Cloud Technology News of the Month: January 2022
Tags: cloud, news, devops, cloudnative
Published: 2022-02-04 08:05:39

<!-- wp:paragraph -->
<p id="2022-started-with-a-bang-that-s-for-sure">2022 started with a bang, that’s for sure.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This series explores the most interesting cloud technology news, bringing you up to speed with the latest releases, acquisitions, research, and hidden gems in the world of cloud computing – the stuff actually worth reading.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>What happened in the cloud world this January? Keep on reading to find out!</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>_____</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="story-of-the-month-coming-to-terms-with-security-vulnerabilities">Story of the month: Coming to terms with security vulnerabilities</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>There’s no denying that volunteer-run, open-source projects power a big chunk of software today. These projects are often maintained by volunteers and may lack adequate resources and staff for incident response and proactive maintenance. Yes, even when they become critical to the internet economy.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Whose job is it to fix things when something goes wrong?</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Everyone is asking this question now that we’ve come to grips with the Log4j vulnerability discovered in December 2021 (read more about it <a href="https://cast.ai/blog/the-cloud-in-2021-21-game-changing-outages-security-issues-and-highlights/">here</a>).</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>According to the FTC, the Log4j vulnerability</p>
<!-- /wp:paragraph -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>“is part of a broader set of structural issues. It is one of the thousands of unheralded but critically important open-source services that are used across a near-innumerable variety of internet companies.”</p></blockquote>
<!-- /wp:quote -->

<!-- wp:paragraph -->
<p>While you crunch on that, AWS published <a href="https://aws.amazon.com/blogs/containers/advice-on-mitigating-the-apache-log4j-security-issue-for-eks-ecs-and-fargate-customers/">handy advice</a> on mitigating the Log4j issue in ECS, EKS, and Fargate (check out <a href="https://github.com/aws-samples/kubernetes-log4j-cve-2021-44228-node-agent">this project on GitHub</a> for EKS). If you run Log4j, upgrade it to v2.16 or higher as soon as possible.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Sources: <a href="https://www.technologyreview.com/2021/12/17/1042692/log4j-internet-open-source-hacking/">MIT Technology Review</a>, <a href="https://www.ftc.gov/news-events/blogs/techftc/2022/01/ftc-warns-companies-remediate-log4j-security-vulnerability">FTC</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Forward this newsletter to the responsible person at your company</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>_____</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="the-business-of-cloud">The Business of Cloud</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Betting on the cloud was a smart move for <strong>IBM</strong>. The company reported a revenue rise beyond analysts’ estimates in Q4 2021 thanks to its hybrid cloud offering. IBM saw the biggest increase in sales during the last 10 years (6.5%, or <strong>$16.7 billion</strong>).&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Meanwhile, another tech giant had a small hiccup. <strong>Microsoft</strong> published its Q2 sales and profit gains, reporting decelerating revenue for Azure cloud-computing services. This got some investors worried. But then the company reassured investors its Azure business still has potential with another report. Microsoft’s <strong>shares rose the most since April 2020</strong>. All’s well that ends well, right?</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Sources: <a href="https://www.bloomberg.com/news/articles/2022-01-24/ibm-posts-best-sales-growth-in-10-years-on-cloud-demand">Bloomberg</a>, <a href="https://www.bloomberg.com/news/articles/2022-01-25/microsoft-s-slowing-cloud-growth-casts-shadow-on-strong-report">Bloomberg</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>The fight for chips is just getting started</strong>. <strong>Intel</strong> announced a <strong>$20 billion-worth investment</strong> in its Ohio manufacturing plants. Also, it poached an Apple engineer who led the transition to Arm and M1 chips - among several other competitor hires (including AMD, Nvidia, and Apple).&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>It looks like <strong>Microsoft</strong> joined the game and hired a veteran Apple engineer to expand its chip-related efforts too. On the other side of the planet, China approved one of the major deals in the global semiconductor industry - <strong>AMD’s acquisition of Xilinx</strong>.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Sources: <a href="https://www.intc.com/news-events/press-releases/detail/1521/intel-announces-next-us-site-with-landmark-investment-in">Intel</a>, <a href="https://www.tomshardware.com/news/intel-poaches-apple-engineer-responsible-for-arm-transition-and-m1-chips">Tom’s Hardware</a>, <a href="https://www.bloomberg.com/news/articles/2022-01-12/microsoft-recruits-key-apple-engineer-to-work-on-custom-chips">Bloomberg</a>, <a href="https://www.bloomberg.com/news/articles/2022-01-27/china-approves-amd-s-35-billion-acquisition-of-chipmaker-xilinx">Bloomberg</a></p>
<!-- /wp:paragraph -->

<!-- wp:embed {"url":"https://twitter.com/intelnews/status/1484511503080476678?ref_src=twsrc%5Etfw","type":"rich","providerNameSlug":"twitter","responsive":true} -->
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
https://twitter.com/intelnews/status/1484511503080476678?ref_src=twsrc%5Etfw
</div></figure>
<!-- /wp:embed -->

<!-- wp:paragraph -->
<p>_____</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="security">Security</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>January was an interesting month for <strong>AWS</strong>. <strong>Orca Security</strong> discovered two critical vulnerabilities in AWS:</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>gaining control plane access to a CloudFormation host (and retrieving its AWS credentials)&nbsp;</li><li>and cross-account access through AWS Glue.&nbsp;</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>AWS employees jumped on Twitter to point out some overblown implications of these vulnerabilities. Still, AWS took its sweet time to respond.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Sources: <a href="https://orca.security/resources/blog/aws-cloudformation-vulnerability/">Orca Security</a>, <a href="https://orca.security/resources/blog/aws-glue-vulnerability/">Orca Security</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>https://twitter.com/colmmacc/status/1481670721449385984</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Things went south for the Nigerian government when it <strong>exposed data of millions of citizens</strong> due to its poor handling of an S3 bucket.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Source: <a href="http://saharareporters.com/2022/01/10/exclusive-hacker-breaks-nimc-server-steals-over-three-million-national-identity-numbers">Sahara Reporters</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>One smart team at NCC Group shared its war tales of <strong>CI/CD pipeline security assessments</strong>. A must-read if you’re curious about what this kind of attack looks like in practice.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Source: <a href="https://research.nccgroup.com/2022/01/13/10-real-world-stories-of-how-weve-compromised-ci-cd-pipelines/">NCC Group</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>_____</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="food-for-thought">Food for thought</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>The <strong>2022 Multi Cloud Security Report</strong> from Valtix revealed that while multi cloud has become a strategic priority for many in 2022, security often fails to keep up. 63% of surveyed IT leaders believe multi cloud security is inefficient, and even more believe it’s underinvested (76%).&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Source: <a href="https://valtix.com/lp/2022-multi-cloud-security-report/">2022 Multi Cloud Security Report&nbsp;</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Trends like <strong>multi cloud, serverless containers, or no code/low code</strong> will rule the 2022 tech scene. Adopting a portfolio of cloud-native applications means welcoming future developments in cloud services and opening the door to many new opportunities.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Source: <a href="https://www.cncf.io/blog/2022/01/05/top-4-cloud-native-trends-in-2022-shaping-the-future-of-business/">CNCF</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>GitOps</strong> used to be fresh just a couple of years ago. 2021 was a milestone year for the approach, which noted explosive customer adoption, many industry validations, and new CNCF initiative launches.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Source: <a href="https://www.weave.works/blog/2021-gitops-moments">WeaveWorks</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>_____</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2 id="meanwhile-at-cast-ai">Meanwhile at CAST AI</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Here are some new product features hot off the press:&nbsp;&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>We released the <strong>Scoped autoscaler</strong> - a mode of operations where the CAST AI autoscaler co-exists with another autoscaler on the same cluster and manages only specific workloads. To restrict the scope of the autoscaler, you need to modify workloads as described in the <a href="https://docs.cast.ai/guides/autoscaling-policies/#scoped-autoscaler-mode">documentation</a>.</li><li>We improved the <strong>Available Savings report</strong> by adding extra interactive settings for simulating further cluster optimization&nbsp; - for example, by using spot instances more aggressively or cluster scheduling.&nbsp;</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>_____</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Get the next portion of cloud technology news directly to your inbox.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p></p>
<!-- /wp:paragraph -->

<!-- wp:html -->
<div id="cloud-tech-news-form"></div>
<!-- /wp:html -->

<!-- wp:html /-->