More and more enterprise data is being transferred to the cloud, but sometimes the journey can break the network's back – which calls for less virtual and more physical solutions.

Microsoft has announced the general availability of Azure Data Box, a physical box which organisations can order, fill up, and then return to Redmond for it to be uploaded to an Azure environment. 

Companies and users can store up to 100 TB per standard box, with variables either way. The newly announced Data Box Heavy can handle up to 1 PB of data, while Data Box Disks go up to 40 TB.

For those who may consider this a decidedly low-tech method of cloudy data transfer, it is worth noting Amazon Web Services (AWS) has long since had Snowball, a petabyte-scale data migration tool which carries similar bulk as Azure Data Box. AWS also has the Snowmobile, a 45-foot long shipping container, for data loads up to 100 PB.

The customers who really  benefit from these types of tools are those organisations either with reams of offline data from legacy tools, or those collecting data in hard to access places. For instance, moving an exabyte of data across a 10 gigabit per second line would take the better part of two and a half decades to complete.

Oceaneering International was one of the first customers of Azure Data Box last year. Its underwater vehicles generate 2TB of data per day, with the vessel itself generating up to 10TB per day. "We're trying to get the data to the decision maker quicker," explained Mark Stevens, director of global data solutions, adding it is aiming for a seven day turnaround from the field anywhere in the world.

The other addition to the product family is Azure Data Box Edge, which combines on-premises with AI-enabled edge compute capabilities. With increasing amounts of data being created at the edge, the Edge hardware enables data analysis and filtering at the edge of the network, as well as being a storage gateway.

You can find out more about the Azure Data Box family here.

Picture credit: Microsoft

If you run workloads in Kubernetes, you know how much important data is accessible through the Kubernetes API—from details of deployments to persistent storage configurations to secrets. The Kubernetes community has delivered a number of impactful security features in 2017 and 2018, including Role-Based Access Control (RBAC) for the Kubernetes API.

RBAC is a key security feature that protects your cluster by allowing you to control who can access specific API resources. Because the feature is relatively new, your organization might have configured RBAC in a manner that leaves you unintentionally exposed. To achieve least privilege without leaving unintentional weaknesses, be sure you haven't made any of the following five configuration mistakes.

The most important advice we can give regarding RBAC is: “use it!” Different Kubernetes distributions and platforms have enabled RBAC by default at different times, and newly upgraded older clusters may still not enforce RBAC because the legacy Attribute-Based Access Control (ABAC) controller is still active. If you’re using a cloud provider, this setting is typically visible in the cloud console or using the provider’s command-line tool. For instance, on Google Kubernetes Engine, you can check this setting on all of your clusters using gcloud:

$ gcloud container clusters list –format='table[box](name,legacyAbac.enabled)'
┌───────────┬─────────┐
│ NAME                  │ ENABLED       │
├───────────┼─────────┤
│ with-rbac              │                        │
│ with-abac             │ True                │
└───────────┴─────────┘

Once you know that RBAC is enabled, you’ll want to check that you haven’t made any of the top five configuration mistakes. But first, let’s go over the main concepts in the Kubernetes RBAC system.

Your cluster’s RBAC configuration controls which subjects can execute which verbs on which resource types in which namespaces. For example, a configuration might grant user alice access to view resources of type pod in the namespace external-api. (Resources are also scoped inside of API groups.)

These access privileges are synthesized from definitions of:

• Roles, which define lists of rules. Each rule is a combination of verbs, resource types, and namespace selectors. (A related noun, Cluster Role, can be used to refer to resources that aren’t namespace-specific, such as nodes.)
• Role Bindings, which connect (“bind”) roles to subjects (users, groups, and service accounts). (A related noun, Cluster Role Binding, grants access across all namespaces.)

In Kubernetes 1.9 and later, Cluster Roles can be extended to include new rules using the Aggregated ClusterRoles feature.

This design enables fine-grained access limits, but, as in any powerful system, even knowledgeable and attentive administrators can make mistakes. Our experiences with customers have revealed the following five most common mistakes to look for in your RBAC configuration settings.

Configuration mistake 1: Cluster administrator role granted unnecessarily

The built-in cluster-admin role grants effectively unlimited access to the cluster. During the transition from the legacy ABAC controller to RBAC, some administrators and users may have replicated ABAC’s permissive configuration by granting cluster-admin widely, neglecting the warnings in the relevant documentation. If users or groups are routinely granted cluster-admin, account compromises or mistakes can have dangerously broad effects. Service accounts typically also do not need this type of access. In both cases, a more tailored Role or Cluster Role should be created and granted only to the specific users that need it.

Configuration mistake 2: Improper use of role aggregation

In Kubernetes 1.9 and later,Role Aggregation can be used to simplify privilege grants by allowing new privileges to be combined into existing roles. However, if these aggregations are not carefully reviewed, they can change the intended use of a role; for instance, the system:view role could improperly aggregate rules with verbs other than view, violating the intention that subjects granted system:view can never modify the cluster.

Configuration mistake 3: Duplicated role grant

Role definitions may overlap with each other, giving subjects the same access in more than one way. Administrators sometimes intend for this overlap to happen, but this configuration can make it more difficult to understand which subjects are granted which accesses. And, this situation can make access revocation more difficult if an administrator does not realize that multiple role bindings grant the same privileges.

Configuration mistake 4: Unused role

Roles that are created but not granted to any subject can increase the complexity of RBAC management. Similarly, roles that are granted only to subjects that do not exist (such as service accounts in deleted namespaces or users who have left the organization) can make it difficult to see the configurations that do matter. Removing these unused or inactive roles is typically safe and will focus attention on the active roles.

Configuration mistake 5: Grant of missing roles

Role bindings can reference roles that do not exist. If the same role name is reused for a different purpose in the future, these inactive role bindings can suddenly and unexpectedly grant privileges to subjects other than the ones the new role creator intends.

Summary

Kubernetes RBAC configuration is a critical control for the security of your containerized workloads. Properly configuring your cluster RBAC roles and bindings helps minimize the impact of application compromises, user account takeovers, application bugs, or simple human mistakes.

Check your clusters today—have you made any of these configuration mistakes?

Many business leaders have a much better understanding of blockchain technology than just a couple of years ago. There's been a surge in R&D, both internally and in partnership with third parties, and a recognition that blockchain has the potential to be deployed in a variety of commercial use cases.

As the number of blockchain research projects increased, awareness among the pilot participants and elsewhere in their industries gained momentum. Now other companies are beginning to consider whether they, too, should seek to gain a competitive advantage from a proof-of-concept deployment.

Blockchain market development

According to the latest worldwide market study by Juniper Research, 65 percent of survey respondent enterprises with over 10,000 employees are considering or actively engaged in blockchain deployment. This marks a significant rise from 2017 when the corresponding figure was 54 percent.

Moreover, nearly a quarter of companies considering deploying blockchain had moved beyond proof-of-concept into trials and commercial rollouts, with dramatic diversification in use cases over the past year.

Only 15 percent of proposed deployments were now related to payments – compared with 34 percent last year – with significant interest in opportunities across diverse fields including logistics, authentication and smart contracts.

The study findings also identified savings and cost reductions across a range of verticals in areas such as compliance and fraud reduction, including a forecast of more than $100 billion by 2030 in food exports.

The survey results revealed that nearly half of companies were considering using Ethereum as their blockchain; reflecting the fact that its token standardization has enabled the creation of an ecosystem of distributed applications (dApps) to be built on its chain.

Furthermore, all the responding companies which had already invested over $100,000 in blockchain indicated they would be spending at least this amount again on the technology over the next 12 months.

According to the Juniper assessment, this demonstrated initial C-suite feedback had been largely positive in most cases, sufficiently so for executives deciding to move to the next stage of integration. That said, three-quarters of respondents expect some disruption to internal or external systems.

Outlook for blockchain applications

"The findings illustrate the need for companies to engage in a prolonged period of parallel running new systems alongside the old, to resolve any issues that might arise," said James Moar, senior analyst at Juniper Research. Regardless, we should anticipate more blockchain application development in the future.

The survey participants also acknowledged IBM as the leading vendor for blockchain project planning and deployment, with the tech giant ranked first by 65 percent of respondents — that's nearly 10 times more than the second-place vendor, Microsoft (7 percent).

Software as a service (SaaS) is becoming ubiquitous. It is estimated that enterprises currently use 16 SaaS applications on average, yet one in seven of these businesses also believe that more than 80% of their applications will be SaaS-based by 2020.

This would seem an especially accurate assessment too by enterprises, as the current market for SaaS products and services is worth £54 billion, yet it is expected to jump to over £85 billion by 2021.

Based on this upward trajectory, SaaS application providers clearly have a huge opportunity on offer. However, how can they maximise it? 

As ThousandEyes works with some of the top SaaS providers around the world, we’ve gleaned five key, operational ‘habits’ for successful delivery. Importantly, it is key to realise that successful delivery doesn’t just focus on your own company’s culture, or strategic direction, or even your operational knowledge. It also encompasses relationships with customers, vendors and other third-party providers.

Don’t point the finger so quickly

Every SaaS provider knows they will face up to both application and network issues, regardless of how good their product is. However, when it comes to actually solving these performance issues, the network tends to be singled out for blame first. This means your network team needs to prove its innocence before your application team will deal with the problem. With this type of culture, it can be a huge distraction from dealing with the issue at hand, while also stunting team collaboration, which will help with resolving issues quicker. Getting your teams to provide a quick view of network health, with application context, can define where the issue lies and be a huge help in dealing with problems.

Relationship with third-parties need to change

A simple fact for the vast majority of service providers is they can’t investigate, or even acknowledge, all performance-related inquiries they receive on a daily basis, due to finite resources. This situation can make resolving issues quite a challenge for you, as a SaaS provider, particularly if there’s no actual data to work off to show a fault.

A natural byproduct of this is that you can fall into a quite unproductive routine of trying to escalate problems, yet your service provider prefers to deny, deflect and defer.

Most of your third party providers will not spend their time troubleshooting for you, particularly if they are responsible on fixing an issue, or, especially if they may face a service level agreement (SLA) penalty.

Evidence in this scenario is critical. Forget mantras like ‘find and fix’, instead you need to adopt an ‘evidence and escalate’ approach. This involves having a proven set of steps to collate evidence, regardless of if you do not control certain services or networks, in order to successfully escalate an issue. 

With this approach, you are no longer relying solely on your external providers. Instead, you’ve taken control of the process and the benefits are significant, including reducing the time it takes to resolve problems, while also having the knock-on effect of benefiting the user’s overall digital experience.

Deal with customers in the right way

Every day, SaaS providers maintain an illusion. They provide a seamlessly delivered application, yet behind the curtain, they work extremely hard to build a unified customer experience, despite many different complex components and reliance on third parties. It is a very hard balancing act for providers. They can’t afford a questionable Internet service provider (ISP), a compromised domain name system (DNS) cache, or false route advertisements, or broken API endpoints.

However, when something goes wrong, as a provider, it is essential that you can speedily attribute responsibility to the right part of the user experience. This is not just to resolve the issue itself, but also so you can communicate with users quickly and effectively, which is crucially important as today’s end users demand a huge level of transparency. 

In order to do this, active networking monitoring is the solution. This technology can provide an unrivalled, clear view of the application delivery path from your customers, all the way to your application servers. This provides a precise understanding of where and why something isn’t working and also enable you to update your customers in a transparent and insightful way.

Monitor interservice communication that includes external networks

The majority of SaaS providers are relying on external APIs for their user experience now. This ranges from things like payment gateways and customer relationship management (CRM) databases. Yet anytime an external API is used, it becomes part of the application stack and, thus, needs to be managed. Again, you need to keep a close eye on when and why your APIs are available and performing (or not), to deal with any issues impacting on the user experience.

The lifecycle can’t end when monitoring your service

Sometimes monitoring can be treated as just an operations practice, in order to ensure service uptime. Yet, this is short-sighted as having access to data early in the application journey can be really useful for enabling you to make better choices around application architecture and network. 

For example, your choice of the location of data centres or workloads in public cloud providers can have a significant impact on service delivery. Therefore, with issues like this, you need to have detailed, visual, and reportable data that charts every aspect of user experience from web server, to network path, to Internet routing. This information is like gold dust before rolling out a new service, enabling you to remove (as much as possible) the risk from your most important SaaS planning decisions.

One thing to keep in mind about these five habits is that they rely on end-to-end visibility, which can be provided by leading network monitoring solutions. This enables a huge degree of transparency in performance across not just your own application, but also your providers. With visibility at the heart of your approach you can really change, for the better, how you deliver your SaaS application, while also future-proofing your performance to make sure you maximise the huge opportunity that is developing in the market.

A couple of partnerships involving Amazon Web Services (AWS) with Accenture and Capgemini have been unveiled, around healthcare and enterprise migrations respectively.

The first partnership, announced with Accenture and Merck, aims to launch a cloud-based informatics research platform which is designed to help life sciences organisations in the early stages of drug development.

The platform will enable healthcare professionals to analyse and aggregate data from multiple applications and a single set of interfaces. The platform is being developed by Accenture and AWS with Merck being the first pharmaceutical company to use it.

Elsewhere, Capgemini and AWS are coming together to build a platform focusing on value-added cloud services for their customers, ranging from SAP migrations, to data centre modernisation and artificial intelligence (AI).

With Capgemini's partnerships with both SAP and AWS in mind, the company is able to migrate the former to the latter as part of the first focus of the initiative. The data centre modernisation will come through leveraging VMware Cloud on AWS – which regular readers of this publication will know all about – to deliver end-to-end hybrid cloud.

"Our clients look for global scale and excellence in digital transformation, enabled by cloud technologies," said Aiman Ezzat, chief operating officer at Capgemini. "With a commitment to scaling our AWS capabilities we can bring to our clients' digital jourenys both operational efficiencies and the power of new technologies, such as artificial intelligence and machine learning."

• By 2020, more than 20 million job seekers will look for automated advice on how to improve their ranking in job-matching algorithms according to Gartner.
• More than 50% of large enterprises based in North America and Western Europe will include diversity and inclusion enablement criteria in their HCM technology selection processes by 2020.
• By 2022, nearly 80% of organisational skills will have to be reprioritised or revisited due to digital business transformation.

These and many other fascinating insights are from Gartner’s recent research note, Cool Vendors in Human Capital Management for Talent Acquisition (PDF, 13 pp., client access reqd.) that illustrates how AI and machine learning are fundamentally redefining the war for talent. Gartner selected five companies that are setting a rapid pace of innovation in talent management, taking on Human Capital Management’s (HCM) most complex challenges. The five vendors Gartner mentions in the research note are AllyO, Eightfold, jobpal, Knack, and Vettd. Each has concentrated on creating and launching differentiated applications that address urgent needs enterprises have across the talent acquisition landscape. Gartner’s interpretation of the expanding Talent Acquisition Landscape is shown below (please click on the graphic to expand):

Source: Gartner, Cool Vendors in Human Capital Management for Talent Acquisition, Written by Jason Cerrato, Jeff Freyermuth, John Kostoulas, Helen Poitevin, Ron Hanscome. 7 September 2018

Company growth plans are accelerating the war for talent

The average employee’s tenure at a cloud-based enterprise software company is 19 months; in the Silicon Valley, this trends to 14 months due to intense competition for talent according to C-level executives leading these companies. Fast-growing enterprise cloud computing companies and many other businesses like them need specific capabilities, skill sets, and associates who know how to unlearn old concepts and learn new ones. Today across tech and many other industries, every company’s growth strategy is predicated on how well they attract, engage, screen, interview, select and manage talent over associates’ lifecycles.

Of the five companies Gartner names as Cool Vendors in the field of Human Capital Management for Talent Acquisition, Eightfold is the only one achieving personalisation at scale today. Attaining personalisation at scale is essential if any growing business is going to succeed in attracting, acquiring and growing talent that can support their growth goals and strategies. Eightfold’s approach makes it possible to scale personalised responses to specific candidates in a company’s candidate community while defining the ideal candidate for each open position.

Gartner finds Eightfold noteworthy for its AI-based Talent Intelligence Platform that combines analysis of publicly available data, internal data repositories, HCM systems, ATS tools, and spreadsheets then creates ontologies based on organisation-specific success criteria. Each ontology, or area of talent management interest, is customisable for further queries using the app’s easily understood and navigated user interface. Gartner also finds that Eightfold.ai is one of the first examples of a self-updating corporate candidate database. Profiles in the system are now continually updated using external data gathering, without applicants reapplying or submitting updated profiles. The Eightfold.ai Talent Intelligence Platform is shown below:

Taking a data-driven approach to improve diversity

AI and machine learning have the potential to remove conscious and unconscious biases from hiring decisions, leading to hiring decisions based on capabilities and innate skills. Many CEOs and senior management teams are enthusiastically endorsing diversity programs yet struggling to make progress. AI and machine learning-based approaches like Eightfold’s can help to accelerate them to their diversity goals and attain a more egalitarian workplace. Data is the great equaliser, with a proven ability to eradicate conscious and unconscious biases from hiring decisions and enable true diversity by equally evaluating candidates based on their experience, growth potential and strengths.

Conclusion

At the center of every growing business’ growth plans is the need to attract, engage, recruit, and retain the highest quality employees possible. As future research in the field of HCM will show, the field is in crisis because it’s relying more on biases than solid data. Breaking through the barrier of conscious and unconscious biases will provide contextual intelligence of an applicant’s unique skills, capabilities and growth trajectories that are far beyond the scope of any resume or what an ATS can provide. The war for talent is being won today with data and insights that strip away biases to provide prospects who are ready for the challenges of helping their hiring companies grow.

Intel has noted a $200 billion addressable opportunity for the 'data-centric' economy combining cloud, AI and edge – and the latter has come into force following a new partnership with Alibaba.

The collaboration, revealed at Alibaba's Computing Conference in Hangzhou, will see the two companies launch a joint edge computing platform.

The primary use case is for industrial manufacturing and smart buildings, integrating Intel's hardware, software and AI with Alibaba Cloud's IoT products. "The platform utilises computer vision and AI to convert data at the edge into business insights," the companies note.

The companies are partnering in other ways – deploying the latest Intel technology in Alibaba to prepare for the 11/11 shopping festival, as well as helping provide content for the Tokyo Olympic Games in 2020.

"Alibaba's highly innovative data-centric computing infrastructure supported by Intel technology enables real-time insight for customers from the cloud to the edge," said Navin Shenoy, Intel EVP and data centre group general manager in a statement. "Our close collaboration with Alibaba from silicon to software to market adoption enables customers to benefit from a broad set of workload-optimised solutions."

Last month, Shenoy told attendees at the Data-Centric Innovation Summit in Santa Clara of Intel's plans to address the 'biggest opportunity' in the company's history. In a subsequent company editorial, he further outlined his vision. "The proliferation of the cloud beyond hyperscale and into the network and out to the edge, the impending transition to 5G, and the growth of AI and analytics have driven a profound shift in the market, creating massive amounts of largely untapped data," he wrote.

This is not the only cloudy partnership Alibaba has tapped into in recent weeks – the company also struck a deal with SAP to launch in China, with the two companies jointly offering ERP suite S/4HANA Cloud in the country.