Current IoT systems are highly distributed systems that integrate cloud, edge, and fog computing approaches depending on where intelligence and processing capabilities are allocated. This distribution and heterogeneity make development and deployment pipelines very complex and fragmented with multiple delivery endpoints above hardware. This fact prevents rapid development and makes the operation and monitoring of production systems a difficult and tedious task, including cybersecurity event monitoring. The DevSecOps can be defined as a cultural approach to improve and accelerate the delivery of business value by making dev/sec/ops teams' collaboration effective. This paper focuses on self-service cybersecurity monitoring as an enabler to introduce security practices in a DevOps environment. To that end, we have defined and formalized an activity that supports `Fast and Continuous Feedback from Ops to Dev' by providing a flexible monitoring infrastructure so that teams can configure their monitoring and alerting services according to their criteria (you build, you run, and now you monitor) to obtain fast and continuous feedback from the operation and thus, better anticipate problems when a production deployment is performed. This activity has been formalized using the Software & Systems Process Engineering Metamodel by OMG and its instantiation is described through a case study that shows the versioned and repeatable configuration of a cybersecurity monitoring infrastructure (Monitoring as Code) through virtualization and containerization technology. This self-service monitoring/alerting allows breaking silos between dev, ops, and sec teams by opening access to key security metrics, which enables a sharing culture and continuous improvement.

IoT edge computing is a new computing paradigm “in the IoT domain” for performing calculations and processing at the edge of the network, closer to the user and the source of the data. This paradigm is relatively recent, and, together with cloud and fog computing, there may be some confusion about its meaning and implications. This paper aims to help practitioners and researchers better understand what the industry thinks about what IoT edge computing is, and the expected benefits and challenges associated with this paradigm. We conducted a survey using a semi-structured in-depth questionnaire to collect qualitative data from relevant stakeholders from 29 multinational companies and qualitatively analyzed these data using the Constructivist Grounded Theory (Charmaz) method. Several researchers participated in the coding process (collaborative coding). To ensure consensus on the constructs that support the theory and thus improve the rigor of qualitative research, we conducted an intercoder agreement analysis. From the analysis, we have derived a substantive and analytic theory of what companies perceive about IoT edge computing, its benefits and challenges. The theory is substantive in that the scope of validity refers to the 29 surveys processed and analytic in that it analyzes “what is” rather than explaining causality or attempting predictive generalizations. A public repository with all the data related to the information capture process and the products resulting from the analysis of this information is publicly available. This study aims to strengthen the evidence and support practitioners in making better informed decisions about why companies are adopting edge computing and the current challenges they face. Additionally, the testing theory phase shows that the results are aligned with the ISO/IEC TR 30164 standard.

Current Internet of Things (IoT) systems are highly distributed systems, which integrate cloud, fog, and edge computing approaches. Accelerating their maintenance and continuous improvement, while ensuring their availability, is complex. DevOps promotes fast and continuous feedback from operations to development to detect problems before customers are impacted, among other benefits. However, there is not any formal definition about how to do this. This paper defines the “fast and continuous monitoring feedback of system availability” activity (F&CF availability) that supports automatic and continuous monitoring feedback from operations to development of IoT system availability. This activity has been formalized through the software and systems process engineering metamodel (SPEM). Its implementation is demonstrated in a real scenario that provides evidence that the formalization of the F&CF availability activity helps teams in better diagnosing and fixing outage problems. The result is a distributed and configurable monitoring component developed through code (Monitoring as Code, MaC). This component is embedded in the IoT infrastructure. MaC enables DevOps team to configure their own metrics and indicators at run time, i.e. monitoring on demand. The formalization of this activity, based on a MaC technique, enables the automation, versioning, and replication of monitoring elements.