Kevin L. Jackson, COO, SourceConnecte
“Knowing what is normal comes from building
standardization into the application infrastructure,
application design, and deployment.”
Visibility is required to show you what is and is not normal in an application environment. Knowing what is normal comes from building standardization into the application infrastructure, application design, and deployment.
Without standardization, you don’t know what normal is. When something happens that you’ve never seen before, you have to decide if it is something that should happen. Because you don’t know what should happen, evaluating that event takes time. If you have a standardized environment, however, and you look at that environment for a week, you know what’s normal for that environment. If something abnormal occurs, it will be obvious. That is visibility.
A standard application infrastructure also makes machine learning tools more powerful for troubleshooting. Complex application environments generate huge amounts of log and tracking data—more data than humans can or should have to process, especially when most of that data describes normal application operations. Humans are good at solving abstract problems. They are great at using their brain power to analyze unique observations. That is where you need to focus human attention. You do not want to waste human brainpower troubleshooting what is normal.
Machine learning can quickly identify something that is not normal. A major prerequisite for the use of machine learning, however, is the broad adoption and consistent implementation of standardized application design, security policies, and controls. Logs and tracking data provide zero insight unless you use them to enforce a standardized policy.
