Connect with us

Tech

What should platform engineering look like? | Computer Weekly

Published

on

What should platform engineering look like? | Computer Weekly


Platform engineering is based on the principles of product management and the product model applied to digital and IT systems. Fast-moving digital teams show resistance to strict process frameworks such as the Information Technology Infrastructure Library (ITIL) and IT service management (ITSM), and autonomous digital or IT product teams are becoming self-sufficient, reducing the need for traditional infrastructure engineers.

Platform engineering, grounded in product management principles, offers an approach to modernising IT operations. By injecting product thinking into platform teams, Forrester believes technology organisations can position themselves for the future.

What is platform engineering?

Forrester has compiled a capability model for platform engineering that includes frequently covered technical aspects and less frequently covered management capabilities. It is an inventory of things you should think deeply about and ensure you have covered via your organisational resources, which might include not only dedicated organisations, but also cross-functional processes, enablement teams, or other mechanisms.

Your capabilities are how your customers experience the platform. They are your front door, so to speak. Your customers will discover your platform, onboard onto it, provision it, interact with its application programming interfaces (APIs), leverage patterns for security and performance, and call for help via these capabilities. And no, there is no such thing as an entirely automated self-service platform.

Users and developers need to be able to discover the platform and its services. Managing your platform like a product means you understand the onboarding journey of users and invite them to be part of the process of defining – and even contributing to – developer platform capabilities.

They will expect easy, frictionless authorisation and access, with few, if any, human-in-the-loop workflow-based approvals. Once provisioned and actively developing, they will need information about the ongoing status of the services they are consuming.

Usually, larger organisations will have a service catalogue or portal capability for IT services. If this does not exist, you must fund and create it. Developer-focused portals – for example, Spotify Backstage, Harness Internal Developer Portal, Atlassian Compass – are gaining popularity. Toyota of North America, for instance, includes consumable blueprints, a discoverable software catalogue, education and training resources, and operational reporting for FinOps and other metrics in its developer portal.

Access to platform services and resources is typically a two-stage process, with initial provisioning (setting up accounts) followed by day-to-day demand (provisioning virtual machines, clusters, and so on). While setting up the account may require some human approvals, day-to-day demand requires API access.

A platform that cannot provision, configure and manage base resources via APIs is not a true platform. Typically, platforms support APIs to instantiate and configure required resources, such as processing nodes, data stores, queues, pipelines and observability probes. There are significant API design questions. Many organisations generally have API engineering capabilities, but may not have explored the nuances of supporting self-service provisioning. 

Users of the platform also require ready access to documentation on how to use it. How will these be created and maintained? Typically, a wiki is used for core system quick starts and how-to guides. Forrester recommends documenting patterns as code and managing them via source control. It is also advisable to define the processes, roles and responsibilities for those in charge of these resources. Saying that it is everyone’s responsibility is tempting, but that approach does not work at scale or in the long run.

Support is another key capability. Platforms are typically highly leveraged. Users building tenant applications may not understand the system. The system may not behave as expected. For these and other reasons, you will likely need some level of on-call support. Human contact is required, even in the age of ChatGPT.

Most organisations have ticketed support management, such as with BMC Software and ServiceNow, for example. This may be used to support the base platforms, and tenant applications may leverage it. However, as Forrester notes, fewer have a robust major incident/critical event management capability, which is essential. Such capabilities are based on products like PagerDuty or Everbridge.

Operational capabilities 

The focus for many platform engineering architectures and frameworks is the operational capabilities, especially those that are more technical. While there are many kinds of infrastructure platform components, the fundamental DevOps chain capabilities appear in most platform engineering discussions.

Forrester recommends that deployments and operational architectures are controlled for governance and policy. Increasingly, this is done as code, such as through Open Policy Agent and similar approaches. Required design patterns, configurations and hardening standards should all be checked. Are software-bill-of-materials (SBOM) checks increasingly mandatory? What are the consequences if they fail? If there is a change management process, how is risk calculated? Are chaos tests recommended or required by policy?

The platform’s direct (administrative/developer) users must be identified and authorised, and the products and applications they are building will require identity and access services, which might be quite different from the services controlling administrator access to the platform. Which are you supporting?

Forrester recommends that IT decision-makers check whether common directory services are available to administrators, if there is privileged access management and, if multifactor authentication (MFA) is being used, whether single sign-on, and/or directory services are available for users of the tenants. The pipeline needs to offer security testing such as software composition analysis, SBOM generation and static application security testing.

Considering that applications, or workloads, are installed on resources once provisioned, it is useful to have a full set of development pipeline resources within infrastructure platforms. These should include access to source control and package management, perhaps via proxying cloud services such as GitHub or GitLab. 

In addition, the IT infrastructure on which the workload is deployed will require provisioning of base IT resources, which will need to be configured and managed. This is generally achieved through infrastructure automation. IT decision-makers should check whether run-time provisioning is based on Terraform or is hyperscaler-specific. Does the platform provide a proxy layer to a cloud provider?

Once initially provisioned, configuration may be a separate concern – for example, with Red Hat, Chef, or Perforce Software [Puppet] – which can also control for drift. There is a wide variation, which depends on technical feasibility.

Deployment support

Platform engineering can include AIOps, so IT decision-makers should also look at how the platform itself is monitored and observed, and how operational insights are generated.

What is the relationship between AIOps and action (for example, support)? Forrester recommends that IT decision-makers assess services like monitoring, logging and tracing that are available to tenant applications. How is user experience understood? For instance, an application performance management or AIOps tool might be available as part of the platform for real-time insights that span platforms and encompass the whole IT estate. These insights may then be published on a developer portal.

Finally, Forrester notes the significance of platform reliability. IT decision-makers should assess how the platform itself is managed for resilience, availability and learning. For example, site reliability engineers might have a specific function in defining the platform approach, leading major incident response and retrospectives, and reviewing operations. A retrospective could lead to identifying a risk for which a chaos engineering approach might be used as a control.

Overall, Forrester regards platform engineering as a viable approach to tackle traditional team silos in areas such as compute, storage, networking and middleware, where teams struggle to meet market demands for innovation and employees prefer a collaborative and responsive work environment. As such, product-centric thinking in IT platform management can be used to enhance service delivery.


This article is based on an excerpt of The Forrester platform engineering capability model. The author, Charles Betz, is vice-president principal analyst and leads Forrester’s enterprise architecture team.



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

Some 87% of enterprises see private wireless, edge ROI in a year | Computer Weekly

Published

on

Some 87% of enterprises see private wireless, edge ROI in a year | Computer Weekly


Artificial intelligence (AI) and private networks have helped elevate industrial networking, yet research from Nokia has found that AI’s potential in industrial settings hinges on access to high-quality, real-time data, while on-premise edge and private wireless are key to unlocking AI’s potential in complex industrial environments.

Nokia’s 2025 Industrial digitalisation report drew on insights from 115 industrial enterprises in manufacturing, energy, logistics, mining and transportation in Australia, Germany, Japan, the UK and the US.

Among the key findings of the study was that as many as 87% of on-premise edge and private network adopters are seeing a return on investment in just one year while enabling AI-driven use cases. In addition, 81% of industrial enterprises found setup costs lower, with over half saving at least 11%. Ongoing costs also dropped for 86% of companies, with 60% reporting savings of at least 11%.

Virtually all industrial enterprises were found to have deployed on-premise edge technology alongside private wireless. This combination said Nokia was enabling secure, low-latency connectivity in complex environments and pervasive sensor coverage, even in hard-to-reach areas, supporting AI-driven use cases such as predictive maintenance, real-time monitoring and digital twins in 70% of surveyed enterprises.

The study also highlighted how operational performance improvements driven by private wireless networks are supporting sustainability goals. Some 94% of the surveyed industrial enterprises reported a reduction in carbon emissions, with 41% achieving decreases of more than 20%, and 89% seeing energy savings. These gains were being amplified by predictive maintenance, connected devices and drones that cut fuel-intensive travel and enable more accurate, real-time emissions tracking.

Beyond environmental impact, 71% of surveyed companies were found to be actively deploying connected worker tools such as automated alarms, AI-assisted monitoring and geofencing solutions to reduce accidents and strengthen worker safety.

Nokia suggested that connected devices streamline tasks by reducing the need to move for signal and simplifying access to information. They also cut paperwork and minimise human error, boosting efficiency on-site, and automation.

Not surprisingly, security remained a top priority, with 57% of respondents identifying cyber security as a driver to deploy an industrial edge platform powered by a private wireless network. Nokia noted that its private wireless solutions offer built-in encryption, physical network separation and compatibility with zero-trust frameworks, making them ideal for mission-critical infrastructure while maintaining business continuity and compliance.

The study was conducted by GlobalData. Assessing the trends revealed in the study, the company’s research director Gary Barton said: “Industrial enterprises are turning to private wireless and on-premise edge to drive innovation and industrial transformation.

“These deployments are delivering a clear return on investment and enabling use cases that would not otherwise have been possible. Private wireless and edge have helped enterprises to improve worker safety, support sustainability and create a delivery platform for AI-powered solutions such as process automation and predictive maintenance.”

David de Lancellotti, vice-president of enterprise campus edge sales at Nokia, added: “[Research] forecasts the global private wireless network market will nearly double to US$8bn by 2027. This reflects the growing demand as industries face mounting pressure to modernise in line with global sustainability and efficiency goals.

“[This] research helps leaders build strong business cases for digitalisation by showing how private wireless and on-premise edge not only reduce costs but also accelerate scalable transformation with measurable improvements in worker safety, productivity, security and environmental impact.”

The study also showed that how leading chemical company BASF has deployed Nokia private wireless at its Antwerp facility to advance its digitisation strategy and enable reliable, high-performance connectivity across its six km2 premises. The private network supports AI- and sensor-driven use cases such as real-time monitoring and predictive maintenance, enhances automation and efficiency, improves worker safety, and reduces environmental impact.

“Private 5G has been a game changer for BASF Antwerp. We’re unlocking automation, strengthening occupational safety, accelerating innovation and meeting ROI targets in just two years,” said Steven Werbrouck, expert network connectivity at BASF. “We have become a front-runner for the wider group with learnings that will deliver value at multiple BASF group locations.”



Source link

Continue Reading

Tech

Save 20% With These LegalZoom Promo Codes and Deals

Published

on

Save 20% With These LegalZoom Promo Codes and Deals


LegalZoom is one of those online legal services that in most cases can handle basic legal tasks for you. I recently tried it out to make an LLC for my cosmic country band, Steel Fringe (shameless plug), and it appears to have worked just fine (we’re still waiting on a full evaluation from legal experts for a future guide to these services). If you use a LegalZoom promo code right now, you will get a discount on the service.

I found it super easy to set up my LLC, and after about $500 and 30 minutes of my time, I was off to the races with an LLC for my band. I did make the mistake of spelling my co-bandleader’s middle name as his last name (I blame his wrongly named Instagram handle for this), so I had to toss them another $129 to fix that. My bad.

Save on top services at LegalZoom, like LLC registration, incorporation, estate plans, and more with coupons and deals from WIRED below.

Get Up to 20% Off Estate Plans for a Limited Time

Umm, this is macabre, but it was apparently just National Make-A-Will Month? Because capitalism breeds invention. Don’t leave your planning for death until it’s too late. For a limited time, both new and existing LegalZoom customers can get 10% off Basic Estate Plan Bundles and 20% off Premium Estate Plan Bundles—the offer will be auto-applied and runs through September 10.

How Much Does It Cost to Set Up An LLC on LegalZoom?

If you’re in need of basic legal services like establishing an LLC, estate planning, or other contract-based services, LegalZoom offers a very simple interface that is shockingly easy to use. I am a luddite when it comes to understanding legal jargon and steps in a process like establishing my band’s LLC, but LegalZoom’s simple interface made it shockingly easy to make sure everything was in order.

The cost to properly set up an LLC in your state can range from $35 to $500, depending on various factors like local legislation and business registration laws. Most states charge between $50 and $200 for filing fees, so you can expect to pay somewhere in that range unless you’re from Montana ($35) or Massachusetts ($500). LegalZoom also shoves a bunch of options you probably don’t need in your face, so be sure to Google what you actually need in your state before paying extra money to … print all your documents and put them in a folder for you, or other such nonsense.

Make the Most of LegalZoom With Free Resources

Once you have your membership, you can take advantage of the bevy of helpful content LegalZoom provides to make sure you’re getting the most out of the money you’ve invested in the service. These articles are especially great resources that provide more information about trademarking LLCs to differences between a B and C corp.

Other Ways to Save at LegalZoom (Even Without a Coupon)

If you’re looking for a good deal on other services, LegalZoom frequently offers seasonal promotions, and nearly always celebrates Black Friday, Cyber Monday, and the New Year with discounts for legal eagles.

If you have many or ongoing needs, you can choose an annual plan with LegalZoom where it will do all of your required legal filings, often offering lower monthly rates than paying month to month. There are also installment plan options for products priced at $200 or more, if you really need something done but can’t quite afford it right now.



Source link

Continue Reading

Tech

Automated Sextortion Spyware Takes Webcam Pics of Victims Watching Porn

Published

on

Automated Sextortion Spyware Takes Webcam Pics of Victims Watching Porn


Sextortion-based hacking, which hijacks a victim’s webcam or blackmails them with nudes they’re tricked or coerced into sharing, has long represented one of the most disturbing forms of cybercrime. Now one specimen of widely available spyware has turned that relatively manual crime into an automated feature, detecting when the user is browsing pornography on their PC, screenshotting it, and taking a candid photo of the victim through their webcam.

On Wednesday, researchers at security firm Proofpoint published their analysis of an open-source variant of “infostealer” malware known as Stealerium that the company has seen used in multiple cybercriminal campaigns since May of this year. The malware, like all infostealers, is designed to infect a target’s computer and automatically send a hacker a wide variety of stolen sensitive data, including banking information, usernames and passwords, and keys to victims’ crypto wallets. Stealerium, however, adds another, more humiliating form of espionage: It also monitors the victim’s browser for web addresses that include certain NSFW keywords, screenshots browser tabs that include those words, photographs the victim via their webcam while they’re watching those porn pages, and sends all the images to a hacker—who can then blackmail the victim with the threat of releasing them.

“When it comes to infostealers, they typically are looking for whatever they can grab,” says Selena Larson, one of the Proofpoint researchers who worked on the company’s analysis. “This adds another layer of privacy invasion and sensitive information that you definitely wouldn’t want in the hands of a particular hacker.”

“It’s gross,” Larson adds. “I hate it.”

Proofpoint dug into the features of Stealerium after finding the malware in tens of thousands of emails sent by two different hacker groups it tracks (both relatively small-scale cybercriminal operations), as well as a number of other email-based hacking campaigns. Stealerium, strangely, is distributed as a free, open source tool available on Github. The malware’s developer, who goes by the named witchfindertr and describes themselves as a “malware analyst” based in London, notes on the page that the program is for “educational purposes only.”

“How you use this program is your responsibility,” the page reads. “I will not be held accountable for any illegal activities. Nor do i give a shit how u use it.”

In the hacking campaigns Proofpoint analyzed, cybercriminals attempted to trick users into downloading and installing Stealerium as an attachment or a web link, luring victims with typical bait like a fake payment or invoice. The emails targeted victims inside companies in the hospitality industry, as well as in education and finance, though Proofpoint notes that users outside of companies were also likely targeted but wouldn’t be seen by its monitoring tools.

Once it’s installed, Stealerium is designed to steal a wide variety of data and send it to the hacker via services like Telegram, Discord, or the SMTP protocol in some variants of the spyware, all of which is relatively standard in infostealers. The researchers were more surprised to see the automated sextortion feature, which monitors browser URLs a list of pornography-related terms such as “sex” and “porn,” which can be customized by the hacker and trigger simultaneous image captures from the user’s webcam and browser. Proofpoint notes that it hasn’t identified any specific victims of that sextortion function, but the existence of the feature suggests it was likely used.



Source link

Continue Reading

Trending