Hackers took three days to identify and exploit a known vulnerability in Equifax’s web applications. I will share new data that reveals why three days (at most) is the new normal for DevSecOps teams to move new business /security requirements from design into production. This session aims to enlighten DevOps teams, security and development professionals by sharing results from the 4th annual State of the Software Supply Chain Report — a blend of public and proprietary data with expert research and analysis.Attendees can join this session to better understand how DevSecOps teams are applying lessons from W. Edwards Deming (circa 1982), Malcolm Goldrath (circa 1984) and Gene Kim (circa 2013) to improve their ability to respond to new business requirements and cyber risks.
Emily Freeman Joins @DevOpsSUMMIT Faculty | @EditingEmily @Kickbox #Agile #DevOps #ContinuousDelivery
So the dumpster is on fire. Again. The site’s down. Your boss’s face is an ever-deepening purple. And you begin debating whether you should join the #incident channel or call an ambulance to deal with his impending stroke. Yes, we know this is a developer’s fault. There’s plenty of time for blame later. Postmortems have a macabre name because they were once intended to be Viking-like funerals for someone’s job. But we’re civilized now. Sort of. So we call them post-incident reviews. Fires are never going to stop. We’re human. We miss bugs. Or we fat finger a command – deleting dozens of servers and bringing down S3 in US-EAST-1 for hours – effectively halting the internet. These things happen.
Slack outage: Collaboration app is down all over the world
27 Jun, 2018
Slack is down, forcing workers everywhere to resort to sending mass emails as the collaboration app tackles a major outage.
The communication tool, which passed six million daily users in 2017, warned that “all workspaces are experiencing difficulties”.
Downdetector, which tracks outages with popular applications, showed the US, UK and mainland Europe were having the most difficulty.
Naturally, people responded to the issue with a sense of calm equanimity online.
The issue began at 2.33pm BST, with Slack posting the following update to its status page an hour later: “We are continuing to work on fixing the connection problems that have been impacting folks. We hope to have the issue fully resolved as soon as possible.”
On Twitter, Slack posted: “We’re working hard to isolate the issue. Thanks for your patience!”
However, with the investigation ongoing, it’s not clear yet what’s caused the issue, though Cloud Pro has approached Slack for more information.
The firm runs its platform on top of Amazon Web Services (AWS) – EC2 instances for basic compute, S3 for user uploads and static assets, Elastic Load Balancing to distribute workloads across EC2, and EBS for overnight backups.
“As a company, our business is integral to our customers’ daily lives,” Richard Crowley, Slack’s director of operations, is quoted as saying on AWS’s website.
“So in our customers’ eyes, our security controls and ability to deliver a reliable service become incredibly important, and it’s a responsibility we take incredibly seriously.”
Slack debuted new developer tools last month designed to allow them to code and test their own Slack apps within the Slack platform, as well as coming with built-in integrations for third-party apps popular with coders; Asana, Bitbucket, HubSpot, Zendesk and Jira.
The collaboration tool isn’t the only service to experience issues recently, with Office 365 dropping offline for UK users earlier this month, as well as back in April.
How to get the most out of document management
3 Jul, 2018
Document management isn’t a sexy new idea. It’s at least as old as computing itself: as a child, I remember asking my parents why they needed so many little keys on their office keyrings, and getting the answer that these were for their individual, lockable output trays on the various printers and copiers they used.
The documents they handled were so sensitive that even a casual bit of misfiling could spell disaster – and individual secretaries were, even then, becoming anachronistic. So their employer had invested in a complicated, state-of-the-art copier that could keep track of who was making each copy, and deposit each user’s prints securely into their own personal out tray.
Some years later, I happened to meet a programmer who had worked on the Post Office’s OCR project – a project which transformed the business of letter sorting by electronically reading handwritten postcodes and turning them into those little blue dots you used to see printed on the outside of the envelope. It was a necessary evolution, he explained, as the number of letters being processed was outstripping the availability of workers to route the mail by hand.
Like the locking trays, those blue dots were reflections of the supreme importance of pieces of paper – and the growing difficulty of managing them. From one perspective, you might say that the Rise of the Machines began in the 1970s as a direct expression of the need for document management.
That’s not to say that it’s ancient history. Document management remains crucial in the 21st century. For sure, it’s become something much broader than simply keeping track of sheets of paper: the QR code on your smartphone that lets you board a plane is a document, just as much as a letter from your landlord that lets you move into a new office. But the old issues – too many eyes on one type of document, not enough on another – remain as prevalent as they ever were.
All that’s changed is that the modern equivalent of the lockable-tray copier has to deal with those who carry their sensitive data around on an iPad rather than in a cardboard folder (and who don’t necessarily understand the limits of security when it comes to Wi-Fi printing). Indeed, there’s still much to be said for the lockable paper tray, as a metaphor if not a reality. It may go against the optimistic precepts of certain computing gurus, but it’s a practical solution to an everyday problem – and that’s what document management is all about.
Paper trail
Document management can save you a lot of money – and space
Small companies tend to assume that their workflow is too simple to justify investing in anything more than a filing cabinet or two. But even if you don’t need to do much in the way of actual managing, technology can help. One of my old clients, in the course of a deal, ended up holding some sensitive documents that were (even by the standards of these things) very long. It rarely needed to refer to them, but had to retain them securely – which meant dedicating two full-height office cupboards, in a room with a locked door.
As you can imagine, the mere process of scanning in all this paperwork yielded huge rewards. The data was downsized into a single locked drawer, allowing the company to situate two additional staff in the room that had been freed up. In consequence, it ended up increasing its turnover by about a quarter of a million pounds a year.
That might sound like a special case, but that’s the nature of the beast. Talking about document management in general terms has always been a challenge, because it’s in the narrowest, most specialised roles that the technology most visibly pays for itself. Those who really need a lightning-fast write-once storage subsystem already know it; with the more generic stuff, like a simple scan and store process, it can be harder to point to exactly where the benefits are going to justify the investment.
Indeed, I come across plenty of businesses that are suspicious that costly document-management projects are scams or rip-offs. (Then again, that’s not unique to document management – such accusations come up with IT projects of all kinds.)
Factor in a general perception of document management as simple and old-fashioned, and it’s easy to understand why companies baulk at spending money on something that “ought to be easy”. But even if we accept that some aspects of the technology are simple and old-fashioned, that’s no bad thing. It’s a classic geek mistake to think that every modern problem needs a rarefied, compute-intense solution.
Get the hardware right
You might assume that document management starts with a scanner, but it’s nigh-on impossible to do rational document management if your printers aren’t up to the job. If something starts out as paper, there’s a good chance it’s going to get printed out again at some point; we may want to save the environment, but people are more comfortable clutching a nice physical piece of A4 than referring to a digital representation of it.
Modern, superfast scanners such as these by Xerox and Fujitsu are a valuable addition to a digitising office
Indeed, you should probably proceed on the assumption that people are going to print more than you bargain for – and the same applies to scanning. I’ve had arguments with companies who simply refuse to believe the figures for numbers of pages ingested per day into their document management systems.
In short, the best advice is not to skimp on the hardware, even if the initial cost seems higher than you’d hoped. Depending on your needs, you may be able to save money by investing in a big multifunction office printer with its own ADF, so it can tear through big scan jobs in minutes or seconds. By all means, test your procedures with a slow, clunky £29 inkjet MFP before you roll them out, but realise that thousands if not millions of sheets of paper are likely to pass through them before you next come to review your document management needs.
A few more practical points: if you expect to scan lots of big documents, scanners that move the paper past the head, rather than the other way about, are normally much faster.
(Read the PC Pro buyer’s guide to desktop scanners in issue 278, p92, where you’ll see reviews of Brother, Fujitsu, Plustek and Xerox machines. Or jump to the A-List on p18.) If you need to digitise lots of bound documents, camera mounts can grab high-quality snapshots while you turn the pages by hand.
Keep the goal in sight
The ambitions of document-management have expanded a long way beyond those early lock-boxes. One currently fashionable idea is seeking to connect together the many different apparitions of a customer across your diverse products and systems. The benefits are obvious, but if your CRM is in the cloud, your email server is 8,000 miles away, and your document scans are right beside you, it becomes quite a major project. Ask yourself whether it’s worth the investment: you may well find that you’re dealing with Pareto’s 80/20 rule, as 80% of the data you’re storing could well end up sitting dormant for the entirety of its retention cycle.
Indeed, while the benefits of document management may not all be obvious, there’s much to be said for keeping things simple. As I’ve mentioned, it’s an easy mistake to try to push the technology out of its comfort zone, and beyond what’s really advantageous to your company. Keep focused on the practicalities and you won’t go far wrong.
Image: Shutterstock
Essential macOS tools and Windows tools with Parallels Toolbox
Save precious time with one-click. We’re excited to introduce our latest release of Parallels Toolbox. Parallels® Toolbox is the perfect Swiss Army knife to help optimize your workday with easy-to-use macOS tools and Windows tools. It’s another step in the Parallels master plan to ensure both macOS® and Windows users have every tool they need […]
The post Essential macOS tools and Windows tools with Parallels Toolbox appeared first on Parallels Blog.
SAP President to Keynote at @CloudEXPO New York | @SAP @SAPIndia @DilipKhandelwa #SAP #HANA #Cloud
Cloud is the motor for innovation and digital transformation. CIOs will run 25% of total application workloads in the cloud by the end of 2018, based on recent Morgan Stanley report. Having the right enterprise cloud strategy in place, often in a multi cloud environment, also helps companies become a more intelligent business. Companies that master this path have something in common: they create a culture of continuous innovation.
In his presentation, Dilipkumar will outline the latest research and steps companies can take to make innovation a daily work habit by using enterprise cloud computing. I will share examples from companies that have benefited from enterprise cloud computing and take a look into the future of how the cloud helps companies become a more intelligent business.
How to leverage cloud architectures for high availability
Cloud architectures are used broadly nowadays; the cloud is a plethora of amazing alternatives in terms of services and solutions. However, with great power comes great responsibility, and the cloud presents itself as a place where failure can and eventually will occur. Thus, consequently, it will spread upon the entire architecture fast, possibly causing massive outages that can leave a business on its knees.
Okay, that’s not an overly optimistic scenario – more likely the opposite – but not to fear. This is the nature of almost any architecture – and why should cloud be any different?
Cloud architects face two different problems at scale at any given time in order to prepare for the worst; firstly, if something unexpected and undesired happens, how to continue business operations as if nothing happened, and secondly, if something unexpected and undesired happens and I am unable to continue operations as usual, how can I bring the architecture up someplace else and within a reasonable window of time, and then, resume operations as usual?
In these terms we can discuss:
– Continue business as usual in the face of an outage
– Resume business as usual in the shortest term possible in the face of an irrecuperable outage
The first is covered by high availability, and the second is covered by disaster recovery. Here, we will look at high availability.
The alternatives currently on the table
The cloud yields more than what is expected to face both scenarios. Most clouds are distributed in a geographic and technical way as to avoid massive outage scenarios by themselves; at a small scale, clouds have what is known as Availability Zones (AZs) or Availability Domains (ADs). These are usually different buildings, or different clusters of buildings, in the same geographic area, interconnected but highly redundant, especially in what refers to power, refrigeration and storage.
At a large scale, clouds are divided by regions; global regions, that is, with 10 or 15 regions if we look at giants such as Google Cloud and Amazon Web Services. These regions are spread geographically across the globe and serve two purposes; isolation in case of disaster, and performance. Customers in different countries and continents will be served by the nearest point of service, not rerouted to the main one. That is what makes the latency smaller and the response higher.
Putting all this into consideration, it is the task of the architect to design the service with availability zones and regions in mind, in order to serve customers properly and take advantage of the technologies at hand. Architectures are not replicated by cloud providers in different regions – that is something architects and engineering teams need to consider and tackle, and the same goes for availability domains, unless the discussion is about storage; compute instances and virtual networks to mention core services, are not replicated throughout Ads or AZs for the most part.
The alternatives for high availability involve avoiding single points of failure, testing the resilience of the architecture before deploying to product, and either constructing master/master, master/slave or active/passive solutions in order to be always available, or have an automation that is able to reduce the unavailability time to the minimum.
What are considered best practices?
The following is a list of best practices in terms of providing HA in the cloud. It is not completely comprehensive, but it may also apply, to a lesser degree, to data centre architectures as well.
- Distributing load balancers across Ads, beware of single point of failure (SPOF) in the architecture: two is one and one is none
- If the cloud provider is not providing redundancy across Ads and at least three copies of the same data automatically, it may be a good idea to re-evaluate the provider decision, or contemplate a service that does so
- Easy to get in, easy to get out: it is necessary to have the certainty that in case it becomes primordial to move or redirect services, it is possible to do so with minimum effort
- Implementing extra monitoring and metrics systems if possible, not to mention good integration: also if possible, off-the-shelf, through third parties that can provide for timely alerts and rich diagnostic information. Platforms such as New Relic, or incident tools such as PagerDuty, can be extremely valuable
- Keeping the architecture versioned, and in IaaC (infrastructure as code) form: if an entire region goes away, it will be possible to spawn the entire service in a different region, or even a different cloud, provided data has been replicated and DNS services are elastic
- Keeping DNS services elastic: this goes without saying, especially after the previous step; flexibility is key in terms of pointing records in one direction or another
- Some clouds do not charge to have instances in a stopped state, especially with VMs e.g. Oracle only charges for stopped instances if those are Dense or HighIO, otherwise it does not. It is easy to leverage this and keep a duplicated architecture in two regions; with IaaC, this is not unreal and it is also easy to maintain
- Synchronising necessary and critical data across ADs constantly in the ways of block storage ready to use and often unattached, avoid NVMe usage if that implies being billed for unused compute resources to which those NVMe are connected to
- Leveraging object storage in order to have replicated data in +2 regions
- Leveraging cold storage (archive, such as Glacier) to retain critical data in several sparse regions; sometimes the price to pay to break the minimum retention policy and request a restore Is worth in order to bring a production environment up
- Using the APIs and SDKs for automation, by creating HA and failover tools, automation can transform systems into autonomous systems that take care of failovers by themselves, mixing this with anomaly detection can be a game changer. Do not rely so heavily on dashboards – most things can/are, and some must, be done behind the curtain
- Nobody says it is necessary to stick to one cloud: with the power of orchestration and cloud providers, it is simple enough to have infrastructure in more than one cloud at the same time, running comparisons and if necessary switching providers
- Using tools to test the resilience of the infrastructure and the readiness of the engineering team – faking important failures in the architecture can yield massive learning
Conclusion
Although best practices are only best practices if applied, not all of them can be applied in the same architecture or at the same time, so the judgement of an experienced architecture and engineering team is always necessary.
That said, most of the points can be applied without significant effort. It only takes some hard work and disposition, but the results yielded will make it worth its weight in copper.
Happy architecting and keep up the good work.
Five Internet of Things Trends That’ll Influence Businesses in 2018 | @MobiDev_ @ExpoDX
2018 is a year when many of the trends surrounding the Internet of Things (IoT) are expected to turn from hype to real results. Adoption continues at a brisk pace, and medium and large enterprises are increasingly finding themselves at decided advantages for bringing IoT systems into their infrastructures. At such a crucial turning point, it’s a good idea to take a look at five of the biggest trends that are expected to dominate this transformation process.
Best Android file managers 2018
26 Jun, 2018
Whether it’s a quick cut-and-paste job or a dive into the digital depths of your Android smartphone, free file manager apps give you greater control over your documents than Google’s built-in counterpart. However, how do you know which is the one for you?
We’ve put together some of our favourites and ranked them according to their feature set, performance and how easy they are to use.
Astro File Manager App
With an uncomplicated interface and an emphasis on productivity, Astro’s file manager app ensures you won’t be fumbling your way through yet another tricky file move on your Android phone or tablet.
You’ll find a familiar Home screen populated with the essentials: file types, storage locations, cloud services, recent files, and favourites. Everything you need is accessible from the moment you open the app.
Setup is pleasantly straightforward. Thumb-friendly ‘Add’ buttons jump out from the Home screen offering LAN, FTP, SFTP and SMB server location support. You’re also able to connect to the most common cloud and social services, such as OneDrive, Google Drive, Dropbox and Facebook. That all makes it ridiculously easy to navigate to your destination. Alternatively, if you don’t know where a file it, you can use the search bar.
Peeking under the hood reveals no-nonsense file manager options. Features don’t get much more exotic than .ZIP and .RAR compression and extraction, alongside app back-up and a ‘task killer’ that can force apps to close to protect battery life. However, Astro’s core strength is that it focuses on being a file manager first and foremost, to copy, move and share your apps and documents, with no unnecessary extras – not even ads.
How it can be improved
While the app remains clean and accessible, the Home screen’s horizontal swipe is unnecessarily finicky. Cleaning up space using the SD Card Usage option is a challenge, which sees file selection looping you back to its folder location. You can get around this by pressing and holding the file to open it, rather than tapping it as normal. The app could benefit from the inclusion of multiple-panes to make navigation even quicker and an increase in cloud storage locations would be also welcome.
Verdict
With streamlined functionality, Astro won’t be for everyone, but it’s that simplicity that gives this app broad appeal, while there are just enough extras to meet most common needs. After all, there’s only so much a file manager app needs to do and Astro does most of it.
Features: 4
Performance: 5
Ease of use: 5
Overall: 5
Total Commander
Total Commander started life as a desktop app and it shows. From design to performance, this feels like a file manager app built for serious users.
You can tell from one glance at the bold, black theme and its Windows-like icons that Total Commander means business. You won’t find flash colour schemes or other such frivolous options here, which is fine as long as you can live with the existing colour scheme.
Total Commander supports FTP, SFTP, WebDAV and LAN connections. You can also connect the app to your OneDrive, Google Drive and Dropbox accounts, but you need to add plugins to the app to get them working. You’ll also find handy extras like creating your own internal commands and a permissions editor.
If you’ve ever used a desktop file manager, you’ll feel right at home here.
How it can be improved
Some terminology, while accurate, isn’t particularly user-friendly because of the transition from PC software to app. Selecting additional plugins takes you to an inelegant external site that’s little more than a wall of text and a few links and bringing those options in-app would refine the process. At present, the app only connects to a small number of cloud services — we’d like to see more.
Verdict
Total Commander isn’t just a name; it’s a declaration of intent. It’s a well-built app that will appeal to those wanting a comprehensive file overview and is a powerful tool to add to Android. However, thanks to its awkward desktop origins, you’ll need to spend a little time learning the app to fully understand its quirks.
Features: 5
Performance: 5
Ease of use: 4
Overall: 4
File Manager
Originally created by Asus for its first-party smartphones, File Manager is now available on other Android devices. Despite its uncreative name and platform-specific origins, the app is surprisingly delightful.
Design-wise, it’s as if Asus decided to improve upon Astro’s minor failings. The app’s striking icons make usage extremely intuitive for Android users. For those sick of manually navigating to common tasks, File Manager also conveniently places key actions like desktop file transfer and storage analyser at the bottom of the Home screen. The analyser itself is a dream: its large tabs and visual reports are designed with smartphones in mind. Elsewhere, a PIN-protected Hidden Cabinet hides private files away from prying eyes.
This is a lightweight app, though, only covering the absolute basics. However, this makes File Manager fast and efficient.
How it can be improved
The app is a tease. It’s so good that in almost every department, you find yourself wishing it offered even more: more actions; more cloud storage options; more network and server connections. As such, clever ideas stashed across the app, such as the Hidden Cabinet, jar with the otherwise very obvious restrictions, making the app feel under-developed. Quick links to additional storage locations on the Home screen would offer a productivity boost.
Verdict
What File Manager does, it does well. Fluid navigation and a single-minded focus on simple file management make the app a joy to use. However, it’s held back by limited capabilities. That’s a shame, but even without expanded functionality, there’s a lot to enjoy using File Manager.
Features: 3
Performance: 5
Ease of use: 5
Overall: 4
Best of the Rest
ES File Explorer
ES File Explorer bills itself as the world’s number one file management app. Efficient in performance and feature-rich, the easy charm of ES should make it the clear Gold winner.
Unfortunately, the ad-supported app forces you to download bloatware to gain access to locked features, which defeats its purpose.
Solid Explorer
Solid Explorer kicks off with a 14-day free trial, with a full upgrade costing a reasonable £1.49. Fitting in well with the Android aesthetic, you won’t have any trouble navigating most of the app. There are some nice bonuses here, too, including individual file encryption. But moving files across to different storage locations isn’t at all smart, which makes the app difficult to recommend, given that it’s a primary function of a file manager.
X-plore File Manager
Aping a desktop file manager, X-plore is similar to Total Commander. It supports more cloud services than any other app on our list, as well as the standard collection of server connections. However, the desktop-style aesthetic is an uneasy fit on Android because the layout is ugly. Also, opening the nested folders soon overcrowds the screen. The dual pane goes some way to addressing this, but it’s not enough to fix all of its problems.
Image: Shutterstock
Oracle bundles cloud revenues, claiming it reflects hybrid approach
25 Jun, 2018
Oracle has changed the way it reports cloud revenue figures every quarter by only offering up a combined figure for SaaS, PaaS and IaaS.
The database vendor used to report SaaS numbers on their own, and a combined figure for PaaS and IaaS, but it is now reporting just one figure for all of these, lumped in with license support. It’s also combined new cloud licenses and new on-premise licenses under ‘new software licenses’, not breaking either out.
Oracle co-CEO Safra Katz explained the change in a conference call with analysts last week, transcribed by Seeking Alpha.
“We have now labelled new software licenses as cloud license and on-premise license, and we’ve combined cloud SaaS plus cloud PaaS and IaaS, plus software license updates and product support, into cloud services and license support,” she said.
Katz said the changes were justified because of the company’s recent introduction of the option for on-premise customers to use a bring your own licence (BYOL) model when shifting to Oracle’s cloud.
“BYOL allows customers to move their existing on-premise licenses to the Oracle cloud so long as they continue to pay support for those licenses,” she said.
“BYOL also makes it cost effective for customers to buy new licenses, even if those licenses are only going to be used in the cloud. So some of our customers are buying new licenses and immediately deploying them in the cloud.”
Her argument is that customers are adopting a hybrid approach to buying Oracle kit, where revenues can’t be broken out neatly as cloud or on-premise, so instead, Oracle’s decided to bundle them together.
“To say it another way,” Katz added, “customers are entering into large database contracts where some of those database licences are to be deployed on-premise, while other database licenses are used in the cloud.
“Previously, all of those licenses and its related support revenue would have been counted entirely as on-premise, which clearly it isn’t.”
However, Oracle has doubled down on its cloud strategy over the last few years, aiming to outgrow rivals like Workday and Salesforce, making this a significant change.
Results a year ago saw cloud revenues grow a huge 60% year-on-year to $1.36 billion across SaaS, PaaS and IaaS. SaaS alone grew 75%.
This year Oracle’s financials painted a very different picture. Its bundled cloud services and license support category grew just 8% year-on-year to $6.8 billion, and its license revenues were down 5% to $2.5 billion.
CTO Larry Ellison cited AT&T’s decision to move thousands of databases into Oracle Cloud, saying: “We think that these large scale migrations of Oracle database to the cloud will drive our PaaS and IaaS businesses throughout FY19.”
But in Oracle’s third quarter for the three months up to the end of February 2018, when it was still listing SaaS separately, and IaaS and PaaS together, growth had slowed. SaaS grew 33% year-on-year (compared to 75% in June 2017) and IaaS and PaaS together grew 28%. Overall cloud grew 32%, almost half that 60% figure it recorded in June 2017.
Picture: Shutterstock