Languages and DevOps: To The Cloud!
Cloud and DevOps are almost a match made in heaven. Cloud started truly gaining steam in the age of DevOps and Agile, and has adapted – or grown up in it – well, depending on your viewpoint. If not for the combined issues of data gravity and data (im)mobility, we might have gone even farther […]
Languages and DevOps: API-First
One of the places development has made significant changes is in the land of APIs. These days, a program almost isn’t considered a proper application unless it offers APIs to do most of what can be done via UI (and even command line). This is a big deal for several reasons; first and foremost, the […]
Languages and DevOps: Traditional
For quite a while now, all the cool kids have been going on and on about “full stack development,” “API first,” and a ton of similar methodologies/practices. And yet, a huge swath of applications are still targeted at a single system to do a specific job. There are fat clients, there are internal servers, there […]
Languages and DevOps: Web Development
Web development has changed a lot since DevOps first hit the scene. The languages used have shifted, where languages are used has shifted, the likely back-end hosting environment has changed – but DevOps has folded these issues in and just kept plugging along. We’re going to approach this from two angles – what languages you’re […]
Languages and DevOps: Embedded
Every once in a while, it is a good idea to take stock of the environment and the market around us to determine if what we are doing is what we should be doing. I’m a developer, not a prognosticator, so these observations are simply based on my experience in the development world, along with […]
DevSecOps Implementation: Patch Management
Patch management has been a thorn in IT’s side for decades. While it is undeniably necessary for security and stability purposes, the staggering array of patches that are available make managing them effectively nearly a full-time job – or a job better left to users. Few IT professionals want to be the “patch person,” and […]
DevSecOps Implementation: It’s About the Data
It seems we are constantly barraged with, “So-and-so announced that their systems had been breached and 80,000 user records were stolen,” notices. In fact, https://haveibeenpwned.com/ lists ten billion hacked accounts. That is no surprise. Databases exist to pool related data together. Even NoSQL type databases, which some saw as an opportunity for wildly disparate data […]
DevSecOps Implementation: EDR/XDR
We mentioned host intrusion detection and network intrusion detection in an earlier blog, and mentioned firewalls a couple of times in passing. Let’s delve a bit into the history to understand how these tools’ functionality has evolved over time. On the host side, we had virus detection, in one form or another, from early in […]
DevSecOps Implementation: SIEM
The world is filled with events. Our inbox floods with events that marketers really want us to pay attention to, while news feeds flood us with events they’re trying to raise above the background noise, but then, the dog barking interrupts our consumption of that information. Our family is, meanwhile, texting us about events on […]
DevSecOps Implementation: Intrusion Detection
Originally, this series was just going to be four articles on the DevSec side of DevSecOps. There are many reasons for this, but primarily because that side is cleaner. The other reason is that these topics are beyond the work we were doing at Accelerated Strategies Group. But we’ve had a number of requests to […]
Linux Foundation Exam for Certified IT Associates Available
A while back I wrote about an upcoming certification people receive from passing the Linux Foundation Exam. Now that it is available, I’m circling back as promised with more information. For those unfamiliar, this certification is specifically targeted at people who are newer to their IT career or just launching it. The goal is to […]
DevSecOps Implementation: Interactive Testing
This is the fourth installment in this series on DevSecOps. Read the first installment, on static analysis, here the second installment, on source composition analysis, here, and the third installment, on dynamic scans, here. Dynamic testing looks at the running application, poking and prodding to see how it reacts to known vulnerabilities. A complete dynamic […]
DevSecOps Implementation: Dynamic Scans
This is the third installment in this series on DevSecOps. Read the first installment, on static analysis, here and the second installment, on source composition analysis, here. One weakness of static analysis is its failure to account for environment and use. Running static analysis on a code base as the only check before production deployment […]
DevSecOps Implementation: Source Composition Analysis
This is the second installment in this series on DevSecOps. Read the first installment, on Static Analysis, here. One of the better additions to security in recent years is source composition analysis (SCA). The purpose of SCA is to sit in the gap between static analysis and dynamic analysis to help you find issues introduced […]
DevSecOps Implementation: Static Analysis
One of the things I’ve done for Accelerated Strategies Group recently is looking into DevSecOps toolsets. This is a fun area for me, as development and security fit together well in my mind. Having a separate security group is useful, even necessary in some scenarios, but letting developers crank out code and looking for vulnerabilities […]
New Survey Highlights Codebase Size Problems
Sourcegraph and Dimensional Research have released a survey of developers at large organizations, which shows a massive growth in codebase size, number of repositories in use and complexity concerns. “The Emergence of Big Code – A 2020 Survey of Software Professionals” is definitely intriguing reading, and a few of the results are eye-opening—such as the […]
Linux Foundation Adds Entry-Level Certification
The Linux Foundation has announced the development of a new entry-level certification exam to complement their existing Linux Foundation Certified Sysadmin (LFCS) and Linux Foundation Certified Engineer (LFCE) exams. This new certification, the Linux Foundation Certified IT Associate (LFCA), targets people just moving into systems administration. The certification will focus on the test taker’s knowledge […]
Onboarding Is Science, Not Art
Make sure your new team members are getting a well-rounded onboarding In Fortnite: Save the World, there is a questline in which a character named The Cloaked Star answers, “Figure it out yourself,” to a variety of questions from a new hero who was a DBA before the end of the world came. It is […]
The Pros and Cons of Configuration-as-Code
Configuration-as-code, or “GitOps” as many are now calling it, is a simple but astounding idea: Standardize configuration, check it into version control; no need for each Operations/DevOps person to develop their own set of scripts to get the job done. Configuring or reconfiguring an environment is as simple as checkout and run, assuming everything in […]
DevSecOps and Passwords: Lessening the Burden
The point of DevOps is to make IT more responsive (and hopefully more stable, but we have evidence that is not always the case). The point of DevSecOps (so far) is to make security more responsive and to build security right into the stack. These are both worthy goals. As we all have pointed out […]
Documenting: Don’t Build Your Replacement’s Nightmare
Want to reduce headaches tomorrow? Document everything today About once a year I feel the need to remind you that you are creating technical debt. DevOps is good stuff, and most shops got over the “whatever a given project team decides” multiplication of services pretty quickly, but every line of DevOps code you write is […]
But Wait, There’s More! The Trouble With DevOps Tools
DevOps tools today increasingly are no longer out-of-the-box ready for use. And that’s an aggravating issue Imagine you bought a new power tool—a sweet battery-powered drill/screwdriver that did everything you needed. Imagine it looked as though it ran on its own, but when you got it out of the box, you discovered that it didn’t […]
Knowledge Is Power
I was doing some research over the weekend, and it became abundantly clear that you can find an Ansible script to do pretty much any repetitive task in your infrastructure. This is good news for Ansible users, and the pool of available scripts will, no doubt, continue to grow as critical mass effect kicks in. […]