staging-devopsy.kinsta.cloud

Category: DevOps Toolbox

  • What AI Could Mean for Developers

    What AI Could Mean for Developers

    Artificial intelligence has been dominating the tech news headlines for a few years now, as the innovations in the sector keep rolling out at increased rates. The technology is, for lack of a better term, awesome, and when used correctly, it can have tremendous effects. We have already begun to see artificial intelligence in the consumer sphere take off at lightning speed.

    Artificial Intelligence is in More Things Than You Think

    Smart assistants, such as Google Home, Amazon Alexa and Apple’s Siri, have all dominated their share of the market with intuitive daily assistants that can keep track of your schedule and tell you the weather. They can even tell jokes—which may or may not leave you in a state of disrepair.

    Looking to the future, we also have autonomous vehicles, which will change our lives undoubtedly by potentially limiting traffic collisions and deaths. That is the true endeavor of technology: to change our lives in such a way that they are never quite the same.

    Artificial Intelligence Development is Open to All

    Development of AI programs is being accelerated due to the availability of AI libraries. With these powerful libraries, development teams are able to build custom code on a complex pre-built infrastructure. Google, IBM and Microsoft all have their own AI APIs that programmers can use to create better products.

    Using paid APIs, developers can use advanced programs developed by tech giants in their own applications. Google Cloud AI provides a suite of machine learning services. You can venture into other APIs also powered by AI. For example, you can use Google’s Cloud Speech API, which uses AI to dynamically convert audio to text in an existing application.

    TensorFlow is freely available to help programmers, developers and engineers use machine learning algorithms to better manage and classify data. All of these APIs empower development teams to dig deeper into deep learning.

    What Advancements Mean for Developers

    The goal of the openness of AI development is to create a new normal brought to life by the endless innovations of the tech industry.

    Without hesitation, we can call AI the next great invention. It has an ability to completely reshape the face of our world in such a way, that this current life will become one of distant fondness and inelegant trite labor. Indeed, the developers of AI will be contributing to the total revolution of life as we know it and the consequences thereafter.

    This is why it is so important to get it right. Using a guideline to build the future will ensure that it can handle the weight of use, without failing itself into obscurity.

    Innovation Means Opportunity

    Ultimately, AI is at its best when it fixes a common problem and is developed with best practices. Because the technology is so new, developers must work around the clock to create applications and get them to market so that their impacts, if any, can be registered and used for analytics. Developing AI is much bigger than a simple web application or smartphone app.

    The pure potential of the tech alone is enough to incite the most lethargic to action, but development will be in vain if not for best practices. Once developers around the world start to follow a development guide, it will increase the fluidity of innovation and knock down any barriers in its way.

    This ensures that developers can share ideas and technology easily, without being in the dark when it comes to the shared development process. Artificial intelligence is an ongoing innovation that may never cease to improve on itself.

    Conclusion

    In this article, we examined the best development practices in AI so that you and your team can create AI applications with the future in mind.

    In fact, the pursuit of humanoid AI, upon its completion, will most likely give us its own revolution in the tech industry as it slowly becomes pervasive in all industries. There is a beauty in contributing to grand goals. You and your team should not be limited or sidelined by a lack of knowledge about best practices when developing AI applications.

    There’s a wealth of resources for developing AI programs through the use of existing AI libraries. There’s plenty of help from the AI community, who are all pursuing a greater utopia with AI—and your team should not be left in the dust.

    — Anthony Coggine

  • Enhance DevOps Experience with AWS Smart Tools

    Enhance DevOps Experience with AWS Smart Tools

    DevOps has become the champion of business operations by fostering collaboration between disparate teams, providing a common work framework and paving way for continuous delivery that greatly boosted software development.

    Amazon Web Services (AWS) has become a leading provider of DevOps tools and services and has been instrumental in taking this experience to a higher level.

    So how does AWS elevate the DevOps experience?

    Automation

    DevOps not only eliminates the cultural disparities between two different environments but also eases the software development process by automating its tasks. This has made maintaining and looking after large-scale complex environments easier.

    Earlier, implementing automation in cloud environments was a painstaking process and was similar to implementation/usage in physical or virtual infrastructures. Today, however, leading cloud services providers offer DevOps automation tools as a part of their feature package, making automation a breeze.

    Continuous Integration and Delivery

    AWS CI/CD tools make building, testing and deploying application source—or just securely storing it—simple and organized.

    Continuous Integration and Delivery with AWS DevOps

    • AWS CodePipeline: This is a continuous integration/delivery tool that builds, tests and deploys code in the event of a code change. AWS CodePipeline helps developers introduce code quickly and reliably into the software life cycle.
    • AWS CodeBuild: AWS CodeBuild is a fully managed build service that compiles source code, runs tests and produces deployable software packages that are ready for use. CodeBuild is expandable and processes multiple builds simultaneously, propelling the purpose of continuous integration and delivery.
    • AWS CodeDeploy: AWS CodeDeploy automates code deployments to instances or on-premises servers. This tool helps users to release new features rapidly, avoid downtime during application deployment and manages updates easily.

      Special Features:

      • Automatic deployment
      • Integration with third-party tools
      • Centralized management
      • Integration with other AWS services
    • AWS CodeStar: AWS CodeStar helps users to rapidly develop, build and deploy applications while providing them with a common interface for managing software development activities. It allows users to set up their continuous delivery tool-chain in minutes for faster code release.

    Microservices

    Microservices allows users to build and deploy microservices architecture with the help of containers or serverless computing.

    • Amazon Elastic Container Service: Amazon EC2 services enables users to manage large groups of containerized applications with the help of Docker containers.
    • AWS Lambda: AWS Lambda relieves users from the burden of constantly administering and managing the system while running code for virtually any type of application or back-end service. This Amazon service just requires developers to upload code after, which the system takes care of running and scaling code with high availability.

    Platform as a Service

    • AWS Elastic Beanstalk: AWS Elastic Beanstalk is used to deploy and scale web applications and services developed with Docker, Java and Python on servers such as Nginx. All users have to do is upload the code and the service will handle deployment, including capacity provisioning, load balancing, auto-scaling and app health monitoring.Special Features:
      • Quick Deployment
      • Integration with other AWS Services
      • Application Health Monitoring
      • Easy Access to Application and System Logs
      • Customized Software and Applications

    Infrastructure as Code

    • Chef: This is an infrastructure automation framework that enables easy configuration, deploying and management of servers and applications on a cloud, physical or virtual environment. It sets up the infrastructure by using recipes.
    • Puppet: It can be tedious to tend to each server individually should you need to make configuration and content changes to multiple servers. In such a scenario, Puppet helps to set up each server as an agent that relays information to the AWS Puppet Master Machine about any changes to be executed on that server, paving way for uniformity across all servers.
    • Ansible: Ansible is another configuration management, software provisioning and application deployment tool. Designed for multi-tier deployments, Ansible enables continuous delivery. It designs your IT infrastructure by describing how all your systems can work as a network.

    Amazon Web Services has a number of DevOps tools, all designed to help professionals work more efficiently in the AWS cloud environment. Are you using the AWS tools? If so, what are your thoughts about them? Let us know your thoughts in the comments section below.

    — Veritis

  • Kemp Adds Predictive Analytics to ADC to Advance DevOps

    Kemp Adds Predictive Analytics to ADC to Advance DevOps

    Kemp this week enhanced the automation and predictive analytics capabilities it makes available within its application developer controller (ADC) as part of an effort to ease deployment of applications across multi-cloud computing environments.

    Company CEO Ray Downes said the goal is to make it easier for DevOps teams to avoid overprovisioning IT infrastructure, at a time when applications are more distributed than ever.

    The Kemp ADC offerings are comprised of a mix of physical and virtual appliances that have now been deployed more than 60,000 times. The volume of data generated by those deployments now makes it possible for Kemp to apply predictive analytics via a 360 Central monitoring tool that, for example, can now make suggestions concerning where to deploy a workload based on current utilization rates, Downes said.

    Kemp also now can provide comparative analytics, he noted. For example, the company revealed that its analytics show 61 percent of application experience issues are related to events caused by capacity issues such as failing or degrading application servers. Kemp also revealed that 48 percent of organizations see as many as nine application incidents per week.

    Now that Kemp has begun to apply predictive analytics to its ADC platforms, Downes said the next logical step will be to apply machine learning algorithms to help further automate application deployments.

    While ADCs provide critical load balancing capabilities, they are often overlooked as a source of actionable intelligence for DevOps teams. That data is more critical than ever because as IT organizations modernize their application portfolios by embracing more complex microservices, many of them are discovering every application will soon require its own load balancing capability. Previously, the primary role of an ADC had been to enable as many applications as possible to share the same IT infrastructure efficiently. Now the goal is becoming to orchestrate and optimize the allocation of IT infrastructure resources across a range of loosely coupled microservices. The Kemp ADC is designed to enable DevOps teams to define a desired state of all the load balancers in the distributed IT environment, including F5 Big-IP, AWS Elastic Load Balancer, Nginx, and HAproxy load balancers. That capability then makes it easier to roll out distributed application services.

    Over time, Downes said Kemp will extend that capability to open source load balancers such as Envoy, which are starting to be deployed on top of Kubernetes clusters. Both Kubernetes and Envoy are being developed under the auspices of the Cloud Native Computing Foundation (CNCF). As critical as load balancing will be within a Kubernetes cluster, however, Downes noted distributed applications will span cloud-native and legacy IT infrastructure environments as well as multiple Kubernetes clusters.

    It may take a while for DevOps teams to fully sort out what form of ADC platform and load balancing capability to employ when and where. But as IT becomes more distributed, there’s rising interest in making sure IT infrastructure utilization rates for those applications remain as high as possible regardless of how they have been developed.

    — Mike Vizard

  • New Relic Accelerates AIOps with SignifAI Acquisition

    New Relic Accelerates AIOps with SignifAI Acquisition

    New Relic, following its acquisition of SignifAI, is in the process of accelerating its investments in machine learning algorithms and other forms of artificial intelligence (AI) as part of an effort to make it easier to separate the signal from the noise created by all the alerts in an IT environment.

    Aaron Johnson, senior vice president of product management at New Relic, said SignifAI represents an opportunity for New Relic to create a superset platform that can apply advanced analytics to a much wider range of data sources. SignifAI has already created more than 60 integrations spanning open source and commercial monitoring tools that are widely used across DevOps toolchains, he noted, adding that as New Relic moves to add other data sources, there’s an opportunity for the company to distinguish itself beyond providing software-as-a-service (SaaS) tools for monitoring applications and infrastructure.

    It’s obviously still early days for AI in the realm of DevOps. But it’s also clear that with the rise of microservices and containers, soon it will be impracticable for IT organizations to manually manage their IT environments. Various forms of automation based on AIOps platforms infused with machine and deep learning algorithms will be required. As a provider of SaaS-based tools for monitoring applications and infrastructure, New Relic already has access to vast amounts of data required to train AI models on optimizing a specific IT environment.

    Of course, there’s lots of competition across the IT monitoring category, so it remains to be seen which vendors will have the resources required to drive continuing investments in AIOps.

    In the meantime, DevOps teams will need to adjust their processes to take advantage of AIOps. It’s unlikely AIOps platforms will eliminate the need for DevOps teams, but the number of applications and platforms any DevOps team must manage effectively will increase substantially. Rather than replacing humans, AIOps platforms will reduce the pressure to hire additional IT staff when professionals with DevOps skills are already in short supply. The AIOps platform, for all intents and purposes, acts like a co-pilot.

    The biggest issue IT organizations are likely to encounter along that journey is establishing trust with any AIOps platform they implement. It takes a while for most AI models to learn the IT environment before that platform makes any reliable recommendations. In most cases, DevOps teams will have to dedicate staff to train and update AI models continuously as the IT environment changes. It may take years, however, before DevOps teams are comfortable enough to move beyond trusting a recommendation and enable an AIOps platform to automate processes on its own. After all, the only thing worse about being wrong about any IT decision is being wrong about it at scale.

    AI at this point is all but inevitable in DevOps environments. But it doesn’t necessarily follow that just because something is based on AI it always will be smarter than experienced DevOps professionals.

    — Mike Vizard

  • Open Mainframe Project: Zowe Ready for Prime Time

    Open Mainframe Project: Zowe Ready for Prime Time

    There is a lot of interest in updating mainframe technology/interfaces across traditional enterprises. As development environments and toolsets have evolved outside the mainframe, there is a struggle to keep up—partially because backward compatibility requirements make wild changes difficult and partly because the very architecture of mainframes is different.

    There have been several fragmented efforts over the last few years—some of them quite good—to update how a mainframe is accessed from external source and the ways that developers can code for the mainframe. After all, the number of developers proficient in mainframe toolsets continues to decline while the number of workloads does not, so something has to change.

    The Open Mainframe Project’s Zowe attempts to address these issues in ways that are both more widely applicable and more technologically advanced. It takes advantage of Open Source REST systems to front-end hardcore mainframe functionality, so developers who are accustomed to application server development can call things such as Spring Boot-based interfaces and use languages including Node.Js to access their mainframe systems.

    This week, OMP announced that Zowe 1.0.0 is production-ready. That means serious experimentation can be started at your organization to see if it addresses some or all of your mainframe modernization needs.

    There will likely always be some (at least operational) differences in mainframe systems usage because the software infrastructure is designed a certain way, but increasing modern tool usage makes learning those different parts easier across the board. By implementing a vendor-independent architecture that has guidelines for users and vendors to add functionality from anywhere, Zowe is a powerful and expandable tool for getting the job done.

    I sound a bit like a fanboy, but for most verticals, this is an issue that will continue to be a pressure point. It’s been more than a decade since companies started bringing back retirees to work on mainframe projects because new developers did not have the skills or interest to complete those projects. As more and more skilled CICS/RPG/PLI/etc. developers and mainframe operations specialists retire, this pressure will increase until it is resolved or unbearable. So I am a fanboy of any company/solution that is addressing this space instead of flocking off to the coolest new DevOps tool du jour. I’ve not yet used Zowe, so can’t directly recommend it, but reading over their documentation, I believe it’s a good idea to use tools we’re familiar with. So I’m rooting for it.

    If you test it out, drop a comment and let the rest of us know what you think.

    And keep rocking it. Whether in VS-2019 or VT-70, you are making the company engines hum.

    — Don Macvittie

  • Electric Cloud Aims to Make DevOps More Accessible

    Electric Cloud Aims to Make DevOps More Accessible

    Electric Cloud today unfurled the Winter 2019 edition of the ElectricFlow platform for managing DevOps, which makes it easier for different classes of users to tailor the platform to meet their specific needs.

    Sam Fell, vice president of marketing for Electric Cloud, said the latest release of ElectricFlow allows end users to choose from different personas based on their role in the organization, and each persona has a user interface crafted to surface the level of detail they most likely require. That approach is intended to make the company’s DevOps platform more accessible to wider variety of end users, he said.

    The latest edition of ElectricFlow also adds a customizable customer login experience that is more task-oriented. Users can now add bookmarks/favorites to access specific pages faster.

    Finally, Electric Cloud is now including release and pipeline templates that make onboarding easier, based on user created events/triggers and code check-ins in a Git repository.

    Fell said that while DevOps platform such as ElectricFlow increasingly have incorporated higher levels of automation by relying more on machine learning algorithms, humans should not be left behind. Electric Cloud has been focusing more of its development effort on making it easier for DevOps professionals of all skill levels to derive value from the platform, he said, noting current DevOps platforms tend to make available far too much information than the average IT professional can ingest, added Fell.

    Less clear is how the complexity inherent in DevOps processes extends the time it takes for an organization to employ DevOps pervasively. While DevOps platforms are undoubtedly powerful, they also can be intimidating. In many instances, it’s simply easier for IT administrators to continue to rely on tools they already know to manage a specific task even when that tool is not as robust or rich as what might be accessible in a more modern DevOps platform. What often is ascribed to cultural IT inertia may have its roots in the simple fact that IT professionals are not always equally excited about having to learn and master new tools.

    The number of IT organizations that have been able to employ DevOps processes across their entire organization are still a comparative minority. Most organizations today have what can best be described as pockets of DevOps processes, usually driven by a small, cross-function team that is highly motivated to update a specific set of applications continuously. IT organizations are, of course, hoping to replicate the success of those teams across the rest of the organization. However, the rest of the IT organization doesn’t always have the same level of engineering skills—the spirit may be willing, but the initial DevOps hurdles needed to be overcome are simply too high.

    It may be a while before IT organizations sort this all out. More accessible tools are only one part of the equation. But IT leaders almost inevitably find that giving their teams access to easier tools will, at the very least, start moving their organization in the right direction.

    — Mike Vizard

  • Actifio Looks to Meld DataOps with DevOps

    Actifio Looks to Meld DataOps with DevOps

    Actifio and IBM have formed an alliance under which IBM will make available data management software developed by Actifio under its own name as part of an effort to close the gap between DevOps and DataOps.

    At the same time, Actifio will make available a software-as-a-service (SaaS) offering for the first time, dubbed Actifio Go, which promises to make it easier to manage and move data across multiple clouds.

    Actifio CEO Ash Ashutosh said with the rise of both DevOps and DataOps there is now a unique opportunity to unify the management of pipelines across the enterprise. While storage administrators have been creating data pipelines for databases and applications for decades, the pipelines developers create to consume that data have been developed and managed separately. Now there is a nascent DataOps effort based on a set of best practices for automating the management of data that borrows many of the same principles being advanced by DevOps proponents for the building and deploying of applications.

    Actifio’s core Virtual Data Pipeline technology advances DataOps, Ashutosh said, by making it easier to copy a virtual instance of a data set running in a production environment and update it with the most recent copy of that data at any point in time. That capability is not only being employed to, for example, copy data into the cloud, but also to make data readily accessible to DevOps teams as needed on a self-service basis, he said, adding the goal is to make it easier for developers to dynamically consume the latest version of any data set as needed, with a minimal amount of intervention required on the part of a storage administrator.

    IBM plans to make an instance of Virtual Data Pipeline available as part of the IBM InfoSphere portfolio of data management software it provides. That agreement extends Actfio’s existing reseller relationship with IBM.

    Ashutosh conceded there is much work to be done before DataOps becomes a natural extension of DevOps. Most storage administrators today are not all that familiar with how the data pipelines they create are consumed by applications. Most storage administrators continue to think in terms of volumes and files rather than in terms of managing data pipelines, he said.

    But as those application environments become more dynamic thanks to the rise of microservices, pressure to modernize data management will only increase, Ashutosh noted. For example, more DevOps teams will be integrating the ability to copy data directly into their continuous integration/continuous delivery (CI/CD) platforms. Achieving that goal will be easier if the software employed to manage data within the context of a DevOps processes is invoked as a SaaS application, he said.

    Most IT organizations are a very long way from melding DevOps and DataOps. Most are still struggling with mastering the fundamentals of DevOps. But the convergence of DevOps and DataOps is all but inevitable. The only thing that remains to be seen is the degree to which IT organizations will proactively seek to achieve that goal versus waiting for developers to force the issue.

    — Mike Vizard

  • ‘DevOps Engineer’ Title Lands in Top 5 of Dice Salary Survey

    ‘DevOps Engineer’ Title Lands in Top 5 of Dice Salary Survey

    The position of DevOps Engineer is gaining some serious respect, and with that comes cash.

    In Dice’s recently released “2019 Tech Salary Report,” DevOps Engineer now ranks in the Top 5 of all tech salaries, with an average of $111,683. The survey is based on the responses of 10,780 technology professionals conducted between Oct. 22 and Dec. 13, 2018.

    It’s the first time that the title of DevOps Engineer has appeared in the Top 5, according to Dice. The one caveat is that the position might not be as popular as the annual salary suggests; rather, more professionals now identify with this position.

    What it does mean is that the DevOps Engineer title is now ranked with more established tech titles, including senior leadership positions CEO, CIO, Vice President and Director, with an average salary of $142,063; System Architect, at $129,952; Tech Management, including Strategist and Architect, at $127,121; and Product Manager, at $114,174.

    Overall, the average salary for tech workers remained relatively flat year over year. In 2018, the average salary totaled $93,244, a less than 1 percent increase from 2017, when the average salary stood at $92,712, according to Dice.

    In an email, Dice CTO Klavs Miller noted that the increasing use and adoption of various cloud-based technologies is pushing enterprises to invest more in DevOps engineers to take advantage of that compute power to develop new apps.

    “Many DevOps Engineer job requirements include a heavy focus on the creation of infrastructure as code, essentially transforming operations into the management of codebases that create infrastructure (in cloud services or native cloud infrastructure rather than servers and hardware),” Miller wrote. “We are also seeing and experiencing first-hand that more and more organizations are moving toward having combined development and operations teams around a domain, rather than splitting along traditional functional lines.”

    In his email, Miller noted that while there might be few tech pros that use the “DevOps Engineer” title, it doesn’t mean that there’s an actual lack of engineers with the skills to help enterprises with their DevOps projects.

    Instead, it’s a matter of looking for talent that might already be there.

    “There is probably a shortage of talent that label themselves as ‘DevOps Engineers,’ but employers should look at the skills required by those roles instead,” Miller noted.

    “There’s a growing demand for a skill that is still evolving with market trends,” he added. “As an example, DevOps is not nearly as common as its more common sibling, software engineers, but it has become more popular each year according to our salary survey and among employers who are sourcing Dice for these positions.”

    The types of enterprises looking for DevOps talent are varied. Right now, insurance company Geico and hardware store giant Lowe’s are each looking for specific DevOps titles, according to Dice.

    If private business isn’t your area, the Louisiana Economic Development agency is currently advertising for an entry-level DevOps position.

    In addition to specific tech titles, the Dice report shows that several types of programming languages that are now associated with the DevOps discipline are commanding significant salaries in the market.

    For instance, those with expertise in Google’s Golang programming language can command salaries of up to $132,827, according to the Dice survey.

    A little further down the line, and keeping with Miller’s emphasis on cloud-based technologies driving much of the DevOps conversation, those with knowledge of Amazon’s DynamoDB and Redshift can command salaries of more than $125,000 on average, the study found.

    Additionally, platform-as-a-service (PaaS) skills can net a developer an annual salary of more than $122,000.

    In his email, Miller noted that it’s difficult to draw a direct line between needs for certain programming languages and the growing popularity of DevOps. The growing reliance on cloud and the types of digital transformation projects enterprises are engaged with now show how the market has shifted.

    “There are some assumptions that we can’t confirm, but DevOps shares programming languages with other roles that are also in demand, as employers adopt cloud-based technology and open source becomes more pervasive in companies’ tech stacks,” Miller added.

    — Scott Ferguson

  • OverOps Employs Machine Learning to Measure Application Reliability

    OverOps Employs Machine Learning to Measure Application Reliability

    OverOps is adding a series of dashboards to its analytics platform that employ machine learning algorithms to identify which software application anomalies in a pre-production environment are likely to have the most impact on a production environment.

    Company CTO Tal Weiss said one of the biggest challenges DevOps teams face is prioritizing which issues to fix first in an application. The Reliability Scoring capability being added to the company’s namesake platform for analyzing code employ machine learning algorithms to keep track of introduced errors, regressions and slowdowns during every phase of pre-production. In addition to enabling DevOps teams to visually identify the root cause of an issue via a single click, that data is then used to identify which issues will impact reliability.

    Weiss noted that the Reliability Scoring can also be employed to set thresholds of acceptable application performance that would also be used to determine whether there is an issue. The data collected using that capability then can be fed back into a continuous integration/continuous deployment (CI/CD) platform to set up gates that would then prevent suspect code from being promoted, he said.

    The primary benefit, however, should be a major reduction in the number of troubleshooting instances any DevOps team should need to engage in after an application is deployed in production, said Weiss. In fact, the Reliability Dashboards will provide a central mechanism through which developers, testing professionals and IT operations teams can collaboratively track and measure the progress of an application development project, he added.

    The Reliability Scoring tool OverOps developed employs “micro-agents” that operate between application code and the hardware. Weiss said those micro-agents can not only capture data that was never previously available, they deduplicate, classify and gate critical issues as they move into staging and production. The Reliability Dashboards visualize that data in Grafana, a set of open source tools for visualizing data. DevOps teams can also opt to feed that data into any existing dashboards they may already have in place.

    In general, Weiss said the metrics surfaced by the Reliability Dashboard are critical to justifying investments in DevOps over the long term. Organizations expend a lot of time and effort making the transition to DevOps. But most of them don’t really know to what degree they are getting better at building and deploying applications. Reliability Scoring dashboards provide the historical context required to make those assessments, he said.

    Far too many DevOps teams are still starved for data needed to make critical decisions. In the absence of that data, teams address issues as they arise, rather than based on the impact they might have on the business. Worse yet, it’s difficult to identify new issues over those that might be another manifestation of a known issue that suddenly becomes a much higher priority.

    Regardless of the root cause of any problem, however, DevOps teams would do well to remember things that get measured are usually the first things to get fixed.

    — Mike Vizard

  • Salt Security Unveils Platform to Secure APIs

    Salt Security Unveils Platform to Secure APIs

    Salt Security, fresh off raising an additional $10 million in funding, announced a platform that promises to advance the state of DevSecOps by making it possible to detect when application programming interfaces (APIs) are being probed by cybercriminals looking for weaknesses to exploit.

    Salt Security CEO Roey Eliyahu said the Salt Security API Protection Platform employs machine learning algorithms to first establish a baseline for how APIs are being invoked across an IT environment. The software-as-a-service (SaaS) platform then monitors activity to surface any anomalous behavior indicative of cybercriminals engaging in reconnaissance of API traffic flows, he said.

    Armed with that analytics, DevOps teams can then prioritize fixes to any potential security hole cybercriminals might be able to exploit. That approach advances DevSecOps because the Salt Security technology makes it possible to feed requests to address those security issues directly into a continuous integration/continuous deployment (CI/CD) platform—critical, he said, because all too often developers are unclear regarding what cybersecurity professionals are asking them to fix whenever a cybersecurity issue arises.

    Eliyahu noted that, in today’s business environment, security has become a major concern. According to the Open Web Application Security Project (OWASP), nine of the top 10 vulnerabilities in its current Top 10 report include an API component. Insecure APIs were ranked as the third most severe threat to cloud computing in 2018 by the Cloud Security Alliance (CSA), and Gartner predicts that by 2022 API abuses will be the most frequent attack vector resulting in data breaches for enterprise web applications.

    The challenge organizations face is each API is unique to each application and the organization that builds them, which means each has unique logic and, by extension unique vulnerabilities, said Eliyahu. Existing cybersecurity tools lack granular understanding of these because they are designed to protect organizations from known attacks. Attacks that target API logic go unnoticed by these tools because they appear to be authenticated use cases, and then employ subtle methods to probe each for unique vulnerabilities, he noted.

    To thwart those attacks, the Salt Security technology automatically discovers all APIs and associated functionality, said Eliyahu. That’s important because it’s not uncommon for organizations to lose track of the many that might have been exposed over the course of an application’s lifetime.

    APIs in general are often overlooked because much of the focus in any organization tends to be on business logic. But as the number of applications and services continue to proliferate across the enterprise, the number of APIs being exposed has increased dramatically. Those numbers will increase more as organizations embrace microservices to build applications that are more easily updated.

    The issue, of course, is how to secure APIs that often are developed and maintained by teams that weren’t involved in the integration of the original application. Because of that issue, API management has emerged as a discipline unto itself within many organizations. The challenge now is finding a way to ensure those APIs are employed as intended, versus becoming an avenue for data exfiltration that no one is aware of until it’s long too late.

    — Mike Vizard