Now is the age of information analytics. We have (very arguably) reached a point where the insight arising from data analytics can be applied to almost every aspect of a company, in every business vertical.
But what shape should that analytics be? Increasingly we talk about embedded analytics, but what do we mean? Should we be embedding analytics inside a) applications themselves, or should we b) look to embed analytics as business rules inside complete corporate processes – or should it be both?

read more

#DevOps #SDN

We keep saying that, does it mean what you think it means?

Operationalization (which is really hard to say, go ahead – try it a few times) is a concept that crosses the lines between trends and technologies. Both SDN and DevOps share the notion of «operationalization» as a means to achieve the goal of aligning IT with business priorities, like that of accelerating time to market for all important applications.

But what does it really mean to operationalize the network, or app deployments, or really, anything?

Operationalization is a lot like DevOps in that it’s more of an approach to how you deploy and manage operations than it is some concrete, tangible thing. It is a verb, it’s something you do that has concrete, measurable impacts on the application environment, aka the data center, and the processes that move an application from development and into the hands of its intended consumers, whether internal or external.

When we say «operationalize the network», what we mean is to apply a systematic approach to automating network tasks and orchestrating operational processes in a way that meets measurable, defined goals that align with business priorities.

Consider the business priority to deliver projects on time. You know, get projects to market before the competition (to meet the business concern of revenue growth) or roll out internal apps faster (to meet the business concern of productivity improvements). The top CIO priorities are intertwined, and IT is in the business of applications as much as it is about technology.

Automate all the network things

Accelerating the time to market (or time to roll out for internal applications) is an imperative that enables IT to meet several business and IT-related goals simultaneously. But to do that, IT has to operationalize all the things – including the network. Operations (whether network or security or application) has to focus on automating tasks and orchestrating processes to achieve the speed, scale, and stability necessary to roll out new or improved apps faster and, in some cases, more frequently. That means taking advantage of programmability (APIs, app templates and even data path) to integrate and automate the provisioning, configuration and elasticity of applications and the services that deliver them.

Does that mean you have to become a coder? Not necessarily. Much of the automation and orchestration of the network is being made available through ecosystems (like those around VMware, Cisco, OpenDaylight and OpenStack) that enable the integration necessary to occur through plug-ins, policies or templates rather requiring network engineers to become developers. No doubt some organizations will choose a more hands-on approach, in which case the answer becomes yes, yes you will have to become familiar with scripting tools and languages and APIs to enable the automation and, ultimately, orchestration required to achieve alignment with business and operational goals.

Measure all the deployment things

Automation and orchestration alone aren’t enough, though, to operationalize the network. Measures must be put into place that span the entire application deployment process. Those measures should align with other operations groups and align better with the business, measures that are typically associated with DevOps but are directly relatable to the network, too:

• Deploy frequency
• Volume of defects
• MTTR
• Number & Frequency of outages
• Number & Frequency of performance issues
• Time/cost per release (deployment)

Automation certainly impacts some of these measures, but not all. Process optimization is a critical component of DevOps and operationalization as well that impacts many measures but is people and analysis driven.

Optimize all the process things

Optimization requires understanding the processes that have likely ossified over time and re-evaluating each and every step to improve not just the speed but the efficiency, too (no, they aren’t the same, Virginia). Optimization of processes is about measuring and mapping processes to find the bottlenecks and idle time that causes the entire app deployment train to slow to a crawl.

The reality is that orchestrating poor processes just lets you fail faster and more often. So identifying those processes (that include handoffs between silos) causing bottlenecks in the deployment process (or where errors seem to constantly be introduced) is a critical component of successfully operationalizing the network (and other operations, for that matter). Giving the app infrastructure operations group an «easy» button to deploy the appropriate network services isn’t going to improve the process if that process is itself broken, after all.

The measures let you ascertain whether changes in the process are going to help or not. Modeling and math can do wonders to help determine where changes must be made to improve the overall results, but both require measurement first – and consistent measurement across groups and the deployment lifecycle.

Share all the app things

All of which requires collaboration. You can automate individual tasks and gain some improvements, yes, but you can’t orchestrate a provisioning and configuration process related to a given application or type of application unless you first understand what that application needs. And to do that you’ve got to talk to the people who develop it and deploy its infrastructure. You have to understand its architecture – is it three-tier? Two-tier? Microservice? Does it present APIs and take advantage of an app proxy or are the integrations and interactions all internal? How is success for this app measured? Productivity improvement? Revenue growth? User adoption?

The answers to these questions are imperative to understanding just what network services need to be deployed, and how. It isn’t enough to just give the app an IP address and put it on a VLAN. You’ve got to deliver value out of the network and that means providing services that will help that application meet its business goals, whatever they might be.

Operationalize. Everything.

Whether you’re approaching operationalization of the network from the perspective of implementing a SDN architecture or by applying the principles associated with DevOps you’re essentially going to have to embrace and adopt the same basic tenets: automation, sharing and common measurements that result in a cultural change across all of IT’s operational groups.

To succeed in an application world you’re going to have to operationalize all the things.

And that includes the network.

More in a presentation dedicated to this topic: Operationalize all the Network Things!

read more

Picture credit: iStockPhoto

Zenedge has announced the general availability of its latest Zenshield DOME platform with a simple goal: to protect your enterprise from what it perceives to be its weakest link.

That weakest link is a firm’s partner and supplier ecosystem, which Zenedge insists is a more likely target for hackers trying to infiltrate an enterprise in the cloud.

The product is a security platform as a service (SPaaS), and can be extended to a retailer’s partner and supplier network so organisations can oversee the entire ecosystem.

Zenedge explains how important third party security is becoming, after recent ecosystem weaknesses temporarily downed Target, Snapchat and Walmart among others.

“CISOs and hackers are discovering that the quickest path to breaking into a company’s classified data comes through remote, often inconspicuous, interconnected third parties,” said Zenedge co-founder and CTO Leon Kuperman. “It’s a reminder that networks are only as strong as their least protected link, and that all vendors need to be assessed, vetted and protected against cybersecurity risks.”

The system is self-updating, with Zenshield DOME identifying vendor access points and automatically closing ports that can expose your data. It also uses heuristic algorithms – in other words, finding a quick fix if an exact solution isn’t available – studies vendor traffic and adapts the network according to behavioural patterns.

“The IT industry has been aware of problems caused by external vendor vulnerabilities for some time,” said Rick Simpson, founder of Snow Commerce. “Seeing red flags pop up around the perimeter is one thing – being able to centrally, cooperatively act to avoid attacks against a large organisational target has so far proved more difficult.”

Zenedge has got plenty of backing from the industry, with the company pocketing $3.5m (£2.3m) in a series A funding round last month. With Black Friday and Cyber Monday just around the corner, there’s plenty of work for the Los Angeles firm to get stuck into for the time being.

Find out more about Zenedge here.

#DevOps

App deployment should be viewed as a comprehensive, end to end process.But we treat it today like each silo is a fork in a project that never merges back together, causing disjointed operations, reporting, measurement and ultimately, failure to meet business priorities of improving time to market, fewer disruptions and lower costs.

Because, silos. Or, as we might call them in the middle ages or the Renaissance, turrets.

Which of the four IT silos does this picture describe?

If you guessed (e) all of the above then you're right. And yes, I'm aware I gave you no choices, it wasn't really a quiz, after all, merely a literary device. I do that sometimes.

All four operational silos in IT are burdened by the same baggage. That's why DevOps ultimately applies to all four ops, because all four ops (storage, compute (aka "operations"), network and security) share the same issues caused by the tendency to create silos (or turrets or towers or whatever you want to call them) as organizations grow. The result is painful for the business, for end-users and for everyone who has to scramble to fix a problem or deal with an outage or figure out the current status (and explain why the app isn't available yet).

Processes ossify and become more complex over time, with no real concern for how they impact the big picture: getting an application to market (whether that market is internal or external is not really important as both productivity and profit are increasingly important to business and thus, the CIO).

So while we can certainly focus DevOps on Dev and Ops, eventually (and by eventually I mean almost immediately) we're going to run into the same issues its trying to solve when we toss the app deployment over the next wall, to the network.

So tear down those walls. Encourage collaboration and shared metrics. Operationalize all the network things and add some Dev to your (Net) ops.

More in this presentation on operationalization: Operationalize all the Network Things!

read more

«SAP had made a big transition into the cloud as we believe it has significant value for our customers, drives innovation and is easy to consume. When you look at the SAP portfolio, SAP HANA is the underlying platform and it powers all of our platforms and all of our analytics,» explained Thorsten Leiduck, VP ISVs & Digital Commerce at SAP, in this SYS-CON.tv interview at 15th Cloud Expo, held Nov 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.

read more

Enthusiasm for the Internet of Things has reached an all-time high. In 2013 alone, venture capitalists spent more than $1 billion dollars investing in the IoT space. With «smart» appliances and devices, IoT covers wearable smart devices, cloud services to hardware companies. Nest, a Google company, detects temperatures inside homes and automatically adjusts it by tracking its user’s habit. These technologies are quickly developing and with it come challenges such as bridging infrastructure gaps, abiding by privacy concerns and making the concept a reality. These challenges can’t be addressed without the kinds of agile software development and infrastructure approaches pioneered by the DevOps movement.

read more

«For the past 4 years we have been working mainly to export. For the last 3 or 4 years the main market was Russia. In the past year we have been working to expand our footprint in Europe and the United States,» explained Andris Gailitis, CEO of DEAC, in this SYS-CON.tv interview at Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.

read more

How do APIs and IoT relate? The answer is not as simple as merely adding an API on top of a dumb device, but rather about understanding the architectural patterns for implementing an IoT fabric. There are typically two or three trends:
Exposing the device to a management framework
Exposing that management framework to a business centric logic
Exposing that business layer and data to end users.
This last trend is the IoT stack, which involves a new shift in the separation of what stuff happens, where data lives and where the interface lies. For instance, it’s a mix of architectural styles between cloud, APIs and native hardware/software configurations.

read more

Picture credit: iStockPhoto

The biggest threat to cloud security among IT is the company’s employees unintentionally exposing data, according to the latest research figures from CloudEntr.

The study, which took 438 survey responses from industries including financial and manufacturing, found three quarters (75%) of smaller businesses are most worried about their workforce when it comes to securing data in the cloud. Larger IT firms were more concerned about hackers using employee credentials to get their hands on data.

Not surprisingly, regulated institutions were more concerned about cloud compliance than non-regulated, but 75% also said their biggest tool in becoming more secure was employee education.

It’s not just employee education, but shadow IT which continues to be a problem. 29% of those polled said they had no plans to use the cloud in their organisations, but of that number, nearly half of IT pros said they knew of employees who were using it.

The vast majority (89%) of IT pros questioned said they were concerned with cloud security, and security (63%) was more important than convenience in a cloud solution.

There have been various vulnerabilities and outages in recent days, from Docker’s vulnerability recorded earlier this week, to Microsoft Azure’s downtime from a bug which slipped the testing process. Dejan Lukan, writing for CloudTech earlier this week, noted data breaches and data loss as some of the most serious threats to organisations, as well as a lack of understanding.

“Enterprises are adopting cloud services in everyday operations, but it’s often the case they don’t really understand what they are getting into,” he wrote.

“When moving to the cloud there are different aspects we need to address. If the [cloud service provider] doesn’t provide additional backup of the data, but the customer expects it, who will be responsible when the hard drive fails? The customer will blame the CSP, but in reality it’s the customer’s fault, since they didn’t familiarise themselves enough with the cloud service operations.”

The IT pros surveyed by CloudEntr are making it their prerogative to change this. 89% of respondents who have been impacted by security breaches say they planned primarily to educate their employees in the next year.

What do you make of this data? Are you worried about what your workforce is doing in the cloud?

Picture credit: iStockPhoto

Docker, the Linux container for run-anywhere apps, has a major vulnerability in all but the latest version of its software which can enable malicious code to extract hosted files.

The vuln, described as ‘critical’ in severity, was first spotted by Red Hat’s security researcher Florian Weimer and independent researcher Taunis Tiigi, with Docker crediting them in a security advisory.

“The Docker engine, up to and including version 1.3.1, was vulnerable to extracting files to arbitrary paths on the host during ‘Docker pull’ and ‘Docker load’ operations,” it reads. “This was caused by symlink and hardlink traversals present in Docker’s image extraction.

“This vulnerability could be leveraged to perform remote code execution and privilege escalation,” it added.

The advisory document noted there was no cure for this issue, and urged users to upgrade to the latest iteration.

This wasn’t the only bug in the system either. An issue which affects versions 1.3.0 and 1.3.1 allows a malicious image creator to modify the default run profile of containers – yet this has been fixed with the current version.

The problem arises when taking into account the vast majority of major cloud computing providers have partnered up with Docker in order to package sleek, secure applications on its platform. Microsoft announced its deal in October, with Google, Amazon Web Services and Rackspace also on board.

It’s easy to see why these vendors are buddying up; as Docker leverages the host’s operating system, there are no overheads or difficulties in spinning up virtual machines when shipping an application in its container. But like a lot of nascent products that are hitting the zeitgeist, it’s best to not get carried away on an untested system when security scare stories are just around the corner.

Users are urged to upgrade to version 1.3.2 as soon as they can, which they can find here.