Zero to Devsecops: Security in a Devops World
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Devops and Testers White Paper
White Paper DevOps and Testers DevOps is part of an overall approach that organizations use to deliver software frequently and with high quality. The most obvious outcome of successful DevOps implementations is the reduction in the time it takes for software changes to transition from an idea to production. What Does DevOps Mean If you are an experienced DevOps Automated tools and processes practitioner, we hope that you are used in system configuration, for Testers might still find the article useful. If the build process, testing, the Background you are not a tester, we hope that deployment to test, staging and The DevOps movement (for want you will at least see the tester’s production environments, post- of a better label) is progressing perspective. deployment monitoring, evaluation, rapidly. Like many other and operations. movements in the industry, the What Is DevOps? speed of adoption accelerates Is DevOps Just About faster than the definition of the Simplistically, DevOps is a label movement itself. DevOps is still to describe an ecosystem in Tools? not well defined and the nuances which development teams and At one level, the goal of DevOps of culture, the emergent capability systems operations teams work is to eliminate bottlenecks in of new technologies, and range of more closely together. In the the delivery pipeline through (mostly successful) case studies so-called delivery pipeline, from automation. But the automation means that the issues at hand are committing source code to putting of staged processes still still widely debated.1 code into production, developers requires governance. Most accommodate and automate some automated processes are not Depending on who you talk to, of operations activities. -
Rugby - a Process Model for Continuous Software Engineering
INSTITUT FUR¨ INFORMATIK DER TECHNISCHEN UNIVERSITAT¨ MUNCHEN¨ Forschungs- und Lehreinheit I Angewandte Softwaretechnik Rugby - A Process Model for Continuous Software Engineering Stephan Tobias Krusche Vollstandiger¨ Abdruck der von der Fakultat¨ fur¨ Informatik der Technischen Universitat¨ Munchen¨ zur Erlangung des akademischen Grades eines Doktors der Naturwissenschaften (Dr. rer. nat.) genehmigten Dissertation. Vorsitzender: Univ.-Prof. Dr. Helmut Seidl Prufer¨ der Dissertation: 1. Univ.-Prof. Bernd Brugge,¨ Ph.D. 2. Prof. Dr. Jurgen¨ Borstler,¨ Blekinge Institute of Technology, Karlskrona, Schweden Die Dissertation wurde am 28.01.2016 bei der Technischen Universitat¨ Munchen¨ eingereicht und durch die Fakultat¨ fur¨ Informatik am 29.02.2016 angenommen. Abstract Software is developed in increasingly dynamic environments. Organizations need the capability to deal with uncertainty and to react to unexpected changes in require- ments and technologies. Agile methods already improve the flexibility towards changes and with the emergence of continuous delivery, regular feedback loops have become possible. The abilities to maintain high code quality through reviews, to regularly re- lease software, and to collect and prioritize user feedback, are necessary for con- tinuous software engineering. However, there exists no uniform process model that handles the increasing number of reviews, releases and feedback reports. In this dissertation, we describe Rugby, a process model for continuous software en- gineering that is based on a meta model, which treats development activities as parallel workflows and which allows tailoring, customization and extension. Rugby includes a change model and treats changes as events that activate workflows. It integrates re- view management, release management, and feedback management as workflows. As a consequence, Rugby handles the increasing number of reviews, releases and feedback and at the same time decreases their size and effort. -
Towards an Application Lifecycle Management Framework
VTT CREATES BUSINESS FROM TECHNOLOGY Technology and market foresight • Strategic research • Product and service development • IPR and licensing Dissertation VTT PUBLICATIONS 759 • Assessments, testing, inspection, certification • Technology and innovation management • Technology partnership • • • VTT PUBLICATIONS 759 TOWARDS AN APPLICATION LIFECYCLE MANAGEMENT FRAMEWORK AN APPLICATION 759 TOWARDS • VTT PUBLICATIONS VTT PUBLICATIONS 742 Elina Mattila. Design and evaluation of a mobile phone diary for personal health management. 2010. 83 p. + app. 48 p. 743 Jaakko Paasi & Pasi Valkokari (eds.). Elucidating the fuzzy front end – Experiences from the INNORISK project. 2010. 161 p. 744 Marja Vilkman. Structural investigations and processing of electronically and protonically conducting polymers. 2010. 62 p. + app. 27 p. 745 Juuso Olkkonen. Finite difference time domain studies on sub-wavelength aperture structures. 2010. 76 p. + app. 52 p. 746 Jarkko Kuusijärvi. Interactive visualization of quality Variability at run-time. 2010. 111 p. 747 Eija Rintala. Effects of oxygen provision on the physiology of baker’s yeast Saccharomyces cerevisiae. 2010. 82 p. + app. 93 p. 748 Virve Vidgren. Maltose and maltotriose transport into ale and lager brewer’s yeast strains. 2010. 93 p. + app. 65 p. 749 Toni Ahonen, Markku Reunanen & Ville Ojanen (eds.). Customer value driven service business development. Outcomes from the Fleet Asset Management Project. 2010. 43 p. + app. 92 p. 750 Tiina Apilo. A model for corporate renewal. Requirements for innovation management. 2010. 167 p. + app. 16 p. 751 Sakari Stenudd. Using machine learning in the adaptive control of a smart environment. 2010. 75 p. 752 Evanthia Monogioudi. Enzymatic Cross-linking of ββ-casein and its impact on digestibility and allergenicity. -
IBM Developer for Z/OS Enterprise Edition
Solution Brief IBM Developer for z/OS Enterprise Edition A comprehensive, robust toolset for developing z/OS applications using DevOps software delivery practices Companies must be agile to respond to market demands. The digital transformation is a continuous process, embracing hybrid cloud and the Application Program Interface (API) economy. To capitalize on opportunities, businesses must modernize existing applications and build new cloud native applications without disrupting services. This transformation is led by software delivery teams employing DevOps practices that include continuous integration and continuous delivery to a shared pipeline. For z/OS Developers, this transformation starts with modern tools that empower them to deliver more, faster, with better quality and agility. IBM Developer for z/OS Enterprise Edition is a modern, robust solution that offers the program analysis, edit, user build, debug, and test capabilities z/OS developers need, plus easy integration with the shared pipeline. The challenge IBM z/OS application development and software delivery teams have unique challenges with applications, tools, and skills. Adoption of agile practices Application modernization “DevOps and agile • Mainframe applications • Applications require development on the platform require frequent updates access to digital services have jumped from the early adopter stage in 2016 to • Development teams must with controlled APIs becoming common among adopt DevOps practices to • The journey to cloud mainframe businesses”1 improve their -
Devsecops in Reguated Industries Capgemini Template.Indd
DEVSECOPS IN REGULATED INDUSTRIES ACCELERATING SOFTWARE RELIABILITY & COMPLIANCE TABLE OF CONTENTS 03... Executive Summary 04... Introduction 07... Impediments to DevSecOps Adoption 10... Playbook for DevSecOps Adoption 19... Conclusion EXECUTIVE SUMMARY DevOps practices enable rapid product engineering delivery and operations, particularly by agile teams using lean practices. There is an evolution from DevOps to DevSecOps, which is at the intersection of development, operations, and security. Security cannot be added after product development is complete and security testing cannot be done as a once-per-release cycle activity. Shifting security Left implies integration of security at all stages of the Software Development Life Cycle (SDLC). Adoption of DevSecOps practices enables faster, more reliable and more secure software. While DevSecOps emerged from Internet and software companies, it can benefit other industries, including regulated and high security environments. This whitepaper covers how incorporating DevSecOps in regulated Industries can accelerate software delivery, reducing the time from code change to production deployment or release while reducing security risks. This whitepaper defines a playbook for DevSecOps goals, addresses challenges, and discusses evolving workflows in DevSecOps, including cloud, agile, application modernization and digital transformation. Bi-directional requirement traceability, document generation and security tests should be part of the CI/CD pipeline. Regulated industries can securely move away -
Towards Embedded System Agile Development Challenging Verification, Validation and Accreditation
Towards Embedded System Agile Development Challenging Verification, Validation and Accreditation : Application in a Healthcare Company Clément Duffau, Bartosz Grabiec, Mireille Blay-Fornarino To cite this version: Clément Duffau, Bartosz Grabiec, Mireille Blay-Fornarino. Towards Embedded System Agile Develop- ment Challenging Verification, Validation and Accreditation : Application in a Healthcare Company. ISSRE 2017- IEEE International Symposium on Software Reliability Engineering, Oct 2017, Toulouse, France. pp.1-4. hal-01678815 HAL Id: hal-01678815 https://hal.archives-ouvertes.fr/hal-01678815 Submitted on 9 Jan 2018 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Towards Embedded System Agile Development Challenging Verification, Validation and Accreditation Application in a Healthcare Company Clement´ Duffau Bartosz Grabiec Mireille Blay-Fornarino AXONIC and I3S AXONIC I3S Universite´ Coteˆ d’Azur, CNRS Sophia Antipolis, France Universite´ Coteˆ d’Azur, CNRS Sophia Antipolis, France [email protected] Sophia Antipolis, France [email protected] [email protected] Abstract—When Agile development meets critical embedded to survive. Moreover, with limited human resources, quality systems, verification, validation and accreditation activities are improvement with Agility usage remains to be demonstrated. impacted. Challenges such as tests increase or accreditation The remainder of this paper is organized as follows. -
The Timeboxing Process Model for Iterative Software Development
The Timeboxing Process Model for Iterative Software Development Pankaj Jalote Department of Computer Science and Engineering Indian Institute of Technology Kanpur – 208016; India Aveejeet Palit, Priya Kurien Infosys Technologies Limited Electronics City Bangalore – 561 229; India Contact: [email protected] ABSTRACT In today’s business where speed is of essence, an iterative development approach that allows the functionality to be delivered in parts has become a necessity and an effective way to manage risks. In an iterative process, the development of a software system is done in increments, each increment forming of an iteration and resulting in a working system. A common iterative approach is to decide what should be developed in an iteration and then plan the iteration accordingly. A somewhat different iterative is approach is to time box different iterations. In this approach, the length of an iteration is fixed and what should be developed in an iteration is adjusted to fit the time box. Generally, the time boxed iterations are executed in sequence, with some overlap where feasible. In this paper we propose the timeboxing process model that takes the concept of time boxed iterations further by adding pipelining concepts to it for permitting overlapped execution of different iterations. In the timeboxing process model, each time boxed iteration is divided into equal length stages, each stage having a defined function and resulting in a clear work product that is handed over to the next stage. With this division into stages, pipelining concepts are employed to have multiple time boxes executing concurrently, leading to a reduction in the delivery time for product releases. -
Agile and Devops Overview for Business
NELKINDA SOFTWARE CRAFT Ƅ TRAINING Agile and DevOps Overview for Business Duration: 2 Days Available Languages: English Audience Everyone who is steering or involved in software delivery: Business, Management, Operations, Development, for example: CxOs, managers, directors, team leads, systems administrators, development managers, business analysts, requirements engineers, architects, product owners, scrum masters, IT operations sta', IT stakeholders, developers, testers Goals Agile and DevOps are the big drivers of organizational transformation today. What do they mean? Where do they come from? What are their goals? How can they help my organization and my team? How can I use and implement them? And are there any side-e'ects or challenges to consider? Learn the answers to these questions in a holistic perspective from the CxO level to the code about what Agile and DevOps mean for organizations of all sizes. Contents • Business Case for Improving the Software Development Life Cycle ◦ Evolution of the Software Development Life Cycle (SDLC) ◦ Business Drivers of the SDLC Evolution ◦ Principles of Agile, DevOps, Extreme Programming (XP), and Software Craft ◦ Goals and Objectives of Agile, DevOps (Development Operations), XP, and Software Craft ◦ The Pipeline for Value Delivery • Essential Principles ◦ Manifesto for Agile Software Development ("Agile Manifesto") ◦ The Values and Principles of XP ◦ Manifesto of Software Craft ◦ The Two Values of Software ◦ The Deming (PDCA, plan-do-check-act) Cycle ◦ The XP Feedback Loops ◦ Parkinson's Law and Timeboxing ◦ Conway's Law, Organizational Structure and Cross-functional responsibility ◦ KPIs (Key Performance Indicators) and Drivers: Story-Point Velocity, Cycle Time, WIP (Work In Progress) limit ◦ Heisenberg's Uncertainty Principle of Agile Estimation 1/3 https://nelkinda.com/training/DevOps-Driven-Agile © Copyright 2015-2020 Nelkinda Software Craft Private Limited. -
CADET: Debugging and Fixing Misconfigurations Using Counterfactual Reasoning
CADET: Debugging and Fixing Misconfigurations using Counterfactual Reasoning Md Shahriar Iqbal∗ Rahul Krishna∗ Mohammad Ali Javidian University of South Carolina Columbia University Purdue University [email protected] [email protected] [email protected] Baishakhi Ray Pooyan Jamshidi Columbia University University of South Carolina [email protected] [email protected] Abstract Swap Mem. Swap Memory Modern computing platforms are highly-configurable with thou- sands of interacting configuration options. However, configuring GPU Resource these systems is challenging and misconfigurations can cause un- 512 Mb Latency 1Gb Memory Pressure expected non-functional faults. This paper proposes CADET (short 2Gb 3Gb for Causal Debugging Toolkit) that enables users to identify, ex- 4Gb Latency plain, and fix the root cause of non-functional faults early and in a GPU Growth GPU Growth principled fashion. CADET builds a causal model by observing the (a) (b) (c) performance of the system under different configurations. Then, it uses casual path extraction followed by counterfactual reason- Figure 1: Observational data (in Fig.1a) (incorrectly) shows ing over the causal model to (a) identify the root causes of non- that high GPU memory growth leads to high latency. The trend functional faults, (b) estimate the effects of various configuration is reversed when the data is segregated by swap memory. options on the performance objective(s), and (c) prescribe candi- date repairs to the relevant configuration options to fix the non- functional fault. We evaluated CADET on 5 highly-configurable systems by comparing with state-of-the-art configuration optimiza- heat dissipation [15, 71, 74, 84]. The sheer number of modalities tion and ML-based debugging approaches. -
Enterprise Application Lifecycle Management Solutions Enterprise Application Lifecycle Management Solutions
Enterprise Application Lifecycle Management Solutions Enterprise Application Lifecycle Management Solutions This extensive onsite knowledge gained from years of expe- Products and Solutions for rience combined with our trusted relationships with end- users, puts us in a unique position to self-instrument the Comprehensive Enterprise products crucially needed by our customers to successfully accomplish their Enterprise Application Lifecycle Manage- Application Lifecycle ment projects. Management With this in mind, we have developed Our Enterprise Application Lifecycle Ma- RaySuite. nagement Solutions include delivering RaySuite is a comprehensive set of products that automates various tasks within an Enterprise Application Lifecycle. consulting and software packaging ser- vices to enterprises undergoing an OS This automation ranges from the analysis of the existing application portfolio and license inventories via complex migration or implementing a software license management and software packaging, all the way deployment tool. We have successfully to comprehensive quality control and fi nally software deployment in production. These automated processes served over 600 enterprise customers are sustainable and can be replicated for every change and with excellent results. every patch. A central database and a common user interface found throughout all RaySuite products form a consistent solution and off er a strong contrast to existing patchwork solutions that are often found in enterprises, as a result of limited vision and the implementation of various suppliers. Al- though Raynet guarantees a consistent approach with the use of its entire product range, it is still possible to buy and implement the individual products of RaySuite autono- mously as well as integrate them with existing third-party or home-grown products. -
Designing Software Architecture to Support Continuous Delivery and Devops: a Systematic Literature Review
Designing Software Architecture to Support Continuous Delivery and DevOps: A Systematic Literature Review Robin Bolscher and Maya Daneva University of Twente, Drienerlolaan 5, Enschede, The Netherlands [email protected], [email protected] Keywords: Software Architecture, Continuous Delivery, Continuous Integration, DevOps, Deployability, Systematic Literature Review, Micro-services. Abstract: This paper presents a systematic literature review of software architecture approaches that support the implementation of Continuous Delivery (CD) and DevOps. Its goal is to provide an understanding of the state- of-the-art on the topic, which is informative for both researchers and practitioners. We found 17 characteristics of a software architecture that are beneficial for CD and DevOps adoption and identified ten potential software architecture obstacles in adopting CD and DevOps in the case of an existing software system. Moreover, our review indicated that micro-services are a dominant architectural style in this context. Our literature review has some implications: for researchers, it provides a map of the recent research efforts on software architecture in the CD and DevOps domain. For practitioners, it describes a set of software architecture principles that possibly can guide the process of creating or adapting software systems to fit in the CD and DevOps context. 1 INTRODUCTION designing new software architectures tailored for CD and DevOps practices. The practice of releasing software early and often has For clarity, before elaborating on the subject of been increasingly more adopted by software this SLR, we present the definitions of the concepts organizations (Fox et al., 2014) in order to stay that we will address: Software architecture of a competitive in the software market. -
Automatic Deployment of Distributed Software Systems: Definitions and State of the Art
Open Archive TOULOUSE Archive Ouverte (OATAO) OATAO is an open access repository that collects the work of Toulouse researchers and makes it freely available over the web where possible. This is an author-deposited version published in : http://oatao.univ-toulouse.fr/ Eprints ID : 14816 To link to this article : DOI :10.1016/j.jss.2015.01.040 URL : http://dx.doi.org/10.1016/j.jss.2015.01.040 To cite this version : Arcangeli, Jean-Paul and Boujbel, Raja and Leriche, Sébastien Automatic Deployment of Distributed Software Systems: Definitions and State of the Art. (2015) Journal of Systems and Software, vol. 103. pp. 198-218. ISSN 0164-1212 Any correspondance concerning this service should be sent to the repository administrator: [email protected] Automatic deployment of distributed software systems: Definitions and state of the art a, a b Jean-Paul Arcangeli ∗, Raja Boujbel , Sébastien Leriche a Université de Toulouse, UPS, IRIT, 118 Route de Narbonne, F-31062 Toulouse, France b Université de Toulouse, ENAC, 7 Avenue Édouard Belin, F-31055 Toulouse, France a b s t r a c t Deployment of software systems is a complex post-production process that consists in making software available for use and then keeping it operational. It must deal with constraints concerning both the system and the target machine(s), in particular their distribution, heterogeneity and dynamics, and satisfy requirements from different stakeholders. In the context of mobility and openness, deployment must react to the instability of the network of machines (failures, connections, disconnections, variations in the quality of the resources, etc.).