Tag: josh corman

  • A True Story: DevOps(Sec) Manages Out Elective Risks

    A True Story: DevOps(Sec) Manages Out Elective Risks

    A True Story

    There are over 2000 developers in Bill’s organization.  He is a C-level executive for one of the largest insurance companies in North America. Bill boosted developer productivity by 15% last year after taking a closer look at the company’s software supply chain. And this approach isn’t unique to Bill’s organization.  Many high performance IT and DevOps teams are adopting proven supply chain principles to accelerate software delivery.

    Origins, Quality and Integrity

    The concept was rather simple and straightforward.  Bill’s team recognized that they were consuming hundreds of thousands of open source and third-party software components to build their applications.  But at the same time, they did not apply much scrutiny to the origin, quality, age, or integrity of those components.  Developers simply selected components at-will that met their functional requirements and helped them meet the next delivery deadline.

    Secrets of the Free-For-All

    Deeper analysis of their practice revealed that the free-for-all component sourcing methods were leading to quality, efficiency, and productivity issues.  Here is what Bill found:

    • The company had downloaded an average of 27 versions of over 100 different binary artifacts over a one year period.  Bill knew this meant the quality of their applications was being impacted through the use of outdated software components.
    • The company had also downloaded 13,203 software components with known security vulnerabilities — and 65% of those included alerts earlier than 2014.  Without quality controls in place, Bill recognized they were sourcing in elective and avoidable risks that would impact the integrity of their application, grow their technical debt, and lead to more rework down the road to replace the flawed components.

    Removing Complexity

    Bill decided to take action.  He knew that to accelerate innovation, he needed to remove complexity from the company’s software supply chain.  He enacted three moves to eliminate waste and complexity within the open source and third-party components being used:

    1. Automate the scrutiny of software suppliers to minimize risk and bloat.
    2. Enable real-time traceability and visibility to components used across the development lifecycle, in order to improve response times when defects were discovered – cutting back from days/weeks to minutes!
    3. Reducing complexity, rework and risk by standardizing on specific components types (e.g., web frameworks, logging frameworks, encryption modules), using fewer and more current artifact versions, and managing out elective security risks.

    Want to hear the rest of the story?

    The same principles that Bill applied to his business that boosted developer productivity by 15% are being discussed by Gene Kim (@RealGeneKim), author of The Phoenix Project, and Joshua Corman (@JoshCorman), CTO of Sonatype, on April 30th.  Both Gene and Josh are huge fans of marrying DevOps practices with leading supply chain management principles that enable developers to maximize throughput of features from “code complete” to ‘in production,” without causing chaos.

    If you’re looking to achieve similar goals, be sure to join Josh and Gene for this April 30th, 1pm ET, discussion.

     

    josh corman, gene kim

  • Welcome to the ADC (After DevOps Connect) era of DevOps and Security

    Welcome to the ADC (After DevOps Connect) era of DevOps and Security

    I was speaking with Britta Glade of RSA Conference after our DevOps Connect conference at RSA Conference Monday.  She congratulated us on putting together a great day of tracks and sessions (kudos to Gene Kim and Josh Corman).  But then she said something else that really struck me to my core.  She said after today there is no longer any question about security working with DevOps.

    Think about it.  Three years after Josh and Gene first presented Rugged DevOps at RSA Conference. After so many papers, articles, presentations and tracks, it has finally sunk in.  Security will embrace DevOps, Security will be better because of DevOps and as importantly, DevOps will be better because of Security.

    It is very fulfilling to know that this event we produced (along with Mark Miller and theNexus Community) was what finally pushed this over the finish line. For me personally it really represents one of the fundamental reasons I was so attracted to DevOps.

    It was 4 or so years ago that I first met Gene Kim and over a bottle or two of wine he explained to me what DevOps was about and what he was working on with the Phoenix Project.  While DevOps may seem primarily about Dev and Ops to some, for me it was about making security work better. It seemed like such a no brainer that of course security should embrace DevOps.

    But it was not that easy.  The besieged security industry faced with a never ending barrage of breaches and a continually escalating threat environment could not accept that automation, acceleration, velocity would also allow us to shift security left, leaving us more secure and more compliant. Many security people dug in their heels and said no, this wouldn’t work and they didn’t take the time to really explore it.

    Monday all of that changed.  Security folk came out in droves to see people like Jez Humble (many people in the audience weren’t really familiar with Jez when he first took the stage, but they were enthralled with him by the time he stepped off. Jez finished to a standing room only crowd of close to 700. They heard Damon Edwards and Alex Honor talk. Though they were also unfamiliar to the crowd, their message resonated to the core.

    When Julie Tsai of Walmart took the stage the audience heard how a “unicorn” like Wal-Mart used Agile and DevOps to be more secure. Terri Pots of Raytheon and Jessica Davita of Microsoft re-enforced the message that security needs to embrace this approach. I loved Jessica’s security org chart.  Chris Corriere who writes here on devopsy.kinsta.cloud, Dr. Aaron Cois of Carnegie-Mellon also had great sessions.

    Then names familiar to the crowd, Gene Kim and Josh Corman kicked it off with a great talk on Software Supply Chains.  Nick Galbreath had a great session. David Mortman delivered a terrific talk, Dan Cornell on web app security and more.  For me the perfect ending was when my friend Rich Mogull took the stage and demonstrated his Squirrel Monkey toolset. Rich’s scripts that he wrote himself showed how we could use automation to make our security better and easier.  People were stunned.

    Throughout the day, the buzz that was coming down the big hallway was that there were some great things happening over at the DevOps tracks. People from the Cloud Security Alliance meeting next door were hopping over to check it out. Other people joined in.  By the end of the day we had given out all of the materials we had prepared.

    By now I know you are wishing you were there.  The good news is the entire event was videotaped. We will have videos and slides of all of the presentations shortly so stay tuned.

    We are already starting to plan next year’s event. Also, the call for speakers is now open for DevOps Connect: Rugged DevOps event @InfoSecurity Europe June 4th.  But after Monday DevOps and security will never be the same again.  No longer can security deny that they must be part of DevOps. We are and should be. We are now in the ADC (After DevOps Connect) era.

  • Are You Embedding Security for a Rugged DevOps Experience?

    Are You Embedding Security for a Rugged DevOps Experience?

    ebookcover

    As security thinkers try to wrap their heads around what’s broken in today’s security architecture and processes, DevOps and continuous delivery patterns may seem like yet another potential problem for already overwhelmed risk managers. But once security gurus get past the intimidation of working within a cycle of fast iterations, they could well find that continuous delivery model could actually provide a  blueprint for fixing what’s wrong with security today.

    Security leaders that work with operations, developers, architects, QA and the rest of the team to build continuous delivery momentum are helping their organizations develop a more rugged development life cycle that not only produces more secure software but that also supports faster fixes to security problems as they’re found.

    Learn more about how to start moving toward a Rugged DevOps mentality in our inaugural eBook, Rugged DevOps: 10 Ways to Start Embedding Security into DevOps Patterns. Some of the insights security and DevOps experts shared with our reporter Ericka Chickowski in this special issue:

     

    • The bad guys are already delivering malicious code continuously. Security can respond faster by working within the DevOps patterns.
    • Security can a learn a lot from the DevOps propensity for smart automation.
    • The DevOps model really can be compatible with compliance.
    • The DevOps paradigm shift may give security pros the opportunity to finally bake security into IT processes rather than add it on as an afterthought.

    We will be distributing printed copies of the book at the DevOps Connect event at RSA Conference this week, as well as at a special Rugged DevOps Breakfast Tuesday morning at Jillians.  But you don’t have to be at RSA to download your own copy. Fill out the form below to download a copy.

    The Ebook is sponsored by Evident.io and Incapsula. Thanks to them for their support.

    Enjoy!

    Download Rugged DevOps Ebook

    • This field is for validation purposes and should be left unchanged.

     

    *downloading the Ebook will add your email to our newsletter mailing list which you can opt out of at anytime.

  • Live Blogging DevOps Connect @RSAC

    Live Blogging DevOps Connect @RSAC

    We will be live blogging the DevOps Connect: SecDevOps event from RSA Conference on Monday, April 20th. Stay tuned for updates

  • Rugged DevOps: From Idea to Automation to Impact

    Rugged DevOps: From Idea to Automation to Impact

    The Idea Behind Rugged DevOps

    josh cormanWhereas DevOps is IT at ludicrous speed, Rugged DevOps is a shift left to find a way to inject security into DevOps from the beginning, says Joshua Corman, CTO, Sonatype and Rugged DevOps founder.

    One way to do that is for Rugged DevOps to establish security parameters and requirements, meet those requirements as the project progresses, and establish and enforce the automated application of new and existing pen tests on software as development teams deliver it to the internal staging environment, in order to confirm software quality.

    Automating Pen Tests? Running the Guantlt Is One Way

    Guantlt is a project and a platform for doing just that: developing tools to hook into pen tests and run them on internally-staged code. The Gauntlt project works to automate security testing using established tools, to disperse standard errors, and to fail code based on test results and software requirements. “The goal is to provide an automated way to attack your software because, what we need in DevOps is to find ways to automatically enforce security quality,” says Aaron Cois, Researcher, CERT Division, Software Engineering Institute, Carnegie Mellon University.

    The industry is developing frameworks such as Gauntlt to support autonomously running pen tests on every newly staged release candidate in order to avoid involving or requiring any manual effort. These frameworks enable an automated system to run unattended tests up to several hundreds of times a day to keep step with as many potential new releases each day. We can’t expect limited human capital to run that many tests in succession. “We want coders to write that automated test once and then go off and do something creative that we haven’t already done,” says Cois.

    All this is necessary to meet security quality standards while maintaining the shortest time to deliver each new release candidate with the confidence that development could release it to production at any time. “We want to fire off Rugged tests against that internal environment. Having that parity environment is what enables the development of more comprehensive and more interesting testing from a security perspective,” says Cois.

    Teams must run pen tests on running code in an environment that mirrors production. That’s the only way to know whether the software will stand up to attack. Teams must be able to add new tests as new threats appear.

    To automate a response to pen test results, coders write conditional ‘if-this-then-that’ rules into Continuous Integration to respond to conditions such that, for example, when any unit test fails, the system fails to build the software. “A lot of organizations start out by saying, well, we’re going to start writing security-focused unit tests and security-focused integration tests, getting our QA department involved and our Integrated Security Department involved early in that process, having them rating those tests and enforcing tests in Continuous Integration,” says Cois.

    Impact: Rugged DevOps in Action

    “Heartbleed and Shellshock were high-profile vulnerabilities that had been present in BASH and Open SSL for a long time and we didn’t know about them. We had to find ways to make sure we weren’t vulnerable to those,” says Cois. Using Rugged DevOps, the security team member can create tests for such new threats and require the tests using CI. As CD quickly fixes bugs, so Rugged DevOps can quickly defend against new threats.

    One hope for Rugged DevOps is that it will bring truly secure coding even to COTS software as DevOps eventually envelopes all software development. DevOps should enable developers to continue to develop COTS software cheaply while adding the inherent security that would prevent a lot of the successful attacks on software that trouble industry today.

    “I don’t know that we will reach that stage quickly since it certainly requires an investment,” says Cois. There first has to be that continued uptake of DevOps approaches and those changes in processes, culture, and mindset. Rugged DevOps has to accompany that or the eventuality of cheap and secure COTS software might never materialize.

    Concluding Remarks

    “People like DevOps because the concrete hasn’t dried yet and people are copying high performers. At the same time, programmers are assembling 90-percent more code from existing open source code,” says Corman. This is good news where those high performers and those who follow in their footsteps fail faster, fix errors sooner, and carefully consider security at every step, as this will magnify secure code. But developers have to build using the higher quality code those high performers are creating, says Corman.

  • First wave of sessions and speakers announced for DevOps Connect: SecDevOps @ RSA Conference

    First wave of sessions and speakers announced for DevOps Connect: SecDevOps @ RSA Conference

    As we previously announced there will be a DevOps Connect: SecDevOps @ RSA Conference this year at the Moscone Center.  The event takes place Monday of RSA Conference week at the Moscone Center.  The program committee for the event is headed up by Gene Kim and Josh Corman.  Gene and Josh will be delivering the keynote for the event as well. More on that will be announced soon.

    Today we are happy to announce the first wave of speakers and sessions selected by the program committee to present at DevOps Connect: SecDevOps.  The first wave of selections are:

    Automating Enterprise Security by Chris Corriere of Autotrader.com (and devopsy.kinsta.cloud) – How to automate security scans and make the remediation process as easy as possible for everyone involved.

    I’m the new Security Lead, and I’m Here to Help by Chris Walsh of Signal – How a new security hire learned from and Agile+Devops team, added security to the mix, and made people happier.

    DevOpsSecFail: DevOps Security Anti Patterns by Constantine Cois of Carnegie Mellon University – Common security anti-patterns I’ve observed in DevOps implementation and process.

    Blending the Automated and the Manual: Making Application Vulnerability Management Your Ally by Kris Curylo of Ally Financial and Dan Cornell of Denim Group – Security in DevOps is often laser-focused on automation. This talk looks at methods to incorporate manual tasks in a non-disruptive manner.

    All four of these sound like excellent presentations. There will be many more sessions to announce soon. With a little over a month until RSA, stay tuned for more information soon including some surprise guest speakers.

    Many thanks to everyone who submitted responses to the CFP for the event. Just because you were not selected in this first wave does not mean you are not selected.  Stay tuned for more speaker announcements shortly.

  • CFP for DevOps Connect: DevOpsSec @RSA Conference is now open

    CFP for DevOps Connect: DevOpsSec @RSA Conference is now open

     

    300x250_Connect_ad2The world comes to talk security at RSA Conference. Every year in San Francisco the RSA Conference is the biggest information themed security conference in the world. This year there is a new addition to RSA Conference. DevOps Connect: DevOpsSec will be held on the Monday of RSA week at the Moscone Center. Attendance is free and open to all RSAC registered attendees. But you must pre-register at the time of registration.

    The keynote and co-chairs for the DevOps Connect program are author and DevOps pioneer Gene Kim of IT Revolution Press and Joshua Corman, CTO of Sonatype and Co-Founder of RuggedSoftware.org and IamTheCavalry.org Gene and Joshua first introduced “Rugged DevOps” at RSAC 2012 and have been building collaborations and bridges between those worlds ever since.

    Additionally, Mark Miller and TheNEXUS are co-producing this show along with devopsy.kinsta.cloud and of course with the sponsorship of RSA Conference.

    “DevOps is one of the fastest rising trends in technology with a tremendous impact on the information security landscape,” said Linda Gray, General Manager, RSA Conference. “We are excited to hear the direction and insights speakers such as Gene Kim and Josh Corman will bring to this event and to our RSAC attendees.”

    The call for papers is now open to speak at this event. The link for the CFP is: http://ow.ly/I27jQ . If you would like to speak at this event, head over now and submit your proposal. Josh and Gene have given a lot of thought in designing the CFP in terms of what the agenda for the conference will be, so please read it carefully before submitting.

    What are they looking for? Here is the pre-amble to the CFP which should help give you a good idea:

    DevOpsSec 2015: Call for Speakers

    Whether we like it or not, DevOps is upon us. The DevOps Enterprise Summit in October 2013 showed us that it’s not just for Internet startups, but it’s for large complex, and highly regulated organizations such as Disney, Capital One, Macy’s, GE, Nordstrom, Target, U.S. Citizenship and Immigration Services at DHS, and many more.

    DevOps and “continuous everything” is profoundly changing the entire software industry. Our goal is to show how the fittest in InfoSec are adapting (and how we all must adapt). The purpose of the DevOps Connect: Security Edition is to assemble the best practitioners who are forging how InfoSec integrates into DevOps, to grow the tribe, and to build relationships and collaborations with DevOps leaders and luminaries outside of the security “Echo Chamber”.

    Gene and Josh first introduced “Rugged DevOps” to RSAC 2012 and have been building collaborations and bridges between those worlds ever since. For 2015, we’ve asked them to host this day-long conference with the following goals:

    • bring the best and brightest of the DevOps and InfoSec communities together
    • share and codify effective patterns and practices, for mutual growth and benefit
    • for new-comers, demystify the DevOps foundational concepts that every InfoSec practitioner needs to know
    • capture the failures and toughest problems facing our industry, and mobilize to solve them

    We are looking for speakers to discuss the unique challenges of adopting DevOps in the enterprise, and the ways to overcome them. Specific topics we’re looking for include, but are not restricted to:

    • How did you get senior management buy-in, what did you do, and how did you quantify the business value?
    • How did you overcome objections inside the organization?
    • How did you design and implement effective controls to mitigate security risks?
    • Which business area (and application) did you start with, why, and what did you do?
    • What were the top challenges, and how did you overcome them?
    • What were your top mistakes, and what advice would you give as a result?
    • In-progress stories (and even nightmares) are welcome!

    Other submission guidelines:

    • Talk slots will be 30 minutes, of which a few minutes should be reserved for Q&A.
    • Attendees must be able to use the bulk of the presentation’s lessons without buying or using a particular tool or service.
    • While we love consultants and vendors (they’re some of our favorite people!), we are looking for stories from the organizations adopting these practices. We are prioritizing practitioner presentations (or joint ones with their game changing consultant/vendors).
    • You can submit up to three talks for the conference. No spamming.
    • Each submission should end with a slide communicating three things:
      1) A specific challenge you could use help with (people, process, or technology).
      2) A specific offer of how you could help other attendees (people, process, or technology).
      3) If you could wave a magic wand and get any change you want from the DevOps and “continuous everything” toolchains you depend upon, what would it be and why?

    The closing date for submissions is midnight Pacific time, February 15, 2015.

    SUBMISSIONS DEADLINE: MIDNIGHT PACIFIC TIME, FEBRUARY 15, 2015
    LINK:REGISTRATION FORM

    Thanks for your interest in DevOps Connect: Security Edition and we look forward to reading your proposal!

    Thank you!
    Josh Corman, Gene Kim

     

  • DevOps Connect: SecOps Edition @RSA Conference

    DevOps Connect: SecOps Edition @RSA Conference

    devops_connect_header3We are very happy to announce that we will be hosting DevOps Connect: SecOps Edition at RSA Conference on Monday, April 20, 2015. It will take place at the Moscone Center and is sponsored by RSA Conference.

    What is DevOps Connect? Great question. DevOps Connect is the new name for the Camp DevOps brand we have run here at devopsy.kinsta.cloud.  We felt that Camp DevOps sounded too much … well, like a camp. DevOps Connect is so much more.  We will hold DevOps Connect events at existing conferences such as this one at RSA Conference, as well as standalone events in cities around the globe.

    DevOps Connect: SecOps edition will be focused on DevOps and security’s role in the software development lifecycle. The agenda, sessions and speakers will be chosen by our program committee.  I am very happy to report that the committee is chaired by Josh Corman and Gene Kim, with the assistance of myself and Mark Miller, organizer of theNexus community. A formal call for speakers will be announced shortly.

    We anticipate over 7 hours of sessions followed by the 2nd annual DevOps wining, not whining happy hour brought to you by Sonatype, IT Revolution Press and devopsy.kinsta.cloud at a location to be announced.

    Full details are on the DevOps Connect website, but there some bullet points:

    1. Admission is free to all RSA badge holders, regardless of level. However you must pre-register for the event when you register for RSA Conference.
    2. At the DevOps Connect website there is a code to save $100 dollars on an RSA Conference full conference pass.
    3. We are limited to 600 attendees, so pre-registration is a must if you want to guarantee you are admitted. Attendance and registration is on and is on a first come first serve basis
    4. Sessions will feature keynotes (Gene Kim will deliver one), panel discussions and multi-track topics.
    5. DevOps Connect will be at Moscone West on Monday of RSA week.
    6. Sessions and presentations will be focused on real world experiences from practitioners.

    RSA Conference is where the premier infosec event in the world and we think a perfect venue for DevOps Connect: SecOps Edition. So if you are planning on attending RSA Conference you don’t want to miss what promises to be a great DevOps event!

    If after visiting the DevOps Connect website you have any questions, please reach out to us at devopsconect@devops.com. We will update the website with more information as it becomes available.

  • Busting The 4 Biggest DevOps Security Myths

    Busting The 4 Biggest DevOps Security Myths

    Last month when the IT security world convened in San Francisco for the annual RSA confab, a number of security experts tackled DevOps in talks that covered the crossover between continuous improvement and risk management. Among them was a lively panel mythbusting some of the most prevalent misconceptions about DevOps held by the security community.

    Moderated by Dwayne Melancon of Tripwire, the panel was made up of Josh Corman, CTO of Sonatype, Nick Galbreath, vice president of engineering at IPONWEB, Gene Kim, author of The Phoenix Project, and David Mortman chief security architect and distinguished engineer for Dell Enstratius, all of them security professionals and very active DevOps evangelists. The banter backed-and-forthed between the participants, with four myths bubbling to the surface as particular highlights from the discussion.

    Myth #1: DevOps Pace Will Leave Security In The Dust

    One of the most prevalent myths about DevOps within the security community is that the rapid deploys of the approach will throw all risk management precautions to the wind and leave security practices behind as a result. Quite the contrary, panelists argued. They believe that DevOps patterns make it more possible than ever to bake security practices into IT processes more than before, when it is frequently bolted on “at the end of the caboose,” as Galbreath puts it.

    “You’re not throwing out your current security system,” he said. “What you’re doing is removing a lot of the junk work that eats up so much time and keeps people underwater. You’re really enabling different teams to all improve security together.”

    As Corman explained, security people say all the time that complexity is the enemy of security.

    “It also happens to be the enemy of stability,” he said. “That is the reason DevOps people come willingly with open arms to the security community.”

    Not to mention, Kim added, “because you can’t be highly available and have stuff coming continuously through the pipeline if it is not secure.

    Myth #2: DevOps Destroys Compliance And Control Frameworks

    This myth came up during the audience Q&A portion of the panel, where one audience member from the financial industry wondered at how possible it would be to institute DevOps in a highly regulated industry. According to Mortman, as seemingly chaotic and fast-and-furious as the DevOps pace can seem to the uninitiated, it is actually far more process-oriented than people realize.

    “People say ‘Oh, there’s no process to this.’ But it is actually very process oriented,” he said. “It’s just not very bureaucracy-oriented. There’s not a lot of paperwork. In its very guts, it is very service-oriented and very delivery-oriented.”

    As he puts it, every compliance framework in the planet says you need to log, audit and approve changes. But none of them stipulate a workflow where each change has to be approved one at a time.

    “The workflow can be ‘Please approve the following list of actions that I can do without notifying you first,'” he explained, “and as long as you have an audit trail showing that that has been done properly, I have yet to meet an auditor who will not buy into that.”

    Myth #3: DevOps Gives Developers Too Much Power

    Many dyed-in-the-wool security pros fear DevOps because they believe it is a cowboy environment that gives developers too much power.

    “I’ll be honest, when i first started observing DevOps patterns, developers doing their own deploys seemed immoral to me; irresponsible, reckless, just shouldn’t be done,” Kim said. “No sane person would want to be associated with that, right?”

    The thing was, after Kim dove in and also did a benchmark study with Tripwire several years ago across 4,000 organizations, he found that when comparing groups where ops did the deploys to those where developers shepherded code through deploys, change success rates and mean time to repair were not adversely affected, and in fact, “it is often considered indispensible that developers take code all the way through the deployment pipeline and you know they are getting great outcomes.”

    And from a security controls perspective, the truth is that in a DevOps situation developers “are not logging individually into each server and SSH’ing the code up, untarring it and installing it,” Mortman said. Instead these actions are being done by automated systems.

    “They’re actually going to give you much better timestamps, much more accuracy, and more consistent results and visibility than a manual process being done by someone in ops,” Mortman said. “So, actually, you’re getting better change management out of that system than you are in other situations.”

    Myth #4: DevOps Cuts Important Testing

    One discussion point also brought up during audience Q&A was the possibility that DevOps would somehow excise important testing functionality from the IT process. The panel quickly put that one to bed.

    “You can do bad testing in any model,” Corman said. “If DevOps starts eliminating any kind of testing, its a bad DevOps program. I think that’s orthogonal to some of the benefits or opportunities of DevOps.”

    Kim pointed to Google as an example of how testing fits into the DevOps methodology.

    “So, Google does about 5,500 code commits per day, they have about 15,000 software engineers, and 75 million hours of testing is run each day,” he said. “You can’t get that massive amount of deployment frequencies without a tremendous amount of testing.”

  • DevOps’ Chicken Or Egg Origins

    DevOps’ Chicken Or Egg Origins

    When acolytes explain the DevOps movement to the uninitiated, they usually run into a chicken and egg line of questioning. What is DevOps, really? Is it a culture? Is it a pattern of processes? Or is it a technology? What comes first?

    The ratios of the perceived importance of each of those elements may shift depending on who you talk to in the DevOps community. But the inevitable answer to these questions is usually that DevOps depends on at least a little of all of them, but probably on culture above all else.

    “I think it’s first and foremost cultural. The development team is a tribe. So is operations.  They have norms.  They have things they value.  They have things that they reward and admonish,” says Josh Corman, chief technology officer for Sonatype, a component lifecycle management firm. “Developers are incentivized to cause change.  And ops people are incentivized to prevent change, to promote stability.  So they were natural enemies.  And when they work it out and align to each other’s tools and incentives, they’re able to go faster.”

    Therein lie the historical roots of DevOps, agrees Andrew Storms, senior director of DevOps at cloud security firm CloudPassage, who explains that it is an answer to the blame game that inevitably occurs in the old model.

    “I think that existing corporations or companies or groups are probably doing DevOps in response to existing pain,” he says, explaining that in previous non-DevOps shops he worked at, it was inevitable that development would write a piece of code, throw it over the fence and let ops catch the heat when trouble brewed. “The question is, why is the person at the end of the train always feeling the pain for something that originated at the beginning of the train? To me, DevOps says, ‘There is no train.’ There’s no more division of who’s in trouble for anything. Everybody is on the same darned team.”

    It’s for this very reason that Jez Humble, a principal for the consultancy ThoughtWorks and co-author of Continuous Delivery: Reliable Software Releases through Build, Test, and Deployment Automation, says that the fundamental ingredient to successful DevOps is trust.

    “You need to trust each other. Developers can’t just assume the ops people are all dumb and don’t know anything about code or are just command line monkeys. And the ops people can’t assume the developers don’t know anything about how systems work in real life,” he says. “These assumptions make it all a big finger-pointing exercise.”

    A lack of trust is the underlying roadblock to better teamwork between dev and ops, but it can be difficult to achieve within enterprises.

    “In small organizations people trust each other because they can see each other and work with each other and must learn to trust to get anything done,” he says. “But as organizations scale you lose that human contact.”

    It’s replaced instead with brittle and bureaucratic processes that only feed into those distinct walls between each tribe. However, as organizations feel the pain that’s inflicted by those bureaucracies that have evolved so far in IT and by the walls thrown up as a result, they face a choice. Engender that trust and a culture that allows  dev and ops to simplify processes and tear down the walls, or face further roadblocks that will hurt the business.

    From there, it is a matter of establishing behavioral and process patterns that are a hallmark of DevOps cooperation.

    “I think ‘patterns’ is the right word for it. People get hung up on this textbook or technical definition of DevOps.  And while there are certain common processes and things like Kanban boards and Scrums, and sometimes it’s a hybrid of Agile, sometimes not that ,” Corman says, “what matters the most is an attitude to fail fast and iterate, to continuously look for ways to increase flow, to automate, instrument and find and root out weakness. And to be responsive to new ideas of the business, or new ideas of your install base, or new market pressure.”

    According to Corman, the beauty of DevOps is that it’s a ‘jump ball’ for IT, so there are no set processes that make or break whether a shop is DevOps or not.

    “It’s in a state of flux, and the cement hasn’t dried.  It’s a singular opportunity to redefine the way we engage with the business and drive value, the likes of which we will not see again for 30 years,” he says. “It’s very, very rare.”

    And while few within the DevOps community would say it is defined by technology, it certainly is enabled by it.

    “To me it is more a cultural shift than a tool shift, but that tools shift presents a huge change in the way IT runs,” Storms says, explaining that instrumentation and orchestration tools like Puppet and Chef makes it possible to achieve continuous improvement and fast iterations. “So does it come about through the cultural change or the technical change? I think, actually, neither. I think it happens at the same time. That’s the force multiplier, that two plus two equals five kind of thing.”

    But like tectonic shifts, changes in IT happen sometimes all of a sudden, but mostly in increments.

    “One part of it is focusing on what we can do every day to make things a little better for everybody. You have to proceed incrementally and accept that it’s going to take time,” Humble says. “You can’t say, ‘Well, we’re going to adopt Agile now across the whole organization—go!’ There has to be enthusiasm from the people on the ground to do this stuff and then you have to work together though a process of experimentation and trial and error to work out how to make it work in practice, probably with a small group of people initially.”

    Even with that force multiplier, Storms says, you’ll still see positive steps forward by establishing an element of DevOps one at a time.

    “Even if you’re in a difficult situation where you can’t have the force multiplier of culture and technology changes at the same time, just one or the other is still going to be a big win,” he says. “Let’s say you just took the one piece of ‘Let’s move our dev and ops teams together and make them be friends,’ you don’t necessarily have to orchestrate and instrument like crazy to win. But you can also do the opposite and just picked the orchestration piece and say, ‘Hey, ops people, stop doing things by hand.’ You send them to Chef conferences and make them learn Ruby and guess what? Their skill sets just went through the roof.”