Latest from Derek
State of the Software Supply Chain: Secure Coding Takes Spotlight
After almost a year of research that involved studying 36,000 open source software projects, 12,000 enterprise development teams and 3.7 million open source releases, we at Sonatype are excited to share the “2019 State of the Software Supply Chain” report. This year, we worked with research partners Gene Kim, founder of IT Revolution, and Dr. […]
Jul 5, 2019 · 3 minAll articles by Derek E. Weeks
Showing 1–24Reducing Risk in Applications Using Docker Containers
Docker. It seems like in this day and age you are either using Docker containers or you are going to use Docker containers. If you haven’t jumped on the bandwagon yet, check out a previous article, “Docker: The New Ordinary.” If you are on the wagon or are thinking about it but have concerns about […]
200 Billion Downloads Can’t Be Wrong
Laurie Voss, COO and co-founder at npm (@seldo), tweeted recently that JavaScript packages downloaded from their repository has topped 4 billion. On an annual basis, that would be more than 200 billion downloads. Wow. Just as open source software turns 20 years old this year, these numbers are a testament to the incredible magic that happens when […]
Challenges in Leading a DevOps Team at a Fortune 100 Company
A manager, an evangelist and a godfather all walk into a bar. Okay, this isn’t a bad joke, this is an article about how managers can implement DevOps in large organizations, especially where culture and organizational change hamper efforts. But, I promise, we will talk about managers, evangelists and godfathers. Uldis Karlovs-Karlovskis (@UldisKK) works at Accenture […]
DevSecOps: Don’t Invest In Hope
A successful DevSecOps approach is rooted in action, not hope. There is a lot of investment in hope. I hope we won’t get breached. I hope our DevOps teams aren’t deploying thousands of vulnerable containers. I hope our developers aren’t downloading millions of vulnerable open source components. I hope our developers and security teams will […]
Software Liability Goes Global
This month, France turned up the conversation on software liability for manufacturers who place known defective software components in their products. But, they are not the first. Software Liability in France According to Lukasz Olejnik, lawmakers in France just suggested a desire to “put the security liability in hands of product suppliers. In other words, making […]
DevSecOps: Digging into Root Cause Analysis
We have all been there in a postmortem when someone says, “Let’s get to the root of the problem.” And, we all know what that means: Who or what is to blame? We also all know that no one wants to play the blame game, yet we all do. But it isn’t our fault (no […]
DevSecOps: If You Build It, They Will Come
Spring training for Major League Baseball in the United States has begun. Millions of people share my love for baseball; however, the same can’t be said for security and compliance—well, at least not yet. Perhaps one day. Much like in the immortal baseball movie, “Field of Dreams,” if you build a friendly security and compliance […]
Continuous Delivery: No Excuses
Jez Humble’s (@jezhumble) career has spanned roles through coding, infrastructure, and product development across three continents and organizations of varying sizes. To say he knows a lot about continuous delivery is a total understatement. In 2010, he and Dave Farley literally wrote the book on continuous delivery—and if you have not yet read it, I […]
DevOps Heals at NIH
Cancer sucks. But with folks like Sarah, DevOps is helping make a difference in the race to a cure. Sarah Elkins is not curing cancer herself, but she is employing DevOps practices to help those who are. Sarah supports the technology infrastructure for those who are trying to cure cancer at the National Institutes of […]
DevSecOps: IoT Right and Nobody Dies
Dr. Suzanne Schwartz, CDRH Associate Director for Science and Strategic Partnerships at the Food and Drug Administration (FDA), recently released a blog to update us on the FDA’s role in medical device cybersecurity. Cybersecurity risks in medical devices are nothing new. As far back as 2012, Sonatype published warnings of security risks in pacemakers that could lead to […]
Learn DevOps from 57 Experts for Free
Need to brush up your knowledge of continuous integration/continuous delivery (CI/CD), automated security, modern infrastructure or cultural transformations? All Day DevOps just released its Summer School program offering 57 online sessions delivered by DevOps practitioners. Every session is free to watch, and absolutely no registration is required. Watch as many or as few sessions as […]
Scaling DevOps at Pearson
Pearson might be one of the more influential companies you have never heard of. Its footprint in the educational publishing marketplace is expansive, and its scope was just one challenge when it made the move to DevOps. Sean D. Mack (@SeanDMackNYC) is formerly the VP of Operations and Application for Pearson. To give you an idea of […]
Characterizing and Contrasting Container Orchestrators
Admiral Calcote, also known as Lee Calcote (@lcalcote) or the Ginger Geek to his friends, gave a presentation titled, “Characterizing and Contrasting Container Orchestrators,” at the 2016 All Day DevOps conference. Okay, he isn’t really an admiral—nor does anyone call him that—but he used the title “admiral” to describe what container orchestrators do, relating it to an admiral directing a […]
Speaking for the Dead: Are ‘Agile’ and ‘Monolithic’ Actually Good?
What if Agile is the product of getting bored at work, microservices are the result of us needing a challenge and scrums are the result of an obsessive project manager? Do we all think waterfall development is a dinosaur whose extinction is deserved because of what we have been told and not because of reality? […]
Liberty Mutual: Taking an Organic Approach to DevOps
Some people are directors, managers, and administrators. Others are disrupters. Eddie Webb (@edwardawebb) is an IT disrupter for Software Development Platforms at Liberty Mutual and was a presenter at the 2016 All Day DevOps conference. His talk, “Organically DevOps: Building Quality and Security into the Software Supply Chain at Liberty Mutual,” looked at Liberty Mutual’s transformation to continuous integration, […]
DevOps and Security is Like Smoking Meat
It isn’t everyone who thinks, “Doesn’t Ubuntu remind you of wild boar?” Or labors over his pit of slow-roasted pork shoulder while contemplating containers. Or dwells on e2e testing while mesquite smoke permeates spareribs. But, Apollo Clark (@apolloclark) does. Apollo is a foodie of smoked meats (is that a meatie or smokie?), working to master the craft: understanding […]
Securing Immutable Servers in a Serverless World
Snowflakes are beautiful, unique creations. But, let’s keep them in nature. They don’t belong in our server infrastructure. Snowflake servers, where every configuration is just a little different, can introduce unnecessary security vulnerabilities and complications. While common in IT infrastructure, in the DevOps realm they are gradually becoming ancient history. At All Day DevOps 2016, Erlend Oftedal (@webtonull), […]
Government Legislation Aims to Secure IoT
The U.S. Senate is making moves to protect consumer interests, data, and privacy with regard to the internet of things (IoT). Sens. Mark R. Warner (D-VA) and Cory Gardner (R-CO), co-chairs of the Senate Cybersecurity Caucus, along with Sens. Ron Wyden (D-WA) and Steve Daines (R-MT), recently introduced bipartisan legislation called the Internet of Things Cybersecurity […]
All Day DevOps: Taking Lambda to the Max
Lambda is the 11th letter of the Greek alphabet, and it is also the name of the Amazon Web Services (AWS) service that lets you run code without actually configuring a server. Amazon chose the name Lambda because—well, okay, I have no idea. Comment here if you know. Thankfully, you don’t need to know that […]
All Day DevOps: Modern Infrastructure Automation
“We’re no longer an airline. We’re a software company with wings,” claims Veresh Sita, CIO, Alaska Airlines. The success of today’s businesses rests on software. It is an integral part of infrastructure, so we need to always ask, “How can it be better? More reliable? More secure?” Nathen Harvey (@nathenharvey) is the VP of Community […]
From ‘Water-Scrum-Fall’ to DevSecOps
As organizations abandon the waterfall method of software development for Agile, many are stuck in what Hasan Yasar terms Water-Scrum-Fall. That is, the organization has not effectively embraced Agile and DevOps principles and remains in silos with no links to business goals. Enter DevOps, an extension of Agile thinking. While Agile embraces constant change and embeds the […]
How To Fully Automate CI/CD – Even Secrets
Imagine a world where your continuous integration/continuous deployment environment is 100 percent automated, including the passing of credentials. Capital One, a leading U.S. bank, has achieved this, and Andrey Utis, director of Software Engineering at Capital One, outlined how the company achieved this in his talk, “Application Secret Management with KMS,” at the All Day DevOps […]
Continuous Everyone: Engaging People Across the Deployment Pipeline
We have continuous integration and we have continuous deployment, but what’s continuous across all of what we do is people. Even when tasks are automated, someone wrote the automation. So, Jayne Groll evangelizes about “continuous everyone.” Jayne is the CEO of the DevOps Institute and the author of “Agile Service Management Guide.” She talked about […]