The New Stack Podcast

In this episode of The New Stack Makers,  TC Currie is joined today by Heather Terenzio, cofounder and CEO of  Boulder-based Techtonic Group, which was named “2017 Innovative Company of the Year” by the Colorado Legislature for their unique, outsourced apprenticeship program. 

“Genius can come from anywhere,” said Terenzio, cofounder and CEO.  It turns out, she said, that once you remove barriers to employment, the top candidates for their apprenticeship program are people who come from groups currently underrepresented in the tech industry. 

Unlike expensive college degrees or code schools, the Techtonic apprentices are fully paid while they learn.  Techtonic’s innovative apprenticeship program is the first-ever, Department of Labor (DOL)-registered Software Developer Apprenticeship program in the United States. 

Terenzio started the program because she came into coding from civil engineering. "I realized that people from any background can learn to code.  It’s just a matter of screening for the right aptitudes," she said.

“It’s not who has the most data who wins, it’s who is able to act most quickly,” said Jack Norris, Senior Vice President, Data and Applications at MapR.  “Its about the data agility, being able to see what the data is telling you and being able to act appropriately.”

In this episode of The New Stack Makers, TC Currie is joined by Jack Norris, Senior Vice President, Data and Applications at MapR a leading dataware firm.  Norris shares wisdom from a mashup of two of his recent talks: “Unlocking Artificial Intelligence (AI) Value at Scale” and "Three Problems, Three Myths, Three Realities.”

It’s not just using AI to plumb historical or accumulated data, he said, but there’s a performance aspect of how one injects performance into a business operation.  The point of operationalizing AI is being able to understand the context of what is going on at a speed that you can actually influence the event.  For customer engagement, that’s interacting with the customer on the web, or with security it’s identifying a fraudulent transaction before it is completed.

An organization may have made the great leap of integrating previously siloed teams in its software development and deployment processes by adopting DevOps practices. And for some security teams, while that scenario may even be the case, security code integration and processes is similar to a tennis match: the developers add the code, which is then volleyed over to the security team before sending the now-securitized code back to the developers who then send it back to security again for a final check. Or worse still, the security team does give its input until just before deployment, creating potential bottlenecks when getting the security right takes longer than expected. (And even worse still, of course, apps are shipped with glaring security holes and are only patched after a major breach).

Call it an example of DevOps growing pains if you will, but the need very often exists for security to “shift left” in continuous integration/continuous delivery (CI/CD) processes, Sonya Koptyev, director of evangelism at Twistlock, said  in this episode of The New Stack Makers podcast hosted by Alex Williams, founder and editor-in-chief of The New Stack.

Kubernetes, microservices and the advent of cloud native deployments have created a Renaissance era in computing. As developers write and deploy code as part of continuous integration and continuous delivery (CI/CD) production processes, an explosion of tools has emerged for CI/CD processes, often targeted for cloud native deployments.

“Basically, when we all started looking at microservices as a possible paradigm of development, we needed to learn how to operationalize them,” Priyanka Sharma, director of alliances at GitLab and a member of the governing board at the Cloud Native Computing Foundation (CNCF), said. “That was something new for all of us. And from a very good place, a lot of technology came out, whether it's open source projects or vendors who are going to help us with every niche problem we were going to face.”

Many traditional security software providers have followed the gold rush to offer solutions for cloud native deployments. But finding a vendor that both meets the technology challenges associated with Kubernetes and microservices and offers a good fit for an organization’s specific needs can be a challenge — even while there has been a near explosion in purported solutions on offer that promise to offer “an exact fit.”

However, the security needs of virtual machines (VMs), while more mature as a technology, do not necessarily get the attention they deserve from third-party software security providers. The result is that organizations struggle to find security solution for VMs as well as for what is required for Kubernetes and microservices running on cloud-native platforms and integrated with service meshes.

“One of the frustrations that a lot of customers have expressed to us is that the traditional market for VM security is really a market that’s been defined by taking legacy technologies that were built for on-premises datacenters and traditional kind of server datacenter endpoint protection,” John Morello, CTO of Twistlock, said. “They are just kind of jamming that into a new marketing term, a new model and selling that as some sort of cloud-security product. But those products don’t really work well when you think about the way that people operate VMs in these modern stacks.”

You likely know you are in a great place if you are a software developer these days. The explosion of opportunities is largely based on the premise that practically any competitive organization today, regardless of what it does, is a software company that relies on the DevOps team to create and deploy the underlying platform on which the business model is based. But part of this API-centric revolution has emerged thanks to new programming tools, technologies and practices. These include, of course, Kubernetes,  microservices and cloud-native deployments, “fail fast, fail often” philosophies and other practices brought to the open source forefront by the likes of Netflix and Google.

But as a developer today who loves to program and code, some, if not much, of the work can be unrelated to applying your skills and creativity to solving problems with code. You might instead find yourself struggling with more mundane tools and practices that might necessitate deployments to, for example, cloud-native platforms.

Unfortunately, much of the job has to do with working with YAML and shell scripts, creating spaces and file names, etc. and devoting time and energy to “ all of those things that has to do with getting your code running that actually has nothing to do with code,” Gene Kim, co-author of the seminal and still very timely books “The Phoenix Project” and “The DevOps Handbook” and advisor to Atomist, which offers a software-delivery platform for cloud-native platforms.

In this episode of The New Stack Makers, TC Currie is joined by Dr. Ayesha Khanna, Co-Founder and CEO of ADDO AI, an artificial intelligence solutions firm and incubator. Forbes named her one of south east Asia’s groundbreaking female entrepreneurs. She has been a strategic advisor on artificial intelligence, smart cities and fin-tech to leading corporations and governments around the globe. Her bio is too extensive to encapsulate in a brief introduction, but she brings both a depth and vision to all she does.

She is also the Founder of 21C GIRLS, a charity that delivers free coding and artificial intelligence classes to girls in Singapore and finds time to be an advisor to the startups Octa (a chatbot for young travelers) and Arro (a delivery robot for sports).

In this wide-ranging conversation, Khanna talks about the purpose of Artificial Intelligence (AI), harnessing the creativity in the rapidly-expanding middle class in Asia flowing into cities, Mobility as a Service is the wave of the future, and what Smart Cities, or even Smart Nations are and how they could be made a reality.

Joining TC Currie for this episode of The New Stack Makers is Masha Sedova, co-founder and CPO of Elevate Security, one of this year’s winner of CloudNOW’s Top Women in Cloud Innovation award, and creator of the game Hacker’s Mind.

“It doesn’t matter what people know, it matters what they do,” said Sedova. "We’ve done a good job of telling people that they need to be concerned about security, but we haven’t told them what they need to do about it."  So engineers across tech are uncomfortably numb.  They’re concerned, she said, but un-empowered.

After seeing really boring (and totally ineffective) security training, she and co-founder Robert Fly decided to focus on what they call people-powered security.  With the explosion  CI/CD pipelines, so much automation is taking place in the areas of QA and testing but security remains one of the last holdouts for integration into the pipeline.

Edge computing on Kubernetes is emerging as a powerful way to share, distribute and manage data on a massive scale in ways that cloud or on-premise deployments cannot necessarily provide. Libby Clark, editorial director of The New Stack, hosted a podcast from During a podcast from Kubecon + CloudNativeCon in Seattle,  in Seattle about some of the challenges involved.On hand to discuss their projects and goals working with Kubernetes for edge-computing deployments were:

Mike Milinkovich, executive director, the Eclipse Foundation;

Kevin Xu, general manager, global strategy and operations, PingCAP;

Derek Collison, creator of NATS and founder of a company called Synadia Communications.

For the Eclipse Foundation, one of the main challenges is managing the interaction between edge and cloud for IoT gateways constructs or edge gateways, Milinkovich said. The Eclipse Foundation is also working with CNCF, Red Hat, Huawei and others and has co-created an IoT/edge working group within Kubernetes to focus on driving requirements from the edge into Kubernetes projects.

Watch on YouTube: https://www.youtube.com/watch?v=V1WVjZrx0lY

Security for cloud-native deployments can certainly vary, depending on the organization, as well as different project groups.

Serving as a guidepost, Working Group: Secure Access for Everyone (SAFE) was created to facilitate ”collaboration to discover and produce resources which enable secure access, policy control and safety for operators, administrators, developers  and end-users across the cloud native ecosystem,” according to the GitHub description. In that way, SAFE’s founders have envisioned a set of tools for  cloud native operators, administrators and developers, consisting of a system security architecture, a common vocabulary and libraries.

SAFE’s potential and what cloud native security involves in general were discussed during a podcast Alex Williams, founder and editor-in-chief of The New Stack, recently hosted at KubeCon + CloudNativeCon in Seattle.

The guests included: Ignasi Barrera, founding engineer, Tetrate; Liz Rice, technology evangelist, Aqua Security; and Sarah Allen, technical lead and manager, Google Cloud and SAFE WG chair.

Watch on YouTube: https://www.youtube.com/watch?v=a894VoKB6e8