people to have access and stuff that, you know, from a different place on different machines, devices than they had before.

    So, though strongDM had a great case before COVID, right, a great use case, post-COVID, Liz, how many—you know, I’m not asking for the amount of customers, but I mean you’ve seen a lot, I imagine you’ve seen a lot of activity from customers who are, have switched to remote and need help with that.

    Zalman: Yeah, certainly, it was challenging before. I think most companies today have remote workers, anyways, or multiple office locations. With the lockdown with COVID, I think what ended up happening is, for companies who rely on the corporate network itself as the perimeter within the building, that perimeter is now gone, and so, what do you do? If you’re using something that’s IP-based, all of a sudden, your IP surface area went from, like, two to 5,000 if you’re an enterprise.

    So, we certainly saw a doubling down of existing customers and an increase in interest in the product. I might ask Steve, like, could you have imagined what—I mean, what was it, like, you guys have an office in New York…do you guys have remote workers? I don’t—yeah.

    Flinchbaugh: Yeah, so, we have an office in New York and we recently—that’s our headquarters—and we recently acquired some office space down in Durham, North Carolina. That’s kind of our first official outpost, and that was kind of our introduction to people outside of New York, and it was—this was after we had adopted strongDM, and I have to say, it was entirely seamless. And ever since the pandemic began, I know it’s good because I haven’t thought about it that much. strongDM is—

    Shimel: That is always the sign. You know what—sorry—I was in security for 20 years. They didn’t call it cyber then, it was InfoSec, but we always used to say, “If they didn’t think about it and it didn’t hit anyone’s radar screen that they—you know, that was a good thing.” When people hear about security stuff, it’s because something bad happened.

    But I wanna make a point here, though, and that is—Steve, it’s my understanding you guys didn’t, you’re not a Johnny come lately to strongDM. You guys were using this well before COVID and the present situation. Talk to us—let’s go back in time to then, it was about a year and a half ago, right?

    Flinchbaugh: Yeah. And actually, if you don’t mind, I’d like to go even further back in time, about four years ago—

    Shimel: Be my guest.

    Flinchbaugh: – when I joined Kustomer.

    Shimel: Okay.

    Zalman: You joined it four years ago?

    Flinchbaugh: Four years in September.

    Zalman: Wow! How big were you then?

    Flinchbaugh: I was, I think, employee number 16. We were still in stealth mode, we weren’t charging our customers yet, and Steve comes into Kustomer bright-eyed and bushy-tailed. But at this time, we were running agents on our servers to provide SSH access to our engineers, and I was charged by the CTO to stand up a VPN, which I had never done. And this came in the form of open VPN, and I had to manage the certificates and the log-in and the users and every employee that joined the company, I had to on board them and configure a profile.

    And then, fast forward to, I think it was about a year ago, where the CTO again came to us and said, “Hey, there’s a really cool company that I think we should take a look at. We have a mutual investor, and they have a lot of cool features that we haven’t had for the past three years.” So, we had a couple really cool meetings with Liz and her team. I could immediately tell that we were working with a team that knew what they were talking about, they were technical, they were fun to work with and they kind of just got what we needed out of the tool.

    And now, today, there are so many things that are taken off of my plate in addition to more features for security and making developers’ lives easier that strongDM now gives us.

    Shimel: Very cool, very cool. Alright, now, we can fast forward to Durham and how strongDM helped with the rollout there of a new—I don’t wanna call it a remote office, but I think you used the term outpost?

    Flinchbaugh: Yeah, so, it’s definitely, like, our—we call it HQ2, I believe, but we’ve got a fully functioning, we call it squad, so we kinda have self-sufficient and cross-functional teams out there, and everywhere across the country, but Durham was our first remote squad, if you will.

    And the neat thing about strongDM is, I don’t necessarily have to say when a new user joins, when someone joins the company, there’s not necessarily a task in my to-do list. It’s so self-service with our Okta configuration, a user can go in and say, “Hey, I wanna start using strongDM, I’ve heard all about it. How do I get access to our data storage and our private resources?” And at that point, I get an e-mail, I can add them to a roll, to a group, and they’re happily on their way. So, I don’t need to configure a profile, I don’t need to do anything special for these individuals. So, from my perspective, it’s incredibly easy to onboard new and remote folks.

    Shimel: That sounds like too good to be true. Is it true, Steve?

    Flinchbaugh: [Laughter] It does feel too good to be true sometimes.

    Shimel: Okay, and you’re saying you guys use Okta for a lot of your IAM and stuff like that?

    Flinchbaugh: Yeah, part of our maturation as a company, you know, back in the day, we had, of course, authentication and identity all over the place and now it’s much more unified. All of our tools that can integrate with Okta, it just makes it that much easier. And again, it’s just things that I don’t have to think about as often

    Shimel: So, Liz, let me throw something back at you. Again, the whole IAM space is something I’m somewhat familiar with—how important is it for strongDM to integrate with an Okta or ADs or other kinda directories and stuff like that

    Zalman: It’s critical. It’s one of the core principles of the business. I think, you know, I’m guessing, Steve, the customer made the decision to buy Okta well before strongDM.

    Flinchbaugh: I think it might have actually been around the same time—but yes, I think Okta was shortly before strongDM

    Zalman: Yeah, so, you have to start with the question of, “What is my identity store? What controls identity, and then how do I integrate that identity store with everything else?” So, strong has integrations with all of the SSOs—because I don’t want to reinvent the wheel. Steve’s already invested a bunch of money in Okta. He’s already reinvested a whole bunch of money in whatever he’s using for automation, Terraform or otherwise or an Amazon tool. Most companies have already invested a whole bunch of money in Splunk or Sumo Logic or QRadar, whatever they’re using for logging, I don’t need to reinvent the wheel with logging and alerting, I just need to make sure there’s a connector between the two.

    And so, honoring what people have already invested a whole bunch of money in and sort of bet the farm on already is critical.

    Shimel: Yeah, you know, Steve, you’re an SRE, so you live this every day. But it’s something—I’m an observer now. My days of those battles are over, right? But as an observer, it’s still, I shake my head sometimes, because so many companies like Kustomer, right, have kinda made their bets on the tools that they use, right? They’ve put together an identity in access management, but it’s not log management, cloud platforms—you know, your whole tool set. But yet, there are still plenty of companies who are trying to say, “No, no—you should use us for everything, right? We can sort of do what strongDM does.” You know, and you know the old saying with this, right? They try to give you 80% of the functionality for 40% of the price, and if that’s good enough for you, it’s good enough, right?

    And I was never a fan of that model—Liz, you’re laughing; what do you think? I mean, we see this still, and I don’t—you know, I assume some companies go for that, you know? But I can’t imagine it really works out. You just don’t get the function—we live in a great time where there’s so much available to us to try to make lives easier for people like Steve, for the SREs of the world and the Ops folks. You know, why would you try to just shove everything into one vendor and do, and put up with less than.

    Steve, what do you think?

    Flinchbaugh: So, it’s definitely, when you’re a smaller company, it’s, of course, much easier to adopt and drop and try new technologies and vendors. But, of course, as we’ve grown, that cost becomes higher and higher. So, when I first joined Kustomer, we could try new things whenever we wanted, but I can already see in the couple years that I’ve been with the company that implementing something like strongDM would be almost exponentionally more effort now, because I’d have to go through different departments and accounting and finance and communicate with the team, and developers just wanna know, “How do I do my job? Like, just tell me what to do.”

    Shimel: Mm-hmm.

    Flinchbaugh: And more than the functionality and the features of the product, I truly feel like we have a relationship with the strongDM team, and that’s almost just as important to us. We know that they are responsive, that they’re gonna listen to us, that they’re gonna help us out—and they have, you know, literally weekly.

    And that is so important to us as customers that, if someone came along and said, “Hey, we’ll charge you 50% of the price that strongDM does,” I don’t think I would be too tempted to consider that right away.

    Shimel: Yeah. But I think that goes to the model today, right? It’s part of this whole cloud native, open source, freemium core, open core, whatever you wanna call it, which is—the key is not to go hire some enterprise sales guy who comes by and wines and dines people. It’s about—hey, here’s the product. Let me get the product in your hands, right? Let me deliver delight, as they say, right, with that product, and the bonds that are formed from that type of relationship, right, it’s—if you wanna call it DevRel, you know, a lot of people call it developer relations and community relations—those sort of bonds are much stronger than the old sort of sales game that I grew up in, for instance.

    Elizabeth, with what Steve is saying, is that sorta news to you that it’s much easier to get in and kinda grow with these customers than it is to kinda come in when they’ve reached a certain scale and it’s a lot harder to get adoptions done

    Zalman: Certainly, it’s easier when a company is young—50, 100, 150, even 200—to get implemented. I think to Steve’s point, eventually,  you have a procurement department, and then you have to go through the traditional, like, “Oh, that’s the price? Okay, we’re gonna knock it down by 50% now,” right, and that’s just how the operate.

    Shimel: Right, yeah. Mm-hmm

    Zalman: And certainly, there are much longer sales cycles in the enterprise side, with a company of Kustomer’s size. Even the size today, you know, two week POC and you can play with it enough, to your point, Alan, where you decide if it’s right for you, if it fits enough of your requirements.

    With larger enterprises, it’s—and again, to Steve’s point, it’s not…you do have to go team by team, right, at a larger enterprise and say, “Okay, we’re gonna do the finance team now, and then we’re gonna do the engineering team, and then we’re gonna do the DevOps team.” And it’s sort of rinse and repeat and you get the hang of it after a while, but it’s bite sized chunks, always, whether the bite sized chunk is the entire company at once, or work group by work group.

    Shimel: Yeah. And I think that very much mimics the whole DevOps adoption pattern as well, right? You don’t go in and just turn on a large enterprise to DevOps, you do it bubble by bubble, team by team, right? And quite frankly, the other thing is, though, is I will tell you that sometimes that procurement process and all the b.s. that goes with it is why developers or DevOps people will whip out a credit card and just do it, right? And you get the whole shadow IT thing or whatever you wanna call it, but it’s like, who wants to—you know, I gotta sit and explain to this person why strongDM makes my life easier? You know, I mean, it’s—especially someone who has no technical background, it’s like, you know, where do I begin?

    But, you know, nevertheless, you guys got a year and a half of history here. Steve, where do you see the first squad’s in Durham, I assume that means you guys are planning second and third squads and maybe outside the U.S. and what have you—is strongDM tied, I imagine, tied into that as the roll out moves along here

    Flinchbaugh: Yeah, of course. It’s become the way that we access our resources across all of engineering. And we actually acquired a Spanish company, Reply.AI, a month back.

    Shimel: Oh, very cool.

    Flinchbaugh: Yeah, so—

    Zalman: Congratulations

    Flinchbaugh: Thank you. So, I’ve been having some conversations with the Reply engineers, and I can already tell that they’re impressed with how we use strongDM and how it kind of fits into our development workflow. And so, that would be interesting, because they have infrastructure of their own, infrastructure that we haven’t used before, so it would be a cool opportunity to say, “How does this plug into strongDM?” And I really have no concerns that that would be the case, but it’s gonna be a fun task to get all of that in the same kind of workflow that all of our Kustomer engineers use today.

    Shimel: Excellent. When you say Spanish, like in Spain—they’re based in Spain?

    Flinchbaugh: Yeah, they’re based in Madrid. I believe they’re a fully remote company, though, throughout Spain. So, they kinda have that remote culture, already, so it’s perfect for us right now, and of course, their AI expertise is nice to have, as well.

    Shimel: Absolutely.

    Zalman: Steve, where is their infrastructure? Like, is it in the U.S. in AWS or is it in something sitting in Europe?

    Flinchbaugh: I can’t say too definitively, but I do know that they have a mix of AWS and Heroku right now.

    Zalman: Interesting.

    Shimel: Really?

    Zalman: So, you’ve got a distributed team in Europe and now, effectively, multiple data centers if you’re talking AWS and Heroku that aren’t merged with Kustomer as well—

    Flinchbaugh: Yes, indeed.

    Zalman: Yeah, I see.

    Flinchbaugh: That’s right.

    Shimel: Sounds like an opportunity, Liz. [Laughter] Liz, let me ask you a question—how many, I mean, what I’ve always loved about the Internet is, it knows no borders, frankly, right? I remember the first time I put up websites and I started seeing hits come in from around the world. This is, like, 1996, and I was like, “Wow, we’re global!” Not at Media—you know, not this company, obviously.

    But what is the customer mix at strongDM? Is it international or is it mostly U.S., or—if you know?

    Zalman: Yeah, it’s heavily international. We’ve got, actually, a big contingent in Australia, we have Europe, we have Asia. Our large enterprise customers all have offices in India, whether they’re using contractors as a work force or an actual office there, you’ve got the U.S., you’ve got Canada, you’ve got South America.

    Oh, and you know what? Actually, I was just gonna say we’re not in Africa—we’re totally in Africa, so it’s everywhere. And then even, we’re not in the Middle East, I don’t think. But even more interesting, I think, than where the people are, it’s where the data centers are. You’ve got this crazy Cartesian product of people trying to connect to stuff, and most companies—we’re in China, I mean, we’ve got people on, we have workers on factory floors in China who need to SSH into infrastructure.

    Shimel: Very cool.

    Zalman: And so, it’s crazy to think about all of the networking going on, the latency, and how to make that connect, and it’s just personally fascinating to hear the new use cases that come up. I was like, when I heard factory, I was like, “Wow!” And then I started thinking of, like, Tesla. I was like, “I wanna be on the factory of Tesla,” but no.

    Shimel: Yeah. That could be in China, too. You know, it’s funny you bring it up, I actually interviewed a CEO of a company maybe last week who, they are instrumenting manufacturing factories, because a lot of that machinery was not connected that you can, you know, you had visibility, and they actually put things on to machinery that allow you to instrument them and monitor and stuff. There’s amazing things going on. And by the way, each one of those add-ons to the manufacturing machines has to have a certificate, an identity—you know, there’s a whole piece of this, too, and I just think it continues to go on.

    Steve, we don’t have a lot of time left. How has the COVID thing kinda affected you guys?

    Flinchbaugh: So, personally, I feel incredibly fortunate to say that my work has changed almost not at all. I think my position and a lot of our department is very remote friendly, and even though we weren’t set up, really at all, for remote before the pandemic, the transition has been relatively seamless—obviously, from a strongDM perspective, it is seamless.

    But overall as a company, I think—of course, there’s a ton of adjustments with different departments and some are having it easier than others. But I actually think engineering is, our efficiency and output and how we’ve put out features since the beginning of this has actually increased just a little bit.

    Shimel: That’s great to hear, man. Really good. Guys, we’re about out of time. I want to thank both of you—both of you coming at us from New York, today, I should mention, so thanks for joining us. Liz, any last thoughts, comments you want to add?

    Zalman: Nope, I don’t think so. I wanted to say thanks to Steve, and I appreciate the comment on relationship. It’s so important, as I say—you know, at strongDM, everybody touches the customer equally. It doesn’t matter if you’re in account management or support or engineering that I joke that if we were to ever have commissions at the company, which we don’t, I would give support the commissions, because they’re that important.

    Flinchbaugh: As a support company, somewhat as an employee there, I can very much appreciate your support team as well, Liz, and it’s not an exaggeration to say it’s the best support that I’ve received from any vendor, ever.

    Shimel: Very cool, very cool. That’s a good way to end it. Alright, Elizabeth Zalman, CEO, strongDM; Steve Flinchbaugh, SRE at Kustomer with a K—thanks for joining us on TechStrong TV. This is Alan Shimel. We’ll be right back with our next guest.