staging-devopsy.kinsta.cloud

Category: Features

  • The Road Ahead for Security, DevOps Transformation

    The Road Ahead for Security, DevOps Transformation

    Qualys hosted its Qualys Security Conference 19 this week in Las Vegas. Hundreds of attendees from around the world have gathered at the Bellagio hotel to learn more about the current state of cybersecurity and what the future has in store. As you might expect, given the technology landscape today, many of the sessions and discussions have revolved around DevOps and how cybersecurity can adapt to DevOps culture.

    Scott Crawford Qualys Security Conference
    Scott Crawford, Research Vice President at 451 Research presents “The Road Ahead for Security, IT, and DevOps” at the Qualys Security Conference

    The Shifting Technology Ecosystem

    Scott Crawford, research vice president at 451 Research, opened day two of the Qualys Security Conference with his keynote, “The Road Ahead for Security, IT, and DevOps.” Crawford talked about the dramatic changes over the last decade or so—from monolithic to microservices, from standalone applications to integrated software, from Waterfall to Agile, enterprise networks to IoT / OT, from standard networks to 5G wireless, and from traditional IT to DevOps. He discussed the challenges organizations face and the dilemma of doubling down on past success and missing out on innovation.

    With all of the changes from this shifting technology ecosystem, there are consequences. Organizations no longer have a single point of control and IT teams are faced with managing and protecting an increasingly complex web of interconnected platforms, applications and services.

    Security and DevOps

    Crawford also talked about the rise of zero trust. He described it as a sort of mashup of the concept of least privileged access, combined with behavioral analytics and an on-demand, just-in-time approach to managing access. The zero trust paradigm is based on the premise of never trust, always verify—and that means determining who is requesting access, under what conditions they’re requesting access and what actions they intend to perform with that access on a case0-by-case basis.

    He shared the Xebia Labs Periodic Table of DevOps tools to illustrate the overwhelming number of options available and stressed the importance of automation. CI/CD (continuous integration/continuous deployment), RPA (robotic process automation), and SOAR (security orchestration, automation and response) solutions have been developed to help address and manage some of the complexity of both DevOps deployments and cybersecurity.

    Xebia Labs Periodic Table of DevOps Tools
    Xebia Labs Periodic Table of DevOps Tools

    DevOps and Digital Transformation

    Crawford’s keynote was followed by a presentation titled, “The DevOps Transformation of the Qualys Platform: Lessons Learned.” Dilip Bachwani, senior vice president of engineering and cloud operations for Qualys, talked about how the company has addressed the “innovator’s dilemma” and steps it has taken to deal with growing pains as it goes through its own digital transformation.

    Bachwani explained that the engineering team at Qualys has expanded exponentially in a relatively short period. That comes with several benefits in terms of how quickly they can develop and implement new solutions, but the team also faced challenges with balancing that growth and trying to maintain velocity at the same time without sacrificing stability or reliability.

    Just like every other organization going through a DevOps transformation, Qualys has had to break down silos with people, processes and tools. Bachwani explained that they needed to do things differently to automate as many functions as possible. They decided to view infrastructure and operations as software problems and find ways to fully automate deployment and configuration.

    He also emphasized that security must be built in throughout the DevOps life cycle. Qualys adopted a hub-and-spoke DevOps model and developed a robust DevOps toolchain designed to combine and orchestrate an effective set of tools for developing, delivering and maintaining software. Having a standardized toolchain ensures that there is a common platform available to everyone.

    Accelerating Transformation With Citizen Developers

    At the end of Crawford’s keynote, he talked about the lack of people with the right knowledge and skills. Cyber Security Ventures predicts that there will be 3.5 million unfilled cybersecurity jobs by 2021. That’s just cybersecurity. What about developers and other key personnel? Crawford posed the question, “Where will we find the people to do it all?”

    The answer, he said, is citizen developers. What is a citizen developer? It’s a movement to empower employees who are not developers by trade with the tools and support to implement ideas. They are the ones closest to the problem and, arguably, best equipped to understand how to solve it. They don’t need to be professional developers or need experience with coding environments. Low-code and no-code platforms give them the power to turn ideas into solutions.

    A few years ago, George Hulme wrote an article on the growing citizen developer movement. Hulme noted, “The organizations that succeed with citizen development will be those that wholeheartedly embrace the movement and cultivate it, with IT’s help and guidance.”

    The DevOps revolution isn’t going away. Companies that don’t embrace digital transformation will likely fade into oblivion as they are left in the dust by more innovative competitors, and organizations that don’t figure out how to integrate security into the fabric of their culture will struggle against a rapidly expanding and evolving threat landscape.

    At this point, these things are like the ocean tide. It is coming whether you like it or not, and it will destroy those who are not prepared. Crawford wrapped up by asking the audience to consider what their role is going to be in building and maintaining the future of DevOps and cybersecurity.

    — Tony Bradley

  • Privileged Access Management at the Speed of DevOps

    Privileged Access Management at the Speed of DevOps

    Privileged access management (PAM) is clearly a very important element of effective cybersecurity. PAM has been ranked number one on Gartner’s Top 10 Security Projects for two consecutive years, and it is number four on the CIS Top 20 Critical Security Controls. The struggle for many organizations, however, is they have also embraced DevOps culture, and the traditional approach to PAM clashes with the principles of a DevOps environment. Thankfully, it is possible to effectively manage privileged access in a DevOps environment—it just takes a new approach.

    Challenges of Privileged Access Management

    Despite advances in identity and access management and the existence of things like two factor or multi-factor authentication and biometric authentication, most organizations still rely on a simple username and password to authenticate an individual and grant access to network resources, applications and data.

    The concept of least privileged access—ensuring that users only have access to things they really need access to—has been preached since the dawn of cybersecurity and, when done right, can be an effective strategy. The problem is it’s tedious to do right and it’s very easy to lose track of who has privileged access to what.

    That’s where a PAM solution comes in. The whole point of privileged access management is to provide a way to track and manage who has access to what—to grant access when it is needed and revoke access when the need no longer exists. Unfortunately, there is a lot of confusion about PAM and the effort to manage privileged access is challenging for many organizations.

    Enterprise Management Associates (EMA) conducted a survey on the state of privileged access management. The survey included responses from companies representing different company sizes and industries around the world and focused on IT and cybersecurity professionals—most of whom are familiar with PAM and are directly responsible for managing or granting privileged access to users.

    There were some concerning findings from the survey regarding the perception of PAM. Twenty percent of organizations that reported using a dedicated PAM solution believe it somewhat or greatly reduces user productivity. Many respondents also expressed frustration about the amount of time required to manage privileged access. Half of the survey participants cited manually granting temporary privileges as either very (29%) or extremely (21%) time consuming, and half also said manually revoking temporary privileged access as very (33%) or extremely (17%) time consuming.

    PAM and DevOps

    As challenging as traditional PAM solutions might be for businesses around the world, they pose an even greater hurdle for organizations that have embraced DevOps. A recent episode of the Defense in Depth podcast, hosted by David Spark and Allan Alford, focused on some of the challenges of PAM. A listener had written to complain that “the traditional approach to PAM breaks everything that is DevOps. Regardless of what your PAM provider says about their ability to scale with your dev cycles, they’re lying about the real level of effort.”

    That seems like a fair assessment. Pretty much every company is somewhere on the cloud journey—and working within a DevOps framework on some level. Companies often face backlash from the DevOps team—with some going so far as to boycott efforts to introduce security tools that can’t keep up with the pace of DevOps in the cloud.

    DevOps developers express frustration about trying to build an automatic scaling, horizontal infrastructure and being dragged down by demands from the security team to install agents and change authentication modules. They complain it often means rewriting all of the scripts, resulting in significant and unnecessary effort for a solution that ultimately can’t scale properly in the DevOps environment.

    That is, unfortunately, true when it comes to traditional PAM solutions. Next generation PAM solutions, however, are built with the cloud and DevOps in mind. They are lightweight, automated, scalable and capable of integrating seamlessly with common tools and platforms.

    Rethinking Privileged Access Management

    Based on the survey, organizations understand the importance of privileged access management, but they struggle with finding a way to implement it effectively. The question from the podcast illustrates how PAM is also a significant issue for DevOps environments because traditional PAM solutions do not integrate or scale effectively.

    At the same time, we all know that PAM is a crucial element of effective cybersecurity. It’s not acceptable to just not manage privileged access, but it also doesn’t make sense to suffer through the headaches and frustration introduced by traditional solutions. Organizations need to find new privileged access management tools that work in the cloud and can scale automatically to provide PAM at the speed of DevOps.

    — Tony Bradley

  • Survey Suggests DevOps Drives Digital Business Transformation

    Survey Suggests DevOps Drives Digital Business Transformation

    A survey published this week by New Relic, a provider of IT monitoring services, suggests there is a high correlation between organizations that have embarked on digital business transformation initiatives and adoption of best DevOps practices.

    Revealed at the Futurestack conference hosted by New Relic, the survey 750 global senior IT decision-makers of enterprises with 500 to 5,000-plus employees in Australia, France, Germany, UK and the U.S. conducted by the market research firm Vanson Bourne finds roughly 50% of organizations in the U.S. have completed or are close to completing their digital transformation journeys.

    The same survey finds nearly two-thirds of U.S. respondents in the region claim they’ve adopted DevOps practices.
    Buddy Brewer, group vice president and general manager for client side analytics at New Relic, said the challenge most organizations face in terms of DevOps is they lack access to real-time analytics. DevOps teams may have access a raft of metrics, but all the data they have only tells them how many times something occurs on average. Roughly half of end users may be having a satisfactory application experience, but the half that are not are the company’s most important customers, noted Brewer.

    Overall, the survey finds that that there’s nothing easy about modernizing IT environments to drive digital transformation initiatives. Nearly three-quarters (72%) expect the technology team to deliver more innovations and updates. However, more than 50% said they find their complex new software and infrastructure difficult to manage and monitor for performance issues.

    Nearly half the respondents (48%) also admitted end users or customers are likely to tell them about a problem before they know about it and 46% said they are told about these issues before they know how to fix them.

    At the same time, 79% said the rest of the business has higher expectations in how digital systems perform and 63% admitted that because of pressure to respond to business needs, they work longer hours to observe and manage software performance. Almost half (46%) said C-suite executives want daily updates about how software systems are performing and 40% said CEOs also want more answers when outages or performance problems happen.

    More than half (56%) of all respondents acknowledged that it is impossible to properly assess all the machine data being collected. Just as troubling, a third said they are challenged on business benefit metrics for their digital transformation projects.

    The survey identifies the top five digital transformation challenges:

    1. Separate parts of the organization are moving at different speeds to embrace digital transformation.
    2. Shortage of skilled employees.
    3. Restricted budgets.
    4. Understanding and measuring business benefits.
    5. Continued resistance to shutting down legacy systems.

    As always in the case of IT professionals, however, hope springs eternal. A full 89% said they believe artificial intelligence and machine learning algorithms will become important element for managing digital systems. That may indeed come about one day. However, until that day arrives, DevOps teams should count on the fact that every digital business transformation project that gets launched equates to a lot more hard work for them.

    — Mike Vizard

  • DevOps Deeper Dive: DevOps Arms Race Heats Up

    DevOps Deeper Dive: DevOps Arms Race Heats Up

    A massive amount of capital is pouring into DevOps companies as organizations finally begin to realize the extent to which they depend on software. While Marc Andreesen may have penned his famous “Software Is Eating the World” opinion piece way back in 2011, it’s only now that many organizations are starting to realize they are software companies that also manufacture something or specialize in the delivery of some type of digital service.

    The most recent example of a massive injection of capital into the DevOps space came in the form of a $268 million investment in GitLab earlier this month. That move followed the acquisition of SignalFx, provider of an application performance management (APM) platform, by Splunk in a deal valued at just over $1 billion.

    Arguably, DevOps vendors have been gearing up for this fight for the better part of the last decade. Way back in 2014, New Relic picked up $115 million after going public. Three years later, Cisco Systems acquired AppDynamics for $3.7 billion.

    Now all these companies are racing to build the platform through which organizations of all sizes will transform themselves into true software companies by embracing best DevOps practices infused with large amounts of artificial intelligence (AI).

    DevOps as a concept has been around now for the better part of a decade. However, it’s only now that organizations are embracing DevOps across the entire application development life cycle. Previously, organizations embraced DevOps within isolated areas of the IT organization. Today, there is a much more concerted effort underway to apply DevOps practices to build and deploy software on an industrial scale.

    Achieving that goal, however, will require a lot more than simply adding higher levels of automation to a continuous integration/continuous deployment (CI/CD) platform. As business leaders realize how dependent the organization is on new applications to drive additional revenue, they are demanding more visibility into the software delivery process. Every delay to a software project now has revenue implications for the business.

    As more organizations come to that realization, it becomes apparent that monitoring software continuously as it is being built and after its deployed is now crucial to the business, said New Relic CEO Lew Cirne.

    “If mission-critical software not working, then the business is not working,” he said. “You must watch it all; you can’t pick and choose.”

    To become the de facto standard within an organization for monitoring those processes, DevOps vendors are racing to build DevOps platforms capable of operating at unprecedented levels of both scale and speed, said SignalFx CTO Arijit Mukherji.

    “The scale of the data has increased,” Mukherji noted. “Everything needs to happen in real-time.”

    DevOps platforms need to be extended to include support for everything from distributed tracing to machine learning algorithms, which organizations will rely on to identify the patterns employed to build AI models, he added.

    That level of investment requires a lot of additional capital that DevOps vendors either need to raise or, in the case of SignalFx and AppDynamics, tap into as a subsidiary of a larger company.

    The rise of microservices is further exacerbating those challenges as the number of dependencies within and between smaller segments of code increases. That fundamental shift in application architecture will require organizations to re-engineer DevOps processes across both the application and infrastructure levels of the entire IT environment, said Matt Cleve, director and global lead for Business iQ at AppDynamics.

    “Real-time visibility into the entire application stack is going to be a lot more important,” Cleve said.

    AppDynamics and parent company Cisco together will be in a unique position to deliver on that promise, he added.

    A recent survey conducted by the Harvard Business Review (HBR) on behalf of AppDynamics finds only 22% of IT organizations have access to any kind of real-time IT metrics.

    Widespread adoption of best DevOps practices has been a long time in coming. What is clear now, however, is that the organizations that take full advantage of DevOps by the end of this decade will thrive the most through the next.

    — Mike Vizard

  • GitLab Outlines Scope of DevOps Ambitions

    GitLab Outlines Scope of DevOps Ambitions

    At the GitLab Commit event in New York today, GitLab launched an ambitious effort to extend the scope of its DevOps platform to provide a view into the software development life cycle for not just developers but also designers, product managers and business leaders.

    Fresh off raising an additional $268 million in funding, GitLab now plans to create different ways to view a common pool of metadata and metrics generated by the GitLab DevOps platform.

    It may be a while before GitLab can deliver on that promise, but the core concept builds on the dashboards the company already has built for IT operations and cybersecurity teams. Rather than requiring each team participating in the software development process to acquire a separate platform, GitLab should be viewed as a DevOps platform delivered as a single application that can now be applied to everyone, said Mark Pundsack, vice president of product strategy for GitLab, in speaking with conference attendees.

    As part of that commitment, Pundsack noted GitLab is expanding its DevSecOps capabilities to include auto remediation. The scanning capabilities built into GitLab will be extended not only to detect issues based on the cybersecurity policies of an organization, but also, when allowed, automatically remediate routine issues, Pundsack said, adding GitLab also will automatically roll back applications if necessary. Once in place, GitLab will have pushed application cybersecurity much further left than anyone might have expected when DevSecOps was first broached as a concept, he said.

    At the conference, GitLab demonstrated a pipeline graph capability that will provide a foundation for many of these promised offerings. GitLab already can be employed to accomplish tasks such as code quality scanning, container scanning, dependency scanning and licensing dependencies.

    All these features are an extension of GitLab’s existing strategy that aims to rationalize the number of tools organizations need to stitch together to drive a set of best DevOps processes. However, other DevOps platform providers have similar ambitions.

    Thanks to its latest round of funding, GitLab—which also announced its plans to go public next year—is now valued at $2.75 billion. The company has not released any revenue results but does claim to support more than 100,000 organizations using its platform, including Ask Media Group, Charter Communications, Delta Air Lines, Goldman Sachs, Ticketmaster and Nvidia. GitLab also claims to have more than 4,800 active contributors to its open core platform. The company now has more than 800 employees in more than 55 countries across the globe, and there currently are 222 open GitLab jobs posted.

    It remains to be seen how much $268 million will enable GitLab to fend off rivals such as GitHub, which was acquired by Microsoft, and CloudBees, which has built a large DevOps community around the open source Jenkins continuous integration/continuous deployment (CI/CD) platform. Whatever the outcome of this arms race, the massive amount of funding pouring into the platforms soon should take DevOps platforms to places many might not have ever imagined possible.

    — Mike Vizard

  • DevOps Experience 2019: Peace, Love and DevOps

    DevOps Experience 2019: Peace, Love and DevOps

    DevOps Experience 2019 is coming, and it’s gonna be groovy, man.

    This year’s virtual event is all about peace, love and DevOps understanding, with a heavy emphasis on understanding. As with last year’s event, DevOps Experience 2019, sponsored by staging-devopsy.kinsta.cloud parent company MediaOps, is chock full of information and education for those in the DevOps space, presented in a virtual reality environment. DevOps Experience is a true virtual conference, complete with theaters to view the keynotes and presentations, a conference lobby to chat and socialize and a virtual trade show floor with virtual exhibitor stands equipped with videos, downloads and company representatives on hand to share information.

    And perhaps the greatest thing about DevOps Experience 2019? You don’t have to leave the comfort of your desk.

    DevOps Experience 2019 will feature keynotes from a lineup of DevOps luminaries including:

    • John Willis, CEO & Founder, Botchagalupe Technologies
    • Nicole Forsgren, Research and Strategy, Google Cloud
    • Jayne Groll, CEO, DevOps Institute
    • Gary Gruver, President, Gruver Consulting

    Additional speakers will include Alan Shimel, MediaOps Editor-in-Chief and Founder, staging-devopsy.kinsta.cloud and Security Boulevard; and Chris Miller, Principal Security Program Manager, Veracode. In addition, the event will feature a number of Spotlight Sessions with topics designed to provide even greater value to attendees.

    This daylong virtual event is a great way to mix with others in the DevOps space without the hassle of traveling. It’s also a perfect excuse to wear your Grateful Dead t-shirt to the office.

    DevOps Experience 2019 is scheduled to be held Thursday, Oct. 10 at 10 AM EST, at a computer or mobile device near you. Visit the website for more information or to register for this daylong event. Registration—which is free, by the way—also includes access to the event on-demand.

    So pull on those bell bottoms, weave some flowers into your hair and join us for what’s sure to be an educational DevOps lovefest. Peace.

    — Charlene O’Hanlon

  • DORA Report: DevOps Maturity Levels Rise

    DORA Report: DevOps Maturity Levels Rise

    The annual DORA report on DevOps shows a marked increase among Elite performers compared to last year

    The DevOps Research and Assessment (DORA) arm of Google Cloud today published the results of an annual survey that suggests there have been marked gains in the level of DevOps maturity.

    The “2019 Accelerate State of DevOps Report,” an annual global survey of 31,000 IT professionals, finds 20% of the respondents now consider their organizations to be “Elite” DevOps performers, up from a comparatively paltry 7% a year ago.

    The Elite group reported their organizations routinely make multiple code deployments per day. By comparison, low performers reported deploying code somewhere between once per month and once per six months. The normalized annual deployment numbers range from 1,460 deploys per 365 days for the highest performers to seven deploys per year for low performers. Effectively, Elite performers deploy code 208 times more frequently than low performers, according to the DORA report.

    The report also finds Elite performers need less than a day of lead time to make a change to an application, compared to 2,555 hours for low performers, and Elite performers reported a change failure rate of 0% to 15%, compared to 46% to 60% for low performers. Finally, elite performers are able to recover from an incident 2,604 times faster than low performers.

    Nicole Forsgren, DORA Lead, Research and Strategy at Google Cloud, said the study makes it clear DevOps best practices are now crossing the proverbial chasm in IT. Organizations that are furthest along in making that transition tend to set up “communities of practice” within their organizations through which DevOps best practices are shared across teams, she noted. The DORA report also makes it clear elite performers automate and integrate tools more frequently into their toolchains on almost all dimensions.

    Forsgren said the study also makes it clear that the practice of slowing down the rate at which code is developed to achieve higher-quality application deployments is not nearly as effective as employing lighter-weight change processes to lower the amount of code getting deployed at any one time. Slowing down the rate at which code is developed and deployed is not a good strategy, she said, because as the amount of code that needs to get deployed at any time increases, reliance on heavyweight processes to deploy that code usually results in more errors being made. A lighter-weight approach provides the added benefit of reducing the amount of technical debt any organization is likely to incur at any stage of the DevOps process.

    The increased rate at which organizations are embracing best DevOps practices naturally coincides with the rise of more complex cloud-native applications. Most of those applications are being built using microservices that create a lot of dependencies within that application environment, with different development teams often working in isolation on specific microservices. The only way to manage that level of complexityeffectively is to embrace DevOps processes, noted Forsgren.

    In fact, the DORA report finds Elite performers are 24 times more likely to have met all cloud characteristics as defined by the National Institute for Standards and Technology (NIST) than low performers. Organizations that meet all essential cloud characteristics are 2.6 times more likely to be able to estimate the cost to operate software accurately. They also are twice as likely to be able to identify their most operationally expensive applications easily, and 1.65 times as likely to stay under their software operation budget, the study finds.

    Clearly, best DevOps practices is one of those rare IT gifts that simply keeps on giving.

    — Mike Vizard

  • How DevOps Training and Certification Benefits the Team

    How DevOps Training and Certification Benefits the Team

    Cisco Systems recently announced sweeping changes to its training and certification programs to increase the real-world value of both. Cisco’s move demonstrates a trend by organizations that provide training and certification to place more value on the practical aspects of educating technology professionals—which, in turn, should have a major impact on those looking to build DevOps teams.

    “Advances in network technologies have enabled new applications and business models—converged IP networks enabled voice over IP, 3G networks enabled mobile applications and 4G networks enabled mobile video,” said Susie Wee, senior vice president and CTO of DevNet at Cisco Systems. “DevOps has become a key factor for bringing those new networked applications to life. Training and certifications for network professionals and software developers have become a must. The goal here is to bring enhanced software skills to networking, enabling application developers to write applications that leverage the full capabilities of the network.”

    Cisco’s realization that real-world knowledge brings demonstrable value to businesses has culminated in new DevNet Certifications, which are designed to demonstrate an individual’s ability to bring software skills to evolving network technologies. “The only way to fully leverage the capabilities of the network is to build DevOps teams with both networking and software skills that can address the intricacies of both software-defined networking and physical networking solutions,” Wee added.

    Cisco is not the only company pursuing a change in training and certification processes. Industry group CompTIA recently revamped its certification programs. For example, the latest version of the CompTIA Linux+ exam has been redesigned to validate the competencies and skills required of early career IT professionals supporting Linux systems.

    “For certifications to have real value today, people must immerse themselves in the technology,” noted James Stanger, CompTIA chief technology evangelist. “The new Linux + certification uses performance-based testing that presents candidates with real-world scenarios, meaning that achieving certification demonstrates the ability to function in the real world.”

    CompTIA may very well be one of the leaders in the movement to bring real-world relevance to the certification process. The company has been using performance-based testing and has been embracing certification pathways to build teams. “For DevOps teams, critical skills, including project management, both agile and waterfall, are important. Developers will need to know the operating systems they are developing in, so they’ll need to understand Windows and Linux,” Stanger said. “The idea is that for DevOps, you need to get deep into the guts of operating systems and understand them well. You can specialize in one area, but you’ll also need to understand databases, relational databases and object-oriented databases.”

    Cisco also understands the importance of educating DevOps professionals. “Our new Cisco Certifications, with new DevNet Certifications, are designed for training and certifying network professionals and software developers, so they can bring software skills to networking,” Wee noted. “This new education process teaches application developers how to write applications that leverage the full capabilities of the network, and it helps build IT teams with network skills and expertise and software skills and expertise so they can leverage the full capabilities of the network, helping to support the DevOps process.”

    Cisco is also investing in the idea of building a community in the form of the company’s DevNet offering. DevNet was created some five years ago to help network engineers and application developers take full advantage of the revolutionary changes shaping the industry. The company is now focusing its efforts on what it sees as its customers’ biggest problem—network automation—and has created the DevNet Automation Exchange, a community-based developer center where networkers and developers can learn to “walk, run and fly” with network automation using Cisco’s products and the full capabilities of the new network.

    According to Wee, those three processes can be broken down into:

    • Walk: Get visibility and insights into their networks in a read-only way. This enables use cases such as gathering telemetry and insights from running networks and performing audits to ensure the ongoing security of the network.
    • Run: Activate policy and intent across different network domains. This enables use cases such as providing self-service network operations that comply with security policies and operational guidelines.
    • Fly: Proactively manage applications, users and devices with DevOps workflows. This enables use cases such as deploying applications in continuous integration and continuous delivery (CI/CD) pipelines while configuring the network in accordance with new application policies.

    Wee noted Automation Exchange has been seeded with more than 50 code repositories, many contributed by Cisco’s engineering teams and SEs. Now, she said, the company is inviting DevNet community members to submit code that solves their use cases.

    Updated certification and training resources from the likes of Cisco and CompTIA will go a long way to helping build DevOps teams that can hit the ground running.

    — Frank Ohlhorst

  • AI for IT Operations: All It’s Cracked Up To Be?

    AI for IT Operations: All It’s Cracked Up To Be?

    Artificial intelligence for IT operations (AIOps) is becoming a critical tool for organizations attempting to bring automation quickly to network management and IT problem resolution. However, many organizations are still unsure how to deploy AIOps for the most value and to net the full, promised results. Perhaps the challenges come from not looking beyond data silos, or perhaps the problems can be attributed to a lack of understanding AIOps’s full potential in the enterprise.

    Enzo Signore, chief marketing officer at FixStream, lends credence to the problem of siloed information. “Despite continued investments in system resources, IT cannot holistically see what’s in their physical and virtual infrastructure,” he said. “And without a clear view of the entire IT environment and the ability to make sense of the mountain of data being served up by various system tools, Ops teams can’t figure out what’s wrong or how to fix it.”

    In essence, for AIOps to be successful, IT must be able to access that siloed data and then be able to process that data to derive actionable insights, exactly what AIOps is meant to do. Yet, complexity still seems to be one of the major challenges of bringing a holistic approach to managing networks and resolving problems. 

    “IT teams are bogged down by the sheer complexity of today’s hybrid, dynamic IT environments,” Signore noted. “Along with steep learning curves and lightning-fast changes to new technology, IT departments must cope with soaring consumer expectations, supporting legacy systems, lack of skilled talent, disparate tool sets and opaque physical and virtual IT infrastructures. These factors complicate IT staff’s ability to oversee operations and optimize system performance.”

    Naturally, companies such as FixStream have a major stake in the AIOps game; the company offers numerous AI solutions that promise to modernize IT operations and bring AI into the realm of IT operations. However, understanding what AIOps is all about is one of the first hurdles to overcome when contemplating the technology. Gartner defines AIOps as platforms that enhance IT operations through greater insights by combining big data, machine learning and visualization. “IT leaders should initiate AIOps deployment to refine performance analysis today, and as an augment to IT service management and automation within the next two to five years,” advised Pankaj Prasad, senior principal analyst at Gartner.

    Gartner defined some best practices that businesses should adopt, which include: 

    • Deploy AIOps by adopting an incremental approach that starts with historical data and progress to the use of streaming data, aligned with a continuously improving IT operations maturity.
    • Select platforms that enable comprehensive insight into past and present states of IT systems by identifying AIOps platforms that are capable of ingesting and providing access to text and metric data.
    • Deepen the IT operations team’s analytical skills by selecting tools that support the ability to incrementally deploy the four phases of IT operations-oriented machine learning—descriptive, diagnostic, proactive capabilities and root cause analysis, to help avoid high-severity outages.

    Best practices aside, FixStream’s Signore opined that there are some other challenges that must be addressed. “Without the foundational capabilities of accurate discovery, contextualization and full-stack correlation, AIOps can become severely limited,” he said. “The lack of those features have become the big elephant in the room that everyone is not addressing, and it’s holding back the advancement of AIOps and machine learning for many companies.”

    Simply put, when AIOps is not fully deployed, important insights may go unnoticed and leads to data remaining in silos. “Companies are getting all this data, but it’s not being properly processed and correlated, and it’s going to waste,” he said.

    It is those types of deployment issues that are lending credence to AIOps not being as effective as promised. “AIOps is a multi-layered platform whose capabilities should include efficient data collection at big data scale, correlation across the collected data, machine learning, analytics and visualization,” said Bishnu Nayak, FixStream CTO.

    Businesses discouraged by the initial ROI of AIOps should take a long, hard look at their implementation strategy and take into consideration what their data sources are and how they are applying analytics, Nayak said. “Done right, an AIOps implementation can lead to a decreased mean time to remediation and better proactive problem-solving. By increasing system availability and responsiveness, AIOps can enhance your digital business operations and improve profitability.”

    — Frank Ohlhorst

  • Linus Torvalds Sees Lots of Hardware Headaches Ahead

    Linus Torvalds Sees Lots of Hardware Headaches Ahead

    Linux founder Linus Torvalds, today at the KubeCon + CloudNative + Open Source Summit China conference, warned attendees that managing software is about to become a lot more challenging, largely because of two hardware issues that are beyond the control of DevOps teams.

    The first, he said, is the steady stream of patches being generated as new cybersecurity issues related to the speculative execution model that Intel and other processor vendors rely on to accelerate performance. That model is the root cause of malware such as Spectre and Meltdown that have roiled the IT industry. Additional bugs in speculative execution with colorful names such as Fallout and ZombieLoad are showing up more frequently. Each of those bugs requires another patch to the Linux kernel that, depending on when they arrive, can require painful updates to the kernel, Torvalds told conference attendees.

    Short of disabling hyperthreading altogether to eliminate reliance on speculative execution, each patch requires organizations to update both the Linux kernel and the BIOS to ensure security. Turning off hyperthreading eliminates the patch management issue, but also reduces application performance by about 15 percent.

    The second major issue hardware issue looms a little further over the horizon, Torvalds said. Moore’s Law has guaranteed a doubling of hardware performance every 18 months for decades. But as processor vendors approach the limits of Moore’s Law, many developers will need to reoptimize their code to continue achieving increased performance. In many cases, that requirement will be a shock to many development teams that have counted on those performance improvements to make up for inefficient coding processes, he said.

    In the meantime, Torvalds noted updates to the Linux kernel are still coming at a rate of every three months, and the Linux team is basically working on a six-month planning cycle—there is no master five-year plan the Linux team is working from. Roughly 1,500 developers work on contributions to the Linux kernel, with 100 maintainers overseeing the implementation of those contributions.

    Naturally, cybersecurity patches at the kernel level have significant implications for all of DevOps. Changes to the kernel need to be absorbed by all the various distributions of Linux, which in turn impacts all the stacks of software that depend on Linux. Jim Zemlin, executive director for The Linux Foundation, said that in the wake of the rise of these hardware issues and previous cybersecurity issues involving open source software such as the Heartbleed vulnerability, cybersecurity is the top priority for The Linux Foundation. As part of that effort, The Linux Foundation is researching various DevSecOps approaches to better securing the global open source supply chain, he said.

    In the meantime, organizations large and small alike will need to up their DevSecOps game significantly if they want to continue to push application performance limits.

    — Mike Vizard