Category: DevOps Culture

  • Best of 2020: Don’t Do Agile and DevOps by the Book

    Best of 2020: Don’t Do Agile and DevOps by the Book

    As we close out 2020, we at DevOps.com wanted to highlight the five most popular articles of the year. Following is the fifth in our series of the Best of 2020.

    In software development, we talk a lot about the importance of Agile and DevOps. Agile aims for rapid releases, positively encourages involvement from customers and other stakeholders and splits work into smaller iterations, releasing as soon as possible. DevOps extends it by introducing cross-functional team collaboration and automation, enabling teams to always have a stable build ready to deploy.

    That’s the short version and there’s a huge range of books and frameworks out there to read so that anyone, anywhere–apparently–can just start doing it. The danger is that if you follow them too closely, processes can actually become too rigid, so you end up losing the agility you’re striving for. I always get suspicious when theories in books are read and regurgitated completely without thinking about the actual situation on the ground. I’d much rather have a conversation, write up our notes, try it out and see how it can be improved.

    Clearly, I’m not saying that you shouldn’t have boundaries and rules. I worked for a company that moved from no processes at all to adopting Agile methodologies. It needed to put in place a framework to guide people in the right direction, particularly initially.

    As companies mature though, they need to look at what works best for their particular situation–otherwise the danger is that common practice masks commonsense. You end up following processes, such as two-weekly reviews, that don’t necessarily match your needs–why wait two weeks for a review, for example, if something obviously needs fixing today? Where did Agile go?

    What Does Agile Mean for You?

    The best place to start is to define Agile for your organization. On the positive side, definitions of Agile are very broad–but the flip side of that is people get confused about what terms actually mean and whether they should be using them.

    For me, Agile is about being able to change the way you work, reflect on things and continuously improve. The biggest goal is to bring in very short feedback loops and be in a position where you can do something when you get that feedback. After all, there’s no point having a quick feedback loop if you can’t adapt or react equally quickly. 

    I’ve deliberately kept this definition high level–it’s important not to mandate exactly how you deliver Agile. For example, we use a variation of Kanban in our team, based on the original methods adopted by Toyota, having switched from a flavor of Scrum. I’ve had people come up to me and say we’re not really doing Kanban properly, as we’re not following every step of it rigorously. That’s not an issue–we’re using it in a way that matches our needs and goals.

    The Components of an Agile Philosophy

    One of the reasons that people follow Agile books and processes is that it’s easier than looking at your culture and mindset. In software, I believe we’re more interested in the output of our minds, rather than the output of our hands. We have bodies, but they’re primarily there to move our minds to meetings. What becomes difficult is if we try and measure productivity by looking at the wrong metrics–essentially focusing on the output of our hands instead of our minds (how many lines of code have you written, for example).

    You need to move away from this and create a culture with four pillars:

     

    • Everyone is committed to constant improvement: Even the best bit of code or greatest process can be improved, so teams need to be open to always try to get better at what they do and how they work (focusing on where improvement will have an impact). It isn’t a negative or an admission that you’re not up to the job. In fact, it’s the exact opposite–wanting to learn and improve is fundamental to Agile, and generally being a good developer. 

     

     

    • Everyone is free to share their ideas: I talked about the need for fast feedback loops, and that extends to everyone being able to give their opinions, without fear or worries about ridicule. There really is no such thing as a bad idea, as it can spur further thoughts that get you to a solution. For sharing to actually work, you need psychological safety in your team–people have to be confident that whatever they say, it won’t be held against them come review time. Forget the “I know best because I’ve been doing it for longer” approach as well. I’ve often seen young inexperienced developers come up with great ideas–because they’re young and inexperienced.

     

     

    • Everyone is encouraged to question everything: Building on the first point, people have to be prepared to constantly review the way they, and the wider organization, works. Why do we do it this way? Is there a better solution? This shouldn’t be a recipe for constantly changing working practices and not getting anything done though. Go back to your original objectives of what you’re trying to achieve and then question whether current methods are the best way of getting you there.

     

     

    • Teams don’t have to follow rigid methods: No one should be forced to work a certain way (that’s the antithesis of Agile). Instead, teams should be encouraged to find the way that works for them. There’s a whole range of Agile methods out there, and the combination you adopt should be focused on your particular needs. That’s where my suspicion of Agile books comes from–for me the perfect read would be one that just fills your brain with thousands of ideas.

     

    Agile is at the heart of efficient, high-quality software development–just don’t risk losing its agility by following processes too slavishly and making everything you do too rigid and inflexible.

    — Dave Rook

  • Best of 2020: 5 Project Management Skills Every Developer Should Have

    Best of 2020: 5 Project Management Skills Every Developer Should Have

    As we close out 2020, we at DevOps.com wanted to highlight the five most popular articles of the year. Following is the first in our series of the Best of 2020.

    The days of the siloed project manager and “skilled” development team are becoming a thing of the past, thanks to the increasing complexity of dev projects. In many cases, the knowledge gap between the project manager and the developer is large, making it nearly impossible for any non-technical person to effectively manage the entire scope without significant input from the development team.

    These days, every member has to have a basic level of project management skills to be able to contribute to the overall direction. With the days of Gantt charts behind us and more companies using project management software as they work from remote locations, all team members have better access to all of the components of the project and an expanded sense of responsibility.

    When the developers take an active role in the management of the overall project, the benefits are numerous. Not only do the developers have a better sense of how long each step of the process will take—and their contribution to the larger project—but they can also more accurately prioritize the crucial elements needed to take the project across the finish line or recognize where errors, scope creep or delays may derail a project. In short, individual team members become more active collaborators in delivering better, tighter code and applications more quickly.

    Project Management Skills to Know

    That said, project management doesn’t happen magically, and it would be foolish to assume that just because someone is a skilled developer they know how to manage a project. But familiarity with a few critical PM skills and requirements can go a long way. Here are five aspects of project management every developer should understand.

    Estimation and Scheduling

    Like any sector of business, project management has its key skills and lingo. The most significant areas of focus for project managers tend to be scheduling and estimation. Scheduling is critical, as you have to assign tasks and accurately manage the workload across the team.

    Estimation is also necessary and important to get right, especially for the product development team. The estimation of a completion date triggers many other teams to perform their functions across the company and is often used by the executive team to target success or failure. But delivery dates are notorious for being missed. Working within date ranges versus single-point deadlines is highly encouraged. Ranged estimates capture and help manage the uncertainty so common in software development today, giving the entire team more opportunity for success and allowing for the unexpected roadblocks that occur with nearly any project.

    Critical Communication

    As a team, it’s essential to keep the lines of communication open. We’re not talking about unnecessary chit chat; we’re referring to critical updates that may affect the overall project. This includes having strong interpersonal skills, namely the ability to maintain clear team communication, complete document reviews and have succinct interactions about project deliverables and expectations.

    Technology and online collaboration skills are also important. Ensure all team members know how to effectively estimate their time and keep their progress updated in software the entire team can access. Ensure document sharing and team updates are enabled, so there are no excuses for missed or mixed messages.

    Problem-Solving

    You can tell a lot about a project team by how the team members solve the major and minor technology and business-related problems that occur—often daily. You might expect that Agile development and DevOps teams have institutionalized troubleshooting in development and engineering. However, teams still need to treat problem-solving as a skill that should be continuously strengthened, especially as technologies evolve. Appointing a lead to coordinate and direct others when problems arise can be an efficient way to take control of a spiraling situation quickly.

    Technical Documentation

    Writing technical documentation can be a neglected task but a valuable skill for project teams. Too often, documentation isn’t part of the team’s workflow, but it should be. Whether a project team has a staff or contract technical writer assigned to its project, documentation is an important skill. It’s also important to note that documentation doesn’t necessarily need to take place in traditional-type documents. Today’s project teams are often better served by wikis, enterprise social tools and online project management tools. What matters is that the documentation is centralized, online, secure, auditable and searchable by the team and by management.

    Risk Management

    Many of the above skills lead to an end-goal of managing risk—in this instance, the risk of not delivering a stable, feature-complete project on time. Risk management is a skill that is most effective when distributed among the project’s team members. This is especially important with teams that consist of cross-functional specialists and those with no clear oversight or direct leader. The key to distributing risk management across a project team is to make individual team members accountable and to explain the potential risks in their project tasks to the greater group. This “ownership” of their function and deliverables allows for the most realistic planning possible, requiring each team member to take accountability for precise timelines for their piece of the project. These timelines then roll up to the greater project plan and provide a more accurate estimation of completion date and potential pitfalls.

    The Well-Rounded Developer

    Project management skills are useful for all employees across an organization. There are no downsides to embracing proven tactics from the project management playbook as they’ll only serve to increase efficiency and promote better team organization and cohesiveness. Developers who have technical skills in collaboration with project management knowledge are always in high demand. Dedicating time to honing these skills is a worthwhile endeavor for any developer.

  • 3 Ways to Support DevOps Teams in Remote Work

    3 Ways to Support DevOps Teams in Remote Work

    As we settle into remote work for the long haul, it’s crucial to consider how best to support DevOps teams. While DevOps employees face similar challenges working remotely as any other department, they also face increased pressure to deliver as IT professionals, supporting the entire organization through an ever-changing work environment.

    By nature, remote work makes it more difficult for your DevOps team to do their jobs. Team members are working in various environments, but also distributed across geographies. And in this new frontier, DevOps must provide service as usual, continuing their development projects and ensuring communication and alignment among departments when it comes to the organization’s technology and IT needs.

    Even more, in a distributed, remote workforce, disruptions to application performance and security issues are more likely to occur and DevOps professionals must be equipped to identify and correct them quickly. For these reasons, it’s critical that these teams have the right tools and support to remain operational, communicate effectively across departments and neutralize threats—keeping applications and the organization running.

    How to Support Remote DevOps Teams

    Remote success looks different for every DevOps team based on organization size, industry and business need. However, the following strategies can be applied universally and may even serve as building blocks on technological foundations you already have in place:

    • Continue migrating operations to the cloud. Your cloud infrastructure is the backbone of any remote support plans for DevOps teams. Migrating operations to the cloud is the biggest enabler in making sure your team is not tied to any physical location and can do their jobs without relying on a single data center or headquarters. For example, deploying your open source data infrastructure in public clouds not only makes it easier for team members to access the data but also increases developer and operational velocity, which accelerates application innovation. While most organizations are well into their migration to the cloud, it’s critical to accelerate the process to expand across more operational areas. Traditional work environments likely won’t return to fully in-office experiences. Rather, many organizations will implement a hybrid working model. Refining and expanding your cloud infrastructure will help you make that transition and continue supporting an in-office, remote or hybrid team in the future.
    • Automate security and performance monitoring. DevOps teams are under pressure to scale solutions for remote work, such as company VPNs for network access and secure application logins. They must also be alerted to and able to track any security issues that arose during the hasty transition to remote work. Automated monitoring of software performance and trends keeps teams ahead of threats and minimizes deployment issues. The software sends alerts and allows teams to view data in real-time. Even more, machine learning technology can analyze the data and identify trends about application performance, the cloud environment and data usage. This level of monitoring and analysis is only possible with automation and makes it much easier for DevOps teams to meet IT service requirements as the remote technology landscape rapidly changes.
    • Increase communication and collaboration efforts. It’s crucial that DevOps teams are in constant communication with key departments across the organization, including security and executive leadership, as well as with other employees to discuss what’s working and what needs to become a priority for change. To help support knowledge sharing across a remote team, first ensure you communicate all application metrics clearly so every member of the team understands and is aligned on projects and next steps. Dashboards can help in this arena, collecting and converting key data points into visuals. And while you can easily create and host meetings with conference calls and video conferencing software, informal face-to-face conversations are harder to re-create—and that’s where ideas are born. To combat this loss, arrange for non-structured discussions without strict agendas or topics to encourage idea sharing, creativity and inspiration among employees.

    Remote work has broken down the traditional DevOps team structure, but this new way of work provides an opportunity to build something better—more time for independent, focused work, a superior work-life balance and modern cloud-based solutions for daily tasks. Supporting DevOps teams as they grapple with the new pressures of remote work is the key to ensuring your organization runs smoothly during the transition—cloud infrastructure, automation and communication are just a few of the strategies to do so. 

  • Global SKILup Festival: Not Your Ordinary Conference

    Global SKILup Festival: Not Your Ordinary Conference

    Global SKILup festival offers the Humans of DevOps a career fair, numerous upskilling opportunities, and a full-day conference, featuring keynote speakers Mirco Hering and Patrick Debois and many more

    2020 has been the year focused on the human. As the pandemic unfolded, the Humans of DevOps worldwide did their part to help mitigate the many challenges we faced. We are grateful to the tech community for their tireless efforts in helping individuals and organizations adapt to the new ways of working in different and non-traditional ways.

    After a long year, DevOps Institute wants to honor our member community and partners by coming together like never before. We’re hosting a weeklong celebration 100% dedicated to advancing the Humans of DevOps, Dec. 7-11: Global SKILup Festival 2020!

    The premier DevOps upskilling event and celebration is not your traditional conference. The agenda will include a variety of different activities that focus on social, professional and educational experiences. It also features a deep-dive into technology trends and presents career advancement opportunities. The world’s first such festival will take place virtually, and is sponsored by industry leaders Rancher, AppDynamics part of Cisco, CircleCI, Moogsoft, CloudHealth by VMware, Harness and Epsagon.

    Want to Learn More About DevOps?

    Whether you are well-versed in DevOps or just starting out, this premier DevOps upskilling event is for you. The festival runs continuously worldwide and includes a career fair, certification opportunities, courses, hackathons, our ever-popular Global SKILup Day conference and more! The 2020 event also features keynote speakers Mirco Hering, Global DevOps Practice Lead/ANZ Modern Engineering Practice (Managing Director) at Accenture, and Patrick Debois, Director of DevOps Relations at Snyk.

    Check out the rest of our speaker lineup.

    Workshops, Hackathons and Certifications

    Many of our partners, sponsors, and DevOps Institute Ambassadors are running seminars, hackathons and certifications throughout the week. We recommend attendees start planning their schedule and save their spot by checking the agenda and signing up in advance.

    SKILup Careers Fair

    Network with HR and hiring representatives and discover DevOps career paths at leading organizations worldwide. Hear from the hiring leaders themselves which skill sets are most important. Explore emerging and available DevOps roles.

    Get SKIL’d Up Days

    Enjoy learnings on gamification, LEGO Serious Play, Kubernetes, Relationship Agility and more! You’ll also have an opportunity to learn more about DevOps and get certified with one of our education partners (advanced registration is required).

    On Wednesday, Dec. 9, join us for the Global SKILup Festival DJ Party—send us your song requests and celebrate with us!

    Global SKILup Day

    We’ll end the week with this one-day conference where you can listen and interact with speakers worldwide as they share their stories and experiences with you. You will have the opportunity to ask questions in the “meet the speaker” sessions and join in some great discussions.

    Download your festival pass and share it with your social networks today. Join the discussion by using the tag #SKILupFest and tell your friends and colleagues: “I’m going to Global #SKILupFest!”

    We look forward to celebrating with you soon!

    Continue to advance your IT career. Join our FREE Professional Membership.

  • What Children Can Teach Us About Coding

    What Children Can Teach Us About Coding

    Redgate’s Code Club for kids ended up teaching their parents to love coding again

    Like lots of people in IT and other office-based jobs, I’ve been working from home since the pandemic started to hit in March 2020. In some ways it’s been hard because I’m the technical lead on a software engineering team, and continuing to work in an agile, collaborative way can be difficult via Zoom. In other ways, it’s been interesting because we’ve demonstrated it can work, often remarkably well.

    But I’m not just a technical lead, I’m also a father. And for my 8-year-old son, Dougie, things have been tougher. Here in the UK, schools were forced to close for a long time and one of the things he really missed was the lunchtime Code Club classes he’d been taking. Run by teachers, parents and volunteers and supported by Code Club UK, part of the Raspberry Pi Foundation, Code Club is a great initiative to help children to code with a range of really well-planned and thought-out projects.

    So naturally, being a software engineer myself, I thought, How hard would it be to organize an online code club for the children of people at Redgate Software? I mentioned it to a few people at work and when someone suggested maybe we should see if parents beyond Redgate would be interested, I thought, No problem at all. Redgate has quite a few followers on Twitter, so we put out a tweet.

    What could possibly go wrong?

    Panic Stations

    What started as an idea to help maybe 10 or so children of the people at Redgate went crazy. By the next morning we had 1,000 sign-ups from kids from all over the world. Not just the U.S. and Europe, but India, Nigeria and Sri Lanka as well. And the sign-ups kept coming in by the hundreds.

    Fortunately, the Raspberry Pi Foundation had already done a lot of the hard work for us by creating a series of Code Club class projects for beginners, intermediate and more advanced coders. They were delighted at our suggestion of using them in our online classes, and recording them so that they could be watched later as well.

    Redgate also actively encourages staff to give back to the community and when I gave a shout-out for volunteers to help run the classes, there was a huge response with 50 people raising their hands. Within a couple of weeks, we had the sessions planned, with the beginner and intermediate ones using Scratch and a more advanced session learning Python.

    There was quite a lot of safeguarding we had to think about as well around talking to other people’s children over Zoom, and we had conversations with the director of Code Club UK and her team to get their input. We wanted to make sure people weren’t sharing their videos and sound and that kind of stuff, but we managed to work our way through it and ensure we were protecting children while sharing some really cool stuff with them.

    All Systems Go

    On Friday, April 3, Redgate’s Kids Coding Club opened its doors online to hundreds of children aged between 6 and 14, as well as their parents. I wanted the kids themselves to run the sessions for other kids, so they were the presenters and their parents were co-presenters. In the sessions hosted by my son Dougie, he would talk about what we were going to do in the session and explain what things like sprites are. We then worked through the module as a group and if anyone got stuck, they could raise their hands virtually using the Zoom tool and a volunteer would step in to help.

    We ended up running six coding club sessions every Friday for 17 weeks while schools were closed. During that time, we taught nearly 800 children from 20 countries how to code, delivered 1,572 hours of learning, and recordings of the classes on YouTube have racked up thousands more views.

    What We Learned

    What I love about the coding club is that while we were delivering learning, we were learning, too. There were three big lessons for me.

    Children love to code

    A lot of people think children just want to sit down and play Minecraft or Fortnite, but if you give them the right tools, they absolutely love coding. Scratch, for example, is a block-based visual programming language that’s really easy for children to pick up and start coding with, particularly when you give them fun stuff to do.

    Sixty percent of the children we taught were between the ages of 6 and 8 and they loved using Scratch on projects such as Rock Band, Cats, Clone Wars and Boat Race. They coded their own musical instruments, stopped cats falling into holes, saved the Earth from space monsters and navigated a boat to an island. What’s not to love?

    Parents love coding, too

    Around 40% of the kids who signed up had parents who had never done any programming either, so they were both starting together in front of the computer, which was great. Typical feedback from the parents was that they were surprised that beginning to code isn’t hard, it’s really fun. A lot of them sat with their children for an hour after the lesson and continued to just play about with things and change stuff.

    Children can help us be better at coding

    There’s this preconception with coding that you have to get it exactly right for it to work, but what’s great about Scratch and other tools is how much freedom the kids had to change the project they were working on. They’d rather use a parrot than a polar bear. They didn’t want it to jump 10 pixels high, but a hundred pixels high. What happened if they asked it to jump minus 10 pixels? They could just poke the thing and play with it, and it was fun to see the little light bulbs going on in the face of the kids—and their parents.

    That can teach us about coding, too, because we often go down tramlines and do things the same way, every time, even when we say we’re taking a test-driven development approach to coding. Teaching children how to code was a nice reminder that we should be thinking more like them, poking and pushing things to the limit and doing the unexpected. We’ll end up with better code, and we’ll have more fun, too.

  • Linux Foundation Adds Professional DevOps Certificate Program

    Linux Foundation Adds Professional DevOps Certificate Program

    The Linux Foundation this week made an addition to its professional certificate program that trains IT professionals on the fundamentals of best DevOps practices.

    Clyde Seepersad, senior vice president and general manager for training and certification at The Linux Foundation, said the goal is to increase the number of IT professionals that have been exposed to DevOps fundamentals at a time when demand for DevOps expertise is surging. A survey published by The Linux Foundation finds 65% of organizations are currently looking for more IT personnel with open source DevOps skills.

    The Introduction to DevOps: Practices and Tools program combines three existing online training courses into a more structured program. Those existing courses are Introduction to DevOps and Site Reliability Engineering; Introduction to Jenkins and Introduction to Serverless on Kubernetes. Each course will continue to be available to audit at no cost.

    However, the $547 certificate fee provides unlimited access to the courses for one year, including all content and labs, as well as a verifiable certificate upon completion of all three courses.

    Longer-term, Seepersad said The Linux Foundation hopes to work with vendors that offer more advanced DevOps certifications. Ideally, recipients of a Linux Foundation certificate would receive some credit toward achieving other DevOps certifications or digital badges, he noted.

    Seepersad said DevOps training for IT professionals is now as much about staying relevant as it is about potentially commanding a higher salary. As IT organizations accelerate digital business transformation initiatives in response to the economic downturn brought on by the COVID-19 pandemic, there is a renewed sense of DevOps urgency, he noted.

    Regardless of experience levels, human resources professionals have always preferred job candidates who have attained professional certificates. The Linux Foundation survey found more than half of hiring managers (52%) said they are more likely to hire someone with a certification.

    IT professionals who have demonstrated DevOps experience can, of course, still land jobs, but the job interviews they get tend to be the result of personal contacts. Obviously, professional certificates don’t guarantee a job will be offered but they do tend increase the number of interviews extended. Naturally, there is, of course, no guarantee that anyone who can pass a certificate exam is going to ultimately have a successful career. Nevertheless, every DevOps journey needs to start with the fundamentals.

    In the meantime, there are plenty of IT professionals that previously worked in vertical industry segments that were hit especially hard by the COVID 19 pandemic. As many of those IT professionals look to migrate to vertical industry segments that are more vibrant, the need for a DevOps certificate becomes more apparent as competition for open positions during the worst economic slumps of modern times intensifies.

    The most important thing to remember is the certificate itself is only the first step toward achieving the hands-on DevOps experience that really matters.

  • Two-Part Training Required for Developers to Slay the Security Beast

    Two-Part Training Required for Developers to Slay the Security Beast

    Developers’ defensive qualities are only as good as the training they receive

    The playing field between the heroes and villains in cybersecurity is notoriously unfair. Sensitive data is the new gold, and attackers adapt quickly to circumvent defenses, exploiting security bugs large and small for potential paydirt.

    The volume of code being produced is too great for security experts—who are becoming increasingly scarce—to contend with, and the rising cost of data breaches is proof that something has got to give. Fortunately, for the sake of our digital safety and the sanity of CISOs everywhere, the DevSecOps movement is helping to bring developers on the security journey from the beginning of the software development process. They are being recognized as the first line of defense against cyberattackers, with the power to eliminate common vulnerabilities at their fingertips.

    However, their defensive capabilities are only as good as the training they receive, and that is yet another gauntlet for security teams to run. For many developers receiving on-the-job training in secure coding, their key challenge is staying awake during mind-numbing, hands-off activities that are neither effective nor inspiring them to keep security front of mind. Soulless video courses aren’t getting us there, token annual ‘tick-the-box’ events are a waste of time, and nobody is winning against the potential malicious threat actor waiting to jump on a small window of opportunity.

    At this stage in our industry, we have worked out that contextual, hands-on education that is delivered in relevant programming languages and frameworks, with challenges that mimic those a developer might come across in the real world, is a far more engaging approach.

    This is phase one of a developer’s quest to help AppSec gurus slay common vulnerabilities, but phase two is where scenarios must get real for a supercharged, security-aware defensive force.

    Scaffolded Learning Is Critical in Adult Education

    When it comes to extracurricular courses or on-the-job training, it is often overlooked that adults bring with them a certain level of experience and existing knowledge. Good training adds to this foundation and is structured in a way that allows for deeper understanding and faster autonomy in the learning process.

    Scaffolded education is a potent, positive method of learning that seeks to activate and enhance prior experience while continuing to build new skills—in manageable chunks—that allow the learner to tackle increasingly difficult tasks with more confidence. Typically, it is a methodology best served with healthy portions of demonstration, visual aids and student-led exploration.

    If we tie this approach back to developer security training, it comes as no surprise that the dynamic, learn-by-doing method has long been preferred over the drudgery that is theory-based static learning. They are free to be the masters of their domain and should see that their time is being well-spent.

    In that sense, learning to code securely in a hyper-relevant, contextual environment is key, but the ‘level up’ from this step is to see an exploit of vulnerable code in action. With the context of front-end and back-end views side-by-side, there is a tangible link between actions taken during the coding process and what an attacker can potentially do with cut corners, misconfigurations or accidents that are not caught and remedied.

    Move From Recall to Application for a Truly Preventative Security Approach

    Experiencing the impact of security vulnerabilities firsthand is a vital piece of the education puzzle, and it’s a fairly rare beast, even with the most modern security training options for developers. The foundational work spent on honing skills in spotting and remediating vulnerabilities and recalling that experience to eliminate the same bugs in code as it is being written is extremely important, but it’s not the whole picture. Seeing how vulnerable code is exploited by a malicious actor adds a powerful layer of context, one that really drives home the importance of securing code and applying hard-earned security knowledge to close every window of opportunity.

    It is generally accepted that developers don’t love security, and they have even less affection for security training. Their experiences with AppSec specialists can be very frosty, and the rework caused by the security team bouncing vulnerable code back to developers for remediation is the bane of their existence. To an engineering team that is already spread thin, security is someone else’s problem, not their priority, and a hindrance to their natural creativity and primary objective of building features. However, there is simply too much code, too many breaches and too much risk to the world’s data for this mindset to continue.

    A functional DevSecOps process has developers working in harmony with security teams right at the beginning of the software delivery life cycle (SDLC). Likewise, the opportunity for applied learning, where they can interact with a simulated exploit and see the impact of poorly secured code, goes a long way in getting developers on the same page as those pesky AppSec people (who aren’t so bad after all).

    Interactive Learning Prepares Developers for the Boss Fight

    At the time of writing, there were two major breaches reported in a seven-day period: Razer announced that more than 100,000 sensitive data records had been exposed, while office supplies retailer Staples also reported a similar data leak. More than a billion sensitive records have been exposed so far in 2020, and this worrying trend shows no signs of slowing down. Simply put, malicious actors have the upper hand and security-aware developers are sorely needed to serve as the front line of defense.

    Interactive challenges that focus on simulating such breaches move developers from passive recall, to applying skills that have an impact on the real boss fight: stopping attackers in their tracks.

  • Building (and Nurturing) a Product Team During a Pandemic

    Building (and Nurturing) a Product Team During a Pandemic

    Building a successful product team is difficult under the best of circumstances. Building one during a pandemic raises the level of difficulty by an order of magnitude. But it’s not impossible.

    In early 2020, everything changed. For months now we’ve been scrambling, adapting to a new normal that none of us had the foresight to plan contingencies for. We’ve moved from a world of in-person collaboration to one that relies heavily on technology to keep the proverbial wheels turning.

    The shift to an at-home workforce has brought with it the productivity you might expect when you strip away lengthy commutes and other inefficiencies. We’re left with an operation that’s run lean, on the back of technological solutions that push deliverables out the door in a matter of weeks, not months.

    Traits of a Team That Can Weather the Storm

    Now that digital transformation is no longer optional, a digital-first product team isn’t either. These digital natives were nice to have before, but in a world driven by Zoom meetings, Slack and Google Docs, they’re essential. Entire operations, quite literally, could fall apart without them. Without a doubt, a good product team starts with a good leader, and that leader these days needs a firm grasp on the tech challenges faced by their teams and the solutions that keep every part of the business moving in times of uncertainty.

    But it’s not just technology. The DNA of the perfect product person starts with curiosity, an ability to poke and prod and find inefficiencies by asking the right questions and always seeking a better solution.

    They should also have a growth mindset. An effective product person is always pushing the limits. It’s this ambition, this desire to keep moving forward regardless of the current situation, that often moves an entire team to keep up or risk getting left behind.

    They aren’t followers. The ideal product person is willing to argue against a decision that the rest of the room agrees with. They stand their ground and explain their thinking in a way that’s productive and respectful. They might not be the typical extrovert, the person always willing to step up and lead, but when they speak up, their words have purpose. These types don’t follow orders blindly; they question them, looking not only at the task but also the desired outcome, in an effort to find a better way. “Because we’ve always done it that way” falls on deaf ears, as these types understand that what brings you success rarely keeps you on top without the ability to adapt and evolve.

    The Collective Consciousness Inherent to a Product Team

    It’s important to zoom out and remember that a great product team is about more than a group of individuals. When done right, it’s a collective that moves as one. Individual achievements become all but meaningless and the focus is always on the team.

    This really boils down to culture. While a product leader chooses the shared beliefs, ideas, attitudes and knowledge that make up the team’s identity and work ethic, it is only the team that can internalize this collective consciousness and make the desired culture a reality. This is why one person can so easily make or break a team, so ensuring a good culture fit becomes the gel that holds the entire thing together.

    For the most part, product teams need individuals that are team-oriented, individuals that care about propelling the team forward rather than just achieving individual goals. Understanding is everything, and an empathetic individual understands not only their own struggles but the challenges faced by those around them. The importance of these individuals cannot be overstated, not only for the culture of the team but that of the company as well.

    Last, but not least, we look for people who make good decisions. This doesn’t mean they always make the correct decision. They are human, after all, but they are decisive in their decision-making and willing to take responsibility for decisions that go wrong. We don’t typically see the results of these decisions right away. Often, they play out several months, or even years, down the line. But we have to know that the person making these decisions is capable of weighing all the options, seeing all the angles and being decisive when called upon. This is particularly true at the senior level, the driving force of the team’s decision-making capabilities.

    Culture starts from within, and though teams are of the utmost importance, they are composed of individuals. If we were to build a product team in 2020, in the midst of a pandemic, we could do worse than identifying these characteristics in each member. One individual could propel the team to new heights or serve as a speed bump on the road to success.

  • Value Stream Management: Treat Your Pipeline as Your Most Important Product

    Value Stream Management: Treat Your Pipeline as Your Most Important Product

    When it comes to accelerating customer value, it’s dangerous to focus only on the development and delivery of a digital product. For many enterprises, most time is invested before a single line of code has been written. That explains the recent focus on value stream management (VSM)—it’s forcing us to think beyond Agile and DevOps and consider the whole system, not just one stage in a complex process.

    By extending our visibility further upstream where work originates, we can begin measuring the value of creating and protect workflows end-to-end to meet business outcomes sooner. Thinking about how software delivery work moves between all teams in the value stream from request to operation leads us to the significant realization that our tooling pipeline is our most important product and we should treat it as such.

    The Rise of Value Stream Management

    The growth of value stream management in software delivery has emerged because Agile and DevOps are not enough to remain competitive against the breakneck speeds of the tech oligopoly. The progressively maturing practice takes a systematic approach to continuously measuring and improving end-to-end flow to accelerate time-to-value. Consequently, new tooling is emerging as we think end-to-end in how we collaborate and work faster together—and measure our productivity and effectiveness.

    Measuring and understanding end-to-end flow isn’t easy. Software delivery is highly technical and creative knowledge work that can span thousands (or tens of thousands) of IT practitioners. Information is scattered across heterogenous toolchains comprising discipline-specific tools. In fact, some 42% of large-scale software delivery organizations use four to 10 core collaboration tools for portfolio management, design, enterprise agile planning, testing and ITSM, and dozens of additional tools to support the CI/CD pipeline and operations. 

    Mik Kersten, “Mining the Ground Truth of Enterprise Toolchains, IEEE (Volume 35, Issue 3, May/June 2018, p12-17

    Measuring flow, therefore, involves tracing constituent units of value creation and protection as they traverse all team tooling in the form of artifacts such as activities, capabilities, epics, features, stories, bugs and incidents. Yet for too long we’ve been too focused on “the right side” of the value stream, thinking about how products are built and delivered through Agile and DevOps tools, without visibility on how they’re requested, analyzed, processed and designed. Our ability to support customers is hindered because we don’t know where and why work is slowing down outside of development. Our product pipeline is broken, our visibility fractured.

    A ‘Broken’ Product Pipeline

    Traditionally, CI/CD tools include source code management, build, deploy, quality management and service management. Moving more to the right, you have release management and service management. But too often organizations have ignored integrating tools further to the left such as planning and portfolio management, product management, requirements management and risk management (static and dynamic security scanning tools). This impacts our ability to see and measure end-to-end flow.

    In”Accelerate,” lead time is defined as the portion of the value stream from (last) code commit until deployment. While this is essential to improve, it only covers the time from the build being produced through deployment. We need to account for the time that elapses before it hits a developer’s backlog. To shift IT from a project to a product focus, you need to reduce end-to-end flow time by measuring earlier in the delivery life cycle by “shifting left.” As such, you need tooling across the whole value stream through the ideate, create, release and operate phases. A focus only on optimizing the CI/CD tooling and practices is too narrow a view that produces diminishing returns over time.

    The Great Disconnect Between IT and the Business

    Because of this lack of a holistic view, IT teams don’t feel like they are able to influence the business side of the house, where most of the work in progress (WIP) starts, such as requests for features or application changes. These intake processes many times result in teams taking on too much WIP and neglecting work. Many teams need to “stop starting” and to “start finishing” to deliver business value more quickly. Crucially, this is the area where business leaders have their own processes and where tools are less likely to be used; it’s a world dominated by spreadsheets, documents and PowerPoint presentations. This is where work is least visible and measurable. And this is precisely where we need VSM: to turn the light on starting with the customer needs so we can continuously improve end-to-end flow. This requires a culture shift from both IT and business/product owners. And that requires taking a broader, more holistic view of the tools and practices in the business space.

    Architecting for Flow

    An end-to-end integrated pipeline product can be architected for flow. For example, tools used for visual system management (e.g. Jira, Azure DevOps) are becoming more of a commodity with the real differentiation becoming how they can be integrated with tools used for portfolio, defect and service management, since those are the sources of work that will flow into product-based teams for development of business value and unplanned work. Teams should think about how they can work more closely with business portfolio teams on continuous flow (and funding) because eventually this work will become the next bottleneck that needs to be addressed on the journey to accelerate business delivery capability.

    Keep an Eye on Value Protection Work 

    With end-to-end visibility into work across the pipeline, you can abstract that connected technical data into overarching value stream metrics—known as flow metrics—to identify areas where to run experiments to improve end-to-end flow. Here we mustn’t just focus on work that creates value but protects it, too.

    We should provide our software delivery teams with the psychological safety to devote time to address debt and neglected work. Debt creates a drag on feature velocity because changes become more complex and take longer to make. In addition, with higher technical debt, more time is spent on addressing defects, which starves the capacity to perform feature work. As debt builds, the following is observed:

    • Flow velocity decreases.
    • Flow time increases.
    • Quality decreases as the code base becomes more fragile/costs increase.

    All of these result in reduced happiness for both the customer and the team, increasing the risk of team burnout. There are many cautionary tales of this occurring where market leaders ended up losing considerable market share due to inattention to technical debt. These stories exemplify why it is necessary to observe flow distribution to ensure that prioritization decisions made with the product owners, include providing necessary capacity to address technical debt.

    Applying the concepts of value stream architecture to your end-to-end pipeline is the key differentiator for organizations that are trying to make it through disruptive periods such as today, as COVID-19 widens the gap between those who have mastered software at scale and are thriving and the many enterprises struggling to pivot and adapt in the digital-first climate.

  • Debunking Misconceptions About Engineering Management in 2020

    Debunking Misconceptions About Engineering Management in 2020

    2020 will be a year we all remember for so many reasons. It has been a year full of uncertainty and confusion, and also one in which misconceptions abound. In the world of software engineering, we feel this acutely as all eyes are on the engineering team to continue building innovative new products and solutions—maintaining the lifeline of the business—even as we grapple with new realities of universal remote work, new constraints on resources and countless distractions.

    Given all of that, it should come as no surprise that go-to-market and other business leadership has grown increasingly concerned with the performance and success of the engineering teams on which they depend. Some of their worries are legitimate, but many are merely misconceptions about the state of software engineering and the efficacy of engineering management. To help foster alignment, the Jellyfish Data Science team investigated by looking at engineering management and team data across dozens of software development teams representing thousands of engineers. Below, three important misconceptions about engineering management in 2020 are debunked.

    Misconception 1: Software engineering teams are working less or being less productive amid COVID-19, universal remote work and lack of management oversight

    The idea that teams are being less productive is not altogether unfounded. Nor is it surprising given the fact that it’s much more difficult to see what’s being built by the engineering team and how the team is being managed directly. It’s true that among the many teams sampled, productivity decreased across the board about a month or two after the shift to universal remote work (after a spike in productivity initially). However, as things have settled into a new normal, productivity metrics on engineering teams have rebounded and in many cases even increased.

    The reality is that engineers are working almost the exact same amount of time as they had been before the pandemic. In fact, the average number of coding days per week has increased 2% (it stands at about 2.2 days). The difference is that engineers are adjusting their working hours to accommodate family schedules. Peak coding hours have shifted four hours earlier, and software engineers are working longer and less regular hours during COVID-19.

    Across the board, engineering metrics suggest productivity is up relative to the same period last year. The number of commits has increased, merged pull requests are up more than 10% and the number of issues resolved has increased a whopping 8.7%. The exception here is issue cycle time, which has increased more than 21%. Engineers may be taking on meatier projects, and are working equally, if not more diligently, to ship them.

    Misconception 2: Communication on engineering teams is breaking down due to remote work during COVID-19

    Again, this worry is not unfounded, especially for older companies where co-located work was important for effective communication and for larger companies where communication is crucial to maintain business continuity across divisions and departments. But among younger, and especially software companies, the move to remote work was not so painful and communication did not break down nearly as much as might have been anticipated given the already widespread adoption of videoconferencing tools such as Zoom or Google Hangouts and messaging platforms such as Slack.

    The reality is it’s difficult to say what has happened with communication. Certainly, informal office banter and hallway catch-ups have taken a nosedive. But communication about engineering work—communication that is measurable—has actually increased, possibly enough to fill those gaps. Review and comments on pull requests, for example, have increased by 5% and 4% respectively, and Slack’s CEO reports the number of Slack messages per user per day has increased 20% (which echoes our findings that Slack messages in engineering work channels have increased). The conclusion is that while informal communication may be down, measurable communication—especially around engineering work—has actually increased.

    Misconception 3: Engineering management has lost visibility into the work their teams are doing as their teams have gone remote and they can no longer walk the proverbial “floor”

    Visibility into the work of engineering teams has not broadly decreased in recent months, but that doesn’t mean visibility is not a problem. Visibility remains a top challenge among engineering leadership.

    The reality is engineering management has had poor visibility into their teams’ work long before they went remote. According to the “2020 Engineering Management and Alignment report,” this poor visibility has led to a misunderstanding and misrepresentation at the highest levels of what types of work need to get done and how many resources they’ll require. The report found, for example, that engineering leaders polled overestimated the amount of resources available for road map and new feature work by 62%! Without a more complete understanding of what work is being done, the study asked, how can engineering leaders take corrective actions and ensure the right projects are being prioritized?

    But not all is lost in this regard. The study also found that visibility dramatically increases, by 60% on average, on engineering teams that have implemented engineering management platforms. Those teams report 16% less time spent on customer support work and 35% more time available to work on “road map work or strategic customer development—the work that moves the business forward.”

    Ensuring alignment with the business is critically important for technical leaders during times of uncertainty. If you can get ahead of these misconceptions, you will better enable your team for success now and in the future. Data-driven engineering leaders already know this to be true when times are good and resources are easier to come by. If you’re not already, strike the misconceptions your business leaders may have by sharing the realities on your team.