Author: Ericka Chickowski

  • IBM InterConnect: Disruption and the stakes of DevOps

    IBM InterConnect: Disruption and the stakes of DevOps

    It’s only a day into the main sessions at IBM InterConnect and it’s already clear that the most persistent theme that’ll be impressed upon the 21,000-strong crowd this year is one of business disruption. Woven throughout programming about cloud, mobile, analytics and DevOps innovation, the case studies already presented yesterday offer a testament to the disruptive power of IT transformation—and there’s more to follow in the next few days. Most important to the DevOps community, these stories don’t just show the hows of making good on DevOps, continuous delivery and iterative IT strategies. They also show the whys driving DevOps momentum.

    Sometimes the DevOps community can get so fixated on the intricacies of orchestrating DevOps practices and processes that it misses the forest for the trees. Ultimately, DevOps is about helping the business completely shake up product delivery models, customer interactions and core business processes through a makeover in how IT delivers its services. And so, it becomes clear through this disruptive message that the show this week offers an informative glimpse of what the stakes are for DevOps transformations.

    Throughout the day, IBM talking heads and a number of big-name customers explained how its become a eat or be eaten digital world across all industries as new technologies introduce new modes of doing business.

    “If you don’t believe that your industry is changing, then you’d better step back and take a look at what your competitors are doing,”  said Robert LeBlanc, senior vice president of cloud and software solutions for IBM, “because there are going to be disruptors and the disrupted. I’ll tell you that it is much more fun to be a disruptor than disrupted.”

    It’s a real concern in the financial sector, according to Citi’s head honcho for consumer digital experience, Heather Cox. In the general session yesterday, she explained that her two biggest challenges are caused by disruptive technology forces. The first is facing up to new entrants into the field of financial services that has had barriers to entry diminished by increased mobility and connectivity.

    “We have new people stepping into our landscape every single day,” said Cox, chief client experience digital and marketing officer for global consumer banking at Citi. “The payments and banking space is  being fundamentally transformed. It has been said that people need banking , they don’t necessarily need banks.”

    Almost equally challenging is the fact that her customers’ expectations for digital interactions are being rewritten by forces completely outside of her industry’s sphere of influence.

    “I no longer look to my competitors to try to determine where we need to go or how we  need to think about innovation,” she said. “I have the likes of FitBit, Uber, Nest–things that have nothing to do with banking but have everything to do with setting our clients’ expectations.”

    In order to meet head-on the kinds of challenges Cox outlined, IT executives are going to need to do a better job taking advantage of the data and the tools already available to them, explained Pascal Eymery, vice president of strategy and business development customer support

    “Look around 360 degrees, because I’m sure you have customers and suppliers and employees who have tons of data ready to be shared to create value for others,” he told the crowd, explaining that speed is paramount, especially as cloud and mobile technologies put continuous delivery in the realm of possibility. “One very good thing with new technology is its capability for agility; with cloud and mobile you can develop very quickly, you can try something and then you can scale fast if it works or just try something else if it doesn’t.”

    Fundamentally, both IT and line-of-business executives grappling with the decision to start a DevOps journey should ask themselves a big question, said Gary Gruver, president at Large Scale Practical Agile.

    “If you could start to say yes to all of the business requests coming in to IT and become two to three times more productive, would that matter for your business?” said Gruver, who explained in his InterConnect session yesterday how he was able to achieve that kind of productivity gain through DevOps practices while managing a team of 800 developers in HP’s printer firmware division.

    “As executives leading large organizations, if you felt like you could deliver 2x to 3x productivity as opposed to trying to go out and hire two to three times more people and ruin your cost structure, there probably isn’t  anything more important that you could be focused on.”

     

     

  • Enterprises using mobile dev to dive into DevOps

    Enterprises using mobile dev to dive into DevOps

    As increasingly more enterprises investigate how to begin their DevOps transformations, many of them are finding mobile development (mobile dev)  a perfect test bed for instituting continuous delivery practices. While speed-of-delivery has become top-of-mind for most IT applications today, it is paramount for success in the world of mobile apps.

    “The rapid pace of how quickly OSes are evolving, as are the number of different devices and form factors are all a driving force across a lot of different disciplines and businesses,” says Stephanie Trunzo, chief operating officer for mobile design and development firm Pointsource. “I would say that one of the driving forces to mobile is time-to-value and acceleration to market. It’s kind of an incubator for changing processes overall—we’ve seen that again and again.”

    In her role, Trunzo has worked with companies to rapidly develop new mobile capabilities using DevOps and Agile principles. In many cases, it goes against the grain of their traditional development and operations modus operandi, but they’re willing to make exceptions for these mobile projects that require faster lifecycles due to the business drivers.

    “When they see it’s working and we gain some credibility, then it’s like ‘Why aren’t we doing everything this way?’” says Trunzo, who next week at IBM InterConnect will present an example of how DevOps can help enterprises quickly scale their mobile development efforts.

    Together with Pointsource client, Primerica, Trunzo and her team were able to help the insurance and financial planning giant to push a key business mobile app to a workforce of 95,000 insurance representatives in just five months from concept to delivery. Tom Swift, executive vice president of field technology for Primerica will join Trunzo in presenting the case study at the show.

    “Traditionally, in-house development projects could see up to an 18-month release cycle, but Primerica knew they needed to accelerate to shift the business to include the mobile focus,” Trunzo explained. However, acceleration is exactly what the business needed in order to retain sales talent.

    According to Trunzo, Primerica found that it needed a mobile app to help educate and engage with competitive representatives and was able to deliver one that gamified sales objectives. In addition, it offered very practical tools for representatives to present pertinent information to clients when visiting at their kitchen tables.

    “It’s been a great experience,” she says. “Their numbers and results are fantastic and that’s a story we’re going to be telling on stage at InterConnect.”

  • GitHub, Bug bounties and DevOps

    GitHub, Bug bounties and DevOps

    A year after starting up its bug bounty program GitHub is showing how complementary bug bounties can be to DevOps practices. Essentially crowdsourcing vulnerability hunting by systematically paying independent researchers prizes for flaws they find, bug bounties are in a sense an extension of the DevOps ethos. They offer a means of continuously delivering application security assurance.

    “The advantage of having a community that is just working 24/7 worldwide is it does tend to be a more continuous approach to vulnerability hunting as opposed to the traditional method of hiring out a consultancy or third party to spot check at some point in time,” explains Shawn Davenport, vice president of security for GitHub.

    And according to GitHub’s security leaders, their program has become one of the most effective and cost-conscious tools they have for extending internal appsec resources. With approximately four application security experts on staff, GitHub has a more than respectable team in place for a company of its size, with an employee total of just over 250. But with so many deploys a day, the team needs air support to ensure they’re thoroughly inspecting the code base.

    “We ship software 100 times a day, we update the site constantly and the security team isn’t looking at every one of those changes,” says Ben Toews, application security engineer at GitHub and the mastermind behind its bug bounty program. “The way we fit security into our software development life cycle is that when someone is getting ready to ship a feature, they’ll reach out to the security team and ask for a review if they think it’s necessary and we’ll get a review in that point in time, but then a lot of smaller changes don’t necessarily get our attention. And then there’s a lot of legacy code we’ve never looked at.”

    Toews says the bug bounty fills the holes a number of ways. He estimates that for any given feature on the site, there’s probably been several hundred researchers who have tested them, “so the odds of someone looking at new code pretty quickly after a change is pretty high.” In its first year, GitHub’s bug bounty program fielded nearly 2,000 reports from bug hunters, 869 of which warranted further review.

    As GitHub rounds the corner into its second year of offering bug bounties, it wants to increase those odds of good coverage with some tweaks to its program. In addition to doubling its max bounty prize to $10,000, it is also experimenting with giving bounty hunters preview access to new features before they ship.

    “We think by doing that we can get even better coverage on features before potentially putting the community at risk,” says Toews, who admits it does complicate rapid release schedules. “We’ve been trying recently to be more methodical about how we ship larger features. If we’re developing a new feature, you will have that feature hidden from the general population and you can develop that and ship it many times a day and iterate on it quickly, but then we do have a little bit of a process around making that feature published and exposing it to the rest of the world.”

    Of course, the efficacy of a bug bounty program depends on organizations finding a good way to marry bounty vulnerability remediation with the deployment process. It’s not good enough to find the vulnerability—you also need to be able to fix it quickly. Fortunately, the continuous delivery model makes this easier than in traditional organizations, says Toews, who reports that independent researchers are often “astounded” that his team can sometimes have problems fixed within hours of receiving a report, considering that they’re used to other organizations taking months to remediate problems.

    Toews says the secret to success is rapid triage of vulnerabilities. If it is simple, he and his team of application security engineers will fix it on the spot. If it is more complex, they’ll loop in the development team. This is where it is important to have buy-in from developers and senior leadership about bug bounties and application security in general, he says.

    “Our developers care a lot about security and they know that our leadership cares a lot about security, so if there’s a problem, everyone is going to jump in and try to fix it,” he says.

  • 11 DevOps start-ups funded for a busy 2015

    11 DevOps start-ups funded for a busy 2015

     

     Slides

    [seoslides embed_id=”4b8ee43e173e” script_src=”https://devopsy.kinsta.cloud/embed-script/11-devops-start-ups-funded-busy-2015/title/” overview_src=”https://devopsy.kinsta.cloud/slides/11-devops-start-ups-funded-busy-2015/” site_src=”https://devopsy.kinsta.cloud” site_title=”devopsy.kinsta.cloud” title=”11 DevOps start-ups funded for a busy 2015″ /]
    Advance slides with arrow buttons or touchscreen

  • DevOps Video Rodeo: DevOps 101

    DevOps Video Rodeo: DevOps 101

    It can sometimes be difficult as a DevOps newbie to get the straight dope on what DevOps is all about without ending up in the weeds with descriptions and tutorials full of specialized details. As you ramp up, that kind of material is invaluable. But when you’re new to the game, it gets in the way of clarifying the basics.

    If you or one of your colleagues is looking into the basics of DevOps, we’ve got a good place for you to start. Today we’re launching a new video round-up feature we’re calling DevOps Video Rodeo and we thought there would be no better way to kick things off than to focus on DevOps 101. We’ve collected some of our videos meant for DevOps beginners. They explain what DevOps is all about, how continuous delivery can help IT deliver better business value and how organizations can begin their DevOps journeys. Some of these are new, some are oldies but goodies, and some are considered classic talks that helped drive the way the industry first started talking about DevOps.
    So let’s get started.

    DevOps Demystified – An introduction to the ideas that are driving DevOps
    Now director of IT and operations at Chef, Ben Joyent has long been spreading the gospel of DevOps. When he was at Joyent a couple of years ago, he gave one of the most thorough talks breaking down DevOps for newcomers that still exists today. This is ideal for practitioners on either side of the aisle who want to dive deeper into the fundamental principles behind DevOps. It’s a long, but thorough primer.


    What is DevOps? – In Simple English
    If you’re looking for a short summary to pass along to the upper-level, line-of-business managers who you’ll need to help support a DevOps transformation, this may be it. Don’t let the slick, vendor-produced nature of this video turn you off. Rackspace kept to the basics without trying to hide a sales pitch in there. It does an especially good job explaining the business value of DevOps.


    What is DevOps
    Like the previous video, this is another DevOps description that clocks in under 10 minutes, but this one is particularly good at offering explanations of how developer and sys admin roles change under the DevOps model. This is particularly good one for new DevOps acolytes to send over to colleagues they’d like to convince to join forces with them. It also offers a quick sketch of how the infrastructure-as-code model works. Plus, its quick-and-dirty, back-of-the napkin style is kind of endearing.


    The (Short) History of DevOps
    If you’ve ever wondered where the DevOps movement came from and who helped refine the ethos, this is about as concise of a history as you’re going to get. Nicely done by Damon Edwards of DevOps Café podcast fame.


    10+ Deploys Per Day: Dev and Ops Cooperation at Flickr
    This is a classic talk, one that many DevOps early adopters point to as a pivotal demonstration that started the snowballing momentum going with a very real case study on how DevOps can improve speed and flexibility. DevOps practitioners may have moved far beyond 10 deploys a day, and John Allspaw and Paul Hammond have since moved on to other organizations, but this stands as an excellent introduction to DevOps.

     

  • Docker tinkers with Docker Hub for performance improvements

    Docker tinkers with Docker Hub for performance improvements

    Docker’s strengthening its infrastructure components to accommodate the volume of use and wide range of use cases that inevitably crop up from such hockey-stick growth. The latest improvements come by way of refinements made to Docker Hub over the last month, according to an announcement made by the company yesterday.

    The Docker Hub team reported that many of the changes were precipitated by performance issues experienced at the end of 2014, following the addition of security enhancements to prevent brute force login attempts. They reported that the enhancements added “overhead to the login process.”

    “Under normal load there wasn’t much difference, but as the number of login attempts increased the site performance started to degrade,” they wrote. “The decreased performance affected not just the Docker Engine logins, push, and pulls, but also the Docker Hub website as a whole.”

    In the process of identifying immediate issues causing the problem, Docker’s engineers audited the entire system and is in the middle of rearchitecting the authorization, push and pull system to improve performance and isolate systems for a bulkhead effect, ensuring that there aren’t cascading problems.

    In the immediate term, some of the fixes already made include bulking out infrastructure capacity, including a tripling of servers in the Docker cluster for four-times the compute power and a production database upgrade for twenty times the RAM. It also improved login infrastructure to include added database indexes and more caching. The team also tuned queries for speed and fixed an issue that was causing database locks. Docker also switch its background worker queue broker from Redis to RabbitMQ and moved background workers to their own server cluster. Additionally, improvements were made to monitoring and metrics gathering, as well as to search functions.

    Meanwhile, down the line they expect to make further improvements that include API throttling,  breaking up larger services to improve scalability, replacing the brute force prevention library with a better performing library and adding API metrics and monitoring to head off performance issues earlier.

    “We have made some good progress, but we are not finished yet, and we still have a lot more planned,” the Docker Hub team wrote. “We will continue to make improvements with every release, so that Docker Hub only gets faster and more reliable as time goes on.”

    Such hiccups as the ones in December are understandable given the meteoric growth of the Docker community. Even just six months ago, the total number of downloads of Docker were under 3 million. By December that number had risen to 100 million. In spite of some questions about the security of Docker containers, Docker’s trajectory seems promising. Just in September the company closed on $40 million in series C investment from Sequoia and over the past few months it has been announcing a number of high-powered partnerships, including those with VMware, Microsoft and AWS.

    Docker’s most recent partnership was announced last week when it teamed up with Google so that the online giant could offer a private registry service for Docker on its cloud platform. Currently in beta, the Google Container Registry will provide Google cloud customers with secure hosting, sharing and management of private container repositories that will include strong access control and server-side encryption.

  • Gartner gives Docker security an ambivalent thumbs up

    Gartner gives Docker security an ambivalent thumbs up

    As organizations continue to evaluate wider spread use of containerization to enable continuous deployment, security concerns around the wildly popular Docker keep popping up. Last week, an analyst with Gartner published a report that gave Docker security positive marks with some big caveats.

    Written by Joerg Fritsch, the report examined the security properties of Docker. According to Fritsch, Docker is effective at resource isolation and has already just about attained parity in secure operations management and configuration governance with Linux OS and hypervisors . But where Docker containers fall short is on the management end.

    “They disappoint when it comes to secure administration and management, and in support for common controls for confidentiality, integrity and availability,” Fritsch wrote, explaining that this could improve as Docker refines its libswarm and nsenter APIs.

    As things stand, Fritsch recommends that organizations that don’t need to emulate a virtual private system should standardize on nsenter for interacting with running containers, and protect nsenter by limiting the input set. He also recommends that when working at scale, organizations should select a framework for managing resources and deploying containers, and consider using SSL/TLS wrappers for the Docker/Swarm API for the sake of integrity and confidentiality.

    Meanwhile, Fritsch particularly calls out the lack of endpoint protection platform and encryption tools for Docker containers, explaining that the outlook is “grim” on this front.

    “Traditional EPP and encryption vendors have not yet recognized containers as an area that they need to pursue and secure in the future,” he says, explaining that organizations have to mitigate risks through application whitelisting, SELinux or by using a strategic DevOps tool chain to automate and secure their containers, essentially making “containers self-assessing entities.”

    Third party vendors may take more note of Docker as 2015 progresses, particularly if Docker’s growth follows the same trajectory in 2014. From June to October alone, Docker’s downloads grew from 3 million to 21 million. And last fall Docker received venture support for future growth by way of $40 million in additional funding—following up a previous round of $15 million in funding earlier in the year.

    However, security concerns around Docker have started gather like storm clouds. In fact, security objections over Docker were a big reason for the introduction of the Rocket containerization project by CoreOS in early December. That announcement came swift on the heels of the release of the 1.3.2 version of Docker Engine, which took care of a number of vulnerabilities that could be exploited through a malicious Dockerfile, image or registry. It also added added a security feature for validation of images in containers.  However, by late-December, security pros were knocking that verification function.

    “Docker’s report that a downloaded image is “verified” is based solely on the presence of a signed manifest, and Docker never verifies the image checksum from the manifest,” wrote Jonathan Rudenberg, co-founder of Flynn, in a long explanation of the insecurities in Docker’s image downloading process. “An attacker could provide any image alongside a signed manifest. This opens the door to a number of serious vulnerabilities.”

  • Four strategies for supporting DevOps collaboration

    Four strategies for supporting DevOps collaboration

    As we’ve discussed before, the ever elusive DevOps culture doesn’t form magically. Rather, it is fostered by building a collaborative environment. While there are many ways to skin the cat in terms of what kind of tools organizations use to start collaborating more effectively, the tool set and the process they enable should revolve around some key principles. The following strategies can help guide organizations to choose the right infrastructure to foster a transformative DevOps culture and support DevOps collaboration.

    Centralize And Unlock Knowledge

    One big mistake some organizations make as they embrace DevOps is they consider their automation tools as knowledge repositories. But things like recipes, manifests and YAML files are great for automation, not collaboration, explains Alan Sharp-Paul, CEO of ScriptRock.

    “They are an awful way of storing desired state,” he says. “Desired state should be visible. It should be easy to understand and simple to modify by any stakeholder. If the systems that define your desired state are not open and accessible then collaboration will suffer. When knowledge is locked up, collaboration breaks down.”

    Sure, there may not be a super platform for everything, but centralize documentation with pointers out to the right details, says Chris Clarke, senior vice president of product management for CollabNet, who suggests that this place should show how work is spawned and what is being asked of whom, where work is being outputted, where to find all of the tools being used across the development and deployment lifecycle and visualizations, diagrams and step-by-step details about important processes.

    “It’s almost like a mall map. ‘You are here,’” Clarke says.

    Enable Timely Communication

    Of course, knowledge doesn’t stand still and there are always day-to-day snags that come up, so constant communication is fundamental to the collaborative process.  Many DevOps and Agile leaders find the success they see in speeding up iterations stems around the experimentation they’ve done in developing a communication channel that work for their teams.

    This usually starts with using a chat platform like HipChat, FlowDock, or Slack, and frequently continues by pairing that with task managers like Trello, Asana or Basecamp.  Many organizations are also integrating IT-specific tools like Git, PagerDuty and Raygun into this mix.

    And, increasingly, DevOps teams have been up-leveling that by implementing GitHub’s open source side project, Hubot, a chat room automation bot that helps teams share scripts,  automate tasks and enable simple deployment tasks and keep everyone else apprised of deployment.

    The sky is the limit for creative combinations—the key is that the overall stack facilitate timely and meaningful communication across the team.

    Find Ways To Visualize Technical And Process-Based Interdependence

    So, what about SharePoint to accomplish these goals? The problem with SharePoint, says Matt Selheimer, chief technical evangelist for ITinvolve, is that it really isn’t designed around the workflow and the dependencies of IT-specific work. As he explains, most organizations never get beyond the stage of using SharePoint as a glorified file share.

    “That’s not going to help you understand risks and relationships and dependencies and nobody has time to go and read through all those documents and try and parse them anyway,” he says, explaining that a collaboration platform should be able to help various employees track activity around applications, policies, servers and what have you that they have a stake in. When someone else is touching those specific objects, they should be alerted and connected with the resources necessary to look into potential issues, resolve any problems that arise and potentially suggestion improvements on current progress.

    Componentize Knowledge

    Centralization is important, but that doesn’t mean that knowledge should necessarily be consolidated.

    “You need to componentized it correctly—in other words, you don’t try to write a 40-page document, you use a wiki or something that should change pretty frequently,” Clarke says. “I’m a huge fan of continuous improvement in everything, including this.”

    Selheimer agrees.

    “We don’t think that trying to capture everything in one giant, massive document and have it be reviewed by a committee is effective because it’s never going to get published  It’s going to be outdated,” he says. “Whenever I ask people about what diagrams do they have to use to manage their environment, they always say, ‘Oh, we got Vizios.’ But they’re all six months out of date, right?”

  • Shooting a Rocket Over Docker’s Bow

    Shooting a Rocket Over Docker’s Bow

    As momentum continues to build for the Docker containerization platform, some of the open source project’s biggest contributors argue that it has lost its way. Priorities have shifted at Docker from the ideal of building a standard container to instead supporting an entire containerization ecosystem. According to the developers at Linux disto company Core OS, it’s this move has left the entire Docker process “fundamentally flawed.” It’s why they announced this week a competing container runtime called Rocket that they hope will become the “simple composable building block” they’d originally envisioned Docker would be.

    “Unfortunately, a simple re-usable component is not how things are playing out,” wrote Alex Polvi of CoreOS in a blog about the launch. “Docker now is building tools for launching cloud servers, systems for clustering, and a wide range of functions: building images, running images, uploading, downloading, and eventually even overlay networking, all compiled into one monolithic binary running primarily as root on your server.”

    That’s an inherently risky prospect for security-conscious organizations, Polvi argues. What’s more, as Docker starts moving toward expanding the capabilities of its platform it will only increase its complexity and diminish its ability to integrate containers elsewhere. Which is why CoreOS is leading the charge for Rocket. Introduced as a prototype on GitHub this week, Rocket is a command line tool designed to run what it calls ‘App Containers.’ These can be a specification of an image format, container runtime or discovery mechanism.

    “Rocket is the first implementation of an App Container, but we do not expect it to be the only one,” Polvi says. “An open specification allows other systems do their own implementation of App Container without using Rocket at all. CoreOS fully supports and embraces alternative implementations.”

    It’s a big move considering that the company’s co-founder and CTO, Brandon Philips, is a huge Docker contributor and on the Docker governance board. However, CoreOS argues that the clients that run Docker on CoreOS are clamoring for something with the kind of flexibility that Docker seemed to promise early on.  So while CoreOS will continue to support Docker long into the future it hopes Rocket can help solve some problems that many of its clients have with the platform.

    “Our primary users have existing platforms that they want to integrate containers with,” Polvi says. “We need to fill the gap for companies that just want a way to securely and portably run a container.”

    Polvi says that as CoreOS designed Rocket around four major factors that its team believes are key for good design of a standard container. First, it should be independent and composable. Second, container images should be designed for easy, distributed retrieval. Third, it should be open so that independent implementations of tools can run in the same container consistently every time. That’s why CoreOS says that it’s developing an open specification so that other systems can implement an App Container without even using Rocket.

    And, fourth, security should be tantamount.

    “Isolation should be pluggable, and the crypto primitives for strong trust, image auditing and application identity should exist from day one,” Polvi explains. “Security primitives are very important to us, so we added an identity feature to the meta-data service. This means every instance of a running container is given a unique identity, coupled with a lightweight HSM-like service for signing.”

    This is a new approach for container environments, so CoreOS is especially seeking community feedback for this design. However, the entire project is essentially ready and waiting for community support. Those interested should  out the details on GitHub.

  • How the Heck do you Jumpstart DevOps culture?

    How the Heck do you Jumpstart DevOps culture?

    When the thought leaders in DevOps get onto their soap boxes, it’s pretty much a guarantee that at some point or other the discourse is going to turn towards culture. But often the speeches and conversations never dive deeper than platitudes about putting emphasis on people over tools.  As true as it may be, though, most newbies want to know what that really means. How exactly does an organization shift to a DevOps culture?

    Answering that question should start with a little bit of translation. When speakers hit the conference circuit, generally their references to “culture” are interchangeable with “collaboration.” An organization with a healthy DevOps culture is an inherently collaborative one.

    Take a hypothetical situation where an DevOps organization is setting a requirement for a certain  amount of performance throughput on an application, says Matt Selheimer, chief technical evangelist for ITinvolve. Developers in a traditional organization with that requirement would probably have to scratch their heads and wonder how to write the code, and figure out what middleware components they’d need to deliver that level of throughput. But an organization running with a collaborative DevOps culture would ideally give operations folks visibility into that project much earlier in the process.

    “They might be able to come and say, ‘Hey, we can solve that through upgrading the IO on the storage area network, and if we do that, that will shave two weeks off your development schedule, and we’ll be able to deliver that faster to the business,’” Selheimer says. “So it’s those moments of opportunity — those synergies that you get when you get people engaged and when you get people who have like interests following one another and engaging one another that creates opportunity.”

    That’s the ideal organizations are striving for, but it still doesn’t answer that question of how to achieve that culture of cooperation. There’s no pat answer for that, but perhaps one of the catalysts most likely to shift people’s behavior and beliefs is the fostering of a collaborative work environment. And that starts with the establishment of some sort of collaborative infrastructure.

    See, sometimes even culture needs a boost from better use of tools. They’re just not necessarily the ones most people talk about when they’re discussing DevOps. Instead of thinking so much about automation tools, DevOps organizations need to prioritize tools and processes that enable knowledge transfer.

    “So there’s an inherent bias in the community against tools, and I’ve seen that bias be eroded on the automation side, but I haven’t quite seen that bias be eroded on the collaboration side,” Selheimer says. “It’s time to really take a look at what tools you’re using to collaborate, because I guarantee you’re using tools.  You know, you’re using email, you’re using instant messaging, you’re using SharePoint, you’re using Vizio, you’re using spreadsheets, you’re using phone calls — those are tools. ”

    The question is, how effective is your existing toolset at greasing the skids for easy collaboration? The point is that automation may be important, but collaboration is the horse to automation’s cart. The problem is, that too many organizations are putting automation tool sets and processes first, leaving collaboration as an afterthought. That’s dangerous, says Alan Sharp-Paul, CEO of ScriptRock, a developer of configuration management tools.

    “The automation of a system is often considered an ‘end’, not a ‘means’. Bad process and bad design become codified because they get buried,” he explained in a blog post. “Taking the necessary steps to ensure collaboration on requirements is often pushed aside in the interests of simply getting it done.”

    Obviously, Selheimer has a biased stake in this game—his company creates collaborative software for IT teams. But his point is valid—organizations generally need to establish better mechanisms for their IT workers to share their work, their processes, their tools and system statuses so that they can better establish a continuous delivery model. More DevOps organizations are slowly coming to that realization. It’s why we’re starting to see more announcements from companies seeking to bulk out the collaborative tool box.

    For example, yesterday the folks at VictorOps released its VictorOps Transmorgrifier to help organizations bake in more existing documentation, graphs and data about relevant systems into IT alerting. And earlier this month AppDynamics announced the release of its new DevOps Virtual War Room to help consolidate application and system information and metrics. Similarly, not long before that Tasktop introduced a new product called Tasktop Data that’s meant to help act as a data repository for real-time analytics across teams, projects domains and tools. Clearly, the pool of tools is growing deeper as organizations voice the need for a better infrastructure to support cooperation across IT tribes.

    But that doesn’t necessarily mean that mechanism has to be expensive or complicated. It just needs to be more cohesive than a bunch of disparate documents spread out across multiple locations.

    “There’s got to be a centralized, secure, well-lit place where people can document how everything fits together,” explains Chris Clarke, senior vice president of product management for CollabNet, saying that even something like a Wiki or a meta site can help  organizations start to link together documentation about processes, architecture diagrams, pointers to tools and so-on.  The simpler that an organization can make it for team members to share information like that, the more likely they’ll start working closely together.

    This consolidation and dissemination of knowledge is also crucial for the long-term resiliency of DevOps teams. As many more organizations seek DevOps-savvy personnel to help jump-start their continuous delivery programs, employee turnover can pose danger to those organizations whose knowledge base is concentrated around a few DevOps rock stars or isolated teams.

    “Churn can be dangerous because you get enough little islands that are each trying to satisfy their own goals and you get the superheros on those island and then effectively what happens is those superheros walk out and those islands blow up,” Clarke says.

    This is why effective infrastructure for sharing knowledge is especially important  in 2015. According to a recent survey by Rackspace, only about 38 percent of organizations who currently use DevOps for all applications across the organization. However, approximately 20 percent more of these organizations are currently working on pilot projects. And among those who haven’t yet implemented DevOps, nearly 50 percent say they have plans to fully integrate development with operations in the near future. Effective collaboration will be critical in ensuring success as as large organizations push simple DevOps pilot projects to full-blown IT departmental transformations. On the enterprise-wide level, collaborative infrastructure lag becomes unsustainable.

    “If I’m a small startup company and everybody’s all in the same offices, I have a lot more opportunity collaborate in a face-to-face manner,” he says. “But if I’m General Motors or Ford or Bank of America, and I’ve got thousands of developers and thousands of operations personnel scattered across every country and continent, I can’t do that effectively.”