Posted on

How Developers Can Create “Sticky” Products

I had the chance to chat with Ajeet Singh, executive chairman and co-founder of ThoughtSpot. Ajeet was also a co-founder of Nutanix. I asked him about what developers need if their goal is to develop products for customers who will love them. Here are some insights from our conversation.

What Are the Most Important Elements of a “Sticky” Product?

Early on, Ajeet's work focused on product management at Honeywell and Oracle where he focused on features and benefits. While at Honeywell, his team built software that monitored the health of aircraft using data from those tasks. This experience allowed him to interact with IDEO — an organization known for its design thinking skills — and adopt a new perspective toward solving customer problems as well. 

Posted on

How to Build Accountability In Your Team

Imagine you've built a team of people who are all-stars at their individual roles. Every one of them is exceptional and has the potential to become a leader at another company. But they won’t because they don’t have accountability on their team. 

If you’re reading this, it means you’re the team leader or aspire to be one someday. You understand that teams are responsible for their outputs, not just their inputs. You know that to build your team and its effectiveness, you need to create a culture where people take ownership of their performance, and working together as a unit is more important than competing against each other for personal gain. 

Posted on

Where Does Cybersecurity Go from Here?

I had the opportunity to hear Chris Krebs, founding partner of the Krebs Stamos Group and former director of the Cybersecurity and Infrastructure Security Agency (CISA) deliver the opening keynote at the 25th Black Hat Security Conference.

For 25 years, the InfoSec community and industry have chipped away at security vulnerabilities in technology with research and adversary insights. For 25 years, vendors and software firms have introduced new products and protection. With the last 25 years as prologue — and as we look to the next 25 years — we need to ask, "Are we on the right track?"

Posted on

IoT + Cloud Growth = Greatest Cybersecurity Risk

The Internet of Things (IoT) has seemingly endless potential. From smart homes to connected cars2014 to sensors monitoring traffic and natural disasters, IoT is set to make our world a safer and more convenient place. But with this new wave of technology comes new risks. As the number of devices connected to the cloud increases, so do opportunities for hackers.

Research conducted by IoT Analytics projects IoT active connections to grow 18%, with 14.4 billion active endpoints, in 2022. This follows an 8% increase in 2021 with 12.2 billion active endpoints. As significant as this growth is, it's being hampered by the persistent chip shortage. 

Posted on

Is Sustainability the New Security and Compliance?

Digital transformation is making every business faster, smarter, and more connected. At the same time, it’s also putting pressure on businesses to reduce their environmental footprint and make sure that their IT operations are socially responsible. Are we at a point where we were with security five years ago, where you can no longer ignore the importance of social governance in your IT environment?

Data Security & Compliance

When I began conducting interviews with IT executives for DZone in 2015, GDPR and data security were only the concern of CIOs and CTOs -- there weren't many CISOs then. Data security was a nuisance to CEOs, CSOs, and COOs. IT just needed to "handle it."

Posted on

After COVID, Developers Really Are the New Kingmakers

Several years ago, pre-COVID, I wrote the article Developers are the New Kingmakers. Today, companies see the value of developers as being even greater.

Since the pandemic began, we've seen a renewed focus on digital transformation. Companies and industries are transforming two to three times faster than they were prior to COVID. Businesses have moved online and become more data-driven than ever before. This has created a demand for application development and data analytics skills.

Posted on

5-Step Cyber Threat Hunting Process

The recent invasion of Ukraine has prompted many people to warn that cyberattacks will become more common around the world. F1000 corporations have issued alerts for their employees and urged them to be on the lookout for phishing emails that could result in the ingestion of malware that will jeopardize company networks and infrastructure. 

Here are five steps developers and SecOps professionals can take to improve their threat hunting program and make it more effective.

Posted on

Data Lives Longer Than Any Environment, Data Management Needs to Extend Beyond the Environment

Komprise enables enterprises to analyze, mobilize and monetize file and object data across clouds, data centers, and the edge. The solution constantly monitors key business services, identifies changes in usage patterns, and automatically captures new insights. Komprise also simplifies access to all enterprise data helping companies make better decisions faster while driving increased revenue from existing infrastructure

The 41st IT Press Tour had the opportunity to meet with Kumar Goswami, co-founder and CEO, Darren Cunningham, VP of Marketing, Ben Conneely, VP EMEA Sales, Krishna Subramanian, Co-Founder and COO of Komprise.

Posted on

The Intelligent Storage Revolution

Intelligent computing and intelligent storage are the future. Intelligent computing is the ability to automatically adjust computing resources based on data and application needs, such as the acceleration of an analytics workload. 

Intelligent storage ensures that applications can always access their data by transparently managing multiple disk tiers. 

Posted on

Data Lake and Data Mesh Use Cases

As data mesh advocates come to suggest that the data mesh should replace the monolithic, centralized data lake, I wanted to check in with Dipti Borkar, co-founder and Chief Product Officer at Ahana. Dipti has been a tremendous resource for me over the years as she has held leadership positions at Couchbase, Kinetica, and Alluxio.

Definitions

  • A data lake is a concept consisting of a collection of storage instances of various data assets. These assets are stored in a near-exact, or even exact, copy of the resource format and in addition to the originating data stores.
  • A data mesh is a type of data platform architecture that embraces the ubiquity of data in the enterprise by leveraging a domain-oriented, self-serve design. Mesh is an abstraction layer that sits atop data sources and provides access.
According to Dipti, while data lakes and data mesh both have use cases they work well for, data mesh can’t replace the data lake unless all data sources are created equal — and for many, that’s not the case. 

Data Sources

All data sources are not equal. There are different dimensions of data:
  • Amount of data being stored
  • Importance of the data
  • Type of data
  • Type of analysis to be supported
  • Longevity of the data being stored
  • Cost of managing and processing the data
Each data source has its purpose. Some are built for fast access for small amounts of data, some are meant for real transactions, some are meant for data that applications need, and some are meant for getting insights on large amounts of data. 

AWS S3

Things changed when AWS commoditized the storage layer with the AWS S3 object-store 15 years ago. Given the ubiquity and affordability of S3 and other cloud storage, companies are moving most of this data to cloud object stores and building data lakes, where it can be analyzed in many different ways.

Because of the low cost, enterprises can store all of their data — enterprise, third-party, IoT, and streaming — into an S3 data lake. However, the data cannot be processed there. You need engines on top like Hive, Presto, and Spark to process it. Hadoop tried to do this with limited success. Presto and Spark have solved the SQL in S3 query problem.

Data in Transition

Different enterprises are able to get their data into the data lake at different rates. Innovators are able to get their data into the data lake with a 30-minute lag-time, while laggards may take a week to land their data. This is where data mesh, or federated access, comes in.

Today, 5 to 10% of compute is on the mesh workload while 90 to 95% are SQL queries to the data lake. All data is eventually in the data lake; however, data that's still in transition is where the mesh workload lives. 
 
There are two different use cases for data lake and data mesh. If your primary goal is to be data-driven, then a data lake approach should be the primary focus. If it's important to analyze data in transition then augmenting a data lake with a data mesh would make sense.

While data mesh is great for data in motion, it does not eliminate the need for other data sources like RDBMS and Elasticsearch as they are serving different purposes for the applications they are supporting.

Posted on

The Evolution of DevSecOps

I wrote The Future of DevSecOps in June 2019 after gathering insights from professionals who foresaw:
  1. greater adoption,
  2. security ingrained in development, and,
  3. AI/ML-driven automation.
For this article, I wanted to go back and see how the adoption of DevSecOps has proceeded over the past two years. In a subsequent article, I‘ll share what these IT professionals now see as the future for DevSecOps.

I received input from more than 40 IT professionals. Based on their feedback, the most significant evolution of DevSecOps over the past couple of years has been:

  1. the expansion and adoption of tools,
  2. businesses realizing the necessity of DevSecOps, and,
  3. software delivery automation.

Tools

Joseph Feiman, Chief Strategy Officer at WhiteHat Security:

A critical step toward DevSecOps has been taken by DevOps itself, which started offering its own application security technologies. Application security vendors, as well as open-source security communities, have started addressing this emerged opportunity as well. They have begun integrating their existing technologies in the unified DevOps, thus serving it with intermediate solutions (intermediate – because those solutions have not been designed for new paradigms). At the same time, those security vendors/communities have been/will be rapidly developing native solutions for the emerged DevOps.

Posted on

Opportunities for DevSecOps in 2021

I wrote The Future of DevSecOps in June 2019 after gathering insights from IT professionals who foresaw:
  1. greater adoption,
  2. security being ingrained in development, and,
  3. AI/ML-driven automation.
For this article, I’m sharing what IT professionals now see as the potential for DevSecOps. I previously shared how these IT professionals have seen the recent evolution of DevSecOps, as well.

I received input from more than 40 IT professionals. Based on their feedback, the greatest opportunities for DevSecOps are:
  1. Alignment of Organizations,
  2. Security of the Software Pipeline,
  3. Automation, and,
  4. AI/ML.

Alignment

Gregg Ostrowski, Regional CTO at Cisco AppDynamics:
The biggest opportunity comes with the addition of “biz.” In a recent article for DZone, I described how BizDevSecOps is the evolution of DevSecOps, and in many ways, this reality is already here. When developing an application, user experience needs to be a top priority as end users are among the most important stakeholders. This is especially true now when the primary way for a customer to interact with a business is through their digital services. Business teams now have user experience top-of-mind because it drives customer satisfaction and that is a key contributor to revenue. By breaking down silos and incorporating their input into overall DevSecOps, teams can create better-performing and more seamless and secure applications.

Rick Vanover, Senior Director Product Strategy, Veeam:
There is an incredible opportunity for traditional IT organizations to align to the DevSecOps practices today as well as work to modernize legacy platforms. This is important in a post-COVID world as organizations scale and change as the world sets itself on the next normal mode of behavior. Having obsolete platforms and applications does not align to the agility requirements of today, much less tomorrow.

Gary Duan, CTO at NeuVector:
Better integration of purpose-built toolings for development, monitoring, threat visibility, and protection throughout the entire pipeline and at runtime. Security automation and real-time protection are the key criteria for ensuring the success of the DevSecOps movement.
 
Saif Gunja, Director of Product Marketing, DevOps, Jack Marsal, Director of Product Marketing, Cybersecurity, and Ajay Gandhi, VP Product Marketing of Dynatrace:
There is a real opportunity for a BizDevSecOps approach to application security to form a new focus for digital transformation. Traditional app security models are buckling under the pressure of dynamic cloud-native environments and applications like Kubernetes, mobile, and serverless. The monitoring tools most organizations deploy to catch vulnerabilities create blind spots and bottlenecks that are only growing. This problem is made worse by siloed teams, manual processes, and outdated approaches that leave vulnerabilities missed in preproduction and production environments. In fact, 93% of CIOs say IT’s ability to maximize value for the business is hindered by challenges like siloed IT and business teams. However, when developers collaborate with ops, or ops with business teams, or the business with developers, everyone can quickly get on the same page, drawing data from a single source of truth.

Dan Hubbard, Chief Product Officer at Lacework:
Alignment of both organizations and architectures. Organizationally security is aligning with the most technical outcomes with developers and more business-driven outcomes with CISO’s. DevSecOps sits in the middle and plays a big role in bridging the gap. 

I believe the biggest opportunity now is being able to actually tie all these DevSecOps requirements, risks, and opportunities into a broader workflow within the organization. Microservices architecture introduces a lot of moving parts. Today, most of these parts are managed as isolated requirements or items. At scale, that makes it really hard to manage, monitor, and secure. I expect to see a tighter workflow between DevOps, DevSecOps, and the overall infrastructure team as part of the continued evolution.
 

Security

Anders Wallgren, VP of Technology Strategy at CloudBees:
There will be an increased focus on the security of the software pipeline itself, as it is a core part of the software supply chain. You may be doing all the right things to your software, but you also need to make sure all the right things are happening in your software delivery pipelines, and that you have control over the security of those pipelines.
 
Jeff Williams, CTO and Co-Founder of Contrast Security:
Most organizations are just getting started with DevSecOps, so there are a ton of opportunities. Focusing on fast and highly accurate Appsec tools for security testing and open source library analysis is a good place to start.  Maturing and expanding threat modeling, standard defenses, Appsec training, and champions program are also strong moves.  One key opportunity is the “SecOps” piece of DevSecOps. Most organizations don’t have visibility into who is attacking them, what attacks they’re using, and which systems they are targeting. This is critical threat intelligence that can both help operations protect the application layer and feedback into the development team. This feedback loop is a great way to build the culture of security innovation and learning that’s at the core of DevSecOps. Supply chain security has also become critical for every organization. DevSecOps must expand its scope to cover these challenges.  There are three parts of the software supply chain to secure.
  1. Your custom code whether developed by staff, consultants, or outsourced. We are pretty bad at this as 20 years of Appsec haven’t moved the needle. Look at IAST and RASP to enhance traditional SAST/DAST/WAF. Note that ordinary Appsec typically only looks for inadvertent mistakes, not malicious code.
  2. Your third-party code, whether OSS or commercial components.  We are also very weak here because with current SCA tools we can’t even stop using libraries with *known* vulns much less deliberately malicious code. RASP can help prevent zero-day library vulns from being exploited.
  3. All the software you use in your software factory: IDEs, build tools, test tools, etc. Little emphasis here currently by defenders. Developer environments are often wide open. An attack here can do anything a malicious developer could do.
All 3 kinds of code in the supply chain are potentially a SolarWinds type debacle. Attackers, who have historically focused on (1) have started probing (2) and (3) in recent years.  We have a lot of work to do to ensure the integrity of the software supply chain. Other industries (electronics, aviation, pharma, etc...) are decades ahead.
 
Deepak Kumar, CEO and founder of Adaptiva:
The greatest opportunities lie in improving the CI/CD (continuous integration/continuous development) pipeline with improved security and tools to help validate third-party code as well as the natively developed code is. Increasing scrutiny on this so-called “shadow code” necessarily improves security, and these additional processes, if implemented properly, can help prevent similar supply-chain attacks in the future.
 
 

Automation

Zeev Avidan, Chief Product Officer at OpenLegacy:
More than ever, teams can develop and deploy confidently in the knowledge that they're meeting corporate security standards. As we see it, the next frontier is the extension of this principle – unlocking team innovation through automation – to the realm of integrations, particularly monolithic core systems, which tend to be the last bastion of centralized IT control.
 
Peter Oggel, Chief Technology Officer at Irdeto:
Automation enables DevSecOps to monitor an attack surface that is increasingly widespread, and almost impossible to monitor without automation technology. This will help prevent organizations from succumbing to cyberattacks with financial and reputational repercussions, while also reducing the risk of non-compliance within regulated industries.

Buck Flannigan, VP Global Partners at Fluree:
Hyper Automation will continue apace with AIOps, but there is a crucial need to “Trust, but (cryptographically) Verify” the data sets being ingested as part of an overall ML Governance strategy.  Privacy and regulatory compliance will increasingly be automated, and attestations require the ability to reproduce the state of code and data going back in increasingly lengthier timeframes.
 
 

AI/ML

Saumitra Das, CTO and Co-founder of Blue Hexagon:
DevSecOps needs to integrate Artificial Intelligence engines for deeper scanning for malicious code into either the build or ship (registry scanning) phase. Just looking for CVEs is a commodity and does not protect against the biggest issue: all the big attacks of 2021 went after unknown CVEs. It is critical to look for malicious code in addition to CVEs.

New approaches to detecting malicious code with very high efficacy and speed are now commercially available. These can be integrated into either the build phase or the ship phase to scan all code that is being put into production. Deep Learning can provide fast verdicts in milliseconds (similar to how self-driving cars make decisions in milliseconds to drive) at scale so that thousands of containers can be deep scanned per day for supply chain and other attack vectors. 
Thanks also, to the following for sharing their insights for this article:

Posted on

What Tech Leadership Looks Like During COVID-19

Ever since technology companies have been ordered to work from home (WFH), I’ve seen examples of great leadership. During the second week of WFM, Todd McKinnon, CEO of Okta hosted a one hour “ask me anything” (AMA) with 6,100 employees. 

I’ve also heard about a lack of leadership with WFH employees unsure of the direction of their company, the security of their job, and the fiscal state of their employer. So I reached out to c-level executives of technology companies to learn how they are leading their employees, their developers, and their clients. Here’s what I learned from 16 executives.

Posted on

AI Provides Insights on CPG Trends

We had the opportunity to meet with Andy Pandharikar, CEO/Co-founder of Commerce.ai during the IT Press Tour at the Plug and Play Tech Center in Silicon Valley. Andy’s vision for his new company is providing self-driving commerce for consumer packaged goods (CPG) companies by training AI to understand every consumer product in the market and to gain insights on what makes a product successful, as well as identify market trends.

This is a joint project in conjunction with Walmart and the client list includes Chanel, Unilever, Coca Cola, SC Johnson, Rakuten, and many more. 90% of the content they monitor is unstructured feedback and 10% is structured data. Text, images, voice, videos have exploded online since 2014. 85% of consumer products fail in the first two years. SKU level data drives intelligence platform for CPG

Posted on

Homomorphic Encryption Protects Data Everywhere

We had the opportunity to meet with AJ Jennings, CEO and Co-founder and Simon Bain, CTO and Co-founder of  Shield.io during the IT Press Tour in San Francisco. AJ and Simon are providing a modern encryption-in-use approach to protect data which:

  • Uses fractal memory management.
  • Eliminates encryption key stores.
  • Solves latency issues while searching encrypted data.

Their solution offers comprehensive, cross-platform enterprise data protection that is database, application, infrastructure, and location agnostic. It has been tested and validated in concert with Oracle, SAP, Google, and Teradata with the most frequent adoption in healthcare (PHI), e-commerce (PII), and financial (PCI) industries.