DevOps.com

Secure software depends on people finding vulnerabilities and deploying fixes before they are exploited in the wild. This has lead to a world of security researchers and bug bounties directed at finding new vulnerabilities. 

As dedicated as security researchers are, there is a vast ocean of software in existence, waiting for someone to find and exploit the next security vulnerability for profit or nefarious uses. With autonomous vehicles on the horizon, is there an autonomous solution to finding and fixing software vulnerabilities?

Enter DARPA Cyber Grand Challenge winner “Mayhem”, created by a team of researchers from Carnegie Mellon University who spun out security startup ForAllSecure. And they have a BHAG (Big Hairy Audacious Goal). "Our vision is to check the world’s software for exploitable bugs so they can be fixed before attackers use them to hack computers”. Mayhem has moved on from capture the flag contests to observing and finding vulnerabilities in DoD software and is working its way to corporate systems.

In this episode of DevOps Chats we talk with David Brumley, ForAllSecure co-founder and CEO, and CMU professor about the technology behind Mayhem, how it observes software as it executes, and injects changes to effect and observe new and potentially exploitable behaviors. More information about Mayhem is also available at www.forallsecure.com.

$2m DARPA Award Sparks Mayhem Testing, ForAllSecure

Our podcast guest believes the world changed “on a Tuesday" six months ago when the enterprise move to the cloud became imperative, not just an aspirational goal. That eureka moment was enough to pull Steve Mullaney off the sidelines and back into the game as CEO of Aviatrix after successful executive gigs at Palo Alto Networks and Nicira.  

Go-build might be a wonderful approach for cloud-native apps, but enterprises want the framework laid out ahead of their move to the cloud. Think enterprise cloud IT reference architecture, much like Cisco provided for enterprise IP networks, DEC mainstreamed for client-server, and IBM established for mainframe computing. You have to “bring the cloud to them.” That enterprise cloud reference architecture is what Aviatrix targets, in the same buy-with-a-credit-card model that fueled customers’ unfettered move to AWS.  

On our DevOps Chat podcast episode, Steve Mullaney, CEO of Aviatrix, talks about what enterprises want in a true enterprise multi-cloud backbone to support their needs. Additional information about Aviatrix offerings is available at www.aviatrix.com.

Enterprise Multi-Cloud Backbone with Aviatrix

RSA Asia Pacific & Japan Conference 2019 in Singapore promises exciting and engaging sessions. A likely popular and possibly controversial talk will be “The Future of AppSec is Cloud Native.” 

Co-Presented by Jimmy Mesta (CEO and co-founder Ksoc and CTO at Manicode Security) and Jim Manico (Founder and trainer at Manicode Security), this talk makes the bold assertion that how we build cloud native applications will establish the new benchmark for application security. 

On this episode of DevOps Chats, Jimmy and Jim preview their RSA APJ 2019 talk, set out the case for why cloud native is the future for AppSec, and entice all of us to come learn more at their session on July 18 at 4:30pm. We hope to see everyone at their talk at RSA APJ 2019.

RSAC 2019 APJ Preview: The Future Of AppSec Is Cloud Native, Manicode

Agile, DevOps, multiple cloud providers, serverless, contemporary cloud native apps, shadow IT using a credit card…it can be daunting for any IT organization to be responsive to the internal customer needs. It’s even tougher to be proactive and get ahead of the curve. Enter Cloud Management Platforms (CMP).

On this episode of DevOps Chat, we talk with Bernard Sanders (no, not the presidential candidate), CTO of CloudBolt. Our conversation explores how IT can use a CMP to provide the IT and self-service capabilities so DevOps and Agile teams won’t feel the pain and slowdown of IT past. Learn more about CloudBolt’s products at www.cloudbolt.io.

Hybrid and Multi-Cloud Management For DevOps, CloudBolt

Should we secure containers? How do we secure containers? How do we secure serverless computing architectured apps? With code repositories growing rapidly with each container we create, our guest John Kinsella, VP of Engineering - Container Security at Qualys, has some sage advice for securing containers. 

Containers are not intended to isolate code from security vulnerabilities, containers are designed for packaging and use. Which of my containers have a vulnerable version of OpenSSL installed in them? Integrating vulnerability scanning into the CI/CD process gives developers information to catch vulnerabilities in open source code before it hits production. 

Join us on this episode of DevOps Chat as we dive into the container security insights John Kinsella of Qualys has to offer.

Container Security in an Open Source World, Qualys

RSAC 2019 APJ in Singapore is coming up and we’re lucky enough to preview a talk by Derek Manky titled "Flash War: Tapering an Accelerating Attack Chain." 

The speed at which networks are attacked, compromised and then intruders spread laterally is increasing rapidly. Add swarm technologies with AI machine learning and automation and the future holds a world where attacks that take days, hours or minutes today could laterally happen in fractions of a second tomorrow. House of Mirror defenses (yes, the network security equivalent of Bruce Lee’s Enter The Dragon mirror room) and other deceptions techniques step up to the challenge of tapering this accelerating attack chain.

On this episode of DevOps Chats, Derek Manky, Chief of Security Insights at Fortinet previews his RSAC 2019 APJ Preview talk, Flash War: Tapering an Accelerating Attack Chain, scheduled at 1:15pm on July18th in Singapore. Join us on this podcast and at Derek’s RSA talk.

RSAC 2019 APJ Preview: Flash War - Tapering an Accelerating Attack Chain, Fortinet

Michael Coates is on a mission, a journey, an unassailable quest. 

You don't come away from senior security leadership roles at Twitter and Mozilla without some real-world lessons of how to improve cybersecurity. Those lessons inspired our guest Michael Coates, former Twitter CISO, to co-found his new startup Altitude Networks. 

While we don't yet know all the details about Altitude Networks, we know Michael is addressing the protection of data when using cloud collaboration software like Google Drive, Box, Dropbox, Office 365 and other online collaboration services. 

Michael shares with us the lessons he learned from security roles at Twitter and Mozilla is applying at Altitude Networks. Security products need to be designed to solve problems and alleviate work, not make work. And security needs to enable end-users to get their work done and not interrupt them with confusing popups, options, and decisions most end users won't understand. 

Join us on this episode of DevOps Chat to get the latest on Michael Coates and his new company Altitude Networks. You can sign up for Michael's new newsletter at https://hubs.ly/H0jvMBN0 .

A CISO's Quest For Better Security, Michael Coates, Altitude Networks

Martin McKeay, a cybersecurity veteran, joins us to review Akamai's latest State of The Internet report (SOTI). This SOTI edition, dubbed Financial Services Attack Economy, highlights the vast array of cyber attacks targeted at the financial systems ecosystem over the past 18 months.

Martin highlight from the report includes readily available lists of compromised user IDs and passwords, stuffing attacks, low cost or free All-In-One (AIO) attack tools, and the characteristics of phishing attacks against enterprises versus financial institutions. And more.

Join us on this episode of DevOps Chat with Martin McKeay, Editorial Director, Akamai. The full report is available at www.akamai.com/soti/

Akamai Financial Services Attack Economy Report with Martin McKeay

The tribe at Armory (https://armory.io) announced their $28m series B funding, led by Insight Partners. Armory enables continuous software delivery at enterprise scale, powered by Spinnaker. 

That is a crisp mission statement, but beyond that Armory is bringing the open source Spinnaker to the enterprise market. As such they are also helping the entire Spinnaker community and as part of this the entire CD market. They are members of the CD Foundation, part of the Linux Foundation as well.

I had a chance to catch up with their founder/CEO, DROdio and VP of marketing, Carl Landers to talk about Spinnaker, CD and the state of software delivery. 

BTW, if you are interested in learning more about Spinnaker and will be in San Diego for CloudNative.com/KubeCon, the Spinnaker Summit is the weekend before. The Armory folks have been nice enough to arrange a 20% discount if you would like to go: 
 https://www.eventbrite.com/e/spinnaker-summit-2019-tickets-57895274324?discount=ARMORYAUGUST20
The code for discount is ARMORYAUGUST20.

Also you can join the Spinnaker slack channel at: http://join.Spinnaker.io i

DevOps Chat

Armory Raises $28m to Bring Spinnaker to the Enterprise

In a world where our apps are stitched together from a various building blocks, why wouldn't we do the same with Kubernetes? Operators make this possible.

We spoke with Rob Szumski of IBM RedHat OpenShift team about the groundbreaking work he and the OpenShift team have been doing with bringing an entire library/repo of Operators for Kubernetes that will make it easier and faster to deploy and use Kubernetes.

Low code/no code is the wave and now you can ride it with Kubernetes too.  Have a listen.

Operators for Kubernetes

The software development tool needs of a 2-3 person team can be much different than those of a large enterprise. CI/CD is a common approach nearly all software teams establish. But what needs of a larger software organization to you adopt early on and which simply adds more complexity than benefit?

Rob Zuber, CTO of CircleCI, began tackling this problem in the mobile space and then moved to CircleCI to help create what is now a well established SaaS-based CI/CD offering to software teams of all sizes. Join us on this episode of DevOps Chat and take away some valuable CI/CD lessons for your organization.

CI/CD Scalability Lessons - Startup to Enterprise, CircleCI

It's easy to forget not everyone started their move to the cloud eight or even ten years ago. Early adopters have a wealth of experiences that can benefit newcomers and experienced teams alike.

A preview to August 14th's webinar "Top 5 AWS Security Mistakes and How to Stop Them Before You Lose Data", DisruptOps CEO Mike Rothman joins us on DevOps Chat. In this episode, we reflect on learnings and knowledge Mike and co-founder Rich Mogul incorporated into their product DisruptOps Guardrails. 

Be sure to register for the Aug. 14th webinar at https://webinars.devops.com/top-5-aws-security-mistakes-and-how-to-stop-them-before-you-lose-data.

Preview - Top 5 AWS Security Mistakes to Avoid Losing Data, DisruptOps

As any CIO knows, a data management architecture is essential to caring for one of the organization's most valuable assets: data. Data management sounds simple but it's not.  Backup and recovery, disaster recovery, data retention, governance, e-discovery... all are parts of any effective data protection strategy.

As businesses move and grow their presence in the cloud, the same capabilities apply in this very dynamic and elastic environment.

Recently, Druva received another investment round of $130m led by Viking Global. Mike Palmer, Druva Chief Product Officer, joins us on this episode of DevOps Chat where we talk about Druva's planned use of those funds, and Druva's approach to providing a SaaS-based data protection platform.

Data Protection - An Enteprise IT Necessity in the Cloud, Druva

Network technology has undergone its own transformation in parallel with cloud infrastructure, how we create software, and the adoption of DevOps. SDN, NFV, virtual network appliances, and an ever-expanding suite of APIs making network and security technologies much more accessible to developers.

Network engineers' worlds are rapidly changing too. From highly skilled to associate-level, all network engineers are faced with building up a new and necessary skill: software development. Learning software dev can be a daunting, even intimidating proposition even for someone already skilled in the network engineer domain. 

So, how do we lift up the community of network engineers and help them build their development chops? How can software and DevOps engineers easily get access to all the programmatic interfaces that configure, manage and control the network? 

These questions and more we explore with Susie Wee, Founder, Senior Vice President, and CTO of Cisco DevNet. DevNet is an online resource full of information for app developers, infrastructure developers, and network and DevOps engineers. On DevNet you'll find training (Python, API, and more), sandboxes for experimentation, code exchanges (including GitHub), CI/CD, and new Cisco certifications for software. Check out DevNet at https://developer.cisco.com.

Cisco DevNet - DevOps and the Programmable Network, Susie Wee

Doing anything at enterprise scale call brings with it a whole new set of requirements. With potentially thousands of requirements across hundreds of applications and releases, it can be a daunting challenge to pull together all the DevOps activities across a large enterprise. This has given rise to the new term Value Stream Management (VSM.) 

Like Salesforce for managing the sales pipeline, Value Stream Management is about IT seeing across all its initiatives, teams and projects. Are high-value requirements making it into production systems? Is DevOps making the expected impact at enterprise scale? Are VSM tools well integrated into the DevOps toolchain or are teams slowed by extra or unnecessary work. You must keep a handle on it all but we don't want the medicine to be worse than the disease.

In this episode of DevOps Chat, we explore VSM with our guest Bob Davis, CMO at Plutora. Plutora tackles the VSM challenge at some of the largest banks, financial institutions, telecom and mobile carriers, insurance, hotels, and Internet technology companies.

DevOps and Value Stream Management in the Large Enterprise, Plutora

Red Hat Linux is a staple of most enterprise IT organization's software diets. Developers and IT leaders all over the world took notice when IBM acquired Red Hat. Will IBM Red Hat change? Will Red Hat continue to operate as it does today or will it be subsumed and disappear into some IBM business unit? Will IBM Red Hat still contribute to projects and tools like Kubernetes, JBoss, Fuse, OpenJDK, Eclipse IDE, and many others (https://redhatofficial.github.io/#!/main)? All are important questions.

Brad Micklea, Lead of the Developer Program and Tools at IBM, joins DevOps Chat to talk about the future of Red Hat as part of IBM. Brad sends a strong message that Red Hat will remain focused on the developer community and tools for Linux, Kubernetes, Java, DevOps, and others. 

Join us as we talk with Brad about the future of Red Hat, DevOps, and open source developer tools.

Red Hat Developer Experience in the IBM Era, Brad Micklea

Swiftly after announcing their acquisition of SignalFx, Splunk vaults into microservices tracing by announcing its intention to acquire Omnition. Tech companies are rapidly making acquisitions to strengthen their position in the DevOps and contemporary cloud-native software stack. 

Rick Fitz, SVP and GM of Splunk's IT Markets Group, joins DevOps Chat to share with us the drivers behind Splunk's move into microservices and service mesh tracing. Information about Omnition is in short supply as Omnition's been in stealth, racing to develop a product to address the observability needs of DevOps teams. Omnition has received some notice through its contributions to OpenCensus open source, now being merged into OpenTracing. 

In addition to this episode of DevOps Chat, check out Mike Vizard's article about the Omnition announcement at https://devops.com/splunk-adds-omnition-to-devops-portfolio/.

Splunk Moves Into Microservices/Service Mesh Tracing, Omnition

Data and database technologies are experiencing disruption. The volume of data collected is exploding, creating new potential for disruptive services and new companies. Data is distributed across locations in the cloud and the data center. Also, cloud technologies bring a plethora of database types, distribution options, analytics capabilities, and AI/ML processing. Any company not leveraging data to the benefit of its customers and business are just asking to be the next victim of disruption.

Nikita Shamgunov, memSQL Co-CEO / Co-Founder, joins DevOps Chat to discuss how these disruptive factors changed how containerized and cloud-native applications approach data collection and storage. Speed, high volume data collection, distributed design, and scale are all challenges Nikita sees as vital for cloud-native applications of today and the future.

Database for Cloud-Native Apps at Speed And Scale, memSQL

As the velocity of software creation, testing, and deployment increase rapidly, security at the app level is gaining ever more scrutiny. Code vulnerability scanners, automated security test tools, test libraries for containers are just a few of the security testing approaches broadly in use. Many of these approaches fall under a DAST (dynamic application security testing) or SAST (static application security testing.) 

As velocity increases, so does that amount of code we're creating, placing even great importance on testing, test automation, and application security testing.

Creator of Seeker IAST (Interactive Application Security Testing), Ofer Maor,  Director of Solutions Management at Synopsys, joins DevOps Chat.  We talk about the value of IAST, maximizing testing automation, integration of testing technologies into the workflow, security testing built into containers, application security testing orchestration, and more.

The Value of Interactive Application Security Testing, Synopsys

Value Stream Management (VSM) is a term we hear with higher frequency. DevOps, Agile, Lean, and contemporary application development are very dynamic. These rapid, dynamic approaches can make the software development process opaque to the broader organization. It’s early in this part of the market, but it’s born out the need for quantifying the business value coming from our investments in software development.

Steve Boone, Head of Product Management at HCL UrbanCode, joins us on this episode of DevOps Chat to talk about the state of this emerging market. Steve shares valuable insights about how organizations are working together, where DevOps and Agile are making a measurable difference, and what management can do to provide teams with tools to manage their VSM.

DevOps.com

Sulabh Chaturvedi