devopsy.kinsta.cloud

Tag: governance risk compliance

  • Managing Cloud Governance Costs Collaboratively

    Managing Cloud Governance Costs Collaboratively

    For those responsible for managing infrastructure, the concept of governance is common, especially as it relates to cloud services. For cloud services, it’s defined as a framework that guides how end users use these services by defining and creating policies to control costs, minimize security risks, improve efficiency and accelerate deployment.

    The term is often associated with “rules” or “compliance” and can restrain innovation within an organization, as it typically is mixed with regulatory bodies and governance procedures that add cycles to required tasks. But what if we could flip the script and make governance more of a collaborative effort? What if we used an approach wherein teams across an organization share information and feedback for better business outcomes?

    This collaborative approach can be beneficial in ensuring everyone is on the same page, enabling businesses to get the most out of their cloud infrastructure while ensuring costs stay within budgets.

    Legacy Governance Overshadows Growth and Creativity

    Legacy governance is an extremely paranoid way of running your business. For example, blocking people or departments from making buying decisions is a perceived best practice to avoid overspending on cloud infrastructure. Unfortunately, this is actually the opposite of what organizations with cloud infrastructure should do.

    The advantage of the cloud is that it gives your organization the ability to develop and bring products to market faster—and at a lower price point—than traditional methods. Following legacy governance processes—adding more steps to the process for provisioning resources—results in slower launch times and overprovisioning of resources (since there is a lack of visibility and teams are not sure when they will get more), negating the cost benefits of on-demand cloud infrastructure over traditional data centers.

    Empowered Employees Produce the Best Results

    Think about it: An overbearing manager or boss makes you feel like you’re walking on eggshells when it comes to your work. Sometimes, this is the same effect legacy governance policies can have on employees.

    Removing access barriers and giving team members the freedom to easily request and use resources should be a cloud operator’s ultimate ambition. It’s also cost management that’s collaborative.

    The idea behind a collaborative approach to managing costs is that the individuals who work on the projects themselves–whether that is the engineering team, DevOps teams, etc.–are best suited to manage them and provide the proper infrastructure recommendations because they know what their needs are.

    To receive the full financial and organizational benefits from a collaborative approach, there are three simple steps to take:

    Have a Consistent Source of Truth

    Have a consistent and agreed-upon source of truth for decision-making and self-evaluation against key metrics. This means that everyone in the business—executives, finance, managers and individual contributors—are aligned and looking at the same numbers. When this happens, teams spend less time haggling about ownership and more time looking at how they can improve. When this doesn’t happen, the focus turns to storytelling about why the numbers are wrong, not solving the underlying inefficiency problem.

    Trust the Team

    Trust the members of your organization to leverage this information for the best possible business outcomes.

    Collaborate

    Encourage collaboration inside and between layers of the business to ensure the decisions are made with the complete picture in mind.

    Implicit tradeoffs are made every day at every business level for teams to align their work to organizational priorities. Encouraging collaboration between different layers, viewpoints and skillsets in the business helps to highlight these implicit decisions and make them explicit, intentional and agreed-upon

    Moving away from legacy governance to a more collaborative approach is within reach for any organization. The key is understanding what methods are required for the transition to be a seamless and positive experience that teams will embrace.

  • GRC: A Key Ingredient in DevOps’ Secret Sauce

    GRC: A Key Ingredient in DevOps’ Secret Sauce

    By now, surely everyone has seen cooking competition shows such as “Hell’s Kitchen” and “Top Chef,” in which people compete to create and serve the best dishes as quickly as possible. These hit TV programs are like the DevOps world, which also consists of people creating and releasing the best software as fast as they can with whatever they are given. In both instances, the best use of random ingredients brings rewards and failure brings disappointment.

    DevOps is becoming evermore common as companies in all industries work to unify their developers and other IT staff while automating as much of the process as possible, creating nimble, fast-moving teams. Think of it in the same way professional kitchens have cooks dedicated to specific stations, such as vegetables or fish, and are able to react swiftly to whatever orders are placed. By redesigning their in-house teams in this fashion, organizations can add speed, agility and resilience to critical functions.

    But, often what’s forgotten in the high-pressure, rush-rush-rush world is the critical importance of security and regulations. Governance, risk management and compliance (GRC) always must form the base decisions; otherwise; the final products will either not be able to be used or, worse, be dangerous to the company, its customers and its shareholders. It’s really no different than cooks having to abide by health code regulations or risk sickening and possibly even killing their diners. Don’t think GRC is that serious? It wasn’t long ago that Dwolla was fined $100,000 by the Consumer Fraud Protection Bureau (CFPB) for lying to customers about data risks. That was the CFPB’s first fine and you can bet more are sure to follow.

    Of course, a key difference is that in the business world, regulations and compliance standards constantly are being created or changed. That makes DevOps even more challenging, but that challenge cannot mean ignoring GRC. In fact, GRC should be seen as a key DevOps enabler, not an obstacle. An organization’s legal and compliance team can take advantage of highly agile, forward-moving DevOps teams to design and implement changes that satisfy risk and control points (resulting in successful audits and avoiding fines) while, at the same time, staying abreast or even beating the competition.

    The key here is to ground DevOps in GRC requirements so they become second nature and security measures are incorporated effectively into all DevOps processes, even automated ones. It’s crucial these measures are seen as integral to the processes and not simply layered on top as an afterthought, just as you wouldn’t try to get raw chicken juice off of lettuce after you’ve made a salad.

    Tactically speaking, how is this accomplished? DevOps teams need awareness and training. They need to learn the rules and laws specifically governing their particular industry, and how to implement them. And, companies need to have internal audits and other review policies in place to ensure GRC is enforced.

    For all of this to happen, however, a very important role must orchestrate it: management. Just as every kitchen depends upon a head chef to ensure not only that each station is obeying health codes (i.e. the law) but also that overall the meal is being prepared and delivered properly, company management must assume its authoritative role in setting up and defining the organization’s internal communication. This means breaking down silos and coordinating a regular flow of information from Compliance to DevOps team and back again.

    If this is done properly, DevOps can enable an innovational Nirvana, with companies boosting speed while maintaining security, creating the perfect consumer experience.

    About the Author / Robert Hawk

    Robert HawkRobert Hawk serves as Information Security Expert at xMatters, Inc. He has extensive experience in information systems security, computer security, cyber security, information assurance and governance, risk, and compliance (GRC) management. He specializes in frameworks and standards from: ISO/IEC, NIST, IEEE, IETF, ITU-T, Common Criteria, AMI-SEC, NERC, CIS, DoD, ANSI, PCI and ISECOM. Robert is a lifelong researcher, innovator and instructor. Connect with him on LinkedIn.