In today’s complex digital landscape, organizations need to be able to scale and innovate in order to compete. The collaborative partner innovation showcased between Dynatrace and its strategic partnerships is a critical piece of enabling growth for our customers.

While the curtains have fallen on Perform 2024, the Dynatrace annual user conference, the commitment and collaborative nature of our partner relationships is consistently being demonstrated. During the conference, we unveiled the winners of the Dynatrace Partner Pro Club app competition. This challenge invited our partners to create impactful apps that solve real-world customer use cases using Dynatrace AppEngine. Below are the winners.

Elevating user experience and design with collaborative partner innovation

The top submissions stood out by solving complex business challenges and focusing on creating an exceptional user experience. The winning User Flow Analytics app by Andrea Caria of Spindox introduces a visual analysis of user navigation within web, mobile, or custom applications, presented through dynamic Sankey diagrams and funnels. This innovative approach enhances the understanding of user journeys through compelling visuals, setting the standard for future app developments.

The User Flow Analytics app was created to address real-life business challenges. For example, a multinational manufacturing company wanted to improve the performance and user experience of their mobile apps and websites. They asked Spindox to evaluate their existing product analytics software and suggest potential alternatives. After careful consideration, Spindox recommended the Dynatrace unified observability and security platform. Spindox also realized that if they could extend the Dynatrace Platform to cover user-funnel analytics and user-navigation Sankey diagrams, it would help the customer consolidate their tooling. Using Dynatrace AppEngine, Spindox was able to implement funnel analytics according to the customer’s specifications, providing them with all the information they needed within a single platform.

“AppEngine is a stunning step forward in data monitoring because it allows you to merge the customization of coding with the high-quality data stored in Dynatrace, unlocking the limits of analysis beyond imagination. The more time you spend developing your application, the more you understand its potential by assembling the amazing number of ready-made components that Dynatrace provides.” — Andrea Caria, observability solution analyst at Spindox. 

Recognizing the runners up

While there was an overwhelming amount of quality submissions, we have to recognize two outstanding runners-up. Gil Givati’s (Matrix) HALO app impressed by allowing users to visually create holistic objectives for applications or products. Meanwhile, Michiel Otten’s (Eviden) Cross Platform Insights app garnered applause for providing a unified view of health across multiple Dynatrace environments.

“We were truly impressed by the apps showcased in the Dynatrace Pro Club app competition. Our partners combined their technical prowess and industry insight to engineer apps that effectively utilize observability, security, and business data to solve key customer challenges. I’m excited about the prospects of AppEngine empowering the creation of numerous groundbreaking custom apps.” — Ahmed El-Jafoufi, global partner enablement architect at Dynatrace.

A collective leap forward

AppEngine empowers partners to create custom solutions that are secure and enterprise-grade with the familiar Dynatrace out-of-the-box look and feel.

Our competition wasn’t just about winning; it was about pushing the boundaries of what’s possible in observability and security. The submissions we received were a testament to the power of innovative partner collaboration, and the shared commitment of Dynatrace and its partners to lead the way in shaping the future of digital experiences.

All of this year’s participants contributed to making this competition a success. The dedication of our partners to excellence elevates the Dynatrace ecosystem and continues to set the standard for what’s possible in the dynamic world of unified observability and security.

Dynatrace Partner Pro Club

Partner Pro Club is an initiative to recognize and reward Dynatrace partners who invest the time and commitment to achieving their Dynatrace Professional certification. Members gain access to exclusive events and training, fostering a community of champions.

• Learn more about what AppEngine can do for you.
• Join the Partner Pro Club by becoming Dynatrace Professional Certified now.
• Specialize in developing custom apps and become App Developer Certified.

The post Unlocking collaborative partner innovation: 2023 Dynatrace Partner Pro Club winners appeared first on Dynatrace news.

In today’s complex multicloud environments, ensuring that your cloud applications are protected and secure is critical. Application vulnerabilities are an inevitable byproduct of the growth of agile development techniques and can be tricky to spot and address. While these vulnerabilities aren’t anything new, the modular and distributed nature of modern software development introduces a new potential for application security risks. As a result, web app attacks are the fastest-growing attack vector according to a recent data breach investigations report.

The advent of microservices and serverless computing means that cloud-based applications may consist of thousands of containerized services. It is nearly impossible for teams to gain full-scope, comprehensive visibility into environments that are so complex. However, with DevSecOps automation, teams can integrate AIOps, risk prioritization, and runtime context throughout all stages of the software development lifecycle (SDLC).

To start with automated detection and resolution, it helps to understand the most common application vulnerabilities and how to prioritize and prevent them. For that, we turn to the OWASP Top 10.

The OWASP Top 10 application vulnerabilities and how to prevent them

The Open Web Application Security Project (OWASP) is a non-profit global community that promotes application security across the web. Here are some lessons we learned about the most important vulnerabilities in the OWASP’s latest list of the top 10 application vulnerabilities.

1. Broken access controls

Broken access controls are when access is unintentionally provided to pages or sections of a website that should be secured. For this situation, teams should adopt a least-privileged approach. This method involves providing the lowest level of access by default, deleting inactive accounts, and auditing server activity.

2. Cryptographic failures

Cryptographic failures are when data is transmitted in plain text, uses outdated or insecure cryptographic algorithms, or is protected by default or weak cryptographic keys. For these, it’s important to turn off auto-completing forms, encrypt data both in transit and at rest with up-to-date encryption techniques, and disable caching on data collection forms.

3. Injection

A query or command that inserts untrusted data into the interpreter, causing it to generate unintended commands or expose data. For this, best practices would be to segregate commands from data, use parameterized SQL queries, and eliminate the interpreter by using a safe application program interface, if possible. Implement runtime application protection capabilities that continuously detect and block common application attacks such as SQL injections and command injections.

4. Insecure design

This broad category refers to fundamental design flaws in the application caused by a failure to implement necessary security controls during the design stage. Use a safe development life cycle with secure design patterns and components. Apply threat modeling and plausibility checks. List use and misuse cases at each tier of the application. Extend observability to pre-production environments to catch vulnerabilities early on.

5. Security misconfiguration

Security misconfiguration covers the basic security checks every software development process should include. For example, ensuring software stacks don’t use default accounts or passwords, error handling doesn’t reveal sensitive information, and application server frameworks use secure settings. To avoid these problems, set up automated DevSecOps release validation and security gates so that no insecure code progresses to production.

6. Vulnerable and outdated components

This is another broad category that covers libraries, frameworks, and open source components with known vulnerabilities that may not have been patched. Continuously monitor applications in runtime for known vulnerabilities and prioritize patching based on criticality: for example, adjacency to the internet and/or critical data.

7. Identification and authentication failures

Unauthorized users can access a system because of weak security or session management functions. Finding a platform that provides a holistic observability approach to application security and vulnerability management is critical. It’s important to implement multifactor authentication (MFA), monitor the availability of the MFA service, use strong passwords, avoid using default credentials, and monitor failed login attempts.

8. Software and data integrity failures

Integrity failures are a growing application security risk in continuous integration/continuous delivery (CI/CD) environments where plug-ins, libraries, or modules from untrusted sources or that contain vulnerable code can unintentionally enter the pipeline. Use trusted repositories and apply adequate segregation and access control to the CI/CD pipeline. Continuously monitor environments for vulnerabilities in runtime. Finally, determine countermeasures and remediation through deep vulnerability analysis.

9. Security logging and monitoring failures

Attackers often lurk inside compromised systems for weeks or months. Failure to monitor for unusual activity can permit wide latitude for intruders to do damage and steal data. Use logging and audit software to continuously monitor for suspicious activities and unauthorized access attempts. In addition, analyze data from a unified observability view that provides contextualized application security analytics.

10. Server-side request forgery (SSRF)

An attacker forces a server-side application to send HTTP requests that trigger forged requests sent to unexpected locations. Although not a common attack currently, SSRF is a serious potential vulnerability. Implement input validation, only accept requests in IPv4 or IPv6 format, and validate incoming domain names. Implement runtime application protection capabilities that will continuously detect and block common SSRF attacks.

How to prioritize application vulnerabilities

Scanning is the most common first step for prioritizing vulnerabilities for remediation. However, scans often turn up far more vulnerabilities than a security team can address. The standard Common Vulnerability Scoring System is a good starting point for prioritization. This system typically scores results, accounting for the type of attack, complexity, and level of access.

Additionally, prioritization must also take exploitability and business impact into account. Often, the CVSS score on its own does not help prioritize as it is designed to score the worst-case scenario and assumes the vulnerability is exploitable. Many times, a “severe” vulnerability is part of a code library that is never executed or is difficult to exploit as it is not adjacent to the internet. Additionally, the impact of exploiting the vulnerability may not be severe if it is in a part of the application that can’t access sensitive data.

Making open source safe from application security risks

Open source now makes up about 70% of modern applications, and there are thousands of known vulnerabilities in open-source code. Numerous organizations offer databases of these weaknesses, such as the Snyk Intel Vulnerability Database. The OWASP also has an extensive list of free tools for open source vulnerability detection.

In response to the growing number of potential flaws, leading monitoring and observability platforms now use artificial intelligence (AI) to detect and prioritize them using factors such as the level of risk, whether the software is in runtime use, potential internet exposure, and whether the vulnerability could compromise sensitive data.

Dynatrace Application Security automates detection and remediation of critical application vulnerabilities

Vulnerability detection and remediation can be a complicated process, especially as organizations adopt multi-cloud environments. DevSecOps teams should emphasize proactive vulnerability management and automate vulnerability detection and prioritization to the greatest extent possible to ensure quick and accurate remediation. Automation, specifically automation with AI for all these capabilities, can be very beneficial to prioritize risk based on runtime context.

Using Dynatrace Davis AI, DevSecOps teams can distinguish real vulnerabilities from potential ones and prioritize affected applications based on the severity of the exposure. Automated security monitoring with Dynatrace Application Security covers traditional hosts, cloud workloads across multiple public and private clouds, and containers. Dynatrace OneAgent proactively alerts teams when it discovers vulnerabilities and uses the Smartscape topology map to display any affected dependencies. Dynatrace Application Security combines runtime vulnerability analysis and runtime application protection to deliver a comprehensive solution for your teams. The platform allows development, security, and operations teams to build a strong DevSecOps culture, including application security along with software development agility and speed.

The post Application vulnerabilities: Important lessons from the OWASP top 10 about application security risks appeared first on Dynatrace news.

The surge in demand for digital services since 2020 is a trend that is here to stay and only expected to accelerate. To compete, organizations have to achieve both speed and reliability when bringing new products and services to market. To meet this demand, organizations are adopting DevOps practices, such as continuous integration and continuous delivery, and the related practice of continuous deployment, referred to collectively as CI/CD.

CI/CD is a series of interconnected processes that empower developers to build quality software through well-aligned and automated development, testing, delivery, and deployment. Together, these practices ensure better collaboration and greater efficiency for DevOps teams throughout the software development life cycle.

Here’s what you need to know about these software development practices, how they relate to each other, and how they benefit DevOps teams as they optimize and automate more processes to achieve ever-faster time to value for customers.

Continuous integration streamlines development

Continuous integration (CI) is a software development practice that streamlines the internal process of creating software. With CI, multiple software developers can work on different features or modules of the same application and individually commit their updates to a shared code repository as they complete them, often many times a day. When they check in their code, the build management system automatically creates a build and tests it. If the test fails, the system notifies the team to fix the code. This practice helps software teams quickly detect and resolve any bugs that come up during the development process.

Continuous integration also prevents “merge hell,” which can happen when two or more developers inadvertently make conflicting changes that break the build when the lines are merged back into the master branch. Continuous integration also avoids teams having to reconcile substantial amounts of conflicting or redundant code, which can require code freezes or even a dedicated integration stage in the pipeline.

When software development teams continuously integrate incremental changes, each developer is free to make changes without worrying about throwing someone else’s work off track or about their own work being stepped on by another. Smooth, regular merging helps software development teams complete projects more quickly and efficiently. It also ensures there is always a testable, up-to-date build that will properly compile, which is critical for frequent and rigorous application testing.

This approach saves time and resources that would otherwise be spent fixing issues later in the software development life cycle, or worse, after release, when issues are much more difficult to address.

Continuous delivery ensures code is always ready to deploy

Continuous delivery (CD) is a process in which DevOps teams develop and deliver complete portions of software to a repository, such as GitHub or a container registry, in short, controlled cycles. Continuous delivery seeks to make releases regular and predictable events for DevOps staff, and seamless for end-users. Another goal of continuous delivery is to always keep code in a deployable state so updates can go live at a moment’s notice with little or no issues.

DevOps teams can automate CI/CD pipelines to move code through the appropriate environments with no human input, which accelerates the build, test, and deployment stages of software development — or any additional stages they have in place, depending on the processes they use.

For example, when a feature is ready for client demonstration, the DevOps team can have a CD tool automatically deploy it to a test server so the client can see how it works and provide feedback before it is released to the production server.

Continuous deployment ensures customers always have the latest

Continuous deployment (also CD) is an extension of continuous delivery in which builds that pass testing are automatically deployed directly to production environments on a daily, or even hourly, basis.

Continuous deployment hastens the feedback loop with your customers and eases the burdens on operations teams by automating the next stage in the pipeline.

Once an organization’s continuous delivery practices are stable and mature, they often adopt automated continuous deployment and testing in a tiered “blue-green” sequence. In this scenario, the new build (green) is deployed in parallel with the existing build (blue) to ensure it works before the blue build is retired. Teams can also use a phased “canary” deployment approach, where the new build is gradually phased in to replace the existing build.

Continuous delivery vs. continuous deployment: which is it in CI/CD?

Continuous delivery (CD) often gets confused with continuous deployment (CD). If CD stands for continuous delivery and continuous deployment, which is it when people refer to CI/CD practices?

In short, it’s either continuous delivery, or continuous delivery and continuous deployment. Although related, the two terms refer to automated processes that happen at different points in the delivery workflow.

You can think of adopting these practices as three steps in a continuum of DevOps automation:

1. Continuous integration to streamline development and automate building and testing. It’s a way for developers to work on the same code base at the same time.
2. Continuous delivery to automate the process of delivering completed code blocks into the main branch, where it can be deployed to a production environment by the operations team. It’s a way for the development part of a DevOps team to automate the process of testing and committing code.
3. Continuous deployment to automate the process of deploying completed, tested code into a production environment. It’s a way for the operations part of a DevOps team to automate the process of deploying new code to customers.

When an organization first adopts agile DevOps practices, they often start out with continuous integration, and mature quickly into continuous delivery, thus achieving CI/CD. Many organizations stop here, preferring to release production code manually. Others progress into continuous deployment so they can automate the entire software development, delivery, and deployment pipeline.

The benefits of CI/CD

The main benefit of continuous integration and continuous delivery is that it reduces the time required to develop applications and features. This gives companies a competitive advantage over businesses that still take a manual approach to software development.

Besides the competitive advantage, CI/CD enables agile development teams to constantly iterate and release new features. These practices ensure everyone is working with the same version of the code as they develop and refine features and functions. With the logistics of integrating and testing builds automated, engineers can focus on what they do best: coding.

If teams have implemented continuous deployment, code can spend less time waiting for testing and deployment and more time in production, which accelerates feedback from users and, ultimately, improves business outcomes.

Increased efficiency, reduced time to market, and quicker innovation make CI/CD an attractive proposition for organizations of all types.

The drive to optimize and automate more CI/CD processes

To meet competitive demands, organizations know they must release new products and services more quickly than ever without compromising quality or reliability. They know basic CI/CD practices are fundamental to DevOps and DevSecOps initiatives that look to develop applications with more effective collaboration and greater precision.

Teams that implement CI/CD practices successfully rely on many tools and methods to manage features, versions, testing, and builds. Automation happens at every stage of the pipeline, from building, packaging, and testing to pushing applications to different production environments.

To accelerate the development pipeline for ever-faster releases with less risk, teams need continuous automation and advanced AI-driven observability across all the tools in their DevOps toolchain so they can automate manual steps and identify quality issues earlier in the software lifecycle.

If your organization uses or is considering adopting CI/CD DevOps processes, a best practice is to implement a full-stack observability platform that can provide code-level visibility of all software builds, apps, and services in your environment, whether they’re in development or deployed to end-users.

The Dynatrace Software Intelligence Platform continuously and automatically monitors the performance of DevOps tools, and seamlessly integrates with CI/CD workflows. With improved collaboration on a single platform and a shared data model, you can ensure your entire team has continuous situational awareness across the lifecycle.

To take a deeper look at continuous delivery, see my next post, What is continuous delivery and what are best practices for implementing it?

The post Continuous integration and continuous delivery (CI/CD): How it enhances DevOps and continuous deployment appeared first on Dynatrace news.