devopsy.kinsta.cloud

Tag: DOES London 2018

  • DevSecOps: Where DevOps and Security Meet

    DevSecOps: Where DevOps and Security Meet

    Catching up with three IT leaders on the role of security in the changing world of DevOps

    The DevOps methodology as a software and engineering culture goes back nearly 10 years—Patrick Debois coined the term when he named a Belgian software conference “devopsdays.” Since then, the movement has taken on a mind of its own, turning into the go-to strategy for enterprises the world over aiming to accelerate their development timelines and deliver better products faster.

    In the shifts and changes that have happened over the last decade, one has been the idea of “DevSecOps,” or the intersection where security practices and DevOps transformations meet. Recently, at the DevOps Enterprise Summit 2018 (DOES18) event in London, several key players in the DevOps world sat down to take a deep dive into the world of DevSecOps. In the following article, we’ll review some of the key points discussed by Ilkka Turunen, head of Solutions Architecture at Sonatype; Zane Lackey, founder of Signal Sciences; and Margo Cronin, senior solution architect for Amazon Web Services during our panel discussion at DOES18.

    The first point of the discussion centered around the role of security in DevOps, and how the name “DevSecOps” should never make you think security is secondary.

    “I’ve never been crazy about the term DevSecOps, because it’s like ‘Sec’ is an afterthought,” said Turunen. “You know, we were squeezing it in between Dev and Ops, the last kid that got on the bus, and we’re like, go on, just sit in there. For all of us, security is the first priority, the top job—’job zero,’ we sometimes call it. And therefore, for DevOps, it actually understands that security is key, and is the first thing that you do.”

    Turunen pointed to recent changes brought on by GDPR that have made privacy one of the pillars of software development, and how this has brought about further emphasis on security in DevOps transformations. In this new world of GDPR regulations, it’s not limited to just data portability and data breech notifications, but truly goes into “privacy by design.” As such, security is paramount.

    Later, the conversation turned to the idea of how one can create a culture where everyone thinks of themselves as a security practitioner, a seemingly necessary step to having foolproof security practices. The answer lies in creating an organization where security is part of the fundamental culture—a similar cultural change as to what happened around testing.

    “So if you think about testing 10 years ago, it was literally people running from test execution plans, and gradually they changed from that to becoming writers of tests, people that write the automatic-execution, help people, help the floor become more efficient at testing for themselves,” said Turunen. “Teaching them unit testing, all these other frameworks. So I feel like we’re at the brink of a similar kind of change. I think it’s a mixture of both incentives and psychology, and just changing roles.”

    Lackey puts it even more simply—that good engineering just goes hand in hand with good security.

    “The best way I’ve ever seen, like the highest performing organizations view it, is security is a subset of good engineering. In the way that resiliency is, reliability is, quality is, performance is, is a subset of good engineering,” said Lackey.

    Finally, the conversation turned to the role of public cloud service providers and how they can help uplift security for software organizations. For Cronin, the idea of machine learning holds a lot of promise for increasing security.

    “You now have services that can scan your landscape and say do you know these large files contain client identifying data, do you know you have keys there?” said Cronin. “And then you have services where you can then change that behavior automatically. But I think that’s where we’re going to see cloud service providers become a lot more active. You know, using machine learning to harden your production landscape before you actually even go to the security operators.”

    While the world of DevOps is constantly evolving, growth in highly regulated and compliance-oriented industries—coupled with increased global concern over data privacy—have put increased emphasis on incorporating security throughout the software pipeline. To learn more about how these DevOps experts view DevSecOps, and how they are making security a bigger focus in their organizations, you can watch the entire discussion on DevOps TV.

    Bonus: You can also watch Cronin’s DOES18 presentation on “Security Automation at Scale” and Lackey’s presentation on “How You Can Use DevOps to Make You More Secure.”

    And be sure to join us next time at DevOps Enterprise Summit Las Vegas, Oct. 22-24, 2018!

    — Alan Shimel

  • DOES London 2018: The Excitement is Building

    DOES London 2018: The Excitement is Building

    DOES London 2018 is on the horizon. Are you ready?

    Holy Cow! We’re only a few weeks away from DevOps Enterprise Summit London 2018 and I can’t begin to describe just how excited I am for our third event in Europe. I never learn as much in short period of time as I do during my days spent at DevOps Enterprise. It’s the place where some of the most courageous and exciting transformation stories I have ever seen take place, and this year’s conference is going to be no different!

    So many of the presenters and organizations involved are pioneering the practices that will be commonplace in business in 10 years. In addition to the two days of showcasing amazing experience reports from the leaders of large and complex organizations—sharing what they did, what they learned and their outcomes—we continue to document transformation journeys from several enterprises and leaders year over year. I hope you’ll join us in London for the next chapter! And, if you haven’t registered yet, use the “Friends of Gene” code below!

    20% OFF DOES18 LONDON REGISTRATION WITH CODE “FOG20”

     London: June 25-26, 2018

    To nurture high-learning, exciting networking opportunities, and to create a forum for exchanging insights with some of the best practitioners and subject matter experts on the planet, we developed a list of objectives that I think promise to make this year’s DevOps Enterprise Summit London the best conference yet.

    Programming Objectives:

    • Get great experience reports, and repeat experience reports.
    • Elevate focus on Next Generation Ops and Infrastructure.
    • Help conference attendees achieve their goals.
    • Elevate focus on Spanning Business/Technology Divide.
    • Get best subject matter experts from the domains we need.

    Next Generation Operations and Infrastructure

    Jason Cox, Director of Systems Engineering at The Walt Disney Company, is a member of the DevOps Enterprise Summit Programming Committee, and someone whose advice I’ve relied on ever since I met him in 2013. I’ve also quoted him extensively in “The DevOps Handbook.”

    In the four years since the first DevOps Enterprise Summit, Jason has consistently told me, “That was a great conference, but it was a better conference for Dev than it was for Ops.”  I had promised him each year that we’d do a better job choosing better Ops talks, and I finally asked him to join the conference Programming Committee.

    This year, we’ve dedicated nearly a quarter of the agenda to speak to “Next Generation Ops and Infrastructure Practices,” targeted specifically at Ops leadership, and created a separate subcommittee to focus on a multiyear road map to properly define the problem space, and seek out the talks to help define the direction of the solution.

    As we were reviewing the amazing talks that we have ahead for DevOps Enterprise Summit London this year, both Jason and I were amazed and very satisfied at the Ops perspectives being presented—it is genuinely different than previous years. The reason for this focus is best verbalized from Jason, as he says:

    “This year’s conference programming will help Ops leaders work towards the same goal that our Development partners are also working towards. These talks should resonate strongly with nearly everyone in Ops leadership, and help them not just participate in the DevOps journey, but be active leaders in it, as well.”

    In a lot of cases these problems are the hindrances for a DevOps transformation going the “entire way” and ultimately can be the difference between the high performers and the so-so performers or low performing organizations. These sessions include experience reports and expert talks from:

    Jason Cox, Director, Systems Engineering, The Walt Disney Company

    Jeffrey Snover, Technical Fellow, Microsoft

    Cornelia Davis, Senior Director of Technology, Pivotal

    Damon Edwards, Co-Founder, Rundeck

    Rob England and Cherry Vu, Teal Unicorn

    Jayne Groll, CEO, DevOps Institute

    Nick Funnel, GTIS CTO Development Practice Lead, Barclays

    Tom Clark, Head of Common Platform, iTV

    John Rzeszotarski, SVP, Director of Continuous Delivery and Feedback, KeyBank

    Shaun Norris, Global Head, Cloud Infrastructure Services, Standard Chartered Bank

    Spanning the Divide Between Tech and the Business

    Increasingly, the obstacles that technology leaders face in large, complex organizations are outside the technology value stream. This year, I am super excited about how we are going to be able to point out how these barriers. It’s not just Dev versus Ops. It’s also about exploring how the technology value stream pertains to project management, the funding model, information security, product owners and product managers, etc. In short, we have some amazing talks and experts presenting in London in regards to “spanning the business and technology divide.”

    We’re doing this by having a technology leader co-present with their business co-collaborators. And, we’re going to get the full-hearted endorsement dialogue to unfold on stage for everyone to see.

    My friend and fellow programming committee member Damon Edwards points out that nothing lives in isolation. When you look at the bigger picture as a business, things such as automation help, but moving the bits around have very little to do with the organization being successful. What matters more is how the organization is structured, how people are incentivized, how they view their work and how they interact with the systems around them that really dictate the successes and failures. You’ll notice these are all business functions, not technology functions.

    So, we have multiple talks to showcase these patterns and involve the business-side stakeholders to tell how the business side is fundamentally understanding and driving the transformation journey. These are three presentations that I am really excited about and you can hear more about them over here >>>.

    Verizon Enterprise
    John Scott, IT Manager; Oliver Cantor, Associate Director of Product Strategy; Sanjeev Jain, CIO of EMEA

    Nike EMEA
    Randy Lyons, Sr. Director, Nike Digital Engineering EMEA; Michele Power, CFO Nike Direct EMEA

    Capital One
    Aimee Bechtle, Senior Manager, Advanced Engineering; John Schmidt, Director, Product Management

    Creating a Community of Connections

    It is so important for the organizers of the DevOps Enterprise Summit to help attendees achieve better outcomes, and we’re trying to meet this objective by addressing three common phenomena to conference-goers:

    1. The “velvet rope” problem where there is a person or a group of people that you really want to talk to, but you can’t get to them for one reason or another. Or worse, you have to decide between waiting in a line of people to talk to someone or miss out entirely and head to the next session on your agenda.
    2. Other situations where you’re surrounded by people, but don’t know who you actually should be talking to. If you’re like me, in the past I decided the best use of my time was to go do something else, such as check my email instead of interacting with my peers. In retrospect, this might’ve been the dumbest thing I could’ve done.
    3. Everyone is going to lunch, and they’re organizing by restaurant names, but what you really want to know what the subject matter of the discussion will be.

    Together with Jeff Gallimore, we are working on establishing different ways to create opportunities for people to ask and answer as many questions as possible. After all, the quality of the audience is one aspect that we think separates the DevOps Enterprise Summit from other events! Therefore, the more spontaneous conversations and interactions we can nurture onsite, the better for everyone. So, how are we striving to do this? Read below and you can also listen to Jeff talk about it here>>>.

    • Slack Workspace! We will have our very own Slack workspace for the DevOps Enterprise Summit! For the first time ever, every attendee has an opportunity to join the shared workspace to interact with speakers, attendees and sponsors. There will even be a “Who’s Hiring” channel for new job opportunities. What’s more, this channel will be open even after the conference ends, so that we can continue the dialogue and interactions with people after June 26.
    • Ask the Speakers! We’re creating opportunities for attendees to have a dedicated time and location to ask the plenary speakers questions that go deeper on the information they presented earlier that morning. We’re going to open up a Slack channel for every attendee to use and submit questions directly to speakers and to other attendees. During the “Ask the Speaker” sessions, we’ll use this repository to highlight the most popular questions, and give attendees different ways to engage with speakers directly.
    • Lean Coffee Sessions! We want to help attendees connect with and learn from their peers at the conference in another semi-structured format as well. We’re going to produce Lean Coffee sessions, led by Dominica DeGrandis, both days of the conference. This will be comprised of 10 tables big enough for 10 people to talk about similar interests that are relevant to the theme at the table. Hopefully, this provides another opportunity to learn a lot and make some valuable new connections.
    • Lunch time! There will be a few different lunch options that attendees can take advantage of as well:
      • Eat lunch with a speaker will be a first-come, first-served basis. This will give you an opportunity to sit down face to face with a speaker and, again, dive deeper into the subject matter of their presentation and experiences in a more personal setting.
      • Have lunch with fellow attendees at high-top tables around the buffet stations, where there are note cards with seed questions to start discussions.
    • Industry party! Book signings, sponsor giveaways, food and drinks and a great opportunity to continue conversations with fellow attendees and speakers. This is where some of the most interesting conversations take place and I heard some amazing stories there last year.

    Leaders Talking About the Continuation of their Journeys

    Another thing that I am always so delighted by is the constant scouting and searching that the programming does to look for the amazing case studies we get to hear at the DevOps Enterprise Summit. Chris Hill of Jaguar Land Rover is a testament to this fact, and we’re really looking forward to having him as part of the program this year. We caught up with Chris during a recent YouTube Live hangout, and he previewed some of his presentation for us here >>>.

    “The DevOps Enterprise Summit for me is something I hold close to my heart, considering I attended my first event in 2016 in San Francisco where I walked away from that conference with the books and motivation I needed to transform my organization. In terms of how we’ve started with our DevOps transformation, this actually came organically from the conference.” — Chris Hill, Jaguar Land Rover

    We have some excellent repeat speakers this year talking about the continuation of their journeys, including Topo Pal, technical fellow at Capital One; Jonathan Fletcher, CTO at Hiscox; Scott Prugh, CTO at CSG; alongside Erica Morrison, executive director at CSG; and Jonathan Smart, head of Ways of Working at Barclays.

    We also have multiple PhDs to present subject matter expert talks on the domain expertise that we need to help us achieve our goals. Here is a glimpse into the expertise we are drawing in at the DevOps Enterprise Summit this year:

    • Richard Cook, research scientist at The Ohio State University, is presenting this year and he’s the person who has probably influenced John Allspaw’s thinking the most over the last decade. I can’t wait for his talk highlighting a new way to think of operations.
    • Nicole Forsgren, CEO at DevOps Research and Assessment, is someone whom I’ve had the pleasure of working with for years on the “State of DevOps” report with Puppet, now in collaboration with Google Cloud. She’ll be sharing the latest knowledge and learnings from that research.
    • Mik Kersten, CEO of Tasktop, will be talking about his work from project funding models to product funding models.

    As you can see, there’s a lot that is getting me excited for the conference this year! To watch the full preview discussion of DevOps Enterprise Summit London 2018 and learn more about the conference, please watch our YouTube Live event with Alan Shimel, editor in chief of devopsy.kinsta.cloud; Damon Edwards, co-founder of Rundeck; Jeff Gallimore, partner at Excella; and Chris Hill, head of Systems Engineering, Infotainment at Jaguar Land Rover.

    Thanks for reading and look forward to seeing you all in London!

    Attend the DevOps Enterprise Summit

     London: June 25-26, 2018

    — Gene Kim