Category: ITIL

  • Tackling Audit Compliance as Code

    Tackling Audit Compliance as Code

    Do the words, “It’s audit time!” make your stomach sink? If so, you’re not alone. Assisting with evidence collection for compliance audits around PCI DSS, SOC-2, ISO 27001, NIST and HITRUST is a drain on DevOps teams’ time and resources at companies of all types and sizes – time and resources that could be better spent driving innovation.

    The good news is, vendors have taken notice, and are delivering new tools and platforms that use automation to eliminate repetitive manual tasks and dramatically speed the audit process. This is entirely in line with the DevOps philosophy of tackling various IT tasks and requirements “as code” to remove tedium and improve efficiency and orchestration. In fact, as this movement to improve the compliance process picks up steam, I believe it’s entirely likely the next evolution is the use of open APIs and online communities where engineers can build and share software to automate a wide variety of evidence collection for compliance.

    But before we can get there, let’s understand where we are today and assess new opportunities going forward.

    Audit Support: DevOps’ Favorite Task

    As keepers of cloud environments, DevOps teams typically spend hundreds or thousands of hours each year gathering evidence for compliance audits. This tedious, manual labor takes significant time away from their primary job responsibilities. Large enterprises often have multiple, overlapping audits each year, with little break from the grind of evidence collection. Companies that make heavy use of the public cloud face additional challenges; the increased complexity means that evidence collection is more difficult, and the fast pace of software development and change management in the cloud (compared to more traditional monolithic application updates) makes it difficult for compliance to keep up. This contributes to an overall lack of clarity and confidence in the compliance process at the leadership level.

    Audit Prep as Code

    When I ran a cloud engineering team at a previous job, we realized the vast majority of repetitive, manual labor involved in evidence collection could be automated to save time and free up resources for other business needs. This automation also improved the completeness and accuracy of the evidence gathered, ensured that important areas weren’t overlooked and allowed for more regular assessment to prevent “drifting” out of compliance in the fast-paced cloud world. While automation helps with multiple aspects of compliance audits (such as evidence-to-control mapping and cross-walking evidence across common control frameworks), it’s the automation of evidence collection that primarily impacts DevOps.

    In this scenario, automated collectors crawl your public cloud environments and connected SaaS systems to rapidly gather technical evidence such as specifics on user access, encryption of data at rest, key management, network segmentation, firewalls, vulnerability scan reports and more. The results are transformed into formatted reports ready for internal review, analysis and auditor review/approval. This, alone, can save thousands of hours annually for typical enterprises facing multiple audits. Even better, the data is considered more complete and accurate from a compliance perspective, because it includes time stamps and other metadata to ensure capture and processing integrity.

    As mentioned, this is well aligned with the broader “X as code” mantra that underlies many DevOps automation initiatives – and why not? What could possibly be a more repetitive, manual task than capturing, renaming, organizing and describing screenshots?

    The Scripting Curse

    When confronted with evidence collection, an engineer’s first thought is usually, “I can write a script for that!” Scripting is a form of automation, but it has some limits in this scenario. First, scripting and doing the necessary QA shouldn’t be your day job; there are better things to spend time on. Second, given the explosion of cloud infrastructure and SaaS apps, there can be a lot of scripts to create. In fact, it’s arguably a never-ending task. Finally, while you understand your scripts, who’s doing the next audit? If it’s not you, are you going to explain and train someone else on all the work you’ve done? Scripting elements of evidence collection is an improvement over doing it manually, but is still only one piece of the larger puzzle.

    Compliance is a Community, not an Island

    So what’s the best way to automate evidence collection? Multiple vendors are tackling the challenge, from cloud platform providers to established GRC vendors and cloud compliance startups – and new tools have already begun to hit the market over the last few months.

    But as discussed, a primary challenge is that there is a lot of complexity in most cloud environments, and tools that approach the puzzle from only one direction – say, a particular cloud platform – still leave a lot of potentially relevant systems untouched. In fact, when you take all of the variations possible with cloud infrastructure into account, this might, ultimately, be a challenge that is best tackled at the DevOps community level.

    Consider this: adherence to industry standards for data handling, privacy and protection is not a competitive issue. We are all better off if everyone shares a basic commitment to complying with these IT security and compliance standards. Viewed from that perspective, the more we can lower the barriers to achieving this compliance, the broader the adoption will be.

    What I hope to see is a DevOps community that coalesces around automating audit readiness. At the engineering level, this could entail sharing of custom collectors. For platform and SaaS vendors, it means ensuring open APIs that allow capture and extraction of relevant data. And the compliance tool vendors must design their collection engines, evidence libraries and usage policies such that customization and sharing is possible. Similarly, automation tools must not only pull data from standard systems, but support pushing data from custom systems or legacy infrastructure. In my view, this bottoms-up approach is the best way to stop wasting DevOps’ time on audit prep, while still allowing enough autonomy to do what works best for their specific environment.

    In this future, then, perhaps an upcoming compliance audit won’t produce a collective groan from the DevOps team – or at least, generate a quieter one.

  • ServiceNow Adds Low-Code Tool to Platform

    ServiceNow Adds Low-Code Tool to Platform

    ServiceNow today made available an update, dubbed Quebec, to its Now platform that adds a set of low-code application development tools.

    Marcus Torres, general manager for IntegrationHub and vice president of platform product management at ServiceNow, said the Creator Workflows tool leverages existing App Engine and IntegrationHub capabilities in the platform to make it possible for both end users and professional developers to build custom applications faster using a visual development tool dubbed App Engine Studio. A set of templates that provide a set of pre-built workflows is also included.

    The goal is to make it easier to develop applications that would otherwise not be built because professional developers, using existing tools, would simply not have the time, Torres said.

    The Quebec release of the software-as-a-service (SaaS) platform is also used for IT operations management (ITOM), adding artificial intelligence (AI) capabilities in the form of ITOM Predictive AIOps that surfaces potential issues before they become a major issue. It is now also easier to set up the virtual agents that ServiceNow makes available to enable conversational AI, and there is now an AI search capability built into the ServiceNow portal. ServiceNow gained these capabilities via its recent acquisitions of Loom Systems and Attivio.

    Finally, ServiceNow has added process optimization and workforce optimization modules, along with an engagement messenger module that extends the self-service capabilities it provides to third-party portals, and a universal request tool that enables agents to collaborate and transfer tickets across departments while keeping employees informed of the status of their ticket.

    Thanks to the general enthusiasm for digital business transformation initiatives being accelerated in the wake of the COVID-19 pandemic, reliance on low-code tools to build applications has significantly increased. The challenge organizations encounter, however, is that a low-code tool can build a relatively simple application. However, development means may need to drop down to a lower level of abstraction to address more complex issues as an application continues to evolve. The Creator Workflows tool from ServiceNow is designed to provide development teams with that option.

    In general, ServiceNow is making a case for building applications on the same platform that many IT organizations already employ to manage IT. Many organizations already take advantage of workflows that ServiceNow has built to extend its core platform to address a wide range of uses cases involving, for example, human resources applications. The addition of the low-code tool will make it easier for IT teams to create applications that address use cases unique to their organization.

    Of course, there is no shortage of options when it comes to low-code and no-code tools these days. IT teams will need to decide to what degree platform-specific low-code tools make sense versus adopting low-code tools that enable them to build applications that can be deployed anywhere. Regardless of the path forward, however, it’s clear the number of applications that need to be deployed is dramatically increasing with each passing day.

  • How to Eliminate Incident Inefficiencies

    How to Eliminate Incident Inefficiencies

    In today’s complex, dynamic IT environments, the proliferation of disparate IT Ops, NOC, DevOps and SRE teams and tools is a given – and usually considered a necessity. This leads to the inevitable truth that when an incident happens, often the biggest challenge is collaborating between these teams to understand what happened and resolve the issue. Inefficiencies suffered during this critical stage can have huge impacts on how much each incident costs the business.

    I recently sat down (virtually) with Sid Roy, VP of client services at Scicom, to get a deeper understanding of how IT leaders can more effectively size up these inefficiencies and eliminate them.

    The Costs of IT Incidents

    When asked what a minute of downtime costs, analysts and vendors may provide different answers – but they are more or less aligned around the same order of magnitude – several thousands of dollars per minute. And with an average of five major incidents a month and an average time of six hours for resolution, this easily amounts to millions of dollars a year.

    The three key drivers of these costs are:

    Staffing and team member costs: This includes full-time employees (FTEs), consultants, and overhead when other teams are pulled in to deal with the incident. For many organizations, this can include offshore incident response teams.

    The direct and indirect costs of an IT incident: This includes your infrastructure or capital expenditures like software licenses for monitoring, log and event management, notification, ticketing, collaboration, etc.

    The business impact of an IT incident: This is one of the most challenging and unpredictable variable costs to calculate or manage, and is often the highest of all three drivers. It includes revenue loss/delay or reduction due to a major incident, and the profit or loss due to brand or goodwill impact. It also includes inefficiencies suffered by other parts of the business when critical services they depend on are degraded or unavailable.

    Fragmented Teams Magnify the Challenge

    The incident volume, complexity and throughput obviously affect the number of people and amount of time needed to deal with them and often drive more indirect costs as needed resources pile up. To save on these millions of dollars of costs, you need to be able to collaborate and lower MTTR. As mentioned above, this becomes a challenge in agile IT environments. To help streamline operations, teams need to start asking and answering several key questions:

    • Do you have an up-to-date map of your critical services?
    • Are they prioritized by business criticality (revenue, number of customers, other supported services in the supply chain)?
    • What are the upstream and downstream dependencies of these applications?
    • Have you identified the major infrastructure and application elements in your environment?
    • Are you aligned with the owners of these systems?
    • Do you have real-time knowledge of changes being done to the infrastructure and applications?
    • Do you have monitoring gaps?
    • Which monitoring tools provide you with the best value?

    Answering these questions involves overcoming fragmentation across teams of people, processes and tools – essentially integrating ITSM and ITOM to enjoy the benefits of contextual full-stack visibility and streamlined processes within the organization.

    The Right Combination for Incident Response

    What is the right combination of people, processes and tools we just discussed? Here are the two main guidelines:

    • Set up a major incident management team – ideally, from your existing staff. This team includes three vital roles:
      • The incident manager/incident response commander. This is a designated role in charge of declaring a major incident and taking ownership of it. Their job is to, essentially, stop the bleeding of revenue and costs.
      • The NOC/monitoring team. This is your front line defense. When things go bump in the night or boom in the day, they’re the ones picking it up with their “eyes on the glass” – 24/7. And, they’re in charge of reporting and creating full situational awareness for the incident command through bidirectional communications.
      • The production support team. This team actually effects the required changes and executes the remediating action.
    • Deploy event correlation and automation tools to enable the incident management team. These tools are key, allowing your team to perform the required actions.
      • First, correlate the alerts created by your monitoring and observability tools into a drastically reduced number of high-level, insight-rich incidents by using machine learning and artificial intelligence (ML/AI). Add context to these incidents by ingesting and understanding topology sources, as well. This creates the necessary full-stack visibility and situational awareness.
      • Then, use ML and AI to determine the root cause of these incidents, including correlating them with data streams from your change tools: CI/CD, orchestration, change management and auditing to identify whether any changes in your environment caused these incidents.
      • Finally, automate as many processes as you can to free your IT Ops team from manual, time-consuming tasks. By integrating with collaboration tools, you can also enable the above-mentioned bidirectional communications.

     

  • Future-Proof Your Product Development Life Cycle

    Future-Proof Your Product Development Life Cycle

    In product development, change is vital. In fact, some might say that product development is the embodiment of change. Continuous improvement keeps products from becoming stagnant, which, in turn, keeps companies afloat.

    While change is important, it’s not always helpful, especially when it involves the management of employee attrition and retention. Over the last year, many organizations have witnessed how an uncertain business environment can leave their workforce in chaos. Every year, thousands of experienced developers and engineers in the product development ecosystem leave their jobs, taking valuable tactics, insights and tools with them to their next role. Though these workers often pass on their expertise to those who take their place, without formal systems or standardized processes for gathering that information, much of the knowledge will be lost. The ultimate result is an increase in development costs and deployment delays.

    We’ve all heard the phrase, “You don’t know what you’ve got until it’s gone.” When it comes to an employee, that individual’s informal knowledge isn’t always easily captured by existing internal company processes. To retain and protect this knowledge, companies need technology that makes it easy to gather, store and access for future use.

    Enter future-proofing, the process of using digital tools to capture knowledge and make accessibility seamless for future employees at various stages of product development. Employing future-proofing strategies will help IT company leaders and decision makers ensure a continuum throughout the product development life cycle.

    Future-proofing is especially vital in this age of digital transformation, as it helps address common concerns that crop up about collaborative environments, team efficiencies and product integrations. Let’s take a look at what this entails.

    Future-Proofing in the Age of Digital Transformation

    The best-case scenario for adept future-proofing in the age of digital transformation is to have product development adapt alongside any systemic changes. Under these terms, software solutions that holistically capture both formal and informal knowledge are the secret to future-proofing the product development process. An effective digital solution will help you do this in three ways:

    • Comprehensively enables collaboration: A comprehensive solution will give users a single source of truth to track decisions, questions and problems. Unlike a shared Excel spreadsheet or Word document that can get overwritten, forgotten, corrupted or contains incomplete, fragmented information, future-proofing tools can effectively gather, store and then pass along knowledge.
    • Increases team efficiency: By working from a single source, teams can capture knowledge – often without even realizing it – through feedback and team communication. Additionally, a single source of information reduces design inconsistencies and discrepancies.
    • Seamlessly integrates digital tools: Because product development does not rely on a single digital system, solutions need to be integrated across different digital tools and throughout the product development life cycle. By integrating with tools that track development and with other information gathering and tracking solutions, knowledge is captured at multiple levels, streamlining future projects.

    Overall, fostering an environment that encourages teamwork is the best way to ensure knowledge sharing and preservation. However, when that is not possible, companies need to have a backup plan. By merging talent with technology, you can capture both formal and informal knowledge before an employee walks away, and, therefore, future-proofing your product development life cycle.

  • AIOps in Service Management: Removing the Noise

    AIOps in Service Management: Removing the Noise

    AIOps (artificial intelligence for IT ops) refers to the automation of IT operations through AI and machine learning. With every organization working rapidly toward the ultimate goal of digital transformation, there is a natural place for AIOps within service management as a means to automate processes and automatically spot and react to issues in real-time. But what exactly is AIOps, and how does it remove the noise from service management?

    AIOps: Taming the Growing Complexity of IT

    Digital transformation has resulted in IT infrastructure complexity growing at an astronomical rate. The resultant increases in infrastructure data and alarms at the service desk far exceed the capacity of any human to meaningfully read, analyze and respond to them. The infrastructure itself is also constantly morphing and changing, yet service desks are still expected to resolve requests, incidents, and performance issues in seconds – an impossible task, given the volume of data.

    AIOps provides the necessary firepower to address this exponential rise in data, using artificial intelligence to continually monitor and analyze changes in the IT infrastructure in real-time. By combining these insights with service desk automation, organizations can benefit from a closed loop of discovery, analysis, detection, prediction and automation which, combined, bring us closer to the enviable goal of self-healing IT.

    Two Phases of AIOps Implementation

    The implementation of AIOps falls into two phases: discovery and analysis.

    Discovery

    The discovery phase involves uncovering all of the compute, network and storage entities across your ever-changing IT environment and ensuring your configuration management database (CMDB) is always kept up to date. But just knowing what is on your network is only the first step – you then need to determine how each asset relates to, or depends on, each other. This dependency mapping stage requires tracking of dynamic, multilayered relationships between applications and hybrid infrastructure, and creating rich, visual topology maps so that you can immediately see where dependencies lie within the network, and, therefore, where potential bottlenecks or risks reside.

    Analysis

    With your CMDB now kept up to date with automated discovery and dependency mapping, you now need to make sense of this data. After all, data is useless if you can’t use it to make informed decisions. By applying machine learning algorithms to analyze this data, AIOps can identify patterns, spot anomalies and predict future outages.

    Why AIOps in Service Management?

    AIOps has many benefits within the larger service management context. AIOps can:

    1. Support, not hinder, rapid digital transformation – with automatic discovery and dependency mapping, AIOps allow the business to continue to invest in new IT services without upsetting those in operations that need to keep the lights on.
    2. Reduce downtime – with automatic reporting of anomalies, operations can address potential issues before they result in a service outage.
    3. Automatically update the CMDB – An accurate CMDB is the foundation of successful IT operations. If your CMDB is out of date, then you are left trying to solve problems blindfolded. Just make sure your AIOps supports hybrid environments, so it can discover all IT assets from physical to virtual infrastructure, on-premises to public cloud, etc.
    4. Remove noise from the service desk – AIOps helps the service desk to overcome alarm noise and determine which events need their attention by eliminating false positives, performing advanced event correlation, reviewing time-series event playbacks and determining probable root cause.
    5. Actualize self-healing IT – no longer a myth or an IT operator’s dream, self-healing IT can be realized through AIOps. By automatically triggering actions based on the findings of the machine learning engine, AIOps can quickly fix issues or prevent them from happening, whether it’s a network link that’s gone down, an over-utilized disk or a service that simply requires a restart.

    Operations is not known for being a calm and relaxing environment in which to work. When your role is primarily a reactive one, there is rarely time to be proactive. You are bombarded with alarm bells and error reports all day long. How can you tell the difference between a false alarm, an isolated incident or the early indicators of a bigger problem? AIOps, leveraging machine learning, has finally provided IT operations with the tools needed to make sense of this growing barrage of data.

  • DevOps Chat: ITIL 4 and Achieving High Velocity IT

    DevOps Chat: ITIL 4 and Achieving High Velocity IT

    In this DevOps Chat, Mark Smalley of Smalley.IT, and Lead Editor with AXELOS of the ITIL 4 High Velocity IT joins ASG CEO Mitch Ashley to discuss his work creating this new contribution to ITIL 4. Mark shares the 5 value investments important for organizations seeking to operate at high velocity and some of the insights gained from himself and others covered in this ITIL 4 module.

    As usual, the streaming audio is immediately below, followed by the transcript of our conversation.

    Transcript

    Mitch Ashley: Well,  I have the pleasure today of being joined by Mark Smalley. Mark is Lead Editor of High Velocity IT, part of the ITIL 4 initiative. Mark, welcome. He’s also with Smalley.IT, I believe a one-person firm. Welcome, Mark. Would you please introduce yourself, tell us a little bit about you and the kinda work that you do?

    Mark Smalley: Sure, Mitch—thank you, thank you. Yeah, Smalley.IT, I’ve been on my own for about eight years now; previously, around 30 years at Capgemini and other managed application service providers. So, very much on the application side, very much on the service provision side. That’s really my background. The personal background—born in London, but have lived in the Netherlands, just outside Amsterdam, for about 45 years now, which is not a bad place to be.

    Ashley: No, not bad at all.

    Smalley: One of the recent—yeah, one of the recent initiatives I was involved with was the AXELOS ITIL 4 update, responsible for the emergence, I say deliberately the emergence of the high velocity IT module, because it was quite an interesting process, pulling in knowledge from various areas in IT service management, but also agile DevOps and out of the IT space completely. For instance, some people may have come across The Toyota Way, the management book about the Toyota manufacturing process. Professor Jeff Liker at Michigan University, he kindly contributed a bit to the book about the Toyota Kata, which is about an improvement method based on scientific thinking. So, drew in people from various fields to try and get this thing off the ground.

    Ashley: That’s gotta make it really fun and engaging, too. Why don’t we start out with what do we mean by it? What’s a good definition of high velocity IT? How would you give kind of a working definition of that?

    Smalley: I’d first qualify it by saying it’s not actually high velocity IT, but it’s more about higher velocity IT, because high would imply that there’s low and you say, you know, “High is good, low is bad”—well, that’s not the case. We’re on a gradient, on a spectrum from lower to higher velocity. We’re looking at the kind of organizations that you’d say would be more digitally enabled than most.

    So, the kind of organizations that use technology to do things significantly differently or even do significantly different things because technology enables them to do that. And that requires a different way of thinking, a different way of working than many people are used to. So, the book’s about different ways of thinking, different ways of working, and primarily the people in the IT service management space who are now confronted with this digital stuff and how do we deal with that? And trying to get them—it’s sort of a guided tour through the kind of things that you come across in these more highly digitally enabled organizations to encourage them to unlearn the old ways of working that aren’t effective any more and integrate new ways of working, new approaches in how they do stuff.

    Ashley: I think one of the really important and kind of fascinating parts of your work on this, Mark, is it’s not just about the bubble of IT or the bubble of my part of, my role in IT, it’s that high velocity for the whole organization and how you all work together. And I know it really—there are many places to start, but clearly, product management, there’s some outcome that we’re doing all of this work for, some product or service or offering that we have, and that’s a great place to really engage in kind of a systems thinking about this.

    Smalley: Yeah, very much so. It’s taking the end to end perspective. We’ve defined five objectives to give us a bit of guidance in this space, talking firstly about valuable investments—are you doing the right thing in the first place? Are you automating the right kind of business processes? Are you building digital products and services that are appealing to the marketplace? Are you doing the right thing? Fast development—are you doing it quickly? Resilient operations—once it’s up and running, is it resilient? And deliberately using the word resilient rather than reliable, because the kind of systems we’re dealing with are often complex and therefore unpredictable in their nature. They will fail.

    Ashley: Mm-hmm.

    Smalley: You know, these are fail-safe systems, these are systems that should be safe to fail, so it’s about the resilience—how quickly can you get the systems back up and running? Then the fourth objective is co-created value. Then again, you have that broader chain; that’s when IT starts engaging again, with the user community, in that intricate and even intimate dance that they do together that’s, you know, to help the users derive value from the investment. And finally, the fifth overarching or underlying objective is all of the above—assured conformance, it should be able to assure conformance to governance risk and compliance requirements, whatever they are in your kind of organization.

    So, it certainly is, what you said, the big picture, end to end.

    Ashley: Mm-hmm, very much makes sense. You know, it’s interesting—tell me if this jives with what you’ve experienced. Highly reliability, the best way to do it is don’t change anything, right? Make it very stable. But we live in a world where business needs to execute quickly, but also dynamically to react to changing market conditions—you know, pandemic being a great example of that.

    Smalley: Yeah, yeah, yeah.

    Ashley: A tragic one, but very much one that’s outside of our control—but also, you know, offensive strategies to go after markets and that, and the degree that the whole chain, the whole kind of supply chain of the organization working together can effectively do that quickly and reliably, but also resiliently, because you want to be able to experiment and try things. And maybe you need to fail to find the right answer for product mix or whatever.

    So, I’m sorry, I don’t wanna go on too long, but it seems like that’s an underlying driver behind all of why you took this approach, at least in part.

    Smalley: Yeah. Well, certainly, if you look at the dominant thinking behind most of the guidance there’s something behind it. There’s that concept of co-creation, realizing that you don’t do stuff and chuck it over the wall, you have to engage with other stakeholders—one of the things.

    The other main thing is dealing with, working in complex environments. Again, using that word complexity in the sense of complex adaptive systems, organizational systems where you simply can’t predict what’s gonna happen and where you, because of the volatility, the unpredictability of stuff, you can say that’s bad but from a research and development perspective, you want to be able to, you know, 10 initiatives will fail, but it’s that 10th one that’s gonna make you millions. You’re gonna benefit from that unpredictability.

    So, it’s really, it’s from the start, through the whole life cycle that you’re dealing with the—with the unpredictability which, for many people in IT service management, is a bit disconcerting, because if you go back—go way back, and you look at where people came from, IT service management people were very much concerned with the stability of systems and putting a wall around them with the best of intentions, with the belief system safe is good, whereas the developers had a different perspective—fast is good. So, you’ve got this fast versus safe. And seemingly, irresolvable, that conflict.

    But if you look at it creatively—and this is something that we’ve got a lot to credit the DevOps community for, and we reference extensively stuff that’s gone on in the DevOps world in the High Velocity IT book. The idea that if you—and it goes back to lean as well, lean in particular, agile a little bit—working with small batches of work, if you do work in small batches and more frequently, then you reduce the risk, ________ smaller changes and less risk in bigger changes. And the interesting thing comes along now—if you do changes more frequently, instead of saving them up for each, you know, masses of changes each quarter, no, do them every day, then you develop your capability to change effectively.

    So, paradoxically, you’ve turned it around completely. The more often you change—small changes—the better your change capability and therefore the more confident you can be that the changes will go through pretty safely.

    Ashley: Mm-hmm.

    Smalley: And it’s interesting, the groups that have to interact together, like, if you’ve got a DevOps group or a classic IT service management group, they identify with their own belief system, and often, the belief system is, you know, safe is fast—sorry, safe is good as opposed to fast is good. And how do you—you know, you’ve got to get these people together and talk about this stuff to resolve the apparent conflict. But it’s great stuff trying to build bridges between these communities.

    Ashley: Yeah, I’m totally with you and thinking of the sort of lean mindset and agile and iterative, which is very much where software product and organizations have moved to or are moving there. What are the—how do you deal with some of the legacy silos and sort of that self-protection of don’t change things or don’t, you know, let’s focus on keeping things stable or whatever the mantra of those individual groups are? How can this book, for example, this module help people start to expand their thinking around those issues?

    Smalley: Well, firstly, if you look at organizations, they will vary in velocity across the various divisions and departments. So, firstly, you’ve got to take a look at which part of the organization are we looking at? What is the appropriate velocity in the business there? What kind of cadence applies to their work? Interesting looking at the pharma industry that’s traditionally been highly regulated with very long periods in which they work. There’s no point speeding things up if you have to wait years before you move to the next stage. It’s like doing the Olympic games—you don’t want the stadium there earlier; there’s no point. So, it’s got to be very much aligned with the business velocity.

    So, look at the specific parts of the business and, depending on the kind of speed—and possibly, you’re dealing with legacy systems that don’t need to go that much quicker. And the advice we like to give in the guidance is, the first couple of statements, the guidance is not complete, and the guidance is not intended to be prescriptive. We don’t pretend to be able to dictate, proscribe how people should act. Rather, we’re trying to encourage them to take a look at the 9 concepts and models that we’ve adopted, the 25 techniques to see which techniques do you think would apply to you. So, be selective, pick and mix, take a few things out, experiment with them, see if it works in your environment.

    Because this is going back to lean, you mentioned lean, going back to the lean movement, you’ll probably know many of our listeners, audience will know that the Toyota production system was the precursor to the lean movement. And one of the grand figures in the TPS Toyota Production System, was Taiichi Ohno, who came up with some wonderful sayings, one of which is, “You should think for yourself and face your own difficulties. Don’t try to borrow wisdom.” So, in other words, how another organization has done something, that’s not gonna work for you. You have a different kind of organization, so you really do have to dig deep and look at the specifics of your situation and pick the various parts that you think apply to you and just experiment and see whether they work. So, it’s—

    Ashley: Really more of an adaptive approach versus prescriptive, right? It has to be done a certain way because one organization succeeded at it that way.

    Smalley: Yeah, no, and of course, it’s very tempting, but people are looking for the quick fix. There’s a fabulous cartoon, if anybody wants to look up a great cartoon, if you look up “Simple but Wrong, Complex but Right” it comes up with a great cartoon and you see people following—there’s a sign pointing in two directions of people, the masses are following the sign “simple but wrong,” because they’re looking for a quick fix.

    Ashley: Mm-hmm.

    Smalley: And what better than looking at how another organization’s done stuff and say, “You know, let’s do that.” It’s not a good idea, usually. [Laughter] So, you do have to be very, very critical, very selective.

    Ashley: Well, these are systemic changes, they’re not quick fixes or just change this one thing of how you’re working and suddenly you’ll get different results. And one of those is, we think about specialties or specialization of what we do, but we’re also now thinking, it’s specialty roles, but it’s also how those things work across the life cycle development operations, product teams. So, individuals and teams’ abilities to work cross functionally is a much higher order skill than maybe we valued in the past.

    Smalley: Yeah, look at the—I think we can kind of credit the DevOps community for something, but look at the agile community, how the concept of multi-functional, cross-functional product teams have emerged where you’ve got business analyst disciplines, development disciplines, testing disciplines all working together.

    It’s interesting to think about the definition of done that they often apply as a concept that you’ll come across in agile and scrum, you know, “When are we done?” It often, in the scrum world, it ends with a potentially deployable increment of software, potentially deployable. The key word is potentially—it hasn’t been deployed yet. So, it’s just asking for an extension of that domain of the team to not stop when it’s deployable but actually deploy it, so start involving the DevOps kind of competencies as well. Then you could extend it further to the service area, because product owners should be aware that the kind of product that they’re building, that needs to be accessed by people, and service is the vehicle that gives users access to your product. You built a great software product, but it’s only through the vehicle of service that people get to it.

    And is the product owner,  is the product team looking as much at service as they should be? And I think that’s often not the case, and I’d certainly like to, in the role of bridge builder, like to encourage product teams to take a closer look at service and think about the kind of characteristics the service experience as well that they expect their users to have. So, you can see a service substrate going through all of the life cycle, really, alongside the software and infrastructure artifact.

    Ashley: I’m curious, you mentioned design earlier and maybe this is what you’re referring to. I’m curious if design thinking or the design approach is something that also influenced your work on this module, the idea that you’re really, the outcome isn’t the car, the outcome is the experience that the customer, the user of that vehicle has and expects, you know, from whatever the product is that you’re creating. Did that influence this work, too?

    Smalley: Yeah, two things, there—design thinking, we’ve referenced more at the start of the process, thinking about the kind of specifications requirements that people have. But towards the end, thinking about the service experience, and you’ll be familiar with the concept of service level agreements, which are often unfortunately formulated. We talk in terms of availability and performance and security and stuff like that—all very technical.

    But how do the users feel about this? We’re slowly extending that domain service level agreement to include experience level agreements, looking at outcome and how people feel about their engagement with either their technology or the people behind the technology. So, again, that’s that human co-creational dimension that you see in high velocity IT, alongside the technology.

    Ashley: Mm-hmm. Yeah, the SRE world, I don’t know if we’ve talked about that, but it has this idea of service level objectives, which is a little less formal and restrictive as what we think of contractual SLAs of, each team really, you know, defining what they’re trying to strive for, for the service that they’re trying to deliver and the experience that people have. So another area, SRE, is a great one.

    Smalley: Yeah, no, that’s in there as well. SRE is certainly something that significantly contributes to more resilient operations, just like chaos engineering, another of the techniques that we reference. But speaking about agreements, certainly, you should measure stuff. Whether you—you know, the trouble is, once you put something into an agreement between two parties, people start to game the system. Things—I think it’s Hawthorn’s Law. It’s like as soon as you make something explicit, intrinsic motivation evaporates.

    Ashley: Mm-hmm.

    Smalley: Yet you do have to agree something with other parties. So, it’s really, it’s a delicate balance, you know, what’s gonna work in this situation. Also looking at the relationship that you have with your customers and other stakeholders—so, assessing what kind of relationship, what kind of agreements and measurements are appropriate for each particular situation.

    Ashley: I was thinking about, too, when you mentioned resiliency, and previously, you were talking about sort of the iterative nature, doing work in much smaller increments—that also gives more flexibility for change. So that, you may have a feature turned into a story that might be delivered over multiple iterations in an agile process, and somewhere in that process, you may have part of it released, but you may move on to other things or shift what you’re actually doing. So, it’s a way of dealing with some of the dynamic, changing needs of the business.

    Smalley: Yeah, it’s—we reference four characteristics of the approaches that you’ll find in these kind of organizations. We reference lean, agile, resilient, but also continuous, and I think that fits into this category.

    You know, things are changing all the time, so it’s interesting when you’ve got these traditional discussions between business people and IT people. You’ve got IT people almost blaming business people for the fact that the world has changed, who it’s the kind of the core values that you have, the belief system you have, if you have the belief system that things are changing all the time and that’s just part of life, that’s a given, then you don’t resist as much. We certainly try to encourage people to embrace and enable change as well. We used to talk about change—management change control, which seems to be a bit defensive. When now, it’s just language, but even then, we like to talk about change enablement—how can you get changes done as quickly and safely as possible?

    Ashley: Very interesting. Yeah, words do matter. What’s the state of the community, the ITIL community in the adoption of some of the principles around lean and agile and DevOps and SRE. Are most folks starting to become aware of or are they educating, are they practicing? Where would you say we are in this journey?

    Smalley: Yeah, well, I forget who said it. Somebody said, “The future’s already here, it’s not just evenly distributed.”

    Ashley: [Laughter] Yeah, that was Stephen Hawking or someone.

    Smalley: Yeah, that’s right, yeah. You know, some people are doing it. I’m very pleased to see on LinkedIn or Twitter a response from an organization in the U.K. that says, “This high velocity IT stuff, this reflects the things that we are doing.” This is a guy on the joint DevOps and IT service management come together. I mean, that’s his area of work.

    Ashley: Mm-hmm.

    Smalley: It’ll depend on the kind of products and services that people, organizations provide are the digitally enabled? How digitally enabled are they? So, it is very diverse. Lots of people for whom this is all pretty new, one of the things we, one of the objectives we have for the book is to familiarize people who know the old way of working, you know, working in silos, that kind of stuff, and get them used to—make them more confident, confident to engage in discussions with their DevOps, with their SRE colleagues about digital to get the conversation going.

    Ashley: It seems like that’s very important because, as things evolve, new things come into the picture—DevOps, et cetera, SRE. It’s really easy to be sort of overwhelmed of, “Now, what’s that, and how is that different and why should I care, or does it apply to me?” So, it seems that maybe taking that approach in this module of trying to bring that together from an ITIL perspective, from an operational perspective makes, maybe, those topics a little more approachable, a little easier to consume and understand?

    Smalley: Yeah, and one of the things we advise people is to look at the five objectives that I mentioned, from valuable investments to a short conformance, and discover, identify where the weakest link is in the organization or in that part of the organization. Because if you look at the theory of constraints, another body of knowledge that we reference, you should always be working on the weakest link.

    So, that helps you to focus on a particular part—don’t be overwhelmed. You can’t do all of this. You wouldn’t want to do all of this at once. Pick your weakest link, pick something that seems feasible that you can think, “Yeah, I can make an improvement, there,” and very much in the sentiment of continual improvement. Of course, one of the DevOps tenets, the third way of DevOps is continuous improvement—learning and improving all the time.

    Little steps. I think that’s the way we’d like to encourage people to go—just take it step by step. Because after each step, you refer to the systemic nature of this kind of stuff. After each step, you’ve changed the system, so you’ve got to look around and see what’s changed and then plan the next step. So, moving from what I call confirmatory ways of working in the high velocity IT books, you know, when you’ve got pre-determined plans and deadlines and milestones, because you can more or less predict what’s going to happen, you confirm that—during execution, you confirm that what you predicted in the plan happened.

    So, move—and we’re used to that in IT service management, predetermined process. So, moving from confirmatory ways of working to more exploratory ways of working, where you take things step by step—so, evolutionary. As Dave Snowden, who some people will know from the Cynefin framework, says—Dave authored a great piece about ethics for the book, by the way, but his core area is, he’s known from his complexity work—he says, “You’ve got to move to the adjacent possible in an organization.” So, sort of feel where the disposition of the organization is, in which direction are they moving naturally, and try and give them a nudge in that direction, zig-zagging towards, you know, whatever you want to achieve. That more—again, that’s that working in complex environments, reflecting the and respecting the unpredictable nature of the world we work in.

    Ashley: You know, we’re kind of borrowing from a lot of disciplines talking about this and one that comes to mind, I believe, it’s quantum mechanics that just observing something changes.

    Smalley: That’s it, yeah, the Heisenberg principle.

    Ashley: The Heisenberg principle, thank you.

    Smalley: Yeah, shine a light on it and it’s moved. You can either detect the velocity or the position, but not both at the same time.

    Ashley: Mm-hmm. Very good. Well, this has been really fascinating—yeah, go ahead.

    Smalley: I think Schrödinger’s cat came into it as well, didn’t he?

    Ashley: [Laughter] Very good. Well, you know, I think what’s fascinating about your work and the contributor’s work on this is, I venture to guess there wasn’t a lot of discussion about tools and technologies, because you’re really thinking about the how of how we do work, how we work together, how this leads to the creation of software toward  some co-created outcome.

    Smalley: It’s very much the people dimension as well. You see that just talking—I mentioned ethics, for instance. Ethics—people want to do the right thing. That’s an aspiration that people have. They want to trust and be trusted in the workplace—psychological safety. I’m delighted that our industry is talking about this kind of stuff more often. Talking about things like—I remember at a conference, you know, the good old days when we actually went to conferences, a conference in, I think it was New Zealand, in Wellington, where somebody was talking about social anxiety as a rather introvert engineer.

    Ashley: Mm-hmm.

    Smalley: And it’s great, because you know, people empathize with that, and it’s great to trust and be trusted, fostering an environment where people can feel free to express themselves without fear for their position or reputation. If you build that kind of a foundation in your organization—you know, all the tools fit into place.

    By giving people the confidence to—and the privilege, possibly a final thought, people just don’t work in IT. Some people say it, but you know, I’m sure some people don’t just work in IT, they have the privilege of contributing to the well-being and prosperity of digital service consumers, right down at the end of the chain. And I find that inspirational, thinking, you know, not just what happens in my silo, but at the end of the chain, you’re helping change somebody’s world. And that’s the kind of, that’s what I like to say about this book—it’s guidance that matters for people like us, who care.

    Ashley: Mm-hmm. It’s definitely inspiring to know that you’re helping people, right, in the work that they do.

    So, Mark Smalley, it’s been fascinating talking with you. I applaud you on the approach you took on this, a lot of great concepts that you’ve incorporated in the high velocity IT module, and I hope folks will check it out, because I think there’s some super valuable things. Again, changing the system is just by first observing it and I think just reading the module, checking out parts of it would be a step in that direction. So, appreciate your contribution, and it’s been great talking with you today.

    Smalley: My pleasure, Mitch. Thank you very much, indeed.

    Ashley: You bet.

  • DevOps Versus ITIL: How to Win the Battle Over Change Management

    DevOps Versus ITIL: How to Win the Battle Over Change Management

    Ever since DevOps came on the scene a decade ago, ITIL has been under siege.

    ITIL lays out a number of IT service management (ITSM) best practices, including release management, change management, incident management, problem management and many other aspects of running an IT shop so that its priorities align with the business’s. For many enterprises, ITIL is essential for governance and regulatory compliance–especially in heavily regulated industries.

    The basic idea of DevOps is that by leveraging better automation technology across the software lifecycle, it’s possible to rework the culture and organization of all the teams involved in software production and deployment. By breaking down the numerous silos and fostering greater collaboration, it should be possible to dramatically accelerate the ability to deploy quality software at scale.

    From the DevOps perspective, ITIL is nothing but a set of speed bumps and roadblocks, getting in the way of its continuous integration/continuous delivery (CI/CD) priorities.

    DevOps wants to speed up software release cycles, while change management often slows them down. Does this dichotomy mean that enterprises have to choose one or the other? Or perhaps we have to water down one of these approaches sufficiently so it’s marginally compatible with the other one?

    Is ITIL Part of the Problem?

    ITIL skeptics abound. “Frameworks like ITIL create the illusion of control that results in [the] organizational delusion that IT is efficient and manageable,” said Greg Ferro, long-time consultant and co-founder at Packet Pushers Interactive. “The single biggest problem in ITIL [is that] the creation of silos creates ‘not my problem’ attitudes.”

    One such silo is the change advisory board (CAB), a team that has the responsibility for making thumbs-up or thumbs-down decisions on numerous different activities across the IT organization. “Having the CAB review every single change request isn’t efficient,” said Kaimar Karu, head of ITSM at AXELOS, “and it’s definitely not common sense, especially when their costs can run to tens of thousands of deployments per hour in some organizations.”

    One organization that has struggled to transform their ITIL process as it moved to a DevOps model is financial services firm ING. In fact, its CABs were a point of contention for it. “We were just like an insurance company, always rejecting your first claim,” said Mark Heistek, IT specialist at ING. “And then come back if you have good arguments.”

    ING found it was able to modify ITIL to work within its new DevOps approach. “Don’t do everything the ITIL book says,” advised Jan-Joost Bouwman, ITSM process owner at ING. And yet, following ITIL for practices such as incident management are “still the best way to do it, because everybody knows what to do and you don’t get confused about the rules.”

    Or Is ITIL Part of the Solution?

    In spite of the skepticism, there are plenty of proponents of using ITIL with DevOps. “The DevOps Movement fits perfectly with ITSM,” according to Gene Kim, DevOps thought leader, author of The Unicorn Project and coauthor of The Phoenix Project. “ITIL and ITSM still are best codifications of the business processes that underpin IT operations, and actually describe many of the capabilities needed into order for IT operations to support a DevOps-style work stream.”

    Kim, however, focuses more on human capabilities than on the ITIL processes and procedures themselves. “ITSM practitioners are uniquely equipped to help in DevOps initiatives, and create value for the business,” said Kim. “ITSM skill sets are ever more important in a world where there is an ever-quickening business tempo.”

    Phil Tee, CEO and co-founder of Moogsoft, agrees with Kim–and also echoes the experience of Heistek and Bouwman at ING. “ITIL is not in conflict with DevOps,” said Tee, “but it must be adapted to DevOps practices in order to define clearly where issues arise and how to solve problems efficiently.”

    Adapting ITIL to work within the context of DevOps–without slowing it down–has become the crux of the discussion. “ITIL is not explicitly opposed to Agile and DevOps,” explained Charles Betz, principal analyst at Forrester Research. And yet, he found that “the overall ITIL narrative is still sequential, plan-centric and deterministic.”

    Rock and a Hard Place

    Part of the DevOps way of thinking is to reevaluate how the organization makes the decision to deploy software into production. “By combining developers and operations into smaller, more agile DevOps teams, organizations can build software more quickly than ever, enabling them to respond faster to changes in the market,” said RJ Jainendra, general manager and vice president, IT business management and DevOps business unit at ServiceNow. “But, that’s a difficult challenge for larger companies, however, that haven’t been able to realize the full benefits of DevOps for a variety of reasons, including the complexity of manual processes they manage, and a shortage of DevOps expertise.” 

    There are many business contexts where internal process or regulatory compliance concerns are the issue, introducing requirements beyond what current DevOps approaches can satisfy.

    Jumping to the opposite extreme and requiring rigid change management procedures, however, can easily be overkill. After all, even for the most heavily regulated, quality-conscious enterprise, some of the changes they put into production don’t have the same stringent requirements as the rest. Not all software changes carry the same level of risk.

    The challenge, therefore, is telling the difference–and putting into place proactive, automated ways of handling different change scenarios that are subject to different levels of rigor.

    Judicious Use of Automation

    In spite of what many DevOps zealots may say, the approach is inherently flexible and human-driven. People still create software, after all–and DevOps is more about encouraging new ways for people to cooperate to achieve a common goal than it is about offloading human tasks to automated processes.

    As a result, DevOps is not nearly as black and white as those zealots might have you believe. For example, the “continuous” in CI/CD doesn’t mean “all the time” or even “as fast as possible.” In practice, continuous means “as fast as practical given the particular business requirements that apply in this situation.”

    Sure, Amazon may deploy several times a minute and be able to easily integrate compliance and governance into their technologies, but that doesn’t mean you can, or even that you must. After all, enterprises have a very different business and technology context from web-scale, born in the cloud companies such as Amazon.

    You may simply have different requirements–and even more importantly, different software will likely have different deployment cadences, even within the same organization.

    These principles of flexibility and human-centeredness apply beyond deployment to all aspects of change–and thus, they apply to the change management and release management practices of ITIL more broadly. 

    Sometimes you need a CAB, and sometimes you don’t. Sometimes you need to change windows, and sometimes you don’t. Sometimes fully automated quality checks are sufficient for giving the green light for deployment, and sometimes they’re not–and so on.

    And perhaps most importantly, sometimes humans should make approval decisions, and sometimes those decisions should be automated. 

    The more you can automate these approvals, the faster your deployment will be. But if you are able to identify those changes that require human approval and route those accordingly, then you’ll have optimized how you handle change in a way that pulls together DevOps and ITIL practices.

    Bringing ITIL and DevOps Together in Practice

    Traditionally, ITSM products are ticketing systems. When some incident occurs or someone calls for a change, they must create a ticket that then kicks off a set of manual tasks, often by different people.

    DevOps can bring automation to this traditional ITSM context. “One of the modern miracles of DevOps principles and practices is that many parts of ITIL processes can now be automated, solving significant challenges, especially in the configuration, release and deployment management processes,” Kim explained.

    Such manual workflows are typically well-suited to supporting ITIL practices, but fall short of the speed that DevOps requires. “ServiceNow DevOps leverages the data and metadata it already has on its platform, combined with new information from the DevOps pipeline to create, automate, and manage ITSM changes from within DevOps workflows on an enterprise-wide scale,” said Jainendra.

    In fact, ServiceNow can oversee the full automation of the deployment, integrating with other DevOps tools as necessary to effect the change, eliminating the need for any additional action from a developer. On the flip side, when the policies in place require a human approval of a change, then ServiceNow routes the change to the appropriate person. 

    The Intellyx Take

    Automation, for all its benefits, has never been about taking humans out of the decision-making loop. On the contrary, automation takes low-value tasks off of people’s plates, allowing them to spend more time and effort on more valuable activities. Decision-making is often among those high-value activities.

    That being said, automation is getting better at making decisions, both because of the breadth of machine-understandable policy representations and other configuration metadata, as well as the increasing prevalence and sophistication of machine learning.

    For DevOps professionals, it’s essential to understand this increasing level of sophistication for the automation available in today’s tools. The choice between automated or manual is no longer a black-and-white affair. Instead, there are different levels of capability for automated decision-making depending upon the situation at hand.

    — Jason Bloomberg

  • ServiceNow Makes the DevOps Connection

    ServiceNow Makes the DevOps Connection

    ServiceNow today announced it is extending the reach of its IT operations management platform to integrate with a variety of DevOps platforms.

    Richard Hawes, director of product marketing for ServiceNow, said ServiceNow DevOps will provide IT operations teams relying on an ITIL-based framework accessed as a software-as-a-service (SaaS) application visibility into DevOps processes and events occurring in on-premises environments or public clouds.

    At present, ServiceNow DevOps is available for financial services organizations based in the Northeast region of the United States and the UK. The service gradually will be rolled out to additional ServiceNow customers over the course of 2020. ServiceNow DevOps initially integrates with Jira Software, GitHub, BitBucket and Jenkins, with more integrations expected to be rolled out periodically.

    Hawes said ServiceNow recognizes that IT organizations are building and deploying applications at rates that are faster than existing ITIL-based approaches can track. However, ITIL-based frameworks provide the highly structured set of processes around which the bulk of IT environments are managed. ServiceNow DevOps enables IT teams to automate change management tasks such as planning, development, testing, deployment and operations via a single dashboard surfacing a common set of metrics, he said. He added in many cases, those preset rules and policies will eliminate manual processes that often conspire to slow the rate at which applications can be deployed and updated within any IT environment, said Hawes.

    No developers need to be involved in those processes because IT operations teams can set rules and policies, and developers will see their code running in production environments in a matter of minutes regardless of what tools they employ, said Hawes. That approach also will make it easier to scale DevOps across an enterprise IT organization at a time when adoption of DevOps is still uneven at best, he noted.

    At the same time, that level of integration should also make it easier for IT teams to audit DevOps processes using a common framework to capture events such as when code is checked into a DevOps platform, he said. That capability is a critical requirement for any company trying to apply best DevOps processes with the context of a highly regulated industry such as financial services.

    Hawes said the majority of organizations that have adopted ServiceNow to manage IT have also adopted a DevOps platform. Overall, Forrester Research reports 56% of global infrastructure decision-makers now report that their organizations are implementing, have implemented or are actively expanding their DevOps initiatives. ServiceNow doesn’t expect DevOps processes to supplant ITIL-based frameworks as much as it anticipates both approaches co-existing as they continue to evolve, he said.

    With the release of the latest version of the ITIL framework, it’s apparent that the proponents of ITIL have come to recognize that IT needs to become more agile to meet the needs of digital business. The challenge they face is finding ways to enable IT teams to become more agile without sacrificing the gains in stability achieved over the course of the last two decades. With the launch of ServiceNow DevOps, the effort to find a middle ground between those two extremes can now begin in earnest.

    — Mike Vizard

  • IT Operations: PagerDuty Unveils Hybrid ITSM Platform

    IT Operations: PagerDuty Unveils Hybrid ITSM Platform

    PagerDuty today unveiled a framework intended to make it possible for organizations to bridge multiple styles of IT service management (ITSM) methodologies for IT operations.

    Rachel Obstler, vice president of product for PagerDuty, said PagerDuty Solution for HybridOps provides a comprehensive incident management framework capable of spanning both ITIL and DevOps processes for IT operations.

    PagerDuty Solution for HybridOps combines existing and new product capabilities such as Event Intelligence and Modern Incident Response with machine learning algorithms and bi-directional integrations the company has developed between its incident management software and more than 300 third-party products.

    Those capabilities make it possible to facilitate real-time communications between platforms that tend to be favored by IT shops relying mainly on ITIL processes, such as ServiceNow, and DevOps teams that rely on Slack to communicate with one another, Obstler said.

    IT Operations: PagerDuty Unveils Hybrid ITSM Platform

    Rather than forcing an entire IT organization to transition to single framework for IT operations, PagerDuty Solution for HybridOps allows organizations to selectively apply each model where and when they best see fit, she said.

    The latest version of the ITIL framework goes a long way toward injecting some flexibility into what historically has been viewed as a rigid approach to managing IT. The ITIL framework is still a long way from being as agile as the various forms of DevOps that many organizations have adopted over the last several years to accelerate application development and deployment.

    Obstler said PagerDuty is moving to bridge that divide by leveraging machine learning algorithms to group all the various alerts generated by all the tools in an IT environment. That capability not only reduces the amount of alert fatigue any IT operations group is likely to suffer, but it also makes it easier to identify the root cause of any IT incident, she noted.

    One of the primary reasons DevOps has been adopted evenly in the enterprise is that IT operations teams are expected to be able to programmatically adapt IT infrastructure to meet the demands of developers. The number of IT operations that have those skills, however, is limited. In theory, IT operations teams without programming skills could rely on automated frameworks to achieve that goal. But that approach requires IT organizations to standardize on a single IT automation framework across compute, storage and networking services. The number of organizations that have been able to bridge all the islands of automation that have been adopted across all the services they deliver are few and far between. Put it altogether and it’s clear that both legacy and modern approaches to ITSM will need to coexist well through the next decade.

    In the meantime, IT leaders might want to consider that old proverb about leading a horse to water. IT leaders can issue all the mandates they want. But when it comes time to accomplish a task, most IT professionals are naturally going to fall back on what they know. The challenge is to create ways to wean the IT operations staff off those legacy processes in a way that doesn’t necessarily result in everything grinding to a halt because nobody knows how to fix an issue that simply wouldn’t otherwise wait.

    — Mike Vizard

  • Agile vs. ITIL: Two Divergent Paths to DevOps?

    Agile vs. ITIL: Two Divergent Paths to DevOps?

    Truth be told, there are dozens of different frameworks in existence and all have their unique perspectives on how a project is managed and executed. Frameworks such as Agile, ITIL, lean, cobit, six sigma and many others were built on an ideology of following a path defined by best practices.

    With DevOps, two of those frameworks, Agile and ITIL, have become the basis for arguments on how to do DevOps correctly. Yet, until recently those frameworks were very different in the paths offered to bring about project success. With the announcement of ITIL V4, things have changed a little: ITIL is becoming a little more like Agile, adding to the confusion of what path makes the most sense in the world of DevOps.

    A Quick Glance Backwards

    The foundations of DevOps were built upon the ruins of non-iterative application release cycles. Or look at it this way: DevOps is all about not taking a plunge over the waterfall. While those observations are little more than metaphors for something that rings true, DevOps has brought a new paradigm to software development and deployment. A new paradigm that comes with its own recommended practices.

    Yet, current DevOps practices—or let’s call them rules—can come up short in the modern enterprise, meaning that other management best practices—such as those illustrated in the Agile and ITIL methodologies—are borrowed to drive DevOps further forward. That said, the common DevOps ideology is built around a few foundational practices that define the framework of DevOps. The primary goal here is to bring application development and operations together as a functional team. Some of the generic best practices include:

    • Implement collaboration and teamwork tools to improve communications as well as improving the ability to share knowledge, ideas and automatically document interactions. Simply put, incorporating teamwork with an audit trail goes a long way toward bringing order to DevOps.
    • Incorporate tools to capture requests. One of the most important capabilities delivered from DevOps is the ability to adapt to change. Traditional application development frameworks are usually based on waterfall processes, where everything is defined at the outset and then an application is eventually delivered. Waterfall ideologies offer no leeway to adapt to change in the middle of a development cycle. DevOps eschews those limitations by incorporating the understanding that change is constant. However, requests for changes must be recorded, tracked and reported upon.
    • Adopt a framework ideology that can match workloads to team capacity. In other words, team leaders and managers need to have a clear view of what work is in progress and the context of that work as it applies to a team’s abilities.
    • Use systems to log metrics on automated and manual processes, which will give insight into productivity, as well as identifying where improvements can made.
    • Implement test automation. The idea here is to automate the testing of code using test data in a sandbox environment. Code that passes the tests can be forwarded further along the DevOps process, while code that fails is automatically returned to developers for correction.
    • Use a continuous feedback system in which a chain of communications can be established to keep developers and operators informed of the status of any issues, as well as change requests and the progress of any code through the framework.

    While the above best practices are simplified representations of a full DevOps framework, they do establish that DevOps relies heavily on collaboration and iterative processes to support the ideology of continuous development and deployment. Now, comparing the DevOps ideology to what constitutes either Agile software development practices or the ITIL Framework brings up some additional questions and establishes that Agile and ITIL may very well have different goals. A more simple way of looking at it is to think of Agile as a set of practices to provide faster software delivery, while ITIL is a framework squarely focused on processes and not practices.

    The Path Becomes Muddy

    Therein lies the real dilemma of establishing a path to DevOps using either Agile or ITIL ideologies. ITIL is designed from the perspective of the governance of IT service management and establishes a framework that supports continuous measurement and should deliver improvement of the quality of IT services. Agile is a set of processes designed for software development that meets the needs of customers and cross functional teams.

    Interestingly, Agile and ITIL prove to be complimentary in the world of DevOps, where ITIL can be used to ensure quality and value while Agile brings forth a continuous stream of improvements in applications. Ultimately, with the arrival of ITIL V4, Agile and ITIL will become more aligned with each other and offer benefits to DevOps.

    — Frank Ohlhorst