Category: Features

  • What happened to the “Ops” in “DevOps”?

    The wave of digital transformation that has been enabled by cloud computing has provided both new opportunities and fresh challenges. On one hand, it is now possible for application developers to provide innovative new functionality to end-users almost instantaneously. One the other hand, this agility has created an environment in which users expect constant improvements and demand ever-higher levels of service. Indeed, the need to increase agility and quality simultaneously is largely responsible for the growing popularity of DevOps practices.

    When I ask customers who say they are “doing DevOps”, the conversation always seems to revolve around speed. Iterate faster. Turn out more innovations and new features – multiple times a week. Pull in microservices from this cloud provider over here, program in polyglot languages over there, virtualize and automate everything on no-name infrastructure, and do it all as quickly as possible. Leverage continuous builds and immediately push to production in a perpetual beta model. Test only at code-time, or even not at all and instead let the end-users test it for you. Forget about run-time instrumentation and monitoring — just get the feature out the door, wait for social media to report any problems, and in the meantime, move on to coding the next feature.

    It all sounds fun and productive, in the same way that dot-com-era rapid application development was fun and productive. And it certainly can reduce the cycle time on new features and provide opportunities to introduce new innovations. But that scenario as described isn’t truly DevOps, and it is built around a dangerous assumption about unlimited end-user tolerance for failures.

    Take a break from coding the next feature, stop, and read the first paragraph again. If you look at it, the only actual “Ops” in it is the automation used to enable the development process and push to production. In other words, it’s all “Dev” – as if all important activities stop the moment an actual user touches the application. But does that make any sense? After all, aren’t we building all of these cool new features for end-users? And isn’t the reason that we want end-users to consume these features that the applications support a business goal of some kind? And for end-users to consume these features, isn’t it important that our applications actually work and provide high levels of service in production scenarios?

    Here are a few tips to ensure there is some “Ops” in your DevOps efforts.

    1. Stop denying there is a problem. IT Operations is “so ten years ago,” many say, because the infinite elasticity of cloud and built-in exception-handling of modern programming environments renders all of that old-school NOC stuff as antiquated as the pager those folks used to wear. But that assumption is patently incorrect – just look at November 2015’s “Black Friday” shopping season, which was a mess for many online retailers, as noted in the Wall Street Journal, Business Insider, CBC, Express and the Independent. IT Operations is more important now, not less. DevOps without Ops is not sufficient.
    1. Eliminate operational information silos so you eliminate finger-pointing. Collaboration is a central tenet of DevOps and yet most people troubleshoot through inefficient “war rooms” full of individual component owners who are feverishly looking through their individual consoles to try and ensure the problem isn’t with “their” stuff. Many of those well-intentioned component owners bang their own heads against the table in frustration about how hard it is to even access the information they need in the first place, not to mention the fun job of trying to manually correlate timestamps and hostnames between their and others’ individual operational data stores. There’s no reason to perpetuate the silos of yesteryear – instead, put your operational data in one place, and let today’s machine-learning-powered management tools do the heavy lifting for you. You will certainly reduce finger-pointing, troubleshoot faster, and you may be able to eliminate the “war room” entirely.
    1. Monitor what (really) matters – your actual end-users. The concept of real end-user monitoring (monitoring the actual activity inside of browsers, mobile devices, etc.) has been around for a while, yet remains an under-utilized capability in most DevOps organizations – perhaps because it used to be technically hard to implement. But that was in the past – today’s next-generation application performance monitoring tools make end-user instrumentation simple to deploy. It’s important to see real user activity not only because end-users are the whole point of the exercise, but because server-side monitoring alone doesn’t tell you what’s actually going on. As late as June 2014, in an Oracle Applications User Group/Unisphere survey entitled “Performance Under Pressure: The State of Enterprise Web App. Quality and Availability,” 85% of customers reported that usually learn about application problems from end-user complaints – a staggering number which is actually up from 79% in 2009. There is simply no excuse for such a reactive view of monitoring.
    1. It’s in the logs! Logs are everywhere, but most organizations don’t use them because they are overwhelmed – logs contain too much data, they are too widely dispersed and too hard for humans to decipher. However, logs represent one of the best ways for development and operations to collaborate together, since the logging that is enabled by application and platform developers only becomes full of information in production. Next-generation management clouds that are designed to ingest big data at enterprise-scale can cope with today’s log data volume and velocity – which can be on the order of terabytes per day. Once the information is collected, your unified management regime automatically takes you to the few individual rows in the few individual logs that correspond to the exact problem you’re looking for (at the moment you’re troubleshooting), this mountain of data can become a treasure trove of information. Similarly, if machine learning algorithms can discover patterns and anomalies automatically, your logs can become ongoing sources of high-value IT and business insights. The data is there, you just need to use it.
    1. Planning is an everyday activity. DevOps organizations are necessarily often focused “in the moment” – but future business results depend on accurate advance planning. In most organizations, planning takes place in artificial time windows (calendar year, budget year, off-season, etc.) with incomplete information and a whole lot of guessing – and is often performed by analysts with no direct connection to the operational context. Instead of viewing planning as a once-a-year exercise in an ivory tower, regularly leverage analytical capabilities against your unified store of operational information to answer a variety of forward-looking questions. Your DBA wants to know if she has enough database capacity for next year? Analyze at the individual instance level. Your marketing people are worried that you can’t support their upcoming launch? Analyze at the application level. Your CIO wants to know where people are spending their troubleshooting time and the corresponding health of your entire infrastructure? Analyze across your entire estate. If you’ve followed my advice in steps 1 through 4 above, you have all the data you need already available. Now it’s time to use it.

    But hang on a minute, you say. Let’s not forget that we are doing DevOps for speed – and all this management, while clearly useful, could take forever to implement and slow everything down in the process. A few years ago, you might have been right. But technology marches on and today’s cloud-based management regimes can be leveraged instantaneously, with no changes to your infrastructure, and start providing the kind of value you need within minutes. With cloud-based IT Operations Management, your DevOps efforts can truly combine development and operations best practices while still delivering the speed you need.

    No more excuses. Put the “Ops” back in DevOps.

    About the Author/Dan Koloski

    UntitledDan Koloski is a software industry expert with broad experience as both a technologist working on the IT side and as a management executive on the vendor side. Dan is a Senior Director of Product Management for Enterprise Manager – Oracle’s integrated IT operations and Hybrid Cloud Management product line. Dan holds a B.A. from Yale University and an M.B.A. from Harvard Business School.

  • Never Mind the Bollocks, Here’s the DevOps

    Never Mind the Bollocks, Here’s the DevOps

    What is DevOps?

    “DevOps is a cultural and professional movement” –Adam Jacob

    [movement (n): a group of people working together to advance their ideas.]

    So, who are these people and what’s the big idea?

    The people are system administrators, developers, product managers, QA technicians, security analysts, network engineers, and anyone else involved in the business of developing software.

    The big idea is to increase the value your product or service delivers, more quickly with less effort.

    (Having a product or service that is designed and built well isn’t inherently valuable. The value comes when your customer is able to use your product or service to solve a problem. DevOps is all about delivering value quickly and effortlessly.)

    DevOps practices and technologies are evolving, but here are some of the core concepts paraphrased–be sure to read the links in the footnotes for the full explanations:

    The Three Ways

    • Systems Thinking
      • Learning how everything is interconnected, from concept to customer
    • Amplifying Feedback Loops
      • Cutting the time between action and reaction, failure and success
    • Culture of Continuous Experimentation and Learning
      • Recognizing failure is important data about how and where to improve

    CAMS

    • Culture
      • It’s about how people relate and work, not something you can buy
    • Automation
      • Faster, less error-prone processes help amplify feedback loops
    • Measurement
      • You can’t get where you want to be until you know where you are
    • Sharing
      • Effective teamwork ignores organizational boundaries

    ICE

    • Inclusivity
      • Everyone is responsible for (and benefits from) these practices
    • Complex Systems
      • Because simple systems are simple
    • Empathy
      • Real collaboration requires real understanding of another’s point of view

    That’s the theory from a very high level; the following Q&A provides some broad explanations of related concepts. These are actual questions I was asked in a recent discussion of DevOps.

    Q: What specific skills or experience do I need before I can put “DevOps” on my resume?

    A: It depends. At this point in time when recruiters and/or hiring managers list DevOps in a job posting they are almost always looking for a “DevOps Engineer” (i.e. a sysadmin who knows just enough coding to be dangerous), or a “full-stack developer” (i.e. a developer who knows just enough about system management to be dangerous). The reality is that (as of today) there is no DevOps certification, organization or even manifesto, so anyone who pretends to authority on what is and isn’t DevOps is overstating their case at best, a charlatan at worst.  

    Q: What is source control?

    A: Source control is a repository for files that make up a modern software application during development. It maintains a historical record of changes so it’s easy to review (or rollback to) changes made to an application’s source files. The most popular source control technology today is Git, and GitHub is one of many online services used to manage Git repositories.

    Q: What is Jenkins?

    A: Jenkins is to task engines or “build servers” what Kleenex™ is to facial tissue. It’s currently the most widely used software product for automating various functions of software build and deployment. For example, a system might be configured such that any code change pushed to source control triggers a job in Jenkins to build, test and deploy that code.

    Q: What is configuration management (e.g. Salt, Ansible, Puppet, Chef)?

    A: Configuration management is a means of scripting server configurations so it’s easier to track, deploy or make configuration changes to large groups of systems.

    Q: What are containers?

    A: In the same way that server virtualization allows you to have many isolated “virtual machines” on a single physical machine, container technology allows you to have many isolated application environments on a single operating system. Containers have been around in Unix/Linux for a long time, they just boomed in popularity when Docker came along and made them easy to use. The next version of Microsoft Windows Server (2016) will introduce Windows containers.

    Q: What are microservices?

    A: Microservices are small, independent components of a software application that are built, tested and operated in isolation from the core product. Using microservices enables development to be faster and more nimble than possible when working with a large, monolithic application.

    Q: What is Continuous Integration/Delivery/Deployment?

    A: Continuous Integration is the practice of continuously integrating (and testing) new code with your existing source code. Continuous Delivery is the practice of automating as much of the build/test/release process as possible while still requiring a manual push to production. Continuous Deployment is the practice of fully automating build/test/release all the way into production.

    Q: Are there any conferences or meetups I can attend to learn more?

    A: Yes! The original DevOps conference is DevOpsDays and there are many of these events around the world annually. A popular conference with large enterprises is the DevOps Enterpise Summit.  Various DevOps-related meetups (#CoffeeOps on Twitter) are springing up around the country. Check the CoffeeOps.org website for details, or search for DevOps at Meetup.com.

    Q: [Do I need to understand everything above | Is this all I need] to be or do DevOps?

    A: Absolutely not, on both counts. You can successfully implement a DevOps way of thinking/working by incorporating all or just some of the above, and there are many other tools and practices around delivering value more efficiently. Naturally there are extensive resources available (a few linked in the footnotes) to do a much deeper dive on all these subjects.  

  • 7 things 2016 has in store for the future of DevOps and IT

    7 things 2016 has in store for the future of DevOps and IT

    With only a couple weeks left in 2015 it’s time to start looking ahead to what next year has in store. Let’s be honest—most of us have already mentally checked out for the holidays anyway, so it’s already 2016 for all intents and purposes. I spoke with a handful of industry experts to get some thoughts on what we have to look forward to in 2016.

    Let’s just jump right in:

    1. Log Management will play a larger role

    According to Christian Beedgen, CTO of Sumo Logic, log management will emerge as the most underrated opportunity for IT. “Thinking about log data may seem too far in the weeds for most tech industry professionals. However, using analytics to monitor, manage and gather insights from logs will be the only near-perfect way to make sense of the increasingly complex and cloud-based architectures.” Log management isn’t exactly new or cutting edge, but Beedgen believes that 2016 will see more vendors trying to move into the log management space, and more organizations trying to use log management to make sense of their big data mess.

    1. Business leaders will demand better insight

    On a similar note, Rick Fitz, senior VP or IT Markets for Splunk, believes that analyzing data and metrics will also play a role from a business strategy perspective. “In 2016 we will see data science demystified, moving from Ph.D. to MBA, with easier ways emerging to consume, analyze and correlate machine data. As business leaders increasingly go digital, this will result in greater “digital insight” into engagement, satisfaction, competition, effectiveness, response, revenue and other business goals.”

    1. Sharing economy will transform IT

    Companies like Uber and AirBnB have transformed entire market segments. The sharing economy has changed the way businesses engage customers and deliver services, and that includes IT through aspects such as cloud services, microservices, APIs and more. Fitz predicts, “Next year this ‘Uberfication of IT’ will turn into a ‘Balkanization of IT,’ driving stakeholders to demand better insight, governance and control of federated technologies to integrate adoption, usage, monitoring, security, cost control and more across shared services.”

    1. Enterprise DevOps will grow rapidly

    The DevOps revolution has taken IT and app development by storm in recent years, but most of the traction has been in startups or smaller businesses that have more freedom to shift gears and embrace new concepts. Enterprise adoption has been growing, but at a much slower rate. Andi Mann, chief technology advocate for Splunk, said, “In 2016 we will see rapid acceleration of DevOps with 50 percent or more of large businesses finally adopting ‘Enterprise DevOps’ — a pragmatic, scalable approach to adopting the culture, process and technology changes at the heart of DevOps.”

    1. The singularity approaches

    OK. That may be an ominous over-statement. In a nutshell, Sumo Logic’s Beedgen claims that the line between machines and humans will continue to fade. The foundation of this is automation—leveraging technology to perform mundane or routine tasks and sift through mountains of data exponentially faster than a human can. As artificial intelligence evolves, though, the scope of what can be automated expands as well. “In automating processes, a human can today wield the power of a legion of operators with a single hand,” stated Beedgen. “Likewise, machine learning will increasingly be adopted for its usefulness in augmenting human understanding of complex interaction and large data sets by uncovering the unknown unknowns.”

    1. Automation and analytics will improve IT service health

    DevOps and microservices have transformed many areas of development and IT infrastructure, but many organizations still rely on decades-old monitoring tools, arcane metrics, and specialized admins dedicated to managing the cumbersome process. Splunk’s Fitz thinks that is getting ready to change. “In 2016, IT analytics will be liberated as easy-to-use dashboards will correlate all sources of service health—legacy tools, APIs, mobile apps, Web logs, wire data, containers and more—while predictive analytics will automatically respond to prevent quality issues.”

    1. DevOps is here to stay

    From the point of view of DevOps practitioners or companies that have adopted DevOps tools and practices, this may seem both painfully obvious, and yet still be good news as well. Christian Beedgen predicts not just that DevOps is here to stay, but that the importance of DevOps and the sphere of influence affected by DevOps will expand. “Increasingly, DevOps will permeate all manner of businesses that rely on information technology to compete. Bimodal IT (the practice of managing two separate, coherent modes of IT delivery) will become the equivalent to “private cloud”—the last forced resistance of the old guard. Both will be forgotten in a short number of years, as public cloud and lean and agile processes dominate the businesses that still compete.”

    There you have it. Now you can enjoy your holiday break in peace and come back in 2016 with an idea of what you have to look forward to in the year ahead.

  • Getting Rugged DevOps Right

    Getting Rugged DevOps Right

    Two Perspectives

    Jack, an accomplished application security pro, tells me, “The developers won’t talk to us.  It’s like we speak a different language.  They are releasing new builds so fast, how could they check each one for security vulnerabilities?  We can’t move as fast as they do.”

    Then in the next moment, Diane, a DevOps pro, let’s me know, “Our current security team’s tools and practices can’t keep up with the pace we have now established.  If it doesn’t fit, it doesn’t get done here.”

    I have heard this little ditty ‘bout Jack & Diane so often in the past two years, it could be a hit record. I imagine you have heard it too.

    The Slow Lane Won’t Lead to Rugged DevOps

    Let’s visit Jack’s world, first.

    When visiting a well-known bank last month, they shared insight on their current application security practice.  They have 10 full-time people employed (offshore where personnel costs are lower) to analyze a set of 100 applications.  The bank has over 2000 applications, but the security practice can’t scale to access their entire portfolio.  In 2.5 years, they had only been able to cover 5% of the application portfolio.

    The application security team employs an application security tool originally built for waterfall-centric development timelines.  As much as they want it and need it to move faster, it is not really for “continuous” velocity.

    Each scan of an application can require anywhere from four hours to two days to get an assessment report.  The reports average about 30,000 potential defects which then require further analysis.  That analysis may take up to two weeks in order to sift through thousands of false-positives and false-negatives.  While this security practice is critical to the bank, it cannot keep pace with development practices that are aiming to go much faster in order for the bank to remain competitive in their industry.

    The Continuous Gap

    Sound familiar?  It should.  This scenario is playing out all across the DevOps and Continuous Delivery landscape.  It is reflective of what I call “The Continuous Gap”.

    Leaders in Rugged DevOps practices aim to minimize the “Continuous Gap”.

    In Diane’s world, DevOps teams pursue “shift left” strategies in an effort to build quality in from the beginning.  Shifting left enables them to bake in the right code, components, configurations, and practices from the beginning.  When done right, velocity increases dramatically, while operating costs are minimized, and unplanned/unscheduled work is reduced.  Investments can then shift more in favor of innovation over upkeep and maintenance.

    The Old-School Rub

    Jack’s world of traditional application security practices often wait to check for security vulnerabilities at testing or release stages of the SDLC.  There are two reasons for this: (1) some security tests like static or dynamic analysis can take hours or days to perform and (2) security teams cannot embed themselves earlier in the SDLC (due to political, organizational, or operational obstacles) without dramatically slowing development in a high velocity world.

    If you are using old-school application security tools, you will continue to be blocked from getting more deeply entrenched in development.  New velocity requirements call for new approaches.

    The New-School Shifts Left

    A number of newer application security solutions and practices been introduced recently that are development and developer-centric.  For example, imagine if build managers could analyze every open source component used in every build for known security vulnerabilities.

    What if, developers could access information inside their IDE that would inform them if a component they were planning to use in an application was known to be vulnerable?  What if developers had access to spell-check like alerts of security issues as they were creating their code?

    Furthermore, imagine if information was available that not only told the developer of a known security defect, but directed them to an alternative safer version of that component to use.  Components would be automatically vetted against corporate security policies at the instant they were chosen by a developer.  When 90% of an application is composed of open source and third party components today, automatic analysis early in the lifecycle save millions of dollars.  This how Rugged DevOps rolls.  This is Diane’s world.

    The evolution of Rugged DevOps is forcing application security practices to shift left.

    But Diane’s world (and your’s for that matter) are not just about increasing velocity.  All organizations need to consider operational costs to both detect and remediate security vulnerabilities in their applications.  We all realize that the further along we are in the application development lifecycle the more costly fixes become.  Feel free to apply your own cost figures to the chart below, but you should also note that these calculations do not include breach cost, help desk calls, maintenance, time-to-market, reputation or stock price.

    Rugged DevOps
    Cost considerations for Rugged DevOps practices compared to waterfall approaches.

    Rugged DevOps: Shifting Gears…Quickly

    Shifting from old-school to new school approaches doesn’t take long.  On a recent visit to one of the largest insurance companies in North America, they shared their tale of transition.  Of five major applications that run their business, one in particular had 40,000 different files that needed to be analyzed.  Their old-school approach involved a lot of manual code investigation and required about two-and-a-half weeks to complete the analysis of that large application.  The new approach that used automated analysis of security vulnerabilities took two minutes — and produced identical results.

    A government tax office wanting to shift security analysis of applications from hours (outside of development – Jack’s world) to seconds (inside of development – Diane’s world) was able to complete the first pass analysis of their existing portfolio of 600 applications within two working days.  The security team was not only faster at identifying known security vulnerabilities in applications, but could also quickly identify alternative open source and third-party software components that were safer to use.  The security team was not simply discovering issues, but the new class of Rugged DevOps solutions were aiding in guided remediation.

    Questions to Ask About That Rugged DevOps Solution

    There are several companies and open source projects that now offer application security solutions that work at extremely high velocity.  When exploring solutions to match the velocity of your Rugged DevOps practices, consider asking the following questions:

    1. How long does it take to complete the analysis of a small, medium, and large application?
    2. Do developers use these tools, or are they only meant for security personnel?  Do you have members of development teams that act as positive references for your tool?
    3. Does the analysis require further investigation of the findings, or does it pinpoint the root cause of the issue?
    4. Does the solution only identify vulnerabilities or does it help guide remediation of issues?
    5. What is the balance of false positives to positive alerts generated by the solution?
    6. How many people are employed to support the solution in environments similar to ours?
  • DevOps and IT Support: 4 Principles to Keep Your Team Ahead of the Curve

    DevOps and IT Support: 4 Principles to Keep Your Team Ahead of the Curve

    Here’s the million-dollar IT question: what is DevOps and why does it matter to IT support?

    Short answer: DevOps advocates collaboration between Development and IT Operations. It’s about constant communication, breaking down silos and a culture of collaboration. The DevOps movement has made great headway and many companies have adopted and are employing DevOps practices – Netflix, Amazon and Google to name a few.

    But where do IT support teams fit into a DevOps environment? 

    When developers launch new features and services, it’s the support team that deals with issues and interactions with frustrated customers. Change is often the enemy of stability. But because innovation can’t be stopped, IT support teams need to catch up. That means making their operational environments resemble the way their software is developed. The problem is that IT agents and developers have different methodologies, work in different systems, and practically subscribe to different technology religions.

    The silos only exacerbate the challenges that the support team ultimately faces:

    • Scattered data limits incident and problem understanding.
    • Deployment failures have a high risk of downtime. And too often, changes are made that IT support doesn’t know about.
    • Support feedback often represents customers, and doesn’t always get communicated to development, product owners and product managers.

    DevOps is ultimately a culture change. When all teams commit to a collaborative approach and common goals, it can shift the entire mindset from silos to working together to deliver better services. Agile, Lean and Kanban are popular approaches that facilitate rapid iteration, learning and information sharing. This means you shorten the feedback loop necessary to drive business agility.

    CAMS, DevOps and IT support

    How do we put DevOps principles into practice for IT support? Over the past 20 years, IT has built up a strong governance model based on ITIL and that can’t be forgotten overnight. While putting new practices isn’t easy, the best way to make big concepts real is a model that covers people, processes and systems. Luckily the CAMS mode coined by Damon Edwards and John Willis at DevOpsDays Mountainview 2010 [1].

    It stands for Culture, Automation, Measurement and Sharing.

    Principle 1: Culture

    The model leads with culture, as it’s the most important facet to DevOps. Support teams learning from and supporting DevOps practices requires a cultural shift. While command and control is comforting, DevOps calls for speed and agility. Daily or weekly rituals can facilitate this cultural shift. Some rituals you can apply to your IT support team include:

    Be sure to focus on results, not just the activities. It’s not about the number of changes but the results of those changes.

    And finally, understand team behaviors. Culture is a result of habits. You need to understand how your team works together, and what you can improve.

    Principle 2: Automation

    To move fast, you can’t do everything by hand. Automation is another principle of DevOps, but is most effective when it supports the people and processes in place.

    Go from trapped knowledge to shared knowledge

    • Known errors should be tracked at the time of deployment and communicated to support. Sound simple? You’ll be surprised how often it doesn’t happen.
    • Support should link articles to incidents and problems, so everyone understands what’s causing the issues

    Shift from orphaned tickets to linked tickets

    • All teams should be responsible for ticket linking and documentation- including the service desk, admins, developers, and operations, so everyone knows what’s going on.
    • Link incidents, problems and requests to all associated changes and releases.

    Don’t just deploy, but support

    • Continuous integration, continuous delivery, and continuous deployment are core to the First Wave of DevOps – thinking about the performance of the overall system. Support needs to be prepared to support, operate and ensure their ability to restore services. They need to know what’s being deployed and when, so they can give the right answers to the customer.

    Help with testing

    • Automated testing is key to a DevOps environment. Every time a developer commits code, they need to make sure all the code is operating the way it is expected to. If it breaks, tests can catch failures before anything is deployed and delivered. Support teams hold data about various customer environments that should be continuously fed back to testing.

    Keep up with monitoring data

    • Proactive monitoring helps developers stay ahead of problems before they snowball. In the same vain, support teams can identify customer problems faster by keeping aware of proactive monitoring and linking it back to their own incident management systems.

    Principle 3: Measurement

    Keep track of metrics that matter. Once you’ve established your individual and team goals, It’s important to measure how you’re tracking to those common goals. How long does it take to recover from failure? Try measuring ‘Mean Time To Repair’ (MTTR) and whether it increases or decreases over time. Here are a few other metrics your support team should keep in mind:

    • How many repeated issues do you have? Measure repetitive incidents and how often they occur in a period.
    • Are you meeting your targets? Measure service level targets in your service level agreements and operational level agreements in the context of deployments.
    • What are your costs? What’s your cost per incident, along with the total cost of support? Take this in context with downtime costs. In some cases, increasing support costs may be the best thing to do to minimize impact to the business.

    Principle 4: Sharing

    And lastly, when it comes to sharing, ask yourself these questions:

    • Does the organization understand what we’re doing? Do we share that understanding?
    • Do all teams understand each other’s goals, hardships and priorities?
    • Does your team’s outputs of processes flow with other team’s processes?
    • Is knowledge shared across teams? If it’s in a system, is it accessible?
    • How is your team collaborating with others? Are there unbarred channels for communicating?
    • Are the right stakeholders kept in the loop of your projects, even if they’re not in your immediate group?
    • Do your IT groups – development, operations, testing, support and even the business – share ownership of successes, failures and learnings?
    • Do teams share tools and information? If not, do those tools integrate with each other?

    Faster, better IT service is about culture, sharing and tools that enable your teams

    A collaborative culture is critical to success in DevOps. Aligning support and development can help your organization understand what services the business wants and needs to be productive.

    About the Author/Sid Suri

    Sid Suri-2Sid Suri is the Vice President of Marketing for JIRA Service Desk. He’s worked in various technology marketing roles over the last fifteen years at Salesforce.com, Oracle (CRM), InQuira (acquired by Oracle) and TIBCO Software. He has an MBA from the Haas School of Business and a bachelors in Economics and Italian from Middlebury College. He lives in San Francisco, California.

  • Why we are still fighting with the same problems in DevOps as 15 years ago

    Why we are still fighting with the same problems in DevOps as 15 years ago

    One thing that continues to fascinate me is how after so many years I can still walk into IT organisations and see basic practices not being followed (e.g. Software Configuration Management or Continuous Integration or …). Shouldn’t we all know better?!? I recently came across some slides from the late 90s and early 2000s that pretty much read like something that comes from a DevOps conference today. So I wonder what is it that has prevented us from being better today and I think I found a feasible answer to my question.

    For illustrative purposes I have used the Accenture DevOps maturity model, but feel free to use any other model here as the tendency would be similar. I believe that as an industry we used to be better than we are today (of course all generalisations are dangerous, including this one). While it is hard to find hard evidence for this, let me try to justify my perspective.
    DevOps Journey

    More than 10 years ago we had much more custom development to solve the big problems and most work was done onshore in collocated teams. The only way to be more productive and reduce cost was to have better engineering practices and leverage more automation, hence companies invested in this. We used to be on the mature end of consistent in many places. Then two trends caused us to regress as far as engineering practices are concerned:

    • Offshoring – With the introduction and mastering of offshore delivery, the industry had an alternative to automation and good engineering practices as labour arbitrage was providing a quick fix to cost reduction. It was potentially cheaper to do something manually offshore than maintaining or introducing automation onshore. Of course this couldn’t last as the labour cost offshore increased steadily. Some organisations stayed the course of engineering practices and automation others lost maturity along the way. This trend is similar to the same trend in manufacturing where manual labor became so cheap that automation wasn’t a critical element to cost reduction anymore. Those companies who went offshore did not sufficiently focus on automation and good practices as it was harder to oversea this with across locations and cost reductions were easy to achieve.
    • Packaged and proprietary Software – As we leveraged more and more packaged and proprietary software we relied on those vendors to provide the solution to our productivity challenges. This led over time to island solutions, which supported specific packages, but are not open enough to integrate into the IT ecosystem. How do you baseline an enterprise wide software package when configuration management is hidden in a package or worse still configuration is only possible through a graphical user interface with no access to the underlying source code/text files? The pre-packaged software was a quick fix to get functionality, but again the good engineering practices were lost out of sight. And many organisations make so many customisations that they should really treat the original “COTS” just like any other application with the same rigor. The other problem that packaged software introduced is that the people customising them are often considered or consider themselves not to be programmers (which means they don’t have to worry about those practices that the custom application developers use), a dangerous mistake in my view.

    “Speed is the new currency of IT and businesses”

    This was all well and good when cost as expressed by the cost of a day of labor was the main driver for optimisation in organisations. This paradigm has shifted and nowadays speed to market is driving incentives and behaviour. Organisations across the globe are trying to find ways to speed up their delivery processes without risking quality. But how do you now revert the trend that many organisations followed – your IT organisations is mainly outsourced and/or offshored, you have an application architecture that is a mix of packaged software, proprietary solutions and custom elements and you lack the engineering experience and skills to fix it.

    This is where we need to acknowledge that DevOps is a journey that is different for every organisation. Of course there are the engineering driven organisations like Etsy, Amazon and Facebook that have engineers/IT people in their C-suite of executives who intuitively understand the importance of application architecture and good engineering. I believe they won’t ask you for a business case for what is ultimate an optimisation for speed and flexibility – they understand how important good IT is – at least I believe that to be the case. They will also consider which applications to introduce into their ecosystem and making sure that those are open products for which good engineering practices can be employed. In other organisations the adoption of DevOps practices needs to be supported by business cases that are often difficult to create (especially in the middle maturity levels where the pain is not at mission-critical levels and the full benefit of highest maturity is not yet in arms reach). Organisations that are on this journey with the majority of us in the industry need to acknowledge the sometimes intangible nature of improvements. Speed to market and other cycle time measures should be the guides for your journey.

    “Everyone is on the DevOps journey, whether you know it or not”

    The question whether “you are doing DevOps or not” is not valid in my view. We are all on the DevOps journey, it’s the journey of improving delivery of IT solutions. DevOps is a broad field and provides us with an ever growing toolkit of practices and tools. All of us IT Executives are on the search to improve our organisations and our delivery capabilities. What label we use for that doesn’t matter as long as we keep moving forward and keep experimenting. Is there a goal to this journey? No, I don’t think there is concrete goal, a state when we declare we are done. I think the best of us will keep pushing forward no matter how good we are getting at it and from what I have seen during my travels there is still plenty of road in front of me that I can see and I don’t need to worry about getting “there” anytime soon in any case. Join me on the journey and may our paths cross to share stories of our adventures on the road.

  • Carving through the hype – take the DevOps maturity assessment

    Carving through the hype – take the DevOps maturity assessment

    As anyone who spends time with their family over the holidays can attest, the notion of maturity is a highly subjective concept.

    Whether it’s sizing up the next generation’s advancement or defaulting to time-honored inter-sibling behaviors, annual get-togethers offer tangible proof of what’s new and those things that likely won’t ever change.

    In the domain of DevOps – an umbrella concept that encompasses a massive array of processes and supporting capabilities – gauging the maturity of your organization’s standing is also a highly interpretive task.

    Given that “DevOps” means something different to nearly every organization, based on its unique makeup, methodologies, tools, and most importantly, business goals, attempting to measure progress against any outside model may seem an effort of limited value.

    That said, as an increasing number of organizations seek to embrace DevOps, and growing recognition that well-worn stories of leading-edge “unicorns” don’t relate closely to most people’s real-world expectations, many teams are left wondering where their own efforts stand, especially in comparison to their peers.

    To help acquit this pursuit, and allow organizations to scope their progress, CA recently launched the second iteration of its online DevOps Assessment.

    Split into three short surveys covering core limbs of the DevOps tree – “Develop and Test”, “Release and Deploy”, and “Manage and Monitor” – this free tool offers detailed insight into how your organization’s maturity stacks up to that of other practitioners.

    For instance, in the domain of development, how well do your teams fare in defining and managing requirements, and then presenting them to others in a structured manner? Related to release cycles, are your teams truly meeting business-driven expectations for more frequent application deployments, shorter lead times, and higher success rates? Or, when it comes to applications monitoring, are you able to distinguish the most critical and recurrent problems and how they truly impact business services?

    These are perhaps some of the most fundamental questions that one could apply to measurement of DevOps adoption in general, but further investigation attempts to take a closer look at more finite, underlying issues.

    Are your development teams accurately replicating realistic conditions from production systems to create virtual services and testing scenarios? Are your application release deployments fully automated across development, test and production environments? Can your teams monitor complete business services that link user experience, transactions and applications to infrastructure to pinpoint any root cause issues?

    The best thing about the survey is that it immediately provides visibility into how your answers compare to those of previous respondents. There’s no fuzzy math or editorial interpretation (though we may highlight trends in a report at some point), merely instant validation, and the option to create a customized report card charting where your efforts stand in relation to those of your peers.

    If you’re wondering precisely just how to achieve your long-term DevOps goals comparative to where you stand today, it might even be worth leveraging some of the involved questions for the purpose of evolving process and methodology.

    The only remaining questions are: Do you think that you’re ahead of the curve? Are you afraid to find out just how far you’re behind the crowd? And most importantly, what do you have to lose?

    Take the survey today and get a real-world fix on your overall level of DevOps maturity. Guaranteed it’s a far more informative activity than debating family and friends over whose turn it is to carve the turkey, or wash the dishes.

  • DevOpsSec: 1 in 16 Chances

    DevOpsSec: 1 in 16 Chances

    The quantitative research summarized below, covering over 7,000 repositories across nearly 100 countries, highlights some of the challenges with quality at modern development velocities, especially important for DevOpsSec practices. By leveraging automation in your repository manager, you can improve application quality and reduce unplanned work while lowering exposure to risk. While this practice supports DevOpsSec initiatives, at its core, it is simply a focus on “building quality in”.

    (Written as a collaboration between me and Mike Hansen, Head of Products at Sonatype; Mike wrote the better parts.)

    Innovation and Risk

    Repository managers like Nexus, Artifactory and Archiva have been serving software components for development teams and their tooling for years now.  We can measure over 70,000 active repository manager installations across the globe today.  Use of a repository manager improves build performance and reliability while also providing a secure, private location to host open source, third party, and proprietary components needed across continuous delivery and DevOps tool chains.

    Industry averages show software development organizations electively downloading over 240,000 components a year from public internet repositories.  While these components accelerate development and increase innovation, the vast majority of components go through little to no vetting process to determine if known security vulnerabilities, risky license types, or outdated/unsupported are being used.

    DevOpsSec: tracking known vulnerabilities requires better hygiene.

    Earlier this year, researchers found that 1 in 16 downloads includes a known security vulnerability. That accounts for over 15,000 elective downloads of components with known security vulnerabilities per organization, per year.

    Why the Focus on Repository Managers?

    Repository managers like Archiva, Artifactory, and Nexus have become a critical piece of the DevOps toolchains and are commonly used across the entire application lifecycle. It is effectively a binary parts warehouse for your applications. Given how integral this warehouse has become, software supply chain intelligence and automation can be used to significantly reduce unplanned work and eliminate avoidable risk.

    To understand this opportunity, let’s take a quantitative look at the world’s software development ecosystem.

    Global Visibility

    Not long ago Sonatype introduced a free feature in its Nexus Repository Manager that is providing new data on the health of software supply chains.  This features, called Nexus RHC (Repository Health Check) – offers a simple way to get basic visibility into what OSS is flowing into development via your repository manager.  RHC provides a summary of components in the repository that have known security vulnerabilities and risky license types. Usage of this service is now significant, with over 30 million components across over 15,000 Nexus instances being analyzed every day across the globe.DevOpsSec: identifying known vulnerabilities.

    There are also around a million developers using those repositories. With the law of big numbers working for us, we can gain a statistically valid view into the behaviors of the modern software development ecosystem. The findings are quite telling.

    The Data

    We analyzed over 7,000 repositories containing 500 or more software components using the RHC service during the past 90 days. These repositories are representative of those used by development teams in medium to large organizations. The question was straightforward: To what extent are bad things flowing in, causing downstream rework and creating avoidable risk scenarios?

    In three months time, the average number of new vulnerabilities that flowed into the repositories analyzed was 69. That is an average of 23 vulnerabilities per month, which is a little more than one every weekday. If you only include higher risk vulnerabilities – those with a CVSS score of 5 or greater – the average number was 48, or about 16 per month. That is a little less than one every weekday. For a sense of the kind of vulnerabilities in this higher risk category, the Heartbleed bug had a score of 5, the lowest risk in this grouping.

    DevOpsSec: tracking known vulnerabilities.

    These are not isolated instances or outliers. In the set of repositories analyzed, 98.3% consumed at least 1 vulnerable component and 97.7% consumed at least 1 higher risk (CVSS >= 5) component. In a period of just three months, nearly every repository consumed something the organization running it would rather not have, and that is only with respect to known vulnerabilities. There are plenty of other attributes that are worthy of consideration given availability of the corresponding data.

    Whether or not security is of particular concern, the real point is that a lack of visibility and control combined with an abundance of supply has led to inferior quality parts routinely being used by the world’s development organizations, adding avoidable risk and slowing us down.

    Image title

    Going (Way) Beyond Security

     

    The consumption of vulnerable components is a quantifiable problem that we used to illustrate the current challenges that every organization has with open source component selection. However, security vulnerabilities are only one of the many dimensions.

    DevOpsSec: Surveys show the need for improved OSS governance.Others include architectural aspects such as rules covering component age and popularity, intellectual property coverage with rules related to open source licensing and technical debt controls associated with technology stack selection.  Introducing more formalized vetting processes coupled with software supply chain intelligence and automation will yield significant overall quality and efficiency benefits for an organization, allowing them to operate with a lower risk profile.

    Yes, A Firewall for Repository Managers

    In November, Sonatype became the first company to introduce a “firewall” for use with repository managers.  Called Nexus Firewall, the solution offers perimeter quality control for software development. Similar to a network firewall, it leverages rules you define that automatically shield an organization from unacceptable software components entering and another set for stopping them from exiting your application development. The basic concept looks like this:

    Nexus Firewall: shifting DevOpsSec further left than ever before.

    In order to build quality in from the beginning, this solution represents a “shift (far) left” innovation.  The Nexus Firewall improves speed and reduce risk through the quarantine of components with known vulnerabilities. With a repository firewall in place, organizations can shield your application development from waste and risk by automatically blocking unacceptable software components inbound and preventing release of applications containing such components outbound.  1 in 16 downloads with known security vulnerabilities could be reduced to zero in 16.

    The firewall also goes beyond blocking, providing organizations with the visibility and data needed to make ideal decisions for open source component selection early, significantly reducing waste related to rework and eliminating avoidable risk.

    For DevOpsSec, Shift (Far) Left to Build Quality In

    The consumption of these unacceptable or, at a minimum, inferior components is unnecessary.  For the vast majority of these vulnerable components, there are non-vulnerable alternatives ready to be used in their place. The challenge is that it has been historically difficult for developers to understand these risks and even harder to avoid them.  Few developers have countless hours to commit to researching vulnerabilities in the components they use and fewer more want to rely on colleagues in security, legal, or audit teams to spend hours or weeks to return with “go” or “no go” vetting decisions.

    The volumes and velocity of component consumption we see today validates that any form of manual review process or automated workflows outside of the development teams will be quickly outpaced.  DevOps and Continuous Delivery processes need to rely on automatic intelligence to help developers select the highest quality components and avoid those with known risks.  When known security vulnerabilities and other risks are identified, software supply chain intelligence will be required to guide developers through the identification and selection of safer, higher quality components.

    An example of the kind of information made available is shown below.

    DevOpsSec: Identify the best components that meet policy guidelines from the beginning.

    The information is divided into two areas. On the left side is component data, which includes details related to the component itself. To the right, there’s a graphical display of any security or license issues, as well as popularity data for each version of the component displayed. Selecting different versions updates this information accordingly, including whether or not a particular version passes the established criteria.

    A Must for DevOpsSec: Quality at Velocity

    Simply by enabling a repository firewall, organizations can immediately improve quality and reduce waste and exposure to risk. None of this comes at the expense of development speed.

    The repository firewall automatically quarantines components that do not pass your rules preventing quality issues from entering the software being developed, immediately reducing risk and avoiding wasteful rework at some later point. Quality is improved, efficiencies are gained and risk is reduced, all through automation and all at the speed of modern development.

    One of my favorite reference books is Continuous Delivery by Jez Humble and Dave Farley.  Let me share a few of their words to help remind us of the importance of innovations and practices that allow us to bring pain forward.  Jez and Dave remark:

    “The techniques that we describe in this book, such as continuous integration, comprehensive automated testing, and automated deployment, are designed to catch defects as early in the delivery process as possible (an application of the principle “Bring Pain Forward”).  The next step is to fix them  A fire alarm is useless if everyone ignores it.  Delivery teams must be disciplined about fixing defects are soon as they are found.”

    Well said Dave and Jez.  Well said.

     

  • DevOps Leadership: Leading a DevOps Revolution in Pay TV

    DevOps Leadership: Leading a DevOps Revolution in Pay TV

    The State of DevOps in Pay TV

    Pay TV is largely rooted in an ancient operator model. “Operators in this industry usually take a year or longer to release new code into software. Their Ops teams are focused on making sure that existing environments never fail,” says Mark Hydar, Head of DevOps, Ericsson TV Platforms. That is as opposed to moving to the CI and CD of DevOps with their continually changing environments.

    Newer Pay TV models that revolve around sending TV shows to a web browser in exchange for a modest monthly subscription arrived with DevOps and evolve faster because of it. Older models where you offer a set top box for a consumer’s home TV are still transforming sluggishly, taking small bites at adopting DevOps.

    “An operator such as a Vodafone has customers who pay a lot of money for the reliability that comes with the set top box model. It’s on a big screen, the customer uses a remote, and they demand 4K and to be able to connect it to their home audio system. The expectation with that is that it never fails,” says Hydar. Environments of constant change such as DevOps where the perception is that the risk of failure is high present a lot of apparent / assumed conflict for operators and ops teams supporting the legacy model.

    Moving Operators to DevOps

    These operators need a guiding hand as they take baby steps toward fast and ferocious innovation and improvement. “Our approach is to first educate the operators’ directors and above on what the consumer tells us they want. Our field research and R&D tell us that by 2020, there will be a lot more connected handsets and smart devices out there,” says Hydar.

    The current generation, the Millennials, have “surpassed the Gen-Xers as the largest generation in the U.S. labor force”. This generation is spending less time in front of a fixed screen and a lot more time with mobile screens, says Hydar; operators need to figure out what they can do to stay aligned with what the current consumer wants while protecting and growing the revenue they currently have with “cord cutters”.

    Ericsson next works to help operators roll innovations out to customers faster by adopting Agile methodologies and moving to a DevOps deployment model while learning how to sustain that model, according to Hydar. But this transition only happens as Ericsson aids its operator customers in dealing with an expected level of internal apprehension and hesitation by bringing each internal group along a bit at a time.

    For example, Ericsson will recommend that operators and their CIOs take existing data center engineers who address trouble tickets and retool their skillsets so that they can look at software bugs and start to think more like developers.

    “Once we suggest that, the CIO will often feel like, wow, and then there will be some push back, some resistance, and what-if questions. Over a period of a month or two, there will be a high volume of pointed questions that come to us, but that goes away,” says Hydar. Operator leadership eventually wraps their heads around it, see the benefits, and translate the changes to a lower cost of ownership, says Hydar.

    As for the operations side who are still keeping the status quo up and running, Ericsson simply informs them as to what is coming down the pike in a very positive way. “We tell them how it is going to make their life better and how they can accomplish more,” says Hydar.

    When approaching the test and development teams, Ericsson focuses on how they test and roll software today, introduces them to how they can innovate and deliver software faster, and leads them to want to align with that process. “They start to see the benefits and gain momentum both on the test and development sides,” says Hydar. Development begins to change.

    Finally, Ericsson goes back to the Ops teams and brings them together in summits where they discuss the speed of delivery of some the software projects, and the test findings. “The Ops team starts to take notice. They want to learn about Agile. That’s where you introduce training in what it takes to be a Scrum master, what DevOps means, and how they as operations people can integrate themselves with development,” says Hydar.