Category: DevOps Practice

  • Keys to the Kingdom: Protect Your Server from Hackers

    Keys to the Kingdom: Protect Your Server from Hackers

    Automation and DevOps undeniably improve the agility and responsiveness of IT. Most of us have taken up at least a bit of the wave of automation that DevOps and Agile have brought to our door, and many are far along on their DevOps journey.

    But every once in a while, we need to look back and lend a hand to those still coming. The fact of the matter is that sometimes we forget to warn those who are new to massive automation about some serious issues.

    It is intuitively obvious, if you think about security at all, that putting together a command and control server—we’ll use Ansible in this blog, but any tool that can roll out applications to a collection of servers—creates a big screaming target for any hacker that gets into your infrastructure. You cannot assume that will never happen, so organizations need to think about protective systems/architectures early, or spend more time patching things up. Remember, the more you build, the more weight there is to making major changes.

    For starters, severely limit access to the command and control machine. It belongs on a management subnet/VLAN with only a few access points. The servers it is managing absolutely should not have access back to the command and control server. If they do, any one of them getting controlled will provide a pathway to all of them getting controlled.

    Next up, early on there were quite a few debates/discussions about which user accounts should be able to run command and control scripts (Playbooks in Ansible). Eventually, the bulk of the community settled on each individual running them, not a single generic user with a name like “ansibledeploy.” Some still use a central user, but the majority wants the ability to track down the leak that individuals running commands allow—searching for strange/uncommon command execution in logs will cough up which account got compromised and allow for rapid response—which outweighs centralization.

    Third, learn and use the security features available in your application. Ansible offers Ansible Vault to allow encryption of playbooks. Since many playbooks require root access, encryption allows those playbooks to hide root access. Use of Ansible Vault has grown over time, and there are excellent tutorials out there to help use it to lock down command and control. Your product will have a similar tool, because putting root passwords in plain text, all over the disk, is just not acceptable.

    In the Ansible Galaxy/Github repositories, you can find excellent roles to help in your quest to lock things down. Geerlingguy is one of the most popular, and his Ansible Role – Security is excellent if you follow the caveats he provides in the readme.

    This is simply an advisory, not a step-by-step solution set. Overall, just remember that putting together a command and control server makes a tempting target. And like Geerlingguy points out in his readme, your security is your concern.

    Look at where the server can be accessed from, who can access it, where sensitive data bits such as passwords are stored—hint: plain text passwords in files went out of fashion when mainframes were hooked up to LANs—and how to protect all of the above. It’s been done, there are plenty of resources to help in your given environment. Take the time to look them up and implement relevant suggestions.

    After all, I won’t get a call in the dead of night if your servers are all taken over, you will. Do everything you can to avoid getting that call. And keep rocking. Everyone remote working has made many organizations more susceptible to all forms of attack, don’t let your guard down.

  • Tips For Managing Development Teams Remotely During Coronavirus

    Tips For Managing Development Teams Remotely During Coronavirus

    Thanks to the global coronavirus pandemic, around a third of the world’s population is on lockdown in their homes, which means a huge number of businesses are currently trying to navigate remote working solutions. Trying to collaborate on software development is difficult at the best of times when your team is all in the same office, but with your team split across various home offices communication and collaboration is made all the more difficult.

    Remote development work is an altogether different challenge, one that needs careful thought and new solutions. Luckily, there are ways to get around it, and they don’t all require huge investment or innovation. Just tweaking the way you think and work will help you continue to deliver on your development goals.

    Spread Knowledge

    Many teams run into problems with their remote workforce when they realize knowledge is not equally distributed amongst team members. I don’t mean the company log-in details (though you might have that problem too), but that the company’s vision and culture have not been effectively communicated. In an office setting this isn’t too much of a problem, as developers can be sent off on projects and the team can come together to implement them with one voice at the end, but when the whole team is divided it’s a lot harder to achieve this final cohesion.

    To avoid having to piece your projects together like a jigsaw puzzle, make sure all of your developers are clear on what goals the company wants to achieve as a whole, and what culture and tone the company is wishing to promote. That way any development decisions made in private working sessions are still geared toward the overall company aim, and individual projects will slot in well together.

    Communicate

    To spread knowledge effectively, you also need a major focus on communication. You won’t realize how much the office dynamic contributes to communication until it’s gone. Working from home eliminates many of the little interactive scenarios in which team members can discuss ideas and clarify details. 

    To counteract this, you need to communicate far more than you previously did. Send more emails for clarification and have more regular meetings (over video chat) than you otherwise would. This might seem annoying or even counterproductive at first, but having a clear flow of information across the whole team is important for accountability. 

    Take Note

    Related to communication, you may find it really helps to note more things down. You’d be surprised how much information is transmitted from being physically in the same space as someone, so a lot of workers find it a lot harder to pay attention to video of audio meetings and can easily forget details. Whether it’s minutes of a Zoom meeting or a brief one-on-one phone conversation, jot down a note of important tasks or details to remember, and circulate them throughout your team.

    Be Humble And Accept Feedback

    If you’re managing a development team that’s just gone full remote, accept the fact that you might not have all the answers. This might be as new to you as everyone else, and even if you have experience of remote working before it probably wasn’t during a global pandemic. By all means, show a strong sense of leadership and implement a solid plan of action, but be humble enough to accept that it might not be a perfect plan.

    Show your humility by being open to feedback from your team members. They are having to adjust to a new lifestyle that may require new strategies to deal with. You might consider flexible working hours, or reassessing your tools or communications strategy. Figure this out as a team and you’re much more likely to keep morale up and not sacrifice any productivity.

    Embrace The New Normal

    Most importantly, don’t spend your time waiting for things to go back to normal. Treating this period as a brief interruption to your normal working schedule will stop you from fully committing to new strategies and tools to help you produce good work right now. It will show in your products, and if your remote working period lasts longer than you’d expected it will mess up your production schedule. For now, this is the new normal: embrace that and start with your best foot forward.

  • Tips on Rightsizing to Reduce AWS Costs Now

    Tips on Rightsizing to Reduce AWS Costs Now

    In this business climate, everyone is looking to reduce costs. CFOs are reevaluating their software and infrastructure spend, and naturally, companies are looking for ways to optimize their AWS costs. In fact, we are now leveraging a major reason cloud is so compelling in the first place: you have more flexibility to control costs based on business needs. 

    How Do You Reduce Costs While Maintaining Performance? 

    A good starting point is to determine where most of the AWS spend is coming from. Once you know that, you can focus on factors that are causing the most charges and determine those services that can be scaled down and those that need the most resources. Depending on the service, there are many options, such as Amazon EC2 Reserved Instances (RI), Amazon EC2 Spot instances and resource rightsizing. In this blog post, I’ll cover rightsizing.

    There are some great AWS and third-party tools (I’m partial to nOps) to help you learn and analyze current usage patterns and make recommendations for rightsizing RI and Spot instances. In my experience, Amazon Elastic Compute Cloud (Amazon EC2), Amazon Relational Database Service (Amazon RDS) and Amazon Simple Storage Service (Amazon S3) show up consistently in the top five items on the AWS bill. So, in this article, I’ll focus on rightsizing strategies with these three services.

    Rightsizing doesn’t just mean migrating from the old instance to the new generation instance. You’re probably not going to save lots of money with that approach. Rightsizing can help to identify resources that are clearly over-provisioned. Furthermore, many of the resources are provisioned using HashiCorp Terraform, AWS CloudFormation or an Auto Scaling group on AWS, so finding the rightsizing opportunities for ephemeral resources, and updating the automation not only reduces cost now but can also lower your future cost on AWS. 

    Optimizing Amazon EC2 and Amazon RDS Instances

    Hands down, Amazon EC2 spend is most-often the most expensive item on your AWS bill. Amazon EC2 comes with a robust set of options for CPU, memory and network I/O, ranging from 0.5GB of memory to 1TB. Having so many options can be a double-edged sword—how do you choose?

    You can choose the appropriate instance type based on your use case: Compute Optimized (for CPU-intensive workloads), Memory Optimized (for memory-intensive workloads) or Network Optimized (for enhanced network throughput).

    Some parameters need to be considered when choosing the optimal instances for your workload. Whether it is an HPC workload, or a simple Python Flask application or a Data Pipeline project, there is an Amazon EC2 instance type best suited for each of those workloads. 

    To select instances wisely, apply the most cost-effective Amazon EC2 instance type based on the network I/O and CPU utilization of the currently running instance. For example, if a t3.xlarge is configured for a Python Flask application and less than half of the memory is in use, the instance type has been over-provisioned for that workload. In such a case, a smaller instance size, such as a t3.small, is probably more appropriate.

    It’s also worth noting that, while most EC2 instances are provisioned with performance in mind, over time the utilization of the program can decrease, resulting in instances that are over-provisioned based on the current CPU/memory usage. I normally look at Amazon CloudWatch for instances that are not consuming all the resources that are currently available to each instance and, based on the historical usage, provide a recommendation to rightsize them. And, I can see the cost savings associated with the suggested changes.

    This approach can also be applied to Amazon RDS. The underlying architecture of Amazon RDS instances is very similar to that of Amazon EC2 instances. Both require an Amazon Virtual Private Cloud (Amazon VPC), security groups and a disk to run the managed database instance. 

    Optimizing Amazon S3 Storage Classes

    Amazon S3 offers a range of storage classes designed for different use cases:

    • S3 Standard for general-purpose storage of frequently accessed data.
    • S3 Intelligent-Tiering for data with unknown or changing access patterns.
    • S3 Standard-Infrequent Access (S3 Standard-IA) and S3 One Zone-Infrequent Access (S3 One Zone-IA) for long-lived, but less frequently accessed data.
    • Amazon S3 Glacier (S3 Glacier) and Amazon S3 Glacier Deep Archive (S3 Glacier Deep Archive) for long-term archive and digital preservation.

    You can determine the most appropriate storage class based on the usage of the objects in that bucket. As a result, you can cut the cost of storage of objects in the bucket and the cost of GET requests needed to download or transfer files from Amazon S3 to any other location.

    Getting Results Fast

    Uber, like many rapid-growth companies, was looking for ways to optimize AWS costs without slowing its high-velocity teams. They were able to save 15% of AWS costs in just 30 days using some of the strategies described above, as well as others. One of the keys for Uber is they are monitoring and optimizing costs continuously–not a one-and-done approach–because they have such high velocity with continuous changes to their AWS environment. They use nOps cloud management for this.

    Nick Cobb, senior engineering manager, Infrastructure Platform, Advanced Technologies Group at Uber, reports he’s able to “operationalize costs and get them in front of the engineers directly, saving 15% in the first month of implementation. In addition to providing reports for leadership and budget processes, our efficiency team can enact behavioral changes for R&D engineers typically used to throwing money at challenging problems.”

    If you’re interested in more details on the strategies that Uber has used, plus other cost-optimization strategies your organization can use right now, Nick will be joining me and AWS for a DevOps.com webinar on continuous cost optimization on April 21. It’s a hot topic for so many organizations right now, so please join us.

  • Twilio Provides 90-Day Free Developer Access to Video Service

    Twilio Provides 90-Day Free Developer Access to Video Service

    Twilio this week announced it will make its video services available for free for three months to developers who are building applications to address COVID-19 pandemic uses cases in the health care, education and nonprofit sectors if they sign up to use the platform before June 30.

    Jesper Joergensen, general manager for voice and video at Twilio, said most of the applications being built to address the crisis benefit greatly from having video embedded in them. For example, a forms-based healthcare application could have embedded videos or include a button that would start a video chat with a healthcare professional. Alternatively, an SMS text could be used to request an appointment and also include a link to a videoconference that would enable healthcare professionals to diagnose a patient remotely. Those types of applications also could go a long way to make it simpler to navigate what are often complex healthcare procedures, noted Joergensen.

    In the education sector, Twilio is already seeing institutions building a wide range of applications that rely on video to engage students and maintain business operations, he added.

    While many applications are being built to address pressing issues, Joergensen said many applications that embed video are being built for the new normal. No one is quite sure when the COVID-19 pandemic will be over or whether it might flare up again. There also could be other pandemics in the future. Many organizations are now moving to make mobile applications that have video capabilities embedded within them a core element of their business continuity strategy, which is being updated in the wake of the pandemic, said Joergensen.

    In general, he said embedding video capabilities within an application provides more context within an application. Otherwise, the end user needs to move off the application to launch a separate videoconferencing platform.

    Twilio makes it easier for developers to embed video within an application using a software development kit for either Apple iOS or Google Android devices. The SDK allows developers to invoke Twilio application programming interfaces (APIs) to access the Twilio Video service running on the Amazon Web Services (AWS) public cloud. While organizations that build these applications don’t necessarily need to master best DevOps practices to build and roll them out, Joergensen said organizations that have embraced DevOps typically have the agile development skills needed to quickly build and test COVID-19 applications.

    In the wake of the COVID-19 pandemic, online video has gone mainstream. Once the pandemic subsides there will be a much higher level of comfort with online video for a wide range of processes ranging from telemedicine to tax preparation. Applications that don’t embed video capabilities will appear antiquated by comparison. Video now has a major role to play in simplifying the customer journey, noted Joergensen.

    It may take a while for organizations to adjust to the new normal once the current pandemic subsides, but it’s clear online video has finally been pushed across the proverbial chasm of adoption.

    — Mike Vizard

  • Is It Time to End the Software Metric Madness?

    Is It Time to End the Software Metric Madness?

    We have all heard the phrase “What gets measured, gets managed,” often attributed to Peter Drucker—interesting note about this quote, Drucker didn’t say it. In the DevOps space, or application development and delivery generally, this quote is often used as a justification to measure things like deployment velocity, bug fixes, lead time and so on, as a way of gauging success.

    One can find countless articles with titles such as “X Key Metrics to Track DevOps Success.” Many of these use a version of this quote to justify measuring attributes that are all essentially related to the speed and/or quality of work.

    Deployment velocity, lead time, bug fixes, etc., are effective ways to show that an organization is producing software rapidly, and with a degree of quality. But, are these really the best ways to measure success?

    In almost any other industry, the answer would be “no.” These traditional software delivery metrics are a measure of work progress. They do not account for whether that work progress results in meaningful value, or business success.

    Take an automobile manufacturer, for example. If Acme Cars can produce hundreds of thousands cars annually (speed), and they all drive down the road perfectly (quality), would they be a successful business?

    What if no one wants to buy all those cars? GM was able to produce many thousands of Pontiac Aztecs, but they were condemned by journalists and consumers (Walter White notwithstanding) as the ugliest car ever created, and demand was far short of projections.

    What if the cars sold, but they all sold for a loss? In the case of the Aztec, Pontiac needed to sell 30,000 annually to break even, but they never came close to that mark. Many today consider the Aztec as being at least partially responsible for the demise of the Pontiac brand.

    Measuring the speed and quality of production is essential but not sufficient. Yet, for the most part, that’s what software organizations are tracking.

    This could be why Forrester Research wrote that “CEOs must end the madness of software metrics” in its report “CEOs: Foster the Software Teams and Talents Your Firm Needs.” Forrester goes on to say that “arcane, indirect measures of success and ROI…confound conventional management techniques.”

    Instead, there needs to be a correlation to business outcomes, such as profit margin, ROI and customer acquisition, according to Forrester. Highly successful organizations are already doing this. Others need to take steps to ensure that “everyone in software delivery gauge success with business measures.”

    This same philosophy is what’s driving increased interest in the concept of BizOps. BizOps is a framework for optimizing software development and delivery to foster the achievement of business objectives. Essentially, BizOps helps connect the dots between traditional measures of software progress and metrics of business success. It’s what is needed to end the software metrics madness.

    Read more about why BizOps is becoming important in this blog by Kieran Taylor.

    — Brendan Hayes

  • The Key to Embracing DevOps: A Real-Time Roadmap

    The Key to Embracing DevOps: A Real-Time Roadmap

    While the term “DevOps” has become somewhat of an industry buzzword, it represents an important shift in the way teams think about planning, building and deploying software. Drawing its inspiration from the Agile movement, DevOps extends many of Agile’s core principles beyond development to how teams deploy, monitor and inform their next round of product planning.

    Because DevOps touches so many areas of the software development lifecycle, more stakeholders than ever before are now involved in the design, production and release of software projects. With more moving parts and people, the continuous delivery of valuable software depends on these stakeholders being aligned at all times and moving in close coordination with each other.

    In reality, however, that’s much easier said than done.

    The problem with most projects is that they face a lag time based on the manual nature of updates required from the people doing the work. Sometimes this delay may be considerable. At the same time, accuracy becomes a problem because it involves people manually making and changing entries. This only compounds as the number of teams and dependencies involved in a project grows.

    Another significant issue is the disruptive nature of context switching on development teams. Ideally, developers can concentrate on coding and not have to contend with a myriad administrative issues. In reality however, most developers are constantly forced to leave where they’re working to provide status updates for the team. Every “start-stop” slows the process and can even impede creativity. 

    While it’s tempting to just do away with updates, they’re incredibly important for the business. Stakeholders and customer facing teams need to understand if projects are on track or running behind schedule. Similarly, management needs to understand what projects are at risk in order to step in and provide additional resources or work with the team to determine ways to reduce scope. 

    So, how can teams stay aligned without compromising the developer experience?

    While there’s no one right way to achieve total team alignment, one solution is maintaining a real-time roadmap that is shared between development teams, ops teams and the rest of the business. In a true, closely coupled DevOps environment, data from testing, deployment, integration, monitoring or other steps can be fed into roadmaps to reflect new realities and considerations.

    If such input comes fluidly and automatically, the roadmap will not only reflect the exact status of development but also the practical matter of having software work as intended in a production environment. Again, not only can business owners know the true status of a project, adjustments and decisions can be made along the way to ensure that goals and expectations can be met.

    A by-product of accurate, fluid, real-time roadmaps is the trust that stems from all being on the same page and having joint ownership for the entire process. The transparency and currency of such a vantage lessens finger-pointing and lessens “us-them” tendencies, as the work and the results can be jointly held. What results from this is accountability across the entire software development lifecycle.

    Real-time, integrated, roadmaps perfectly fit with the spirit of what DevOps tries to achieve.

    They operationalize work being completed and allow for user feedback and telemetry to continuously flow back into the next rounds of iteration planning. Real-time roadmaps accurately reflect what’s happening at each stage in the DevOps lifecycle, creating a single source of truth for developers, business owners and operations teams working at each stage of the process to ship value to customers.  

    The spirit behind DevOps calls for tighter integration leading to increased levels of efficiency and effectiveness. Adding real-time, integrated roadmaps to the DevOps discipline makes it even better.

    — Aaron Upright

  • Build Better CX Across the Entire User Journey with AIOps

    Build Better CX Across the Entire User Journey with AIOps

    Ready or not, digital experiences are now the gateway to customers and the standard-bearer of a company’s brand. Yet, as apps become more distributed, more intelligent and more real-time, they continue to run on infrastructure that resides within on-prem data centers as well as multiple public clouds. This complexity is underscored by gaps across IT teams, leaving businesses, developers and operations teams working in silos without a single source of truth, exposing risks that can inflict not only severe damage to an application’s performance and reliability, but also eventually exposing the entire business. 

    For IT teams, understanding their applications is key. Not only are they the backbone of any organization, but they also hold invaluable data on customers and their decision-making habits. Having complete visibility is critical in today’s multi-cloud and hybrid cloud world.

    When IT teams are able to work quickly and intelligently, they consistently deliver a strong customer experience–avoiding the risk of creating opportunities for customer disengagement and abandonment. Recent research shows that nearly 84% of respondents said they have experienced problems with digital services. As a result, 40% reported switching suppliers due to a poor digital experience and 63% have actively tried to discourage others from using a service or brand if they have a bad digital experience.

    What’s the way forward and how can these existing silos be eradicated? 

    How to Build Better CX

    IT teams are faced with a conundrum–they’ve been asked to manage app complexity while simultaneously navigating operational silos that make collaboration, data exchange and problem resolution incredibly challenging. The way forward lies in a collaborative approach across traditionally siloed teams that leverages artificial intelligence (AI) and machine learning to uncover hidden bottlenecks and resolve issues before they can impact the end-user.

    Transformational CIOs need their teams–across app and infrastructure owners–to speak a common language rooted in what’s important to the application performance, user experience and the business impact. They need infrastructure decisions in service of the application, which will ultimately drive business performance. They also need application teams to be able to go deeper and quickly identify underlying infrastructure that may be contributing to poor application performance. 

    In order for true collaboration to take place, the first step is to increase visibility across the IT organization by providing a common view of correlated data across domains that provides contextualized insights to better collaborate and create a superior digital experience.  

    For application teams, this means gaining insight into the users’ most transited application journeys, helping to clearly identify application bottlenecks and abandonment and to triage efficiently. For the infrastructure teams, improved visibility means having insight into infrastructure constraints impacting app performance so that teams can correlate the user experience to any underlying infrastructure in real-time. Through this increased visibility and context, application and infrastructure teams can clearly identify respective action items and move swiftly to resolve the right issues, at exactly the right time.

    This notion of fill stack visibility and correlated insights that drive action is a mindset commonly referred to as AIOps.

    Enter AIOps

    While it may be true that the emergence of today’s modern application and infrastructure environments has provided the speed and flexibility professionals demand, the numerous services have unleashed a deluge of data on the enterprise IT environment. Automating tasks has helped teams to free up some bandwidth for operations and planning, yet automation alone is no match for today’s increasingly complex environments. What’s needed is a strategy focused on reducing the burden of mounting IT operations responsibilities, and surfacing the insights that matter most so that businesses can take the right action.

    So, what are forward-thinking IT professionals doing to stay ahead of the curve? 

    Many are applying an AIOps approach to the challenge of environment complexities. AIOps leverages advances in machine learning and AI to proactively resolve problems that arise in the application and infrastructure environment. This is so powerful because using AI to identify potential challenges doesn’t just help IT professionals get ahead of problems, it helps companies avoid revenue-impacting outages that jeopardize the customer experience, the business and the brand. What’s more, an AIOps strategy can provide:

    • Intelligent alerting that can be trusted to indicate an emerging issue. By ingesting data, AIOps platforms and technology can play a pivotal role in not just automating existing IT tasks, but identifying and managing new ones based on potential problems detected.
    • Automated root cause analysis and business impact assessment. With the help of AIOps technology, this can be achieved, providing increased agility in the face of potential service disruptions or threats, and without additional drain on resources.
    • Automated remediation for common issues. With an AIOps platform, it’s easy to not only automate remediation for known issues, but unknown issues, too. That’s because it can ingest data and also provide more intelligent insights as a result of it.

    The path forward is clear. Digital businesses are not only the future but they are today’s norm. Any IT leader looking to succeed needs to rethink their overall approach and embrace a future that includes complete visibility of their technology and application stack, and also a strategic approach that keeps their teams operating one step ahead of the curve.

    — Whitney Satin

  • Practical Advice on How to Use Lead Time

    Practical Advice on How to Use Lead Time

    Many ALM tools and Value Stream Management platforms graph lead time, but few really tell you what to do about it, how to use it and why you shouldn’t use the average. In fact, so much of what is written on this subject is rather vague and hand wavy. Part of the reason is that Value Stream Management is a big job, and it isn’t something a tool can provide. Rather, it’s a human endeavor. Another driver for the hand waving may be that the writers really don’t know much about lead time because they’ve never actually used it.

    Improving the value stream is a big topic but there are definitely things we can cover in this space: how to use lead time, how to get it, prerequisites to using it well, techniques or approaches and references for further study. I’ll start with the simplest, most mechanical topic, and move to the harder topics last.

    What Is Lead Time?

    Lead time is how long it takes a work item to get through a system, such as your IT development value stream. If your system is under control, recently measured lead times can be a good predictor for lead time in the future. People want to know when stuff will be done so they can make plans.

    Lead time is also a lagging indicator for many of the actions used to improve, well, lead time and flow. It’s what some people call an output metric—you make a bunch of improvements to the system and improved lead time is what you get out of your efforts. 

    Where to Start

    Measure lead time separately for the few types of work where it really matters, such as production defects and epics or initiatives. For every work item, record the start and end dates. But first you have to define what you consider the start and end. If you are using the measure to communicate with a customer, use dates from the customer’s perspective. If you are trying to improve the development part of the pipeline, post planning, then start the clock when it’s scheduled for dev. In that way, some people distinguish flow time from lead time. Cycle time is sometimes used for an even smaller slice of the value stream, usually just one step—I’m not going to debate here whether that’s a proper or official use of that term.

    Whatever you do, for heaven’s sake, don’t use the average lead time. Instead, use a percentile. I use the 80th percentile. For illustration, the 25th percentile is the point at which 25% of the observations fall below that point. The 80th percentile of your lead time observations (measures) is the point at which 80% of your historical lead time observations fall below that point. The 50th percentile is not always the median, but for the sake of this article we can say it’s close.

    Average, however, could be materially off. It’s worse to use the average than the median because the average can be thrown off by outliers more than the median and 80th percentile. If you are good enough with statistics to correctly identify and remove outliers, that’s great, but few people do that at all (much less with statistical precision) and it’s really not necessary for most IT work.

    The only thing I’d use the median for is to monitor the trend—to see if the median is improving. But using it for forecasting or expectation setting would be bad. You see, when using median, 50% of observations took less time, but 50% took longer. You wouldn’t want to tell a customer that he has a 50/50 chance of getting a fix in two weeks. Telling them they have an 80% probability of getting a fix in three weeks, in my experience, is more palatable.

    You want to be able to tell your customers (or marketing, management, support or program management) that 80% of the time you resolve this kind of issue in “n” weeks. Most people are happy with those odds. Anything higher takes in so much of the long tail of the distribution that it makes forecasts not terribly useful for planning.

    How to Get the Graph

    Use the lead time graph in your existing tooling if you can; get the data into a data warehouse and use a BI tool if you must; or use Excel only as a proof of concept or if your organization is small. More on this below. Compute your 80th percentile lead time expectation every sprint or month, and graph it in a bar chart so you have a new bar every period.

    How to Get the Data

    It’s easy to find the 80th percentile in your dataset. If your tooling can give you your choice of percentiles for lead time, that’s fantastic. If not, you’ll need to gather all of your lead time observations. You can do it in Excel, but then you’ll be forever updating Excel with fresh data or re-importing the data. That’s workable if you have a small number of teams and observations to input each sprint. Otherwise, you’ll want to get it into a database and make a BI dashboard. 

    How Much Data to Get

    You don’t need a whole lot of data.

    “Data beyond 24 weeks is most likely out of date,” said agile data and probabilistic forecasting guru, Troy Magennis. 

    How to Compute It

    In Excel, use the percentile.inc function. Generally, order your lead time data from smallest to largest, multiply your number of observations by 0.8, round up to an integer, then identify the observation at that location. Technically, you should average the two observations at that point if you didn’t have to round, but I’ve not found that materially significant in any of my data for these purposes so I don’t do it.

    What to Do with It

    I publish my 80% lead time expectation. I talk about it with the people who are anxiously waiting for the delivery. I talk about it with my engineering team. I talk about it with my management team, PMO, project managers and program managers. I talk about it with my lean and agile coaches and consultants and scrum masters. I talk about it with my team leads. I want everyone in the loop and on board with the improvement goal. I use it to explain how certain behavior, such as expedites and high work-in-progress (WIP), work against improving the lead time expectation.

    Look at your bar chart showing the changes in your lead time expectation over time. See if it’s moving in the right direction. Use A3s, Toyota Kata, lean principles and systems thinking to improve the system. Engage your upstream and downstream neighbors in the improvement process and in making process policies explicit.

    What if the Data Isn’t in One Tool?

    Change your process before you change your tooling, and don’t tool up a bad process. A common problem is when an organization doesn’t have the beginning and ending lifecycle states of a given class of work in a single tool. I didn’t say value stream here because you don’t need the whole value stream mapped for every class of work in order to get lead time. You can combine data from multiple tools in order to get the end-to-end, but the simplest thing that could possibly work is to have your top-level item reflect or approximate that end-to-end flow.

    Before deciding you need a new tool, there are a couple of easier approaches to try first:

    • Add the starting or ending date to the items of interest, whichever of those is missing. Sometimes I see those planning an initiative only track the item until it’s approved and released to engineering. It may be easier to add another date to that item and track it to delivery to production than to change tooling.
    • Add more steps to an existing kanban. Likewise, it may be easier to add additional columns to a kanban and keep the items on the board until they are in production. Or get them on the board earlier in their lifecycle.
    • Add another kanban. It may be that you don’t have a kanban. Your initiatives or your production requests aren’t tracked well. Get them in a kanban. This is not the same as changing tooling. You probably already have a tool that can give you a kanban. Use it. Every organization should have an epic kanban.

    Prerequisites

    You can use lead time as a lagging indicator of your process improvement efforts without any of these prerequisites. However, if you are using lead time to set completion date expectations, you should attend to these matters first: stable teams, predictable teams (stable throughput), a stable system (few process changes) and low WIP.

    If you are trying to make predictions, being predictable is helpful. A leading indicator for predictability is velocity variance or throughput variance. I compute that as the standard deviation divided by the average, and I want that to be 0.2 or lower. That 0.2 is the point at which the numbers are more reliable, in my experience with many organizations’ data.

    You need to have stable teams. Your organization will not be predictable if your team makeup is changing all the time, or if you are moving people around between projects or if you are allocating people to multiple projects.

    You need to control your WIP at every level. Put all of these on your metrics dashboard:

    • The number of items being worked on per individual. This should be one per individual, or less. It’s usually easier to gather this data at a team level. At a team level, the number of items being worked on should be less than the number of individuals. Encourage working together. If you are pair-programming most of the time, your WIP should be less than the number of pairs. With TDD, good test coverage and good continuous integration practices, you should be able to get multiple pairs on one user story.
    • The number of epics or initiatives each team is working on. This should be on your metrics dashboard, and list teams with more than one epic in progress. But remember, it’s not the team’s fault. Fix the system. Don’t blame the team.
    • The number of open sprints. This should be 1 per team. On your dashboard, list the teams with more than 1 open sprint.
    • The number or epics or initiatives the organization is working on. Graph this measure each sprint on a bar chart so you can see the trend. Work to improve (lower) the trend.
    • The number of releases being maintained (fixed, patched, level 3 support). Graph the trend and work to lower it.
    • The number of releases being supported (help desk, service desk, level 1 and 2 support). Graph the trend and work to lower it. 

    Conclusion

    Lead time, if tracked and used correctly, is a great predictor for how quickly work will be completed, allowing you to more accurately forecast delivery dates. You should measure it, talk about it and review it often to see what improvements have been made, and can be made. And remember:

    • Measure lead time separately for the few types of work where it really matters.
    • Use percentiles rather than averages for more accurate forecasting and expectation setting. 
    • Adjust your process before you change your tools.

    — Andrew Fuqua

  • New Relic Extends Reach and Scope of AI Capabilities

    New Relic Extends Reach and Scope of AI Capabilities

    New Relic this week announced it has extended the capabilities within its New Relic AI module to include support for additional data sources and provide access to more advanced analytics.

    Integrations with Splunk, Grafana, Prometheus and Amazon CloudWatch are now provided along with support for a number of incident management platforms, including ServiceNow, OpsGenie and VictorOps. New Relic AI previously provided support for the incident management platform from PagerDuty.

    DevOps teams can also surface more details about anomalies, including attributes that caused spikes, related signals to investigate root cause by looking at what happened around the anomaly and view upstream and downstream dependencies.

    Guy Fighel, general manager and group vice president for New Relic, said these and other capabilities being added to extend the capabilities of a monitoring platform that as a software-as-a-service (SaaS) platform provides a natural focal point applying machine learning algorithms to the massive amounts of data required to inform an AI engine.

    Other new capabilities being added to the platform include the ability to infuse correlations with decision logic to drive custom decisions and greater transparency into why and how correlations are performed.

    New Relic AI has also been enhanced to reduce the number of extraneous alerts that might be generated in addition to providing insights into the rate of total incidents correlated, total correlated issues, rate of noise reduction and the most common reasons why incidents are correlated. New Relic AI also provides access to a configurable set of filters to specify a grace period for each issue priority.

    Fighel said the goal is to make it possible to continuously evaluates telemetry data for anomalies and then share those insights via existing collaboration tools. To accomplish that goal, New Relic AI ingests multiple data types, including alerts, logs, metrics and deployment events.

    New Relic doesn’t see AI replacing the need for IT teams anytime soon. Rather, Fighel said AI will augment existing IT staff in a way that enables them to determine the root cause of any issue faster. Monitoring tools accessed via the cloud make an ideal platform for infusing AI into a service where data already reside, said Fighel. In contrast, other platforms require IT teams to aggregate massive amounts of data to enable an AI model to be trained.

    There’s naturally a high degree of skepticism when it comes to applying AI to IT management, but Fighel said it’s only a matter of time before AI capabilities are taken for granted. In fact, as IT environments continue to become more complex and there is an increased focus on driving down IT costs in the wake of the COVID-19 pandemic, it’s now only a matter of time before AI technologies become more widely adopted.

    In the meantime, DevOps teams should expect many of the rote tasks they need to perform today to become increasingly automated. That might make some members of the IT team uncomfortable, but before long most IT professionals won’t really miss aspects of their jobs that today are little more than pure drudgery.

    — Mike Vizard

  • GitHub Makes Private Repositories Free for Unlimited Users

    GitHub Makes Private Repositories Free for Unlimited Users

    GitHub this week announced is making available private repositories for an unlimited number of collaborators available to all GitHub accounts for free.

    Kelly Stirman, vice president of product strategy and marketing, said that subsidiary of Microsoft could make this move because it is now generating enough revenue from the enterprise edition of its platform to sustain its business model.

    Previously, organizations that wanted to use GitHub for private development needed to subscribe to a paid plan. DevOps teams that need access to advanced features such as code owners or secure access markup language (SAML) support will still need to upgrade to a paid plan. However, the cost of a paid Team plan has been reduced to $4 per user/month from $9 per user/month, effective immediately, as part of an effort to increase the use of paid plans around the globe. Existing customers of paid plans will also see their bill reduced, added Stirman. Alternatively, existing customers can downgrade their current plan to take advantage of a free service.

    The overall goal is to increase the number of projects being developed on GitHub, said Stirman. Many open source projects generally get started by small groups of developers that are not initially ready to share their code publicly. GitHub provides an affordable way to launch those projects among a core set of developers that may not have ever met one another.

    Stirman also noted private repositories on GitHub provide a much more cost-effective alternative to standing up a private repository in an on-premises IT environment that requires IT teams to provision and manage their own infrastructure.

    GitHub also tracks all the vulnerabilities that are discovered in open source projects hosted on the platform, which is information that is shared with every developer on the platform, added Stirman.

    Additionally, GitHub provides access to a content delivery network (CDN) to more easily share code across geographically distributed teams of developers, Stirman said.

    It’s hard to forecast how much pent-up demand there is for access to a free private repository for an unlimited number of collaborators. GitHub has previously made private repositories available for a limited number of collaborators. Nevertheless, Stirman said there was a massive spike of adoption on the first day the new plan was available.

    In addition, Stirman noted there has been a marked increase in the number of teams that are working on projects related to COVID-19 research.

    Of course, the more development teams that are exposed to repositories such as GitHub the more likely it becomes more of those teams will find themselves to varying degree embracing best DevOps practices. Invariably, those bet practices will then find their way into a larger number of enterprise IT projects. Undoubtedly, GitHub views making private repositories available for free as a method to create increased demand for the enterprise edition of its platform down the line. Of course, rival providers of continuous integration/continuous delivery (CI/CD) platforms will be seeking to convert as many of those projects into enterprise customers as well.

    — Mike Vizard