May 2024 Summaries

Chaos engineering is a strategic approach to enhance system resilience by deliberately introducing disruptions to test how systems respond, and Harness ChaosGuard provides a comprehensive framework to manage these experiments securely, especially in sensitive environments. ChaosGuard offers key features such as security governance to maintain integrity and compliance, flexible testing windows to minimize operational disruptions, controlled access to ensure only authorized personnel conduct experiments, detailed policy enforcement to manage permissions and fault types, and AI integration for accurate configuration. By implementing ChaosGuard, organizations can increase system resilience, enhance security, ensure compliance with policies and regulations, and safely test new ideas, thereby promoting continuous innovation and improvement. This robust framework equips companies with the tools needed to adopt chaos engineering safely and responsibly, allowing them to leverage its benefits without exposing themselves to unnecessary risks.

Split Software is joining forces with Harness, a leading software delivery platform, in a strategic move aimed at enhancing feature management and accelerating innovation. This union is set to create a comprehensive software delivery platform that integrates feature flags, advanced measurement capabilities, and AI-powered management tools into the development lifecycle. The collaboration will provide Split customers with access to Harness' robust suite, including advanced permissioning models, compliance tools, and seamless integration with Harness' product modules. The partnership promises to maintain strong customer support and advisory services, while also leveraging AI to optimize feature delivery and streamline development processes. By combining their strengths, Split and Harness aim to establish a new category leader in the DevOps space, offering unparalleled functionality and efficiency.

Harness has announced the acquisition of Split Software to enhance its feature management and experimentation capabilities, aiming to deliver the most powerful offering in the industry. Split Software, known for its advanced feature flagging, A/B testing, and real-time experimentation, will be integrated into Harness's existing suite of DevOps products to enable faster and safer software updates. Jyoti Bansal, CEO of Harness, highlights the importance of feature management and experimentation in the software development lifecycle, emphasizing the need for real-time insights into the impact of newly released features on business outcomes. The acquisition reflects the growing market demand for comprehensive solutions that seamlessly integrate feature management into the entire software delivery platform. Bansal, a seasoned entrepreneur and co-founder of Harness, has been impressed with Split's team since 2016, and sees this collaboration as a means to provide significant value to customers while maintaining a competitive edge in the evolving software delivery landscape.

Poisoned Pipeline Execution (PPE) is a critical security risk where attackers exploit permissions within source code repositories to execute malicious commands in build and test pipelines, as outlined in the OWASP Top 10 CI/CD Security Risks. PPE attacks can occur in three forms: Direct, Indirect, and Public. Direct PPE involves modifying pipeline configuration files to execute harmful instructions, while Indirect PPE allows attackers to exploit scripts or tools referenced by these configurations. Public PPE occurs when attackers submit pull requests to public repositories, especially when the same Continuous Integration (CI) instance serves both public and private repositories, risking exposure of sensitive assets. Protecting against PPE attacks involves separating pipelines for pull requests, requiring code reviews, securing webhook triggers, and managing pipeline configurations separately from application code. Harness CI offers features such as role-based access controls, manual approval stages, and separate management of pipeline triggers to safeguard against PPE attacks.

Software rollback is an essential strategy in software development, allowing developers to revert applications to previous stable versions when new updates introduce issues. This process serves as a critical safety net, enabling teams to maintain system stability, minimize downtime, and ensure user trust by swiftly undoing disruptive changes. A well-executed rollback plan, often incorporating feature flags, enhances deployment reliability by allowing selective deactivation of problematic features without redeploying the entire application. Feature flags offer granular control, making rollbacks quicker and less disruptive by isolating features, minimizing system-wide impacts, and facilitating targeted troubleshooting. Distinct from system restoration, which addresses broader system-wide issues, rollbacks focus on specific application changes, requiring careful management of data consistency and dependencies. Harness's Feature Management & Experimentation tools provide robust solutions for managing rollbacks, enabling developers to experiment confidently while ensuring a resilient software delivery pipeline.

Harness pipelines offer comprehensive failure handling mechanisms to enhance the resilience and stability of software deployment processes. By enabling configuration of failure strategies at various levels—such as stage, step, and step group—teams can effectively address deployment failures, infrastructure issues, and human errors. Features like failure rollback and post-deployment rollback allow for quick recovery from errors, reverting systems to the last known good state to minimize downtime and user impact. Additionally, marking stages or pipelines as failed facilitates immediate intervention and resource cleanup. These strategies not only ensure continuous improvement and system reliability but also foster resilience in software development and operations by transforming failures into learning opportunities.

Harness, co-founded by Jyoti Bansal in 2017, recently secured $150 million in funding from Silicon Valley Bank and Hercules Capital to advance its AI-driven software delivery platform, aiming to revolutionize software development by minimizing manual, repetitive tasks and boosting productivity for over 30 million developers globally. The company addresses the prevalent issue of "toil" in development teams, which costs companies approximately $1 trillion annually, by focusing on automating and simplifying software delivery processes. Harness has experienced rapid growth, reaching over 600 clients including major companies such as Citigroup, Nike, and United Airlines, and aims to expand its innovative AI applications and product offerings while fostering a global work environment. Bansal, a serial entrepreneur, also co-founded Traceable, an API security platform, and Unusual Ventures, a venture capital firm that provides extensive support to entrepreneurs, demonstrating his commitment to enhancing the software industry.

Gitness enhances security in software development by integrating secret detection capabilities, leveraging tools like Gitleaks to scan every push to Git repositories for recognized secret patterns and denying commits that contain them, thereby reducing the risk of unauthorized access and data breaches. This feature helps maintain the integrity and confidentiality of code repositories and is part of Harness Open Source, which provides an end-to-end software delivery platform that aims to boost productivity and accelerate development cycles. According to the State of Secrets Sprawl Report 2024, nearly 5% of active source code repositories leaked a secret last year, posing significant security risks and potential financial and reputational damage. Dewan Ahmed, a Principal Developer Advocate at Harness with extensive experience in DevOps and infrastructure, emphasizes the importance of proactive secret detection to protect intellectual property and secure software delivery, drawing from his background with companies like IBM and Red Hat and his commitment to the tech community and underrepresented groups.

Harness, a prominent DevOps platform, has integrated its Feature Flags with Cloud Cost Management (CCM) to help businesses manage the cost implications of feature toggles. This integration provides real-time anomaly detection and cost insights, enabling teams to efficiently balance feature deployment with budget control. The Feature Flags and CCM modules work together to identify and correlate potential cost anomalies resulting from changes in feature flag statuses, offering users enhanced visibility into their cloud expenditure related to feature changes. By associating each feature flag environment with a CCM perspective, the integration allows users to monitor and quickly identify any significant cost increases when a feature is toggled. This strategic development empowers organizations to optimize both feature development and cloud costs, facilitating informed decision-making in the rapidly evolving world of cloud computing.

Harness Deployment Pipelines facilitate the integration of third-party tools to enhance testing, performance, and security by employing API and webhook methods for automated commit-to-deploy processes. By configuring dynamic triggers and external approvals, these pipelines improve software delivery efficiency and ensure stable code reaches production. The design includes multiple stages for different environments, enabling selective and conditional execution, such as deploying code to QA targets for internal testing. Third-party tools, including Vulcan, Sonar, or Checkmarx, can be integrated to trigger deployments and manage approvals through API-based interactions, ensuring loose coupling and seamless collaboration. Dynamic Triggers and External Approval concepts allow the automation of these processes, with third-party tools providing necessary inputs and approvals using Harness's exposed APIs and custom configurations. This integration supports asynchronous communication among heterogeneous tools, enhancing businesses’ ability to achieve efficient, automated end-to-end deployment processes.

Harness has announced a partnership with Semgrep, integrating Semgrep's open-source Static Application Security Testing (SAST) and Semgrep Code into Harness Security Testing Orchestration (STO). This integration aims to simplify the process of implementing shift-left security, allowing users to easily add a preconfigured scan step. Semgrep is chosen as the default SAST scanner for Harness STO, enabling users to scan code repositories with minimal manual configuration. Harness STO then processes the results by normalizing, deduplicating, and prioritizing vulnerabilities and offers AI-driven remediation guidance. Users can start with Semgrep Open Source and upgrade to Semgrep Code by providing an access token, enhancing the analysis capabilities and reducing false positives. This partnership is expected to provide users with faster deployment and improved security in complex environments, with opportunities for further engagement through product pages and demos.

Split is a feature management platform that enhances the process of releasing new software features by automating the capture of performance data and the creation of key metrics, which empowers faster decision-making and reduces risks associated with feature rollouts. Its Instant Feature Impact Detection (IFID) capability allows teams to quickly identify and resolve performance or user behavior issues, significantly reducing the mean time to detect and resolve these issues. By automatically generating metrics and capturing event data through Split Suite for iOS, Web, and Android, the platform eliminates the manual effort traditionally involved in configuring metrics. Split's platform also provides tools for monitoring, alerting, and conducting feature experiments like A/B tests, ensuring a safer and more efficient release process. Customers using the Business and Enterprise plans with the Experiment and Monitor add-on can benefit from these automated capabilities to enhance their software delivery and management processes.

Harness has partnered with Wiz, a leading cloud security provider, to integrate Wiz's scanning capabilities into the Harness Security Testing Orchestration (STO) module, making it the first CI/CD platform vendor to do so. This integration allows developers to incorporate Wiz's Infrastructure as Code (IaC), Static Application Security Testing (SAST), Secret Detection, Container, and Software Composition Analysis (SCA) scans directly into their pipelines. The partnership aims to enhance security by enabling developers to detect secrets, identify misconfigurations, and address vulnerabilities within pull requests, while also reducing alert fatigue through deduplication and prioritization. Harness users can block pipelines based on vulnerability severity and automatically remediate issues using the Harness AI Developer Assistant (AIDA). This collaboration emphasizes a developer-friendly approach to security by shifting left, ensuring vulnerabilities are managed proactively within the development workflow.