Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: A big-tech consortium goes toe-to-toe with Google Maps, and a big-tech consortium tries to fool AI regulators. (more…)
VMware announced it is adding a service mapping capability to the Wavefront 3D Observability platform it provides with the Wavefront by VMware monitoring tools.
Stela Udovicic, senior director of product marketing for Wavefront, said Wavefront Service Maps will make it easier for IT organizations to visualize what will soon be thousands of microservices running highly distributed computing environments, including those based on containers running on Docker Engine, connected via service meshes such as Istio or spanning proxy servers such as Envoy.
Capabilities provided by Wavefront Service Maps include packaged visualization of request flows with a map of service dependencies, built-in tracking of health metrics and view into individual traces to pinpoint performance bottlenecks.
Accessed as a set of software-as-a-service (Saas) applications, Wavefront by VMware relies on an agentless approach to monitoring that supports all the major public clouds along with providing integrations with platforms such as Kubernetes, GitHub, Slack, PagerDuty, Kafka and Pivotal Application Service.
Udovicic said by making it easier to visually identify and troubleshoot microservices, IT organizations should be able to accelerate their transition to modern cloud-native applications. Building and deploying a single application based on microservices is complicated enough. Trying to support hundreds of those applications is simply too daunting without the ability to visualize all the interdependencies between those services. Troubleshooting any issue then becomes easier because Wavefront Service Maps is designed to enable DevOps teams to drill down to the traces being employed to monitor the application, she said.
Earlier this year, Wavefront added support for distributed tracing and machine learning algorithms that also make it easier to identify anomalies within a microservices-based application.
In terms of adoption of cloud-native applications, Udovicic said there are basically two classes. The first are early adopters who are already highly committed to developing cloud-native applications. The bulk of the enterprise IT community, however, is still in the early stages of building and deploying these types of applications, said Udovicic.
There’s naturally a high correlation between organizations that have adopted cloud-native application development using microservices aggressively and those that have implemented best DevOps practices. In fact, one of the benefits of a visualization tool is that it makes it easier to bring new members on to those teams. Rather than having to piece together what is occurring in the environment, a new member of a DevOps team can visually inspect each microservice they might be responsible for managing.
It may be a while before DevOps processes become the dominant default method for managing IT. But as DevOps tools become easier to use, the number of DevOps practitioners should increase steadily. Arguably, one of the reasons DevOps adoption is not as far along as it might be is that the learning curve is still too steep. But as visualization capabilities gets added to the analytics frameworks baked into those tools, it’s now only a matter of time before the number of IT professionals that might be intimidated by DevOps processes starts to decline steadily.
— Mike Vizard
Issued Patents Will Drive Innovation in Managing Large Volumes of Data Generated by Application Security Testing Programs
San Antonio, TX – October 30, 2018 – – Denim Group, the leading independent application security firm, today announced that the United States Patent and Trademark Office (USPTO) has awarded the company two patents which will provide a method of correlating and merging static application security testing (SAST) and dynamic application security testing (DAST) for web and mobile applications. The official name of the Hybrid Analysis Mapping (HAM) patents are as follows: Method of Correlating Static and Dynamic Application Security Testing Results for a Web Application (Patent #10,043,012) and Method of Correlating Static and Dynamic Application Security Testing Results for a Web and Mobile Application (Patent #10,043,004).
The continued proliferation of websites, web applications, and mobile applications that handle sensitive data makes securing an organization’s application portfolio a major challenge. Effective application security programs utilize multiple types of analysis to test applications for security vulnerabilities, resulting in a high volume of data produced. This increased data can be valuable when it provides deeper insight into vulnerabilities; however, it can also make the problem of identifying areas of concern harder to manage by requiring further manual reviews by the analyst or highlighting large numbers of vulnerabilities and weaknesses that are of low value or priority. Without positive correlation of large data sets, the value of vulnerability data sets is diminished.
Denim Group has implemented the technology from these two Hybrid Analysis Mapping patents into their vulnerability resolution management platform, ThreadFix, in order to help organizations efficiently manage the large volume of data that is generated by an organization’s application security testing program. This technology makes ThreadFix the first platform able to correlate SAST and DAST results without requiring a runtime agent. As a result, organizations report a 71% success rate in matching SAST and DAST results and an average reduction of 15-35% in overall findings. ThreadFix improves the ability of the application development team to identify vulnerabilities found by both testing tools and prioritize them in order of degree to be addressed.
“We are honored to be awarded these two patents by the USPTO to help organizations more effectively manage their application security testing data,” said CTO of Denim Group, Dan Cornell. “By enabling organizations to more accurately correlate the results of static scans with dynamic scans and manage the data that is generated by their testing program more efficiently, we are delivering a significant breakthrough for today’s industry professionals in the application security space.”