staging-devopsy.kinsta.cloud

Tag: devops

  • Rugged DevOps: Less Capture the Flag, More Teamwork

    Rugged DevOps: Less Capture the Flag, More Teamwork

    At the recent DEVNEXUS conference in Atlanta, I caught up with Chris Corriere to talk about his experiences in the realm of Rugged DevOps. Chris is a DevOps Engineer at AutoTrader and a contributor here at staging-devopsy.kinsta.cloud. During our conversation, we discussed automation, culture and collaboration, and which thought leaders he is following. Chris also shared insights on the upcoming DevOps Days Atlanta conference where he serves on the organizing committee.

    Derek Weeks: What’s your definition of rugged DevOps?

    Corriere: Rugged DevOps to me is definitely manifested in the security sector but it’s a shifting quality and awareness left in doing the best we can with the tools we have, the constraints we’re given, and in the environment we’re in. It’s about being more experimental, understanding that we’re going to encounter failure, and learning to adapt accordingly. We’re very much having to make tough decisions in real time. If you’re running anything in production these days, you need to do that as safely and as consistently as you can.

    Weeks: Is rugged DevOps only about security?

    Corriere: No. Security is really about mitigating risks. I think a lot of this ties into situational awareness about understanding your company’s risk. Is it user data? Is it credit card transactions or do you have a Russian botnet running in your infrastructure that you’re not aware of? What’s the asset you need to protect? Are you trying to protect an asset that is not there?

    You can’t have security come in and become suffocating where it’s not needed. In other situations you can’t leave things wide open that really do need to be protected because you’re more concerned with moving quickly than moving safely.

    https://youtu.be/fgMPKkM1NdY

    At the end of the day when you’re mitigating risk, it doesn’t matter if it’s customer data or a broken build or a bad user experience, these are all risks we need to mitigate. That’s really what rugged DevOps is. It is about is tying that value back to the user. It’s knowing what problems we trying to solve and understanding what we doing effectively (or not). It can be locked down as tight as you please, but if you cannot use the tool to solve the problem you picked it up for, it might as well not be running.

    Weeks: Security teams have been one of the last parts of the organization to come into DevOps practices. What’s been your experience with engaging security teams at Auto Trader?

    Corriere: That’s a good question. I’ve had experience with more than just security teams at Auto Trader. I’ve been involved in security a few places and they’ve approached me first when they found out I was into the DevOps stuff. They often come looking for assistance. They want to know: How do we get this baked in? How do we make this a priority?

    It really ties back into multi-factor authentication. It’s a good way to frame it up where you want developers and operations (those people who aren’t permanently rooted in security) to be aware of these things, to have automated scans, to be aware of cross-site scripting, and to understand how to remediate those kinds of issues.

    We’ve been implementing open source tools earlier in the development lifecycle to give us quicker feedback loops in order to be able to triage these things. Security applauds that but they can’t trust us too much with it. They’ve got to verify that we’re doing a good job with this, right? It’s a give and take where I’ve seen security come and offer automated solutions to DevOps teams and those solutions get adopted. The DevOps teams then take that and really start to run with it. Then security wanted to slow down a little bit because they were concerned about the quality of the vulnerability remediation. There is some back and forth there that has to be anticipated.

    ________________________________

    “We’ve been implementing open source tools earlier in the development lifecycle to give us quicker feedback loops.”

    ________________________________

    For security to trust you you’ve got to trust security to a large extent. If you’re putting more automation into the left side of your process and doing things before they hit production should be making your job easier. One of the side effects of that security may start going through some systems with a finer tooth comb because they’re not doing as much fire fighting. That may result in another ask from security. Understanding that this isn’t a declaration of war—we are simply continuing with an incremental progression toward further improvements. Interactions are cyclic and will happen again.

    We need to help security understand our pipeline, determine what’s going to be a good fit, and keep that communication level high so the trust is there. In these symbiotic relationships, cooperation is dependent on that trust. If that trust goes away you end up in something more competitive.

    There’s always room to drop back to where it’s more commensal and knowing when the kitchen’s gotten too hot. At those times, everybody needs to take a cool down lap and come back to it at the beginning of the next month. It goes back to that situation awareness, knowing where you’re at right now before you try to get to where you’re going.

    Weeks: We talked earlier today about red teams, blue teams, purple teams. What are they and can you describe some of the practices you’ve used to end up with more purple teams?

    Corriere: Yeah. Red teams take an attacking, reactive posture. Red security teams are worried about internal compromise, and when they find gray areas—for example, things that haven’t been fully signed off and authorized—it can result in unplanned work cropping up for the DevOps team. Generally that kind of unplanned work is introduced because the “Red” team felt they were not able to accomplish their job another way.

    Then the blue team side of the equation is really trying to stomp all that out. Blue teams keep things standard and locked down. They make sure everything’s approved in triplicate before it gets implemented, which can be rigid and very frustrating for developers.

    Purple teams allow that experimentation in earlier in the development lifecycle where they’ve got a little bit more leash. They’re allowed to experiment and stand up new things and make those things work before they getting it approved. Again, it’s about being transparent. Teams first want to understand what change was introduced and what the advantages of it are. They may also acknowledge that you need more than one solution to some problems, and that one tool might not fit everybody. If they’re using tools to automate that’s good. We can’t box them all into one necessarily. That’s where you see this go from blue and red to more of a purple. There’s more communication. There’s more conversation. There’s less capture the flag, more teamwork.

    ________________________________

    “There’s more communication. There’s more conversation. There’s less capture the flag, more teamwork.”

    ________________________________

    Weeks: You’ve been involved in the conversations around rugged DevOps for awhile. Who are some of the other thought leaders you learn from?

    Corriere: Jamesha Fisher out of San Francisco is one. She’s done some neat security stuff and is starting to look more into the vulnerabilities around some of the automation tools. Where are those vulnerable and where can they be leveraged against us? Automation is great until it automatically starts doing things we didn’t want. Another aspect of that is really trying to think more like an attacker; we need to think about: how would I break into this thing instead of just thinking how do I protect it.

    Georgia Weidman is popular in a lot of security circles and I’ve missed her workshop once. I’d like to catch it. She’s got a book out on pen testing which covers a lot of operations and concepts from an attack perspective. I would say that can be a fault of some rugged DevOps practices; you’re so quick to get the thing working and provide business value that you don’t realize where you’ve left something vulnerable. Sometimes you’ve got questions about why that thing you work with frequently is always locked down. Perhaps you find you can’t use it the way you want to. At those moments, it’s time to read through Georgia’s book. You’ll get some information as to why that thing is not open the way you want and where someone might use it for reasons might not expect.

    ________________________________

    “You’re so quick to get the thing working to provide business value that you don’t realize where you’ve left something vulnerable.”

    ________________________________

    Weeks: As we wrap up I know you’re on the organizing committee for DevOpsDays Atlanta. Do you want to give us an insight on the dates of when that’s coming up and call for papers, et cetera or we can help you share that?

    Corriere: Our CFP is open through the first of March. Our event is going to be in April. It’s the 26th and 27th which is a Tuesday and Wednesday. Monday, the 25th of April, we have Jeff Sussna coming in to do a full day workshop on continuous design. He’s going to be giving the keynote on our first day. We’re excited to have Jeff in town and excited to have him as a keynote. John Willis is going to be giving our keynote on the second day.

    We’re looking for proposals from anything in progress, people learning in the field, or trying to drop that barrier of entry. We’ve got a lot of bright people in the space. We’ve got a lot of people learning as they go. We need to be more vocal about that learning process and how we find our way through it. There’s not always this instantaneous vision that strikes us. We understand how to convert a shop into continuous delivery every night. There are definitely steps in between that. We need to have more conversations about those step in our industry. Yeah, anywhere in the stack, any interesting projects going on, we’d love to hear from you if you’ve got something.

    If you are interested in learning more about this subject, I invite you to download Amy DeMartine’s Forrester research paper, “The 7 Habits of Rugged DevOps.”

    As Amy notes, “DevOps practices can only increase speed and quality up to a point without security and risk (S&R) pros’ expertise. Old application security practices hinder speedy releases, and security vulnerabilities represent defects that can leave a company open to cyberattacks. But DevOps practitioners can leap forward with both increased speed and quality by including S&R pros in DevOps feedback loops and including security practices in the automated life cycle. These new practices are called Rugged DevOps.”

  • Mobile-Disruptor Simgo Launches World’s First eSIM

    BARCELONA, Spain, Feb. 22, 2016 /PRNewswire/ — Mobile-disruptor startup, Simgo® today announced the availability of an SDK for it’s award winning virtual eSIM cloud-platform (vSIM™) for cellular devices. Simgo’s v-SIM SDK, simgoinside™ is the world’s first fully functioning e-SIM for smartphones, tablets, wearables, connected cars and the exponentially expanding universe of IoT.  The simgoinside™ SDK is available for implementation by manufacturers and OEMs today at no cost to partners. A v-SIM implementation enables remote provisioning and automated, dynamic instant connectivity to any available mobile network based on user-defined rules such as QoS and cost, among others.

    “We’re glad the GSMA recognized the need for an e-SIM and implicitly validated Simgo’s work in the space. Unfortunately, however, the specification does not go nearly far enough,” said Eyal Shmueli, co-founder and Chief Innovation Officer at Simgo. “The e-SIM does much for subscription management, but nothing for device manufacturers or subscribers, who need connectivity management. e-SIM simply gets rid of the need to swap out a physical card, but it doesn’t help any user, enterprise or otherwise, manage their connectivity based on real requirements like signal strength, or managing roaming, which are two major issues for connected cars for example.”

    “Our decision to make the v-SIM SDK available for integration for free reflects constant discussion within the industry to address the palpable frustration among enterprise IoT players that the industry is not keeping up with the momentous technological changes occurring in economy and culture,” said Avi Ben Shlush, co-founder and Chief Executive Officer at Simgo. “We know an open source, cloud-based solution is aggressive but we want to help catalyze evolution for businesses and consumers alike.”

    In other news at Mobile World Congress, Simgo announced that industry veteranMasahiro Inoue is joining the Simgo board of directors. Founding CEO of Yahoo!Japan, Inoue was formerly the Director of Softbank who was instrumental Softbank’s Vodaphone acquisition, taking it to the number 2 position behind NTT DoCoMo.

    Simgo will be demonstrating its award-winning vSIM™ product range at Mobile World Congress, Barcelona February 22-25, in Hall 5, Stand 5D81 and in the Intel Booth at 4YFN To schedule a meeting, click here or go tohttps://simgo.typeform.com/to/mqDHuD

    About Simgo
    Simgo® provides the world’s leading cloud-based virtual SIM (vSIM™) platform for cellular devices, developed from its patented and award-winning technology.  By moving SIM management to the cloud, Simgo is shifting the paradigms of the mobile world and opening doors to new and exciting opportunities for users, operators, service providers and device manufacturers. Simgo is a 2016 partner in the Intel® Ingenuity Partner Program, “a carefully selected group of startups, chosen for their vision, innovative technology, and potential to create transformative solutions and products.” Simgo was awarded the first place in theMobile Enterprise Innovation category of the 2015 CTIA MobITs awards.

    For more information, visit www.simgo-mobile.com

  • 451 Research and Actifio Announce DevOps and Test Data Management Best Practices Webinar

    BOSTON, Feb. 22, 2016 /PRNewswire/ — Actifio, the copy data virtualization company, today announced its participation in an upcoming webinar featuring Jay Lyman, an analyst at 451 Research, and Chandra Reddy, VP of product marketing at Actifio, to discuss best practices for accelerating application development with DevOps, and copy data virtualization strategies.

    Webinar overview:

    This live webinar explores some of the most pressing issues in the world of application development, including test data management. Lyman and Reddy will discuss challenges facing teams moving towards a DevOps model and how new approaches and technologies such as Copy Data Virtualization can help:

    • Accelerate release cycles by drastically reducing test data provisioning, enabling faster time to market
    • Free test and development teams from the constraints of siloed infrastructure and processes with self-serve access to test data
    • Release higher-quality code by testing through the dev cycle against real, current, high-fidelity production data that is masked according to business requirements

    Who:

    • Jay Lyman, Research Analyst, 451 Research
    • Chandra Reddy, VP of Product Marketing, Actifio

    What: Crush Your Application Release Cycles – Get 5 Quarters in a Year

    When: Wednesday, February 24, 2016; 1:00-2:00p.m. ET | 10:00-11:00a.m. PT

    Where: Register here

    About Actifio
    Actifio virtualizes the data that’s the lifeblood of businesses in more than 30 countries around the world. Actifio’s Virtual Data Pipeline™ technology enables customers to protect, access, and move their data faster, more efficiently, and more simply by decoupling data from physical storage, similar to hypervisor technology decoupling compute from physical servers. For enterprise-class backup modernization, self-serve instant data access, or service provider business transformation, Actifio is the first and only choice for radically simple copy data virtualization. For more visit Actifio.com, or follow us on Twitter @Actifio.

    About 451
    451 Research is a preeminent information technology research and advisory company. With a core focus on technology innovation and market disruption, we provide essential insight for leaders of the digital economy. More than 100 analysts and consultants deliver that insight via syndicated research, advisory services and live events to more than 1,000 client organizations in North America, Europe and around the world. Founded in 2000 and headquartered inNew York, 451 Research is a division of The 451 Group. Learn more.

    CONTACT INFORMATION
    Callum Gibson Durr
    Bite for Actifio
    actifio@biteglobal.com
    +1 (415) 365-0392

  • The Difference Between DevOps and Anarchy

    The Difference Between DevOps and Anarchy

    DevOps is about being more efficient. It’s about breaking down silos and removing traditional business obstacles that get in the way of just getting things done. It’s about enabling teams and individuals to collaborate more seamlessly.

    None of that, however, means that DevOps is about turning your IT into some sort of “Wild West” anarchy, where anyone and everyone can just push code to production. That would be insanity.

    One of the primary catalysts that started the DevOps movement was the frustration of developers trying to deal with an operational bottleneck. As developers evolved from the old-school Waterfall development method to the much faster-paced Agile, developers were able create better software more quickly. That simply resulted in a “hurry up and wait” scenario, though, because the Operations and IT infrastructure side of the house couldn’t keep up.

    Fast forward a bit and DevOps was born. Since its inception, however, there has been confusion about what exactly DevOps is or isn’t. That might be a function—at least in part—of the fact that there was no “inception” of DevOps; nobody developed a thing and then rolled it out to the world with the announcement, “This is DevOps.” DevOps was an evolution that occurred organically and out of necessity. It meant different things to different organizations and was implemented in ways that were largely subjective and often not called anything in particular. Organizations were simply struggling to address challenges and coming up with solutions that worked.

    Suppressing the Anarchy

    Although traditional IT operations were the roadblock that sparked the DevOps movement, DevOps doesn’t mean developers get to simply do their own thing. I’ve worked in the trenches as an IT admin at a dotcom startup—I’ve experienced firsthand the disastrous fallout of a developer pushing untested code onto a production server, and I’ve witnessed the wrath of executive leadership when that happens and the proverbial “stuff” hits the fan. It’s not pretty.

    No, DevOps does not mean eliminating Operations from the equation and functioning as an IT anarchy. You’ll note that DevOps is a very obvious portmanteau of developers and operations—implying that operations is half of the DevOps solution. DevOps is about developers working more closely and cooperatively with Operations—not developers bypassing IT Operations.

    There are two components to successful DevOps: culture and continuousness. First, organizations need to shed the traditional mindset of separate siloed teams and departments and let individuals focus on working together in whatever way makes the most sense for efficiency and effectiveness. Empowering individuals to do what’s necessary to collaborate and get things done is a big part of DevOps.

    The other component is continuousness. When developers adopted Agile and started producing code faster, they discovered that Operations was a bottleneck. When developers and Operations started working together more seamlessly, new bottlenecks were identified, and solutions were developed to automate as much of those tasks and processes as possible.

    The ultimate goal of DevOps is continuous delivery—to continuously deliver new solutions and features. Rather than a lawless void where developers just push code out onto production servers willy-nilly, organizations adopt continuous development, continuous testing, continuous deployment, continuous monitoring and other tools that enable their teams and those developing solutions to do so with as little friction as possible.

  • Devops meme mondays

    Devops meme mondays

    Today starts a new week and a new round of entertaining memes.  Again this week we will leave the creativity open to a meme of your choosing.  Simply find a picture and create a funny and/or cunning devops themed meme. You can use https://imgflip.com/memegenerator as an easy source for generating memes.

    To submit your meme for a chance to win a t-shirt (top 5 memes receives a t-shirt), simply post it to twitter tweeting @DevOpsDotCom and using the hashtag #DevOpsMM.

    Last week was a holiday, so we do not have any winners from last week.

    Here are some examples of DevOps memes to help get the wheels spinning:

    download

    446644

    images

  • Avalon Consulting, LLC Announces “Getting Started” Workshop for Walmart Labs OneOps

    Custom engagement designed to empower enterprises to quickly assess open-sourced application lifecycle management platform from Walmart Labs

    PLANO, Texas, Feb. 18, 2016 /PRNewswire/ — Avalon Consulting, LLC, a leader in delivering business value through information technology, today announced the launch of a high-impact workshop for enterprises interested in evaluating Walmart Labs’ OneOps, a continuous application lifecycle management (ALM) platform for cloud-based workload.  Avalon’s 3-day workshop will enable organizations to reduce cost, time, risk and uncertainty related to suitability of OneOps for their ALM needs. The workshop furthersAvalon’s commitment to supporting full circle DevOps.

    Logo – http://photos.prnewswire.com/prnh/20160218/334831LOGO

    OneOps, the most comprehensive open-source ALM product available, allows developers to build and launch new products and features faster, forklift legacy applications to the cloud easily and maintain applications throughout their entire lifecycle with advanced auto-healing and auto-scaling capabilities. ALM products, such as OneOps, seek to alleviate the friction between business, technology and operations groups in organizations entering the Digital Economy and adopting cloud computing.

    “The promise of executing DevOps consistently and efficiently is in enabling IT to deliver breakthrough business results; OneOps is an innovative, comprehensive Application Lifecycle Management platform that will make that promise a reality for many,” said Brian Johnson, Sr. Director of Engineering, @Platform, Walmart Labs. “A primary challenge an enterprise will face in exploring OneOps due to its comprehensive nature is simply getting started. Workshops, like the one being offered by Avalon, are an excellent way to overcome that challenge in a cost-effective and timely manner and start off down the right path.”

    Avalon’s 3-Day Workshop for OneOps, offered onsite and customized for each client delivery, is designed to guide an organization in assessing OneOps within the context of that organization’s unique business operations and technology environment. The highly interactive workshop offers a guided, hands-on experience with OneOps combined with a facilitated discovery session to capture the organization’s current applications delivery practices. Additionally, the workshop identifies opportunities for optimizing existing Continuous Delivery (CD) pipeline and DevOps practices. Where appropriate, the conclusion of the workshop will include a high level outline of tasks and work effort required to achieve successful implementation of the OneOps platform.

    “The tools and techniques used to implement and manage applications in a hybrid multi-cloud architecture like OneOps are nascent and evolving. Technology and training environments that offer education and assistance to do so would be a welcome and valuable resource for those so charged,” said Carl Lehmann, a hybrid IT analyst with 451 Research.

    The tactics required to achieve success with DevOps initiatives are increasingly complex.  Aligning system architects, developers, administrators and business stakeholders to rapidly deliver new features with no downtime but a great return on investment is a growing challenge. Avalon provides expert leadership to guide clients in realizing the benefits of DevOps through accelerated adoption of, and enhancements to, agile development, continuous delivery, architecture, and cloud management processes.  OneOps is designed to offer all stakeholders in a DevOps initiative the easy-to-manage control truly needed to succeed. Avalon’s 3-Day Workshop for OneOps is designed to ensure organizations can get started in a fast and cost-effective manner.

    About Avalon Consulting, LLC

    Avalon Consulting, LLC is a technology consulting leader providing support for businesses of all sizes to maximize and utilize data and analytics in order to grow revenue, drive profit, and compete in a fast-paced global economy. Avalon specializes in enabling full spectrum DevOps. As a result, clients are able to turn data investments into actionable results. Avalon has benefitted over one-hundred organizations, primarily Global 2000 companies, through its four core service offerings: Continuous Delivery, Cloud Automation & Management, Agile Delivery, and Architecture. The volume and variety of data that organizations need to manage and analyze is changing rapidly and Avalon is plays a critical role in enabling our clients to navigate through it all. Headquartered inPlano, Texas, Avalon also maintains offices in cities across the US. For more information, please visit www.avalonconsult.com.

    PR Contact:
    Amy Bailey
    E: Email
    P: 800-681-8809 x111

    SOURCE Avalon Consulting, LLC

  • Illumio Introduces Adaptive User Segmentation as the Newest Weapon in the Battle to Reduce Cyber Attack Surface

    Illumio’s Adaptive User Segmentation capabilities dynamically integrate Microsoft’s Active Directory entitlements for hundreds of millions of users, dramatically expanding the reach of the Adaptive Security Platform
    SUNNYVALE, Calif.—February 17, 2016—Illumio today announced it has extended the capabilities of its industry-leading Adaptive Security Platform (ASP)Ô through integration with Microsoft’s Active Directory groups. The new capability, known as Adaptive User Segmentation, dynamically calculates and provisions connectivity rules based on user identity to prevent unauthorized communications with, and access to, any Illumio-protected applications. Illumio ASP now can govern how hundreds of millions of users connect to applications across data centers, clouds or hybrid-cloud compute environments.
    Adaptive User Segmentation is the latest step in Illumio’s core mission to secure data anywhere it resides:
    ·      When Illumio launched in October 2014, it introduced a complete range of adaptive segmentation models to reduce the attack surface, from environmental separation to micro-segmentation. It also introduced “MRI-like” visualizations of data center and cloud environments, as well as policy-driven transport layer encryption.
    ·      During RSA 2015, the company introduced its nano-segmentation capability, which provides process-level segmentation among both physical servers and virtual machines and reduces the surface area of server-to-server communications by over 99 percent. Illumio also extended its policy-driven segmentation model to incorporate F5 Local Traffic Manager and Application Firewall Modules.
    ·      Later in the year, Illumio announced partnerships with Docker and Mesosphere to extend adaptive security capabilities to fast-growing Linux container deployments.
    Illumio’s Adaptive User Segmentation extends to all of these environments and delivers the most meaningful reduction in the cyber attack surface area in computing history. The company has fused governance of both workload-to-workload communications and user-to-workload communications through this technology breakthrough, strengthening the traditional entitlement model in a way never possible before today. According to statcounter.com, Windows 7—the target OS for VDI desktops/laptops connecting to the data center—accounts for just under 50 percent of all desktop operating systems in operation.
    Today, users within an organization can see and connect to most, if not all, applications within the data center or cloud environment, regardless of their Active Directory entitlements. Given heightened challenges to deliver trust and security, relying on central systems of record like Active Directory to ensure users only have access to the appropriate assets is no longer sufficient. The breaches that occurred in the past few years in large enterprises and government agencies underscore that entitlements and authentication alone are unable to provide the protection required by high-value applications and data.
    Leveraging the Illumio ASP approach of writing and delivering a dynamic policy using a whitelist model, the integration of Illumio ASP and Active Directory allows an organization to ensure that only the correct users can connect to the appropriate workloads and applications in the data center, public cloud, private cloud or hybrid compute environment.
    “Illumio’s mission since our founding has been to help our customers regain control over their applications and data,” said Andrew Rubin, co-founder and chief executive officer of Illumio. “With the introduction of Adaptive User Segmentation, Illumio once again is dramatically reducing computing attack surface through dynamic, policy-driven enforcement that allows users to only connect to the data center and cloud compute they are entitled to access.”
    “Illumio’s new capabilities will resonate with security professionals assessing their security posture,” said Jon Oltsik, senior principal analyst, Enterprise Strategy Group. “Security leaders must deal with both sides of the user/data center equation and are well served to do it together rather than separately.”
    About Illumio
    Illumio delivers adaptive security for every computing environment, protecting the 80 percent of data center and cloud traffic missed by the perimeter. The company’s Adaptive Security Platform™ visualizes application traffic and delivers continuous, scalable, and dynamic policy and enforcement to every bare-metal server, VM, container, and VDI within data centers and public clouds. Using Illumio, enterprises such as Morgan Stanley, Plantronics, NTT, King Entertainment, NetSuite, and Creative Artists Agency have achieved secure application and cloud migration, environmental segmentation, compliance, and high-value application protection from breaches and threats with no changes to applications or infrastructure. For more information, visit www.illumio.com or follow @Illumio.
    ———————————————-
    Amber Rowland
  • Flash Mob Inflection: Rugged DevOps Revolution

    Flash Mob Inflection: Rugged DevOps Revolution

    Truthfully, I was never a huge fan of the HBO series “The Sopranos.” It’s not that it wasn’t entertaining; I just didn’t agree with the “best ever” label that so many espoused during the show’s halcyon days.

    This had something to do with living in Hoboken, N.J., at the time and feeling the show was a heavily glamorized caricature of the real-life Mafioso I still perceived to be in my midst. More specifically, it’s hard for anything mob-related to stand up next to “Goodfellas” and “The Godfather”—among my favorite films, ever.

    Either way, I currently find myself identifying with the series’ defining sentiment (copped directly from The Godfather, but hammered home as The Sopranos main theme): “Just when I thought I was out … they pull me back in.”

    It wasn’t that I assumed that I’d never delve back into the domain of IT security after transitioning into the DevOps market last year; leveraging DevOps methodologies to improve security, policy compliance and related workflows stands as a core element of the overall movement.

    But, in recent months and weeks it has become increasingly obvious that the security facet of the larger DevOps revolution appears poised for explosion as the buzz around emerging best practices, business models and solutions providers grows from a low hum into a steady roar.

    After spending a few days talking DevOps security with Derek Weeks of Sonatype at CA World ’15 (we were booth neighbors and dinner mates) and giving more consideration to his company’s angle on securing the systems development life cycle (SDLC) supply chain, the internal gears really got spinning.

    Regardless of whether you buy into Sonatype’s security-heavy approach, the concept of aggressively and proactively addressing security across the DevOps spectrum makes infinite sense. The ultimate downfall of applications security has always been the challenge of securing all the underlying layers of code (and today, microservices), especially as applications are assembled using heavier doses of shared, open source componentry.

    As further evidence, nearly every major solutions vendor focused on the DevOps space—whether oriented toward the vibrant application performance management (APM), configuration management and continuous testing segments, among many others—seems to have launched some initiative aimed at integrating security into their products.

    The rise of security capabilities adjacent to—and supporting inclusion into—the DevOps world, such as container giant Docker’s Content Trust initiative, along with the advancement of related startups including Twistlock, Scalock and StackRoxs, offers more proof of this growing momentum. And that’s only the container security piece of the puzzle.

    Of course, there are also a number of emerging startups aimed at addressing the DevOps security opportunity, backed by well-known venture capitalists. A shortlist might include providers such as Immunio, Prevoty and UpGuard (formerly known as ScriptRock, which recently rebranded itself under the guise of a “DevOps security” provider), and we’re sure to see many more. And don’t forget the growing emphasis on DevOps security among established security industry stalwarts such as CyberArk, Snort and Tripwire, among others.

    For a comprehensive list of the various types of DevOps security best practices and tools that we should expect to see gain wider adoption, this October 2015 blog by noted security analyst Adrian Lane of Securosis serves as a basic framework. Each of the areas of focus that he cites clearly offers significant opportunity for both new and existing methodologies.

    Finally, one need look no further than this year’s RSA Security Conference, to be held in San Francisco at this end of this month, as tacit proof of the continued growth of what people now varyingly refer to as DevSecOps or Rugged DevOps (I prefer the latter as it just sounds cooler).

    In addition to multiple conference sessions, notably a “DevOps Throwdown” between security industry veterans Caleb Sima, Chris Wysopal and Gary McGraw, there’s also the 2nd Annual DevOps Connect: Rugged DevOps Edition. If last year’s event is any indication (standing room only, venue literally at max capacity), this daylong DevOps security track at RSA will be an even more high-profile element of the entire week.

    Further, if DevOps security—or, at the very least, the growing focus on adjacent segments such as container security—isn’t the unofficial theme of this year’s entire RSA show, I’d be extremely surprised.

    Meanwhile (self-serving), my employer CA Technologies absolutely has a lot going on that complements and contributes to this growing DevOps Security market momentum.

    For all of those reasons, here I find myself again, drawn closer back into the security space that I’ve called home for roughly the last decade. I guess that’s just how it goes, as DevOps and security are inarguably two of the most significant trends in IT these days and inextricably linked at their respective cores.

    There are definitely worse fates out there. But, just when you think you’re out …

  • Webinar: 5 Key Metrics to Release Better Software Faster

    Webinar: 5 Key Metrics to Release Better Software Faster

    No matter how often you deploy your application, or how sophisticated your delivery pipeline is, you always need to know the quality status of the software you are building. This can only be done if you measure it. But measure what exactly?

    Join us for this webinar where Andreas Grabner and Brett Hofer, app performance evangelists, will look at five key metrics that will increase your confidence in securing a safe build for production.

    • Learn why metrics can be huge quality gateways
    • Identify key metrics to take back to your team (Dev, Test, Ops and Business)
    • Understand how to use, measure and report these metrics
    • 3 short use cases and how using metrics can help you avoid them

    After this webinar you’ll understand how specific key metrics can be set-up, understood collaboratively across teams, and help you produce better software, faster!

    Recording

    Slides

    [seoslides embed_id=”5481e89ca9d5″ script_src=”https://staging-devopsy.kinsta.cloud/embed-script/5-metrics-release-better-software-faster/13511/” overview_src=”https://staging-devopsy.kinsta.cloud/slides/5-metrics-release-better-software-faster/” site_src=”https://staging-devopsy.kinsta.cloud” site_title=”staging-devopsy.kinsta.cloud” title=”5 Metrics to Release Better Software Faster” /]

    

    

    
			
    
		
    
		
	
  • 
		
		
    
			
			
    Application Analytics for DevOps will be Presented by Nastel Technologies at IBM InterConnect 2016 in Las Vegas
    
			
    Join us and learn about analyzing shared metrics and tracking transactions in order to reduce support costs and deliver continuously. Visit Nastel in booth #660
    

    Melville, NY (PRWEB) February 18, 2016
    

    Nastel Technologies, a global provider of software for Application Performance Monitoring (APM), delivering real-time application analytics, transaction tracking and forensics will present “Application Analytics for DevOps” at IBM InterConnect 2016 in Las Vegas. The presentation will be delivered on February 22nd at 7 pm in the Expo Theater in the Mandalay Bay Solution Expo.
    

    Many organizations struggle with adopting DevOps. These businesses have invested in a large assortment of tools to make this work and yet there is still finger-pointing instead of collaboration. Nastel AutoPilot provides forensics for IT. Analyze the data from multiple sources, compare behavior across different times and locations, create metrics and search for the patterns that emerge.
    

    Join Nastel Technologies and learn how AutoPilot can help by providing: continuous monitoring, tracking and analytics. Nastel AutoPilot creates and analyzes shared metrics across HDFS, Logstash, Flume, Syslog, Kafka, MQ, Spark, Log4j, JMS, Java and other data sources; tracks transactions across applications; and provides an easy-to-use natural language to inquire or subscribe to live metrics.
    

    Nastel is also exhibiting at IBM InterConnect 2016 in booth 660. Nastel will be demonstrating its new AutoPilot Insight solution and end-user monitoring capabilities. AutoPilot Insight helps businesses gain instant insight into application performance by providing: a unified application analytics platform, automated transaction tracking, a wide array of data collectors and an English-like query language. All of this is built on an elastic architecture using clustered computing and NoSQL.
    

    jKool will also be presented in the Nastel booth and show a solution that provides real-time analytics for the Internet of Things (IoT).
    

    “2015 was an outstanding year for Nastel, with large wins, happy customers and new product innovation. Our laser focus on ensuring the highest levels of customer satisfaction combined with our relentless technical innovation has been the key to our revenue growth. With the addition of our new cutting edge analytics and forensics capabilities we are excited to provide continued competitive advantage to our global customer base” said Charley Rich, VP Product Management at Nastel Technologies.
    

    Recently, Nastel was honored by Gartner’s recognition of its accomplishments in the 2015 Magic Quadrant for Application Performance Monitoring Suites
    

    The chosen APM solution for over 200 Fortune 500 and Global 2000 corporations, Nastel AutoPilot has earned a reputation for helping companies significantly reduce the frequency and duration of costly application outages. By providing real-time analytics and transaction tracking across multiple event sources, Nastel AutoPilot is able to evaluate situations in IT Operations as a whole as opposed to just individual events. This powerful approach can infer a root-cause from multiple events and deliver meaningful, actionable alerts at the same time it prevents false alarms.
    

    About Nastel Technologies
    

    Nastel Technologies is a global provider of application performance monitoring solution with real-time analytics, comprehensive transaction tracking and forensics. Nastel is a privately held company headquartered in New York, with offices in the U.S., the U.K., France, Germany and Mexico, and a network of partners throughout Europe, the Middle East, Latin America and Asia. For more information, visit us at http://www.nastel.com.