Keumars Afifi-Sabet

Keumars Afifi-Sabet

Bobby Hellard

The demands of today’s tech-savvy customer have placed huge emphasis on software development and user experience as a barometer for success. DevOps adoption has grown rapidly as a result, with many businesses looking at routes to either introduce or accelerate DevOps workflows within their IT organisations.

‘Tool chains’ are an integral part of any DevOps programme, helping automate the delivery, development, and management of software applications and deliver better products to both customers and business units, more efficiently and effectively. The collaborative nature of these development and production environments makes them difficult to protect however, particularly the privileged accounts and secrets associated with them.

Navigating this risk and securing key tools and infrastructure is therefore critical if organisations are to achieve successful DevOps outcomes and progress on their digital transformation journeys. To do so, there are five key measures they must consider to prioritise protection of DevOps tools and processes:

The crucial importance of selection and configuration policies

Any security conversation should always begin a full inventory of the DevOps tools being used by dev teams. After all, it’s impossible to defend environments if you don’t know they exist. This process can be cumbersome, but is massively important for open source tools.

Once these tools are accounted for, security teams should undertake an evaluation to identify any existing security deficiencies and address them promptly. This could involve making sure tools are not being used in an unsecure default configuration for example, and that they are kept up to date.

As part of this evaluation process, security teams should also find a way to get a seat at the table. That means collaborating with the group with the business that is responsible for tool selection and configuration, or working closely with IT procurement to select the best tools for the organisation so that enterprise security standards are established at the outset.

Keep your DevOps tools on lockdown

Attackers only need to exploit one vulnerability to carry out their mission, so it’s important to take a holistic approach to addressing security requirements and potential vulnerabilities. This starts with securing the secrets and credentials associated with DevOps and cloud management tools in an encrypted vault protected with multi-factor authentication (MFA).

Once complete, access privileges should be reviewed so that users are only granted “just in time” access. In other words, provide high-level access only when it’s needed to perform certain tasks, and ensure that this temporary usage is closely monitored.

Access to high-risk commands within DevOps tools should also be limited. For instance, Docker users often run a Docker container with the —privileged flag, which provides the container with direct access to host elements. Where possible, security teams should mandate that users are not able run containers with this flag, and if it’s a “must,” severely limit user access and monitor and record all activities with the –privileged flag.

Once you have addressed access, it’s also advisable to adopt other cyber hygiene best practices, such as setting up access controls that segregate DevOps pipelines. This prevents attackers from gaining access to one and then moving to another, ensuring that credentials and secrets are not shared between DevOps tool accounts and Windows sysadmin accounts. It also removes all unnecessary accounts with access to DevOps tools, including those of developers who may have changed roles or no longer require access to these tools.

Manage the proliferation of privilege

Enforcing the principle of least privilege should be a requisite for every company. Doing so limits each user’s level of access to DevOps tools to the minimum necessary for their role. However, it will be less effective unless security teams configure DevOps tools to require dual authorisation for certain critical functions. They should for example require that a second person must review and approve any changes before a change to a Puppet manifest file goes live.

Additionally, teams should ensure separation of duties for build automation tools such as Jenkins, which often retain permission to perform all duties without restriction, from building and testing to packaging. In the case of Jenkins this problem can be overcome by separating duties by implementing multiple Jenkins nodes, each dedicated to one function (build or test or package) for each application.

This ensures each node will have a unique identity and a limited set of privileges, which minimizes the impact of a potential compromise.

Keep your secrets safe in code repositories

Code repositories such as GitHub have become infamous in recent years due to IT teams erroneously leaving code in publicly accessible locations. Security teams should therefore develop risk-based policies for developers that secure the use of such repositories.

It’s worth noting however that beyond credentials, code may contain details about the organisation’s internal network that could be useful to attackers. Ideally firms should therefore use an on-premises rather than a cloud-based code repository, if it’s possible to do so without adversely affecting workflow.

If this approach is applied, then the next step is to scan the environment to make sure that any on-premises code repositories are inaccessible from outside the network. If cloud-based repositories are used however, then security teams should ensure they are configured to be private.

Above all, every organisation should make it their policy that code is automatically scanned to ensure it does not contain secrets before it can be checked in to any repository.

Invest in the protection of your infrastructure

Cyber attackers seek the path of least resistance, and for many organisations, this remains their employees. Well-crafted phishing emails can often do the trick, so IT teams should make sure that all workstations and servers undergo regular patching, vulnerability scanning and security monitoring.

Away from hardware, it’s also important to monitor your cloud infrastructure for signs of unusual credential usage or configuration changes (such as making private data stores public). This means ensuring VM and container images used in development and production environments come from a sanctioned source and are kept up to date.

To ensure security remains “baked in” to countless rounds of automatic rebuilds, security teams should also work with their DevOps counterparts to automate the configuration of VMs and containers so that, when a new machine or container is spun up, it is automatically configured securely and given appropriate controls – without requiring human involvement.

The benefits of DevOps are plain and clear for all to see – hence the rapid adoption that we have witnessed in recent years. Adopting a DevSecOps approach, using the measures outlined above, is critical to ensuring application and infrastructure security from the outset of any software development activity.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Google Cloud has announced the launch of Cloud Dataproc on Kubernetes, adding another string to the bow for the product which offers a managed cloud service for running Apache Spark and Hadoop clusters.

Google – which originally designed Kubernetes before handing it to the Cloud Native Computing Foundation (CNCF) – is promising ‘enterprise-grade support, management, and security to Apache Spark jobs running on Google Kubernetes Engine clusters’, in the words of a blog post confirming the launch.

Christopher Crosbie and James Malone, Google Cloud product managers, noted the need for Cloud Dataproc to utilise Kubernetes going forward. “This is the first step in a larger journey to a container-first world,” Crosbie and Malone wrote. “While Apache Spark is the first open source processing engine we will bring to Cloud Dataproc on Kubernetes, it won’t be the last.

“Kubernetes has flipped the big data and machine learning open source software world on its head, since it gives data scientists and data engineers a way to unify resource management, isolate jobs, and build resilient infrastructures across any environment,” they added. “This alpha announcement of bringing enterprise-grade support, management, and security to Apache Spark jobs on Kubernetes is the first of many as we aim to simplify infrastructure complexities for data scientists and data engineers around the world.”

To say Kubernetes is not a major priority for both vendors and customers would be something of a falsification. The recent VMworld jamboree in San Francisco two weeks ago saw the virtualisation giant launch a major attack on the product, with the primary launch being VMware Tanzu, a product portfolio which looked at enterprise-class building, running and management of software on Kubernetes.

As this publication put it when KubeCon and CloudNativeCon hit Barcelona back in May, it was a ‘milestone’ for the industry. Brian Grant and Jaice Singer DuMars certainly thought so; the Google Cloud pair’s blog post at the time agreed Kubernetes had ‘become core to the creation and operation of modern software, and thereby a key part of the global economy.’

The goal now is to get the most out of it, whether you’re an enterprise decision maker or developer alike. Writing for CloudTech last month Ali Golshan, co-founder and CTO at StackRox, noted the acceleration in user deployments. “Despite the fact that container security is a significant hurdle, containerisation is not slowing down,” Golshan wrote. “The advantages of leveraging containers and Kubernetes – allowing engineers and DevOps teams to move fast, deploy software efficiently, and operate at unprecedented scale – is clearly overcoming the anxiety of security concerns.”

Golshan also noted, through StackRox research, that Google still ranked third among the hyperscalers for container deployments in the public cloud but had gained significantly in the past six months.

“Enterprises are increasingly looking for products and services that support data processing across multiple locations and platforms,” said Matt Aslett, research vice president at 451 Research. “The launch of Cloud Dataproc on Kubernetes is significant in that it provides customers with a single control plane for deploying and managing Apache Spark jobs on Google Kubernetes Engine in both public cloud and on-premises environments.”

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Microsoft has announced the launch of new Azure availability in Germany and Switzerland, citing increased data residency and security concerns as key to European expansion.

Azure is now available from cloud data centre regions located in Zurich and Geneva, for the Switzerland release announced at the end of last month, while Germany’s newest regions are in the North and West Central zones, in Berlin and Frankfurt respectively.

The communications announcing the Germany and Switzerland releases, from Azure corporate vice president Tom Keane, were almost identical, save swapping out a customer story here and stock photo there. Among Microsoft’s German customers are Deutsche Bank, Deutsche Telekom and SAP, while Swiss companies utilising Azure include Swisscom, insurance firm Swiss Re, and wealth manager UBS Group.

Customers in Germany are promised compliance specific to the country, including C5 (Cloud Computing Compliance Controls Catalogue) attestation. Alongside Office 365, Dynamics 365 and Power Platform, customers will be able to benefit from containers, Internet of Things (IoT), and artificial intelligence (AI) solutions, Microsoft added.

“These investments help us deliver on our continued commitment to serve our customers, reach new ones, and elevate their businesses through the transformative capabilities of the Microsoft Azure cloud platform,” wrote Keane.

Microsoft is not the first hyperscaler to hoist its flag atop Switzerland, with Google opening its Zurich data centre region back in March. Both Google and AWS have sites in Frankfurt, with AWS first to launch there back in 2014.

This is not the end of the European expansion for Microsoft, with two new regions in Norway planned. The sites, in Stavanger and Oslo, are set to go live later this year.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

IT operations management (ITOM) software helps enterprises manage the health, availability, and performance of modern IT environments. Analyst firm Gartner expects the ITOM software market to grow to $37 billion in annual revenues by 2023, with legacy on-prem tools giving way to powerful SaaS solutions for hybrid performance monitoring and management.

August this year saw five significant ITOM tool exits, with Splunk acquiring SignalFx for a cool $1.05 billion, Resolve Systems buying out FixStream, Virtual Instruments purchasing Metricly, VMware splurging on Veriflow, and Park Place Technologies acquiring Entuity. In related news, application performance monitoring provider, Dynatrace, went public at a $6.7 billion valuation while cloud monitoring tool, Datadog, recently announced its $100 million IPO listing.

To better understand ITOM software acquisition patterns, we assembled a dataset of 80+ acquisitions and buyouts of ITOM tool vendors since January 2015. This dataset lets IT buyers analyse and decipher the answers to the following questions:

• What industry trends are responsible for a new wave of acquisitions?
• Which ITOM categories have seen the most number of acquisitions and buyouts?
• Which technology leaders have acquired innovative startups in the last few years?
• What role has private equity played in fueling market innovation and consolidation?
• What are the strategic reasons behind an incumbent assembling an acquisition portfolio?

Here are five things we learned from 80+ ITOM software acquisitions over the last five years:

Industry trends fuel new category creation

Research firm IDC expects public cloud spending to grow from $229 billion in 2019 to $500 billion in 2023. The runaway adoption of public cloud infrastructure has unleashed massive disruption in the ITOM software market. Traditional approaches to performance monitoring and cost optimisation are no longer relevant in a world of on-demand, ephemeral, and elastic cloud services. Enterprise cloud consumption has led to several technology acquisitions in the following categories:

• Cloud monitoring: Cloud monitoring tools deliver visibility and control of business-critical services built on multi-cloud and cloud native architectures.

  IT operations and DevOps teams have heavily invested in cloud monitoring point tools, which explains the purchase of eight cloud monitoring startups (SignalFx, Metricly, Outlyer, Server Density, Unigma, Wavefront, Opsmatic, Boundary, and Librato) by industry incumbents like Splunk, VMware, New Relic, BMC Software, and SolarWinds
   

• Cloud management platforms: Cloud management platforms (CMPs) help enterprises migrate on-prem workloads to cloud environments with capabilities for discovery, provisioning, orchestration, and workload balancing.

  Technology vendors like Apptio, Flexera, Nutanix, Microsoft, Cisco, ServiceNow, and IBM have made eight CMP acquisitions across startups like FittedCloud, RightScale, Botmetric, Cloudyn, CliQr, ITapp, Gravitant, and FogPanel
   

• Cloud cost optimisation: Cloud cost optimisation tools let business and IT teams manage public cloud consumption by identifying underutilised and idle cloud instances and delivering real-time recommendations for cloud workload placement. Given the pressing need to avoid cloud sticker shock, industry leaders purchased six cloud cost optimisation tools (Cloudability, ParkMyCloud, StratCloud, CloudHealth Technologies, Cmpute.io, and Cloud Cruiser)
   
• Network performance monitoring: How do enterprises deliver compelling customer experiences across on-prem, private cloud, and public cloud networks? Network performance monitoring and diagnostics tools offer real-time insight into network traffic utilisation and help troubleshoot problems with multi-layer visibility.

  Industry incumbents and investors capitalised on the demand for network monitoring by snapping up eight different tool providers (Entuity, Veriflow, Corvil, Netfort, Savvius, Performance Vision, Gigamon, and Danaher Communications)
   

• AIOps: The adoption of hybrid and cloud native architectures has led to endless alert storms, where it is nearly impossible for human operators to extract the signal from the noise. Artificial intelligence for IT operations (AIOps) tools apply machine learning and data science techniques to the age-old problem of IT event correlation and analysis.

  Larger incumbents have swallowed seven AIOps startups (FixStream, SignifAI, Savision, Evanios, Perspica, Event Enrichment HQ, and Metafor), underlining the need for AI/ML approaches to isolate and pinpoint incident root cause(s).

Growth by acquisition

Since 2015, serial acquirers like SolarWinds, Cisco, ServiceNow, Splunk, Datadog, New Relic, Flexera, VMware, and Nutanix have acquired thirty-two diverse startups across performance monitoring, hybrid discovery, IT service management, cloud management platforms, cloud cost optimisation, and AIOps.

SolarWinds leads the pack with seven deals (Samanage, Loggly, Scout, TraceView, LOGICnow, Papertrail, and Librato) followed by Splunk (SignalFx, VictorOps, Rocana, and Metafor), Cisco (Cmpute.io, Perspica, AppDynamics, and Cliqr) and ServiceNow (FriendlyData, Parlo, DxContinuum, and ITapp) with four acquisitions each.

ITOM software leaders have dedicated corporate strategy, business development, and investment teams that are constantly scouting for the next big thing. Acquiring the right startup can ensure competitive parity, market entry, or talent infusion, which is critical for technology incumbents with stale and aging product portfolios.    

Private equity continues to reshape the ITOM software landscape

Private equity (PE) firms like Bain Capital, Insight Partners, KKR, Thoma Bravo, and Vista Equity Partners have had an outsized influence on the ITOM tools market. Companies like Apptio, BMC Software, Cherwell, Connectwise, Continuum Managed Services, Dynatrace, Flexera, Ivanti, Kaseya, LogicMonitor, Optanix, Resolve Systems, Riverbed, and SolarWinds have all benefited from strategic PE investments.

In the managed services software segment, Thoma Bravo alone controls Connectwise, Continuum, and SolarWinds MSP, while Vista Equity Partners engineered a merger between two portfolio companies, Datto and Autotask to create a new managed services leader. Expect PE firms to invest, acquire, and divest portfolio companies, creating new ITOM software winners and losers in the process.

No sign of mega deals slowing down

While Splunk’s billion-dollar deal for SignalFx was astounding, there have been several blockbuster acquisitions and buyouts in the ITOM software market.  In the last five years, Broadcom acquired CA Technologies for $18.9 billion, Thoma Bravo purchased Connectwise for $1.5 billion, KKR bought out BMC Software for $8.5 billion, Elliott Management acquired Gigamon for $1.6 billion, Cisco spent $3.7 billion on AppDynamics, Micro Focus engineered a reverse merger with HPE Software for $8.8 billion, NetScout purchased Danaher Communications for $2.3 billion, and Thoma Bravo took Riverbed private for $3.5 billion.

Just these eight deals generated $47+ billion demonstrating sustained momentum and continued investments in ITOM software firms from leading technology vendors and VC/PE firms.

The elusive quest for a unified ITOM platform

Platform thinking is the motivation behind several recent ITOM acquisitions (Splunk’s takeover of Metafor and VictorOps for modern incident management or SolarWind’s TraceView and Librato acquisitions for real-time observability).

The big four ITOM vendors (BMC, CA, IBM, and HP) famously used acquisitions to build their ITOM minisuites (chasing the ever-popular “single pane of glass”). Unfortunately, inorganic product strategies never resulted in a unified platform that could combine disparate performance and capacity insights in a single place.

It is an open question if current industry leaders like ServiceNow, Splunk, and SolarWinds have learned any lessons from the 'big four' acquisition debacles. Every technology acquisition requires significant engineering resources and product roadmap enhancements for successful integration with an incumbent’s platform. Enterprise IT buyers should carefully verify whether there remains continued focus and commitment to making the acquisition work before writing a big check to an industry leader that touts its recent acquisitions as proof of its innovation DNA.

The bottom line?

Next-generation technology startups are constantly redefining customer expectations with innovative solutions for modern digital operations management. Industry incumbents will continue to use acquisitions as a means to acquire modern technologies, battle-tested talent, and market credibility.

IT buyers should partner with technology startups for emerging use cases as well as evaluate how incumbent vendors are modernising their technology portfolios and truly integrating the acquired technology to achieve the long-sought-after vision of a single pane of glass. Otherwise, they may instead end up with the more common scenario of a single glass of pain.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Connor Jones

Remember Project Natick, Microsoft’s experiment last year in placing a data centre underwater off Orkney? A little further down the Scottish coast, another company is looking to use the ocean waves to create sustainability in infrastructure – but through a slightly different method.

SIMEC Atlantis Energy is looking to build the first ‘ocean-powered data centre in the world’ in Caithness, with the aim of attracting a hyperscale cloud infrastructure provider for its hosting needs. The facility will utilise electricity from a private wire network from tidal turbines at MeyGen, an existing project site, as its power supply.

“The MeyGen project has a seabed lease and consents secured for a further 80MW of tidal capacity, in addition to the 6MW operational array which has now generated more than 20,000MWh of electricity for export to the grid,” the company notes in its press materials.

SIMEC Atlantis is looking to partner with engineering firm AECOM to assess the feasibility of the project, with particular regard to connectivity, with the target date for operations set at 2024. The company noted a smaller initial data centre module could be deployed sooner.

“This exciting project represents the marriage of a world-leading renewable energy project in MeyGen with a data centre operator that seeks to provide its clients with a large amount of computing power, powered from a sustainable and reliable source – the ocean,” said Tim Cornelius, SIMEC Atlantis CEO. “At MeyGen we have many of the ingredients to provide clean power to the data centre, including a large grid connection agreement, proximity to international fibre optic connections and persistent cool weather.”

Cornelius added that Scotland can ‘play a key role in the global data centre industry.’ This is based upon the dual advantage of a more temperate climate and access to clean energy. Speaking to the BBC last year around Project Natick, Microsoft confirmed Orkney’s location was chosen primarily because of its renewable energy expertise.

Scandinavia has seen various energy-efficient initiatives taking place, many taking advantage of its suitable geography. Last year, Nordics-based provider DataPlex announced it was reusing wastage from its data centre facilities to heat apartments in Oslo. Last month, the company launched a guide to help businesses solidify their data centre strategies – with sustainability a key message. Various stakeholders are involved; as far back as 2015, this publication reported on a study in Sweden – later passed as legislation – to give tax breaks on electricity for data centre providers.

In terms of the biggest cloud providers, Google announced last April it was running all of its clouds on renewable energy. Amazon Web Services (AWS) is not at that level yet however, announcing in April new projects with the goal of achieving 100% renewable energy for its global infrastructure. A report from Greenpeace at the time however argued some of AWS’ data centres were running off as little as 12% renewable energy.

Writing for this publication in July, Hiren Parakh, senior director of cloud services EMEA at OVH, noted the key trends emerging to create sustainability in the data centre industry. “Through a fully integrated industrial model, providers are capable of building systems that are more energy efficient and should always thrive to optimise the use of data centres and server resources across their customer base,” wrote Parakh. “When it comes to managing and fitting out a data centre, it’s clear that sustainability needs to be top of mind.”

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Esther Kezia Thorpe