David Rico, profile picture
Uploaded byDavid Rico
PDF, PPTX1,428 views

Business Value of CI, CD, & DevOps(Sec)

The document discusses the business value of Continuous Integration (CI), Continuous Deployment (CD), and DevOps in scaling global systems using automation and containerization. It emphasizes the iterative and collaborative nature of DevOps, which integrates development and operations to maximize business value and minimize costs and risks. Additionally, it outlines the evolution of practices in testing and deployment, including Test-Driven Development (TDD), Behavior-Driven Development (BDD), Continuous Integration (CI), Continuous Delivery (CD), and DevOps, highlighting their benefits in software development.

Embed presentation

Download as PDF, PPTX
Business Value of CI, CD, & DevOpsSec Scaling Up to Billion User Global Systems of Systems Using END-TO-END AUTOMATION & CONTAINERIZED DOCKER UBUNTU IMAGES Dr. David F. Rico, PMP, CSEP, FCP, FCT, ACP, CSM, SAFE, DEVOPS Twitter: @dr_david_f_rico Website: http://www.davidfrico.com LinkedIn: http://www.linkedin.com/in/davidfrico Agile Capabilities: http://davidfrico.com/rico-capability-agile.pdf Agile Cost of Quality: http://www.davidfrico.com/agile-vs-trad-coq.pdf DevOps Return on Investment (ROI): http://davidfrico.com/rico-devops-roi.pdf Dave’s NEW Business Agility Video: http://www.youtube.com/watch?v=hTvtsAkL8xU Dave’s NEWER Scaled Agile Framework SAFe 4.5 Video: http://youtu.be/1TAuCRq5a34 Dave’s NEWEST Development Operations Security Video: http://youtu.be/X22kJAvx44A DoD Fighter Jets versus Amazon Web Services: http://davidfrico.com/dod-agile-principles.pdf
Author Background  Gov’t contractor with 35+ years of IT experience  B.S. Comp. Sci., M.S. Soft. Eng., & D.M. Info. Sys.  Large gov’t projects in U.S., Far/Mid-East, & Europe 2   Career systems & software engineering methodologist  Lean-Agile, Six Sigma, CMMI, ISO 9001, DoD 5000  NASA, USAF, Navy, Army, DISA, & DARPA projects  Published seven books & numerous journal articles  Intn’l keynote speaker, 200+ talks to 14,500 people  Specializes in metrics, models, & cost engineering  Cloud Computing, SOA, Web Services, FOSS, etc.  Professor at 7 Washington, DC-area universities
3 Internet of Things—Dinosaur Killer IoT is an Extinction Level Event • 25-50B Devices on IOT • 5-10B Internet Hosts • 4-8B Mobile Phones • 2-3B End User Sys • Mass Business Failure
 Dev-Ops (dĕv′ŏps) Early, iterative, & automated combo of development & operations; Incremental deployment  An approach embracing principles & values of lean thinking, product development flow, & agile methods  Early, collaborative, and automated form of incremental development, integration, system, & operational testing  Design method that supports collaboration, teamwork, iterative development, & responding to change  Mult-tiered automated framework for TDD, Continuous Integration, BDD, Continuous Delivery, & DevOps  Maximizes BUSINESS VALUE of organizations, portfolios, & projects by enabling buyers-suppliers to scale globally 4  Crispin, L., & Gregory, J. (2009). Agile testing: A practical guide for testers and agile teams. Boston, MA: Addison-Wesley. Crispin, L., & Gregory, J. (2015). More agile testing: Learning journeys for the whole team. Boston, MA: Addison-Wesley. DevOps—What is it?
Network Computer Operating System Middleware Applications APIs GUI  Agile requirements implemented in slices vs. layers  User needs with higher business value are done first  Reduces cost & risk while increasing business success 5Shore, J. (2011). Evolutionary design illustrated. Norwegian Developers Conference, Oslo, Norway. Agile Traditional 1 2 3 Faster  Early ROI  Lower Costs  Fewer Defects  Manageable Risk  Better Performance  Smaller Attack Surface Late  No Value  Cost Overruns  Very Poor Quality  Uncontrollable Risk  Slowest Performance  More Security Incidents  Seven Wastes 1. Rework 2. Motion 3. Waiting 4. Inventory 5. Transportation 6. Overprocessing 7. Overproduction MINIMIZES MAXIMIZES  JIT, Just-enough architecture  Early, in-process system V&V  Fast continuous improvement  Scalable to systems of systems  Maximizes successful outcomes  Myth of perfect architecture  Late big-bang integration tests  Year long improvement cycles  Breaks down on large projects  Undermines business success  DevOps—How it works?      
6 Traditional vs. Agile Cumulative Flow Work(Story,Point,Task)orEffort(Week,Day,Hour) Time Unit (Roadmap, Release, Iteration, Month, Week, Day, Hour, etc.) Work(Story,Point,Task)orEffort(Week,Day,Hour) Time Unit (Roadmap, Release, Iteration, Month, Week, Day, Hour, etc.) TRADITIONAL Cumulative Flow  Late big bang integration increases WIP backlog  Agile testing early and often reduces WIP backlog  Improves workflow and reduces WIP & lead times Anderson, D. J. (2004). Agile management for software engineering. Upper Saddle River, NJ: Pearson Education. Anderson, D. J. (2010). Kanban: Successful evolutionary change for your technology business. Sequim, WA: Blue Hole Press.  DevOps—Workflow Results   DEVOPS Cumulative Flow
7  Methods to “scope” project, product, or system  “Key” is smallest possible scope with highest value  Reduces cost, risk, time, failure, & tech. obsolescence INCREASES TESTABILITY, QUALITY, RELIABILITY, SECURITY, MORALE, MAINTAINABILITY, & SUCCESS Denne, M., & Cleland-Huang, J. (2004). Software by numbers: Low-risk, high-return development. Santa Clara, CA: Sun Microsystems. Ries, E. (2011). The lean startup: How today's entrepreneurs use continuous innovation. New York, NY: Crown Publishing. Patton, J. (2014). User story mapping: Discover the whole story, build the right product. Sebastopol, CA: O'Reilly Media. Layton, M. C., & Maurer, R. (2011). Agile project management for dummies. Hoboken, NJ: Wiley Publishing. Krause, L. (2014). Microservices: Patterns and applications. Paris, France: Lucas Krause.  MINIMUM MARKETABLE FEATURE - MMF -  Advantage  Difference  Revenue  Profit  Savings  Brand  Loyalty MINIMUM VIABLE PRODUCT - MVP -  Goal  Process  Features  Priorities  Story Map  Architecture STORY MAP OR IMPACT MAP - SM or IM -  Goal  Actors  Impacts  Deliverables  Measures  Milestones VISION STATEMENT - VS -  For <customer>  Who <needs it>  The <product>  Is a <benefit>  That <customer>  Unlike <other>  Ours <different> MICRO- SERVICE - MS -  Purpose  Automated  Unique  Independent  Resilient  Ecosystem  Consumer DevOps—MMF, MVP, MVA, etc.  
8   Lightweight, fast, disposable virtual environments  Set of isolated processes running on shared kernel  Efficient way for building, delivering, & running apps Monolithic Applications Just-Enough Applications Containerized Apps Minimal - Typically single process entities Declarative - Built from layered Docker images Immutable - Do exactly same thing from run to kill • Small autonomous services that work together • Self-contained process that provides a unique capability • Loosely coupled service oriented architecture with bounded contexts • Small independent processes communicating with each other using language-agnostic APIs • Fined-grained independent services running in their own processes that are developed and deployed independently • Suite of services running in their own process, exposing APIs, and doing one thing well (independently developed and deployable) • Single app as a suite of small services, each running in its own process and communicating with lightweight mechanisms (HTTP APIs) Krause, L. (2014). Microservices: Patterns and applications. Paris, France: Lucas Krause. DevOps—Microservices       OS’s Have UNREPORTED 30-50 CVEs 
9  TDD - 2003 - CI - 2006 - BDD - 2008 - CD - 2011 - DEVOPS - 2012 - DEVOPSSEC - 2014 -  User Story  Acc Criteria  Dev Unit Test  Run Unit Test  Write SW Unit  Re-Run Unit Test  Refactor Unit  Building  Database  Inspections  Testing  Feedback  Documentation  Deployment  Analyze Feature  Acc Criteria  Dev Feat. Test  Run Feat. Test  Develop Feature  Re-Run Feature  Refactor Feat.  Packaging  Acceptance  Load Test  Performance  Pre-Production  Certification  Deployment  Sys Admin  Config. Mgt.  Host Builds  Virtualization  Containerization  Deployment  Monitor & Supp  Sec. Engineer.  Sec. Containers  Sec. Evaluation  Sec. Deploy.  Runtime Prot.  Sec. Monitoring  Response Mgt. Beck, K. (2003). Test-driven development: By example. Boston, MA: Addison-Wesley. Duvall, P., Matyas, S., & Glover, A. (2006). Continuous integration. Boston, MA: Addison-Wesley. Barker, K., & Humphries, C. (2008). Foundations of rspec: Behavior driven development with ruby and rails. New York, NY: Apress. Humble, J., & Farley, D. (2011). Continuous delivery. Boston, MA: Pearson Education. Huttermann, M. (2012). Devops for developers: Integrate development and operations the agile way. New York, NY: Apress. Bird, J. (2016). Devopssec: Delivering secure software through continuous delivery. Sebastopol, CA: O'Reilly Media.  Numerous models of lean-agile testing emerging  Based on principles of lean & agile one piece flow  Include software, hardware, system, & port. testing DevOps—Evolution
STAGE 1—Test Driven Development  Term coined by Kent Beck in 2003  Consists of writing all tests before design  Ensures all components are verified and validated 10Beck, K. (2003). Test-driven development: By example. Boston, MA: Addison-Wesley.  
 Agile TDD consists of seven broad practices  Document test criteria, tests, software units, etc.  Include refactoring, verification, optimization, etc. 11 Practice User Story Acc Criteria Dev Test Run Test Dev Unit Rerun Test Refactor Unit Description Read story, analyze meaning, ask questions, and clarify understanding Identify, verify, and document acceptance criteria for each user story Design, develop, code, and verify automated unit test for user story Run automated unit test to verify that it fails the first time (sanity check) Design, develop, code, and verify the software unit to satisfy user story Rerun automated unit test to see if code satisfies automated unit test Refine, reduce, and simplify code to remove waste and optimize performance STAGE 1—Test Driven Develop.  Beck, K. (2003). Test-driven development: By example. Boston, MA: Addison-Wesley.
STAGE 2—Behavior Driven Develop.  Term coined by Dan North in 2006  Consists of writing feature tests before design  Ensures all system features are verified and validated 12Smart, J. F. (2014). BDD in action: Behavior-driven development for the whole software lifecycle. Shelter Island, NY: Manning Publications.  
 Agile BDD consists of seven broad practices  Document test criteria, tests, syst. features, etc.  Include refactoring, verification, optimization, etc. 13 Practice Feature Acc Criteria Dev Test Run Test Dev Feature Rerun Test Refac Feature Description Read feature, analyze meaning, ask questions, and clarify understanding Identify, verify, and document acceptance criteria for each feature Design, develop, code, and verify automated feature test for feature Run automated feature test to verify that it fails the first time (sanity check) Design, develop, code, and verify the feature software to satisfy feature Rerun automated feature test to see if code satisfies automated feature test Refine, reduce, and simplify code to remove waste and optimize performance STAGE 2—Behavior Driven Dev.  Smart, J. F. (2014). BDD in action: Behavior-driven development for the whole software lifecycle. Shelter Island, NY: Manning Publications.
 Term coined by Martin Fowler circa 1998  User needs designed & developed one-at-a-time  Changes automatically detected, built, & fully-tested 14Humble, J., & Farley, D. (2011). Continuous delivery. Boston, MA: Pearson Education. Duvall, P., Matyas, S., & Glover, A. (2006). Continuous integration. Boston, MA: Addison-Wesley.  STAGE 3—Continuous Integration Thousands of Tests Continuously Executed No More Late Big Bang Integration Build Integration Server Version Control Server Build Scripts UsesWatches Build Status Provides Developer A Developer B Developer C Commits Changes Commits Changes Commits Changes Builds Database Analysis Testing Reporting Documentation Deployment Early, Automated, Fast, Efficient, & Repeatable Constant Readiness State & CM Control Lean, Waste Free, Low WIP, No Deadlocked Test Queues Rapidly & Successfully Dev. Complex Systems           ALL DEVELOPERS RUN PRIVATE BUILDS  DEVELOPERS COMMIT CODE TO VERSION CONTROL  INTEGRATION BUILDS OCCUR SEVERAL TIMES PER DAY  100% OF SYSTEM TESTS MUST PASS FOR EVERY BUILD  A SHIPPABLE PRODUCT RESULTS FROM EVERY BUILD  FIXING BROKEN BUILDS IS OF THE HIGHEST PRIORITY  REPORTS AUTOMATICALLY GENERATED & REVIEWED
 Agile CI consists of seven broad practices  Automated build, database, inspection, tests, etc.  Include reporting, documentation, deployment, etc. 15 Practice Building Database Inspections Testing Feedback Documentation Deployment Description Frequently assembling products and services to ensure delivery readiness Frequently generating/analyzing database schemas, queries, and forms Frequently performing automated static analysis of product/service quality Frequently performing automated dynamic product and service evaluation Frequently generating automated status reports/messages for all stakeholders Frequently performing automated technical/customer document generation Frequently performing automated delivery of products/services to end users Duvall, P., Matyas, S., & Glover, A. (2006). Continuous integration: Improving software quality and reducing risk. Boston, MA: Addison-Wesley. Humble, J., & Farley, D. (2011). Continuous delivery. Boston, MA: Pearson Education. STAGE 3—Continuous Integration 
 Created by Jez Humble of ThoughtWorks in 2011  Includes CM, build, testing, integration, release, etc.  Goal is one-touch automation of deployment pipeline 16 Humble, J., & Farley, D. (2011). Continuous delivery. Boston, MA: Pearson Education. Duvall, P., Matyas, S., & Glover, A. (2006). Continuous integration. Boston, MA: Addison-Wesley. Ohara, D. (2012). Continuous delivery and the world of devops. San Francisco, CA: GigaOM Pro.   CoQ • 80% MS Tst • 8/10 No Val • $24B in 90s • Rep by CD • Not Add MLK STAGE 4—Continuous Delivery Source Code Control Build Automation Test Automation Continuous Integration Release Automation Continuous Delivery
 Agile CD consists of seven broad practices  Automated acceptance, load, performance, etc.  Include packaging, pre-production test, C&A, etc. 17 Practice Packaging Acceptance Load Test Performance Pre-Production Certification Deployment Description Frequently generating system images for pre-production testing & checkout Frequently performing automated system & user acceptance testing Frequently performing automated system load, stress, & capacity testing Frequently performing automated system user & technical performance testing Frequently performing automated pre-production tests prior to final deployment Frequently performing automated system certification & accreditation tests Frequently generating product images for pre-deployment testing & checkout Mukherjee, J. (2015). Continuous delivery pipeline: Where does it choke. Charleston, SC: CreateSpace. Swartout, P. (2014). Continuous delivery and devops: A quickstart guide. Birmingham, UK: Packt Publishing. STAGE 4—Continuous Delivery 
 Created by Patrick Debois of Jedi BVBA in 2007  Collaboration of developers & infrastructure people  Goal to automate the deployment to end-user devices 18 Bass, L., Weber, I., & Zhu, L. (2015). Devops: A software architect's perspective. Old Tappan, NJ: Pearson Education. Gruver, G., & Mouser, T. (2015). Leading the transformation: Applying agile and devops at scale. Portland, OR: IT Revolution Press. Humble, J., Molesky, J., & O'Reilly, B. (2015). Lean enterprise: How high performance organizations innovate at scale. Sebastopol, CA: O'Reilly Media.  STAGE 5—Development Operations  Collaboration
 Agile DevOps consists of seven broad practices  Automated sys admin, CM, building, monitor, etc.  Include virtualization, containerize, deployment, etc. 19 Practice Sys Admin Config. Mgt. Host Builds Virtualization Containerize Deployment Monitor & Supp Description Frequently performing automated system administration tasks, i.e., scripting Frequently performing automated infrastructure config. mgt./version control Frequently performing automated system and server host builds and config. Frequently performing automated system, server, & net virtualization services Frequently performing automated software and Microservices containerization Frequently generating final end-user system & software images for distribution Frequently performing automated metrics collection & deployment monitoring Duffy, M. (2015). Devops automation cookbook: Over 120 recipes coverying key automation techniques. Birmingham, UK: Packt Publishing. Farcic, V. (2016). The devops 2.0 toolkit: Automating the continuous deployment pipelines with containerized microservices. Victoria, CA: LeanPub.  STAGE 5—Development Operations
 STAGE 6—Development Ops Sec  DevOpsSec coined by Shannon Lietz in 2014  Rugged devops, devsecops, secdevops, devopssec  Microservices, security engineering & operations keys Secure Microservices • Docker App • Docker Bins • Docker Files • Docker Images • Docker Scanning • Docker Registry • Docker Host • Docker Hub • Docker Monitoring Secure Engineering • Security Champions • Security Planning • Security Training • Security Requirements • Security Architecture • Security Analysis • Security Testing • Security Review • Security Response Secure Operations • Activity Logging • Event Monitoring • Configuration Mgt. • Patch Management • User Access Control • Privilege Management • Vulnerability Mgt. • Response Mgt. • Performance Mgt. Bird, J. (2016). Devopssec: Delivering secure software through continuous delivery. Sebastopol, CA: O'Reilly Media. 20 
 DevOpsSec consists of seven broad practices  Automated secure build, analysis, & deployment  Includes containerization, engineering & operations 21 Practice Engineering Containers Evaluation Deployment Protection Monitoring Responses Description Frequently performing “baked-in” lean and agile security engineering practices Frequently performing automated microservices containerization practices Frequently performing automated static and dynamic vulnerability analysis Frequently performing automated digitally signed security deployment practices Frequently performing automated real-time self-security protection practices Frequently performing automated real-time security monitoring practices Frequently performing automated trigger-based rollback response practices  Bird, J. (2016). Devopssec: Delivering secure software through continuous delivery. Sebastopol, CA: O'Reilly Media. STAGE 6—Development Ops Sec
 SE framework by Dean Leffingwell of Rally in 2007  Newest version leaner, meaner, lighter, and simpler  Experimental bottoms-up DevOps-based innovation 22Leffingwell, D. (2007). Scaling software agility: Best practices for large enterprises. Boston, MA: Pearson Education.  PORTFOLIO LARGE PROGRAM PROGRAM TEAM STAGE 7—Enterprise DevOpsSec
23Juengst, D. (2015). Deliver better software faster: With the cloudbees jenkins platform. San Francisco, CA: CloudBees. Weeks, D. E. (2014). Devops and continuous delivery reference architectures (volume 1 & 2). Fulton, MD: Sonatype.  DevOps—Tools Ecosystem  Numerous tools to automate DevOps pipeline  People can piece together toolset along with hubs  Tools include version control, testing, & deployment
24XeniaLabs. (2016). Periodic table of devops tools. Retrieved April 11, 2016, from https://xebialabs.com/periodic-table-of-devops-tools. Weeks, D. E. (2014). Devops and continuous delivery reference architectures (volume 1 & 2). Fulton, MD: Sonatype. DevOps—Periodic Table
25Tesauro, M. (2016). Taking appsec to 11: Appsec pipelines, devops, and making things better. Denver, CO: SnowFROC 2016. Weeks, D. E. (2014). Devops and continuous delivery reference architectures (volume 1 & 2). Fulton, MD: Sonatype.  DevOps—Security Tools Ecosystem  Many tools emerging for DevOps application security  Begins-ends with microservices—tiny attack surface  Includes containers, testing, & real-time monitoring 
26
DevOps—Automation Metrics 27Duvall, P., Matyas, S., & Glover, A. (2006). Continuous integration: Improving software quality and reducing risk. Boston, MA: Addison-Wesley.  Defects DecreaseIntegrations Increase Increase Coverage Increase Automation
28  DevOps metrics gaining in widespread popularity  Hybrid of development & IT operations measures  Includes code, deployment & e-business analytics Velasquez, N. F. (2014). State of devops report. Portland, OR: Puppet Labs, Inc.  DevOps—Deployment Metrics
Activity Def CoQ DevOps Economics Hours ROI Development Operations 100 0.001 100 Defects x 70% Efficiency x 0.001 Hours 0.070 72,900% Continuous Delivery 30 0.01 30 Defects x 70% Efficiency x 0.01 Hours 0.210 24,300% Continuous Integration 9 0.1 9 Defects x 70% Efficiency x 0.1 Hours 0.630 8,100% Software Inspections 3 1 2.7 Defects x 70% Efficiency x 1 Hours 1.890 2,700% "Traditional" Testing 0.81 10 0.81 Defects x 70% Efficiency x 10 Hours 5.670 900% Manual Debugging 0.243 100 0.243 Defects x 70% Efficiency x 100 Hours 17.010 300% Operations & Maintenance 0.073 1,000 0.0729 Defects x 70% Efficiency x 1,000 Hours 51.030 n/a 29  Agile testing is orders-of-magnitude more efficient  Based on millions of automated tests run in seconds  One-touch auto-delivery to billions of global end-users Rico, D. F. (2016). Devops cost of quality (CoQ): Phase-based defect removal model. Retrieved May 10, 2016, from http://davidfrico.com  DevOps—Cost of Quality  Under 4 Minutes 4,500 x Faster than Code Inspections
30  Hewlett-Packard is a major user of CI, CD, & DevOps  400 engineers developed 10 million LOC in 4 years  Major gains in testing, deployment, & innovation Gruver, G., Young, M. & Fulghum, P. (2013). A practical approach to large-scale agile development. Upper Saddle River, NJ: Pearson Education.  TYPE METRIC MANUAL DEVOPS MAJOR GAINS CYCLE TIME IMPROVEMENTS Build Time 40 Hours 3 Hours 13 x No. Builds 1-2 per Day 10-15 per Day 8 x Feedback 1 per Day 100 per Day 100 x Regression Testing 240 Hours 24 Hours 10 x DEVELOPMENT COST EFFORT DISTRIBUTION Integration 10% 2% 5 x Planning 20% 5% 4 x Porting 25% 15% 2 x Support 25% 5% 5 x Testing 15% 5% 3 x Innovation 5% 40% 8 x DevOps—HP Case Study  
 Assembla went from 2 to 45 releases every month  15K Google developers run 120 million tests per day  30K+ Amazon developers deliver 136K releases a day 31Singleton, A. (2014). Unblock: A guide to the new continuous agile. Needham, MA: Assembla, Inc. 62 x Faster U.S. DoD IT Project 3,645 x Faster U.S. DoD IT Project  DevOps—Dot Com Case Study  
32Ashman, D. (2014). Blackboard: Keep your head in the clouds. Proceedings of the 2014 Enterprise DevOps Summit, San Francisco, California, USA.  Productivity STOPS due to excessive integration  Implements DevOps & Microservices around 2010  Waste elimination, productivity & innovation skyrocket DevOps—Blackboard Case Study  DEVOPS & MICROSERVICES IMPLEMENTED
33Denayer, L. (2017). U.S. DHS citizenship and immigration services: USCIS agile development. Washington, DC. iSDLC Seminar.  1st gen replete with large portfolios & governance  2nd-3rd gen yield minor incremental improvements  4th-5th gen enables big order-of-magnitude impacts DevOps—U.S. DHS Case Study            Automated GovernanceManual Governance  
34  Detailed DevOps economics starting to emerge  ROI ranges from $17M to $195M with minor costs  Benefits from cost savings, revenue, and availability Forsgren, N., Humble, J., & Kim, G. (2017). Forecasting the value of devops transformations: Measuring roi of devops. Portland, OR: DevOps Research. Rico, D. F. (2017). Devops return on investment (ROI) calculator. Retrieved August 29, 2017, from http://davidfrico.com/devops-roi.xls  DevOps—Return on Investment
35  DevOps adoption growing fast in-spite of slow start  35% using, 27% thinking about it, & 38% are in-dark  DevOps a global industry-wide extinction-level event 35 Brown, A. (2016). Devops and the need for speed, quality, and security: Do organizations really have to pick two out of three. Portland, OR: Puppet Labs.  DevOps—Adoption Statistics 
36  Having a DevOps rollout strategy is a key to success  Phased, incremental, and situational implementation  Includes build, testing, & IT operations, & practices St-Cyr, J. (2015). Evolving devops: Advance alm and devops practices with cont. imp. Agile Dev, Better Software, & DevOps East Conference, Orlando, Florida, USA.  DevOps—Roadmap
37  Industry leading DevOps assessments are emerging  DORA Technology DevOps Assessment is popular  Includes speed, deployments, reliability & morale Kim, G., Forsgren, N., & Humble, J. (2017). The DORA technology performance assessment. Portland, OR: DevOps Research.  DevOps—Assessments
38Kim, G., Debois, P., Willis, J., & Humble, J. The devops handbook: How to create world-class agility, reliability, and security in technology organizations. Portland, OR: IT Revolution Press.       Everything begins with lean & agile principles  Next step is smaller portfolio & simpler designs  Final step is modular interfaces & E2E automation DevOps—5 Keys to Success    
 DevOps DOES NOT mean deliver it now and fix it later  Lightweight, yet disciplined approach to development  Reduced cost, risk, & waste while improving quality 39 Rico, D. F. (2012). What’s really happening in agile methods: Its principles revisited? Retrieved June 6, 2012, from http://davidfrico.com/agile-principles.pdf Rico, D. F. (2012). The promises and pitfalls of agile methods. Retrieved February 6, 2013 from, http://davidfrico.com/agile-pros-cons.pdf Rico, D. F. (2012). How do lean & agile intersect? Retrieved February 6, 2013, from http://davidfrico.com/agile-concept-model-3.pdf What How Result Flexibility Use lightweight, yet disciplined processes and artifacts Low work-in-process Customer Involve customers early and often throughout development Early feedback Prioritize Identify highest-priority, value-adding business needs Focus resources Descope Descope complex programs by an order of magnitude Simplify problem Decompose Divide the remaining scope into smaller batches Manageable pieces Iterate Implement pieces one at a time over long periods of time Diffuse risk Leanness Architect and design the system one iteration at a time JIT waste-free design Swarm Implement each component in small cross-functional teams Knowledge transfer Collaborate Use frequent informal communications as often as possible Efficient data transfer Test Early Incrementally test each component as it is developed Early verification Test Often Perform system-level regression testing every few minutes Early validation Adapt Frequently identify optimal process and product solutions Improve performance                  DevOps—Summary
40 DevOps ensures enterprise success by delivering large volumes of valuable, reliable, & secure IT products & services to billions of users in fractions of a second ... DevOps—Bottom Line?
Dave’s PROFESSIONAL CAPABILITIES 41 Software Quality Mgt. Technical Project Mgt. Software Development Methods Leadership & Org. Change Cost Estimates & Scheduling Acquisition & Contracting Portfolio & Program Mgt. Strategy & Roadmapping Lean, Kanban, & Six Sigma Modeling & Simulations Big Data, Cloud, NoSQL Workflow Automation Metrics, Models, & SPC BPR, IDEF0, & DoDAF DoD 5000, TRA, & SRA PSP, TSP, & Code Reviews CMMI & ISO 9001 Innovation Management Statistics, CFA, EFA, & SEM Evolutionary Design Systems Engineering Valuation — Cost-Benefit Analysis, B/CR, ROI, NPV, BEP, Real Options, etc. Lean-Agile — Scrum, SAFe, Continuous Integration & Delivery, DevOpsSec, etc. STRENGTHS – Communicating Complex Ideas • Brownbags & Webinars • Datasheets & Whitepapers • Reviews & Audits • Comparisons & Tradeoffs • Brainstorming & Ideation • Data Mining & Business Cases • Metrics & Models • Tiger Teams & Shortfuse Tasks • Strategy, Roadmaps, & Plans • Concept Frameworks & Multi-Attribute Models • Etc. ● Data mining. Metrics, benchmarks, & performance. ● Simplification. Refactoring, refinement, & streamlining. ● Assessments. Audits, reviews, appraisals, & risk analysis. ● Coaching. Diagnosing, debugging, & restarting stalled projects. ● Business cases. Cost, benefit, & return-on-investment (ROI) analysis. ● Communications. Executive summaries, white papers, & lightning talks. ● Strategy & tactics. Program, project, task, & activity scoping, charters, & plans. PMP, CSEP, FCP, FCT, ACP, CSM, SAFE, & DEVOPS 35+ YEARS IN IT INDUSTRY

More Related Content

PPTX
The Values and Principles of Agile Software Development
byBrad Appleton
 
PDF
Agile. Una introducción a la agilidad en el desarrollo de software
byAndrés Lozada Mosto
 
PPTX
Exin Agile Scrum Master - Course Preview
byInvensis Learning
 
PDF
LAST Conference 2016 Agile Landscape Presentation v1
byChris Webb
 
PPT
Tips n' Tricks - Sprint Review
bySteve Greene
 
PPTX
Agile
byAbhinav Regmi
 
PDF
Scrum process powerpoint ppt slides.
bySlideTeam.net
 
PPTX
Agile (Scrum)
byDom Cushnan
 
The Values and Principles of Agile Software Development
byBrad Appleton
 
Agile. Una introducción a la agilidad en el desarrollo de software
byAndrés Lozada Mosto
 
Exin Agile Scrum Master - Course Preview
byInvensis Learning
 
LAST Conference 2016 Agile Landscape Presentation v1
byChris Webb
 
Tips n' Tricks - Sprint Review
bySteve Greene
 
Agile
byAbhinav Regmi
 
Scrum process powerpoint ppt slides.
bySlideTeam.net
 
Agile (Scrum)
byDom Cushnan
 

What's hot

PDF
Agile Transformation Approach Playbook Powerpoint Presentation Slides
bySlideTeam
 
PDF
Introduction to CICD
byKnoldus Inc.
 
PDF
Agile & SCRUM basics
byArun R
 
PPTX
Introduction to CI/CD
bySteve Mactaggart
 
PPTX
Agile methodology
byDhruv Kumar
 
PDF
Scrum 101: Introduction to Scrum
byArrielle Mali
 
PPTX
Agile-overview: Agile Manifesto, Agile principles and Agile Methodologies
byBalaji Sathram
 
PDF
10 steps to a successsful enterprise agile transformation global scrum 2018
byAgile Velocity
 
PPTX
Spotify Engineering Culture
byMaisara Khedr
 
PPTX
Agile Values, Principles and Practices
byjackcrews
 
PDF
Agile Product Owner in Wonderland!
byDr. Tathagat Varma
 
PPTX
Agile Product Management: Getting from Backlog to Value
byLiminalArc
 
PPTX
Scrum 101
bybeLithe
 
PDF
AGILE@DELOITTE AGILE LANDSCAPE v02
byChris Webb
 
PDF
Introduction agile scrum methodology
byAmit Verma
 
PPTX
Agile fluency and metrics2
byThomas AC Kofoed
 
PPTX
Agile evolution lifecycle - From implementing Agile to being Agile
byMichal Epstein
 
PPT
Scrum In 15 Minutes
bySrikanth Shreenivas
 
PDF
Scrumban
byXebia Nederland BV
 
PDF
Design Spikes for the Dual-Track Agile Process
byuxpin
 
Agile Transformation Approach Playbook Powerpoint Presentation Slides
bySlideTeam
 
Introduction to CICD
byKnoldus Inc.
 
Agile & SCRUM basics
byArun R
 
Introduction to CI/CD
bySteve Mactaggart
 
Agile methodology
byDhruv Kumar
 
Scrum 101: Introduction to Scrum
byArrielle Mali
 
Agile-overview: Agile Manifesto, Agile principles and Agile Methodologies
byBalaji Sathram
 
10 steps to a successsful enterprise agile transformation global scrum 2018
byAgile Velocity
 
Spotify Engineering Culture
byMaisara Khedr
 
Agile Values, Principles and Practices
byjackcrews
 
Agile Product Owner in Wonderland!
byDr. Tathagat Varma
 
Agile Product Management: Getting from Backlog to Value
byLiminalArc
 
Scrum 101
bybeLithe
 
AGILE@DELOITTE AGILE LANDSCAPE v02
byChris Webb
 
Introduction agile scrum methodology
byAmit Verma
 
Agile fluency and metrics2
byThomas AC Kofoed
 
Agile evolution lifecycle - From implementing Agile to being Agile
byMichal Epstein
 
Scrum In 15 Minutes
bySrikanth Shreenivas
 
Scrumban
byXebia Nederland BV
 
Design Spikes for the Dual-Track Agile Process
byuxpin
 

Similar to Business Value of CI, CD, & DevOps(Sec)

PDF
ROI & Business Value of CI, CD, DevOps, DevSecOps, & Microservices
byDavid Rico
 
PDF
Business Value of Agile Testing: Using TDD, CI, CD, & DevOps
byDavid Rico
 
PPTX
DevOps Approach (Point of View by Ravi Tadwalkar)
byRavi Tadwalkar
 
PPTX
Dev ops != Dev+Ops
byShalu Ahuja
 
PDF
Business Value of CI, CD, & DevOpsSec: Scaling to Billion User Systems Using ...
byDavid Rico
 
PDF
Sukumar Nayak-Agile-DevOps-Cloud Management
bySukumar Nayak
 
PPTX
Devops Introduction.pptx devops courseda
byRanjeet Reddy
 
PDF
Introduction to DevSecOps. An intuitiv approach
byFrancisXavierInyanga
 
PPTX
DEVOPS - Laxmi Itikala.pptx bridging the gap
byvvsp1
 
PPTX
DEVOPS-UNIT-I-DEVOPS-INTRO-ROLES,PRINIPLES
bySoundharyaSubramania1
 
PPTX
Unit No. III Part1.pptx Cloud Microservices & Application
byPriyanka855141
 
PPTX
Introduction to DevOps
byCprime
 
PPTX
Agile, DevOps & Test
byQualitest
 
PDF
Agile Software and DevOps Essentials
byNarayanan Subramaniam
 
PDF
Software Development Using DevOps
byThirupathi Peraboina
 
PPTX
How to go from waterfall app dev to secure agile development in 2 weeks
byUlf Mattsson
 
PDF
Dev ops lpi-701
byRadhouen Assakra
 
PDF
Accelerate Delivery: Business Case for Agile DevOps, CI/CD and Microservices
byRick Hightower
 
PDF
Key items for a digital enterprise
byJean-François Nguyen
 
PDF
Webcast Presentation: Increasing Product Quality through DevOps
byGRUC
 
ROI & Business Value of CI, CD, DevOps, DevSecOps, & Microservices
byDavid Rico
 
Business Value of Agile Testing: Using TDD, CI, CD, & DevOps
byDavid Rico
 
DevOps Approach (Point of View by Ravi Tadwalkar)
byRavi Tadwalkar
 
Dev ops != Dev+Ops
byShalu Ahuja
 
Business Value of CI, CD, & DevOpsSec: Scaling to Billion User Systems Using ...
byDavid Rico
 
Sukumar Nayak-Agile-DevOps-Cloud Management
bySukumar Nayak
 
Devops Introduction.pptx devops courseda
byRanjeet Reddy
 
Introduction to DevSecOps. An intuitiv approach
byFrancisXavierInyanga
 
DEVOPS - Laxmi Itikala.pptx bridging the gap
byvvsp1
 
DEVOPS-UNIT-I-DEVOPS-INTRO-ROLES,PRINIPLES
bySoundharyaSubramania1
 
Unit No. III Part1.pptx Cloud Microservices & Application
byPriyanka855141
 
Introduction to DevOps
byCprime
 
Agile, DevOps & Test
byQualitest
 
Agile Software and DevOps Essentials
byNarayanan Subramaniam
 
Software Development Using DevOps
byThirupathi Peraboina
 
How to go from waterfall app dev to secure agile development in 2 weeks
byUlf Mattsson
 
Dev ops lpi-701
byRadhouen Assakra
 
Accelerate Delivery: Business Case for Agile DevOps, CI/CD and Microservices
byRick Hightower
 
Key items for a digital enterprise
byJean-François Nguyen
 
Webcast Presentation: Increasing Product Quality through DevOps
byGRUC
 

More from David Rico

PDF
Scaled Agile Framework (SAFe) 4.5 Tutorial ...
byDavid Rico
 
PDF
Return on Investment (ROI) of Lean & Agile Methods
byDavid Rico
 
PDF
Business Value of Agile Product Management
byDavid Rico
 
PDF
Scaled Agile Framework (SAFe) 4.5 Metrics
byDavid Rico
 
PDF
Lean & Agile Project Management
byDavid Rico
 
PDF
Lean & Agile Organizational Leadership: History, Theory, Models, & Popular Ideas
byDavid Rico
 
PDF
Lean & Agile Organizational Change
byDavid Rico
 
PDF
Scaled Agile Framework (SAFe) 4.6 in U.S. Government
byDavid Rico
 
PDF
Business Value of Agile Human Resources (AHR)
byDavid Rico
 
PDF
Business Value of Lean Thinking
byDavid Rico
 
PDF
ROI of Evolutionary Design to Rapidly Create Innovatively New Products & Serv...
byDavid Rico
 
PDF
Business Value of Agile Organizations: Strategies, Models, & Principles for E...
byDavid Rico
 
PDF
Using SAFe to Manage U.S. Government Agencies, Portfolios, & Acquisition Prog...
byDavid Rico
 
PDF
Business, Enterprise, & Organizational Agility
byDavid Rico
 
PDF
Lean & Agile Thinking Principles for Leaders
byDavid Rico
 
PDF
ROI of Organizational Agility for Transforming 21st Century Enterprises
byDavid Rico
 
PDF
Intro to Agile Methods for Execs, Leaders, and Managers
byDavid Rico
 
PDF
Lean & Agile Performance Measurement: Metrics, Models, & Measures
byDavid Rico
 
PDF
Lean & Agile Organizational Leadership
byDavid Rico
 
PDF
Growth of SAFe in Government Acquisitions, Contracts, & Portfolios
byDavid Rico
 
Scaled Agile Framework (SAFe) 4.5 Tutorial ...
byDavid Rico
 
Return on Investment (ROI) of Lean & Agile Methods
byDavid Rico
 
Business Value of Agile Product Management
byDavid Rico
 
Scaled Agile Framework (SAFe) 4.5 Metrics
byDavid Rico
 
Lean & Agile Project Management
byDavid Rico
 
Lean & Agile Organizational Leadership: History, Theory, Models, & Popular Ideas
byDavid Rico
 
Lean & Agile Organizational Change
byDavid Rico
 
Scaled Agile Framework (SAFe) 4.6 in U.S. Government
byDavid Rico
 
Business Value of Agile Human Resources (AHR)
byDavid Rico
 
Business Value of Lean Thinking
byDavid Rico
 
ROI of Evolutionary Design to Rapidly Create Innovatively New Products & Serv...
byDavid Rico
 
Business Value of Agile Organizations: Strategies, Models, & Principles for E...
byDavid Rico
 
Using SAFe to Manage U.S. Government Agencies, Portfolios, & Acquisition Prog...
byDavid Rico
 
Business, Enterprise, & Organizational Agility
byDavid Rico
 
Lean & Agile Thinking Principles for Leaders
byDavid Rico
 
ROI of Organizational Agility for Transforming 21st Century Enterprises
byDavid Rico
 
Intro to Agile Methods for Execs, Leaders, and Managers
byDavid Rico
 
Lean & Agile Performance Measurement: Metrics, Models, & Measures
byDavid Rico
 
Lean & Agile Organizational Leadership
byDavid Rico
 
Growth of SAFe in Government Acquisitions, Contracts, & Portfolios
byDavid Rico
 

Recently uploaded

PDF
[BDD 2025 - Artificial Intelligence] Building AI Systems That Users (and Comp...
byWintari Yasmin
 
PDF
[BDD 2025 - Full-Stack Development] Agentic AI Architecture: Redefining Syste...
byWintari Yasmin
 
PDF
[BDD 2025 - Full-Stack Development] The Modern Stack: Building Web & AI Appli...
byWintari Yasmin
 
PDF
[BDD 2025 - Mobile Development] Exploring Apple’s On-Device FoundationModels
byWintari Yasmin
 
PDF
Cloud Infrastructure monitoring with Grafana Cloud
byImma Valls Bernaus
 
PDF
Mastering Agentic Orchestration with UiPath Maestro | Hands on Workshop
byUiPathCommunity
 
PPTX
Guardrails in Action - Ensuring Safe AI with Azure AI Content Safety.pptx
byUdaiappa Ramachandran
 
PDF
MuleSoft Meetup: Dreamforce'25 Tour- Vibing With AI & Agents.pdf
byTintu Jacob Shaji
 
PPTX
UFCD 0797 - SISTEMAS OPERATIVOS_Unidade Completa.pptx
byscribddobruno
 
PDF
Integrating AI with Meaningful Human Collaboration
byCadabra Studio
 
PDF
[BDD 2025 - Artificial Intelligence] AI for the Underdogs: Innovation for Sma...
byWintari Yasmin
 
PDF
So You Want to Work at Google | DevFest Seattle 2025
byMargaret Maynard-Reid
 
PDF
Welcome by Uni Systems: Shaping Experiences
byUni Systems S.M.S.A.
 
PDF
[DevFest Strasbourg 2025] - NodeJs Can do that !!
bymoassiongbon
 
PDF
[BDD 2025 - Full-Stack Development] Digital Accessibility: Why Developers nee...
bywintari3
 
PPTX
kernel PPT (Explanation of Windows Kernal).pptx
byINFOBYTES1
 
PDF
The Evolving Role of the CEO in the Age of AI
byPipal Tree Services Executive Search Firm
 
PPTX
Leon Brands - Methodical GPU Profiling (Graphics Programming Conference 2025)
byleonbrands1998
 
PPTX
Connecting the unconnectable: Exploring LoRaWAN for IoT
byasasiraarthur
 
PDF
The partnership effect: Libraries and publishers on collaborating and thrivin...
byBookNet Canada
 
[BDD 2025 - Artificial Intelligence] Building AI Systems That Users (and Comp...
byWintari Yasmin
 
[BDD 2025 - Full-Stack Development] Agentic AI Architecture: Redefining Syste...
byWintari Yasmin
 
[BDD 2025 - Full-Stack Development] The Modern Stack: Building Web & AI Appli...
byWintari Yasmin
 
[BDD 2025 - Mobile Development] Exploring Apple’s On-Device FoundationModels
byWintari Yasmin
 
Cloud Infrastructure monitoring with Grafana Cloud
byImma Valls Bernaus
 
Mastering Agentic Orchestration with UiPath Maestro | Hands on Workshop
byUiPathCommunity
 
Guardrails in Action - Ensuring Safe AI with Azure AI Content Safety.pptx
byUdaiappa Ramachandran
 
MuleSoft Meetup: Dreamforce'25 Tour- Vibing With AI & Agents.pdf
byTintu Jacob Shaji
 
UFCD 0797 - SISTEMAS OPERATIVOS_Unidade Completa.pptx
byscribddobruno
 
Integrating AI with Meaningful Human Collaboration
byCadabra Studio
 
[BDD 2025 - Artificial Intelligence] AI for the Underdogs: Innovation for Sma...
byWintari Yasmin
 
So You Want to Work at Google | DevFest Seattle 2025
byMargaret Maynard-Reid
 
Welcome by Uni Systems: Shaping Experiences
byUni Systems S.M.S.A.
 
[DevFest Strasbourg 2025] - NodeJs Can do that !!
bymoassiongbon
 
[BDD 2025 - Full-Stack Development] Digital Accessibility: Why Developers nee...
bywintari3
 
kernel PPT (Explanation of Windows Kernal).pptx
byINFOBYTES1
 
The Evolving Role of the CEO in the Age of AI
byPipal Tree Services Executive Search Firm
 
Leon Brands - Methodical GPU Profiling (Graphics Programming Conference 2025)
byleonbrands1998
 
Connecting the unconnectable: Exploring LoRaWAN for IoT
byasasiraarthur
 
The partnership effect: Libraries and publishers on collaborating and thrivin...
byBookNet Canada
 

Business Value of CI, CD, & DevOps(Sec)

  • 1.
    Business Value of CI,CD, & DevOpsSec Scaling Up to Billion User Global Systems of Systems Using END-TO-END AUTOMATION & CONTAINERIZED DOCKER UBUNTU IMAGES Dr. David F. Rico, PMP, CSEP, FCP, FCT, ACP, CSM, SAFE, DEVOPS Twitter: @dr_david_f_rico Website: http://www.davidfrico.com LinkedIn: http://www.linkedin.com/in/davidfrico Agile Capabilities: http://davidfrico.com/rico-capability-agile.pdf Agile Cost of Quality: http://www.davidfrico.com/agile-vs-trad-coq.pdf DevOps Return on Investment (ROI): http://davidfrico.com/rico-devops-roi.pdf Dave’s NEW Business Agility Video: http://www.youtube.com/watch?v=hTvtsAkL8xU Dave’s NEWER Scaled Agile Framework SAFe 4.5 Video: http://youtu.be/1TAuCRq5a34 Dave’s NEWEST Development Operations Security Video: http://youtu.be/X22kJAvx44A DoD Fighter Jets versus Amazon Web Services: http://davidfrico.com/dod-agile-principles.pdf
  • 2.
    Author Background  Gov’tcontractor with 35+ years of IT experience  B.S. Comp. Sci., M.S. Soft. Eng., & D.M. Info. Sys.  Large gov’t projects in U.S., Far/Mid-East, & Europe 2   Career systems & software engineering methodologist  Lean-Agile, Six Sigma, CMMI, ISO 9001, DoD 5000  NASA, USAF, Navy, Army, DISA, & DARPA projects  Published seven books & numerous journal articles  Intn’l keynote speaker, 200+ talks to 14,500 people  Specializes in metrics, models, & cost engineering  Cloud Computing, SOA, Web Services, FOSS, etc.  Professor at 7 Washington, DC-area universities
  • 3.
    3 Internet of Things—DinosaurKiller IoT is an Extinction Level Event • 25-50B Devices on IOT • 5-10B Internet Hosts • 4-8B Mobile Phones • 2-3B End User Sys • Mass Business Failure
  • 4.
     Dev-Ops (dĕv′ŏps)Early, iterative, & automated combo of development & operations; Incremental deployment  An approach embracing principles & values of lean thinking, product development flow, & agile methods  Early, collaborative, and automated form of incremental development, integration, system, & operational testing  Design method that supports collaboration, teamwork, iterative development, & responding to change  Mult-tiered automated framework for TDD, Continuous Integration, BDD, Continuous Delivery, & DevOps  Maximizes BUSINESS VALUE of organizations, portfolios, & projects by enabling buyers-suppliers to scale globally 4  Crispin, L., & Gregory, J. (2009). Agile testing: A practical guide for testers and agile teams. Boston, MA: Addison-Wesley. Crispin, L., & Gregory, J. (2015). More agile testing: Learning journeys for the whole team. Boston, MA: Addison-Wesley. DevOps—What is it?
  • 5.
    Network Computer Operating System Middleware Applications APIs GUI  Agilerequirements implemented in slices vs. layers  User needs with higher business value are done first  Reduces cost & risk while increasing business success 5Shore, J. (2011). Evolutionary design illustrated. Norwegian Developers Conference, Oslo, Norway. Agile Traditional 1 2 3 Faster  Early ROI  Lower Costs  Fewer Defects  Manageable Risk  Better Performance  Smaller Attack Surface Late  No Value  Cost Overruns  Very Poor Quality  Uncontrollable Risk  Slowest Performance  More Security Incidents  Seven Wastes 1. Rework 2. Motion 3. Waiting 4. Inventory 5. Transportation 6. Overprocessing 7. Overproduction MINIMIZES MAXIMIZES  JIT, Just-enough architecture  Early, in-process system V&V  Fast continuous improvement  Scalable to systems of systems  Maximizes successful outcomes  Myth of perfect architecture  Late big-bang integration tests  Year long improvement cycles  Breaks down on large projects  Undermines business success  DevOps—How it works?      
  • 6.
    6 Traditional vs. AgileCumulative Flow Work(Story,Point,Task)orEffort(Week,Day,Hour) Time Unit (Roadmap, Release, Iteration, Month, Week, Day, Hour, etc.) Work(Story,Point,Task)orEffort(Week,Day,Hour) Time Unit (Roadmap, Release, Iteration, Month, Week, Day, Hour, etc.) TRADITIONAL Cumulative Flow  Late big bang integration increases WIP backlog  Agile testing early and often reduces WIP backlog  Improves workflow and reduces WIP & lead times Anderson, D. J. (2004). Agile management for software engineering. Upper Saddle River, NJ: Pearson Education. Anderson, D. J. (2010). Kanban: Successful evolutionary change for your technology business. Sequim, WA: Blue Hole Press.  DevOps—Workflow Results   DEVOPS Cumulative Flow
  • 7.
    7  Methods to“scope” project, product, or system  “Key” is smallest possible scope with highest value  Reduces cost, risk, time, failure, & tech. obsolescence INCREASES TESTABILITY, QUALITY, RELIABILITY, SECURITY, MORALE, MAINTAINABILITY, & SUCCESS Denne, M., & Cleland-Huang, J. (2004). Software by numbers: Low-risk, high-return development. Santa Clara, CA: Sun Microsystems. Ries, E. (2011). The lean startup: How today's entrepreneurs use continuous innovation. New York, NY: Crown Publishing. Patton, J. (2014). User story mapping: Discover the whole story, build the right product. Sebastopol, CA: O'Reilly Media. Layton, M. C., & Maurer, R. (2011). Agile project management for dummies. Hoboken, NJ: Wiley Publishing. Krause, L. (2014). Microservices: Patterns and applications. Paris, France: Lucas Krause.  MINIMUM MARKETABLE FEATURE - MMF -  Advantage  Difference  Revenue  Profit  Savings  Brand  Loyalty MINIMUM VIABLE PRODUCT - MVP -  Goal  Process  Features  Priorities  Story Map  Architecture STORY MAP OR IMPACT MAP - SM or IM -  Goal  Actors  Impacts  Deliverables  Measures  Milestones VISION STATEMENT - VS -  For <customer>  Who <needs it>  The <product>  Is a <benefit>  That <customer>  Unlike <other>  Ours <different> MICRO- SERVICE - MS -  Purpose  Automated  Unique  Independent  Resilient  Ecosystem  Consumer DevOps—MMF, MVP, MVA, etc.  
  • 8.
    8   Lightweight, fast,disposable virtual environments  Set of isolated processes running on shared kernel  Efficient way for building, delivering, & running apps Monolithic Applications Just-Enough Applications Containerized Apps Minimal - Typically single process entities Declarative - Built from layered Docker images Immutable - Do exactly same thing from run to kill • Small autonomous services that work together • Self-contained process that provides a unique capability • Loosely coupled service oriented architecture with bounded contexts • Small independent processes communicating with each other using language-agnostic APIs • Fined-grained independent services running in their own processes that are developed and deployed independently • Suite of services running in their own process, exposing APIs, and doing one thing well (independently developed and deployable) • Single app as a suite of small services, each running in its own process and communicating with lightweight mechanisms (HTTP APIs) Krause, L. (2014). Microservices: Patterns and applications. Paris, France: Lucas Krause. DevOps—Microservices       OS’s Have UNREPORTED 30-50 CVEs 
  • 9.
    9  TDD - 2003 - CI -2006 - BDD - 2008 - CD - 2011 - DEVOPS - 2012 - DEVOPSSEC - 2014 -  User Story  Acc Criteria  Dev Unit Test  Run Unit Test  Write SW Unit  Re-Run Unit Test  Refactor Unit  Building  Database  Inspections  Testing  Feedback  Documentation  Deployment  Analyze Feature  Acc Criteria  Dev Feat. Test  Run Feat. Test  Develop Feature  Re-Run Feature  Refactor Feat.  Packaging  Acceptance  Load Test  Performance  Pre-Production  Certification  Deployment  Sys Admin  Config. Mgt.  Host Builds  Virtualization  Containerization  Deployment  Monitor & Supp  Sec. Engineer.  Sec. Containers  Sec. Evaluation  Sec. Deploy.  Runtime Prot.  Sec. Monitoring  Response Mgt. Beck, K. (2003). Test-driven development: By example. Boston, MA: Addison-Wesley. Duvall, P., Matyas, S., & Glover, A. (2006). Continuous integration. Boston, MA: Addison-Wesley. Barker, K., & Humphries, C. (2008). Foundations of rspec: Behavior driven development with ruby and rails. New York, NY: Apress. Humble, J., & Farley, D. (2011). Continuous delivery. Boston, MA: Pearson Education. Huttermann, M. (2012). Devops for developers: Integrate development and operations the agile way. New York, NY: Apress. Bird, J. (2016). Devopssec: Delivering secure software through continuous delivery. Sebastopol, CA: O'Reilly Media.  Numerous models of lean-agile testing emerging  Based on principles of lean & agile one piece flow  Include software, hardware, system, & port. testing DevOps—Evolution
  • 10.
    STAGE 1—Test DrivenDevelopment  Term coined by Kent Beck in 2003  Consists of writing all tests before design  Ensures all components are verified and validated 10Beck, K. (2003). Test-driven development: By example. Boston, MA: Addison-Wesley.  
  • 11.
     Agile TDDconsists of seven broad practices  Document test criteria, tests, software units, etc.  Include refactoring, verification, optimization, etc. 11 Practice User Story Acc Criteria Dev Test Run Test Dev Unit Rerun Test Refactor Unit Description Read story, analyze meaning, ask questions, and clarify understanding Identify, verify, and document acceptance criteria for each user story Design, develop, code, and verify automated unit test for user story Run automated unit test to verify that it fails the first time (sanity check) Design, develop, code, and verify the software unit to satisfy user story Rerun automated unit test to see if code satisfies automated unit test Refine, reduce, and simplify code to remove waste and optimize performance STAGE 1—Test Driven Develop.  Beck, K. (2003). Test-driven development: By example. Boston, MA: Addison-Wesley.
  • 12.
    STAGE 2—Behavior DrivenDevelop.  Term coined by Dan North in 2006  Consists of writing feature tests before design  Ensures all system features are verified and validated 12Smart, J. F. (2014). BDD in action: Behavior-driven development for the whole software lifecycle. Shelter Island, NY: Manning Publications.  
  • 13.
     Agile BDDconsists of seven broad practices  Document test criteria, tests, syst. features, etc.  Include refactoring, verification, optimization, etc. 13 Practice Feature Acc Criteria Dev Test Run Test Dev Feature Rerun Test Refac Feature Description Read feature, analyze meaning, ask questions, and clarify understanding Identify, verify, and document acceptance criteria for each feature Design, develop, code, and verify automated feature test for feature Run automated feature test to verify that it fails the first time (sanity check) Design, develop, code, and verify the feature software to satisfy feature Rerun automated feature test to see if code satisfies automated feature test Refine, reduce, and simplify code to remove waste and optimize performance STAGE 2—Behavior Driven Dev.  Smart, J. F. (2014). BDD in action: Behavior-driven development for the whole software lifecycle. Shelter Island, NY: Manning Publications.
  • 14.
     Term coinedby Martin Fowler circa 1998  User needs designed & developed one-at-a-time  Changes automatically detected, built, & fully-tested 14Humble, J., & Farley, D. (2011). Continuous delivery. Boston, MA: Pearson Education. Duvall, P., Matyas, S., & Glover, A. (2006). Continuous integration. Boston, MA: Addison-Wesley.  STAGE 3—Continuous Integration Thousands of Tests Continuously Executed No More Late Big Bang Integration Build Integration Server Version Control Server Build Scripts UsesWatches Build Status Provides Developer A Developer B Developer C Commits Changes Commits Changes Commits Changes Builds Database Analysis Testing Reporting Documentation Deployment Early, Automated, Fast, Efficient, & Repeatable Constant Readiness State & CM Control Lean, Waste Free, Low WIP, No Deadlocked Test Queues Rapidly & Successfully Dev. Complex Systems           ALL DEVELOPERS RUN PRIVATE BUILDS  DEVELOPERS COMMIT CODE TO VERSION CONTROL  INTEGRATION BUILDS OCCUR SEVERAL TIMES PER DAY  100% OF SYSTEM TESTS MUST PASS FOR EVERY BUILD  A SHIPPABLE PRODUCT RESULTS FROM EVERY BUILD  FIXING BROKEN BUILDS IS OF THE HIGHEST PRIORITY  REPORTS AUTOMATICALLY GENERATED & REVIEWED
  • 15.
     Agile CIconsists of seven broad practices  Automated build, database, inspection, tests, etc.  Include reporting, documentation, deployment, etc. 15 Practice Building Database Inspections Testing Feedback Documentation Deployment Description Frequently assembling products and services to ensure delivery readiness Frequently generating/analyzing database schemas, queries, and forms Frequently performing automated static analysis of product/service quality Frequently performing automated dynamic product and service evaluation Frequently generating automated status reports/messages for all stakeholders Frequently performing automated technical/customer document generation Frequently performing automated delivery of products/services to end users Duvall, P., Matyas, S., & Glover, A. (2006). Continuous integration: Improving software quality and reducing risk. Boston, MA: Addison-Wesley. Humble, J., & Farley, D. (2011). Continuous delivery. Boston, MA: Pearson Education. STAGE 3—Continuous Integration 
  • 16.
     Created byJez Humble of ThoughtWorks in 2011  Includes CM, build, testing, integration, release, etc.  Goal is one-touch automation of deployment pipeline 16 Humble, J., & Farley, D. (2011). Continuous delivery. Boston, MA: Pearson Education. Duvall, P., Matyas, S., & Glover, A. (2006). Continuous integration. Boston, MA: Addison-Wesley. Ohara, D. (2012). Continuous delivery and the world of devops. San Francisco, CA: GigaOM Pro.   CoQ • 80% MS Tst • 8/10 No Val • $24B in 90s • Rep by CD • Not Add MLK STAGE 4—Continuous Delivery Source Code Control Build Automation Test Automation Continuous Integration Release Automation Continuous Delivery
  • 17.
     Agile CDconsists of seven broad practices  Automated acceptance, load, performance, etc.  Include packaging, pre-production test, C&A, etc. 17 Practice Packaging Acceptance Load Test Performance Pre-Production Certification Deployment Description Frequently generating system images for pre-production testing & checkout Frequently performing automated system & user acceptance testing Frequently performing automated system load, stress, & capacity testing Frequently performing automated system user & technical performance testing Frequently performing automated pre-production tests prior to final deployment Frequently performing automated system certification & accreditation tests Frequently generating product images for pre-deployment testing & checkout Mukherjee, J. (2015). Continuous delivery pipeline: Where does it choke. Charleston, SC: CreateSpace. Swartout, P. (2014). Continuous delivery and devops: A quickstart guide. Birmingham, UK: Packt Publishing. STAGE 4—Continuous Delivery 
  • 18.
     Created byPatrick Debois of Jedi BVBA in 2007  Collaboration of developers & infrastructure people  Goal to automate the deployment to end-user devices 18 Bass, L., Weber, I., & Zhu, L. (2015). Devops: A software architect's perspective. Old Tappan, NJ: Pearson Education. Gruver, G., & Mouser, T. (2015). Leading the transformation: Applying agile and devops at scale. Portland, OR: IT Revolution Press. Humble, J., Molesky, J., & O'Reilly, B. (2015). Lean enterprise: How high performance organizations innovate at scale. Sebastopol, CA: O'Reilly Media.  STAGE 5—Development Operations  Collaboration
  • 19.
     Agile DevOpsconsists of seven broad practices  Automated sys admin, CM, building, monitor, etc.  Include virtualization, containerize, deployment, etc. 19 Practice Sys Admin Config. Mgt. Host Builds Virtualization Containerize Deployment Monitor & Supp Description Frequently performing automated system administration tasks, i.e., scripting Frequently performing automated infrastructure config. mgt./version control Frequently performing automated system and server host builds and config. Frequently performing automated system, server, & net virtualization services Frequently performing automated software and Microservices containerization Frequently generating final end-user system & software images for distribution Frequently performing automated metrics collection & deployment monitoring Duffy, M. (2015). Devops automation cookbook: Over 120 recipes coverying key automation techniques. Birmingham, UK: Packt Publishing. Farcic, V. (2016). The devops 2.0 toolkit: Automating the continuous deployment pipelines with containerized microservices. Victoria, CA: LeanPub.  STAGE 5—Development Operations
  • 20.
     STAGE 6—Development OpsSec  DevOpsSec coined by Shannon Lietz in 2014  Rugged devops, devsecops, secdevops, devopssec  Microservices, security engineering & operations keys Secure Microservices • Docker App • Docker Bins • Docker Files • Docker Images • Docker Scanning • Docker Registry • Docker Host • Docker Hub • Docker Monitoring Secure Engineering • Security Champions • Security Planning • Security Training • Security Requirements • Security Architecture • Security Analysis • Security Testing • Security Review • Security Response Secure Operations • Activity Logging • Event Monitoring • Configuration Mgt. • Patch Management • User Access Control • Privilege Management • Vulnerability Mgt. • Response Mgt. • Performance Mgt. Bird, J. (2016). Devopssec: Delivering secure software through continuous delivery. Sebastopol, CA: O'Reilly Media. 20 
  • 21.
     DevOpsSec consistsof seven broad practices  Automated secure build, analysis, & deployment  Includes containerization, engineering & operations 21 Practice Engineering Containers Evaluation Deployment Protection Monitoring Responses Description Frequently performing “baked-in” lean and agile security engineering practices Frequently performing automated microservices containerization practices Frequently performing automated static and dynamic vulnerability analysis Frequently performing automated digitally signed security deployment practices Frequently performing automated real-time self-security protection practices Frequently performing automated real-time security monitoring practices Frequently performing automated trigger-based rollback response practices  Bird, J. (2016). Devopssec: Delivering secure software through continuous delivery. Sebastopol, CA: O'Reilly Media. STAGE 6—Development Ops Sec
  • 22.
     SE frameworkby Dean Leffingwell of Rally in 2007  Newest version leaner, meaner, lighter, and simpler  Experimental bottoms-up DevOps-based innovation 22Leffingwell, D. (2007). Scaling software agility: Best practices for large enterprises. Boston, MA: Pearson Education.  PORTFOLIO LARGE PROGRAM PROGRAM TEAM STAGE 7—Enterprise DevOpsSec
  • 23.
    23Juengst, D. (2015).Deliver better software faster: With the cloudbees jenkins platform. San Francisco, CA: CloudBees. Weeks, D. E. (2014). Devops and continuous delivery reference architectures (volume 1 & 2). Fulton, MD: Sonatype.  DevOps—Tools Ecosystem  Numerous tools to automate DevOps pipeline  People can piece together toolset along with hubs  Tools include version control, testing, & deployment
  • 24.
    24XeniaLabs. (2016). Periodictable of devops tools. Retrieved April 11, 2016, from https://xebialabs.com/periodic-table-of-devops-tools. Weeks, D. E. (2014). Devops and continuous delivery reference architectures (volume 1 & 2). Fulton, MD: Sonatype. DevOps—Periodic Table
  • 25.
    25Tesauro, M. (2016).Taking appsec to 11: Appsec pipelines, devops, and making things better. Denver, CO: SnowFROC 2016. Weeks, D. E. (2014). Devops and continuous delivery reference architectures (volume 1 & 2). Fulton, MD: Sonatype.  DevOps—Security Tools Ecosystem  Many tools emerging for DevOps application security  Begins-ends with microservices—tiny attack surface  Includes containers, testing, & real-time monitoring 
  • 26.
  • 27.
    DevOps—Automation Metrics 27Duvall, P.,Matyas, S., & Glover, A. (2006). Continuous integration: Improving software quality and reducing risk. Boston, MA: Addison-Wesley.  Defects DecreaseIntegrations Increase Increase Coverage Increase Automation
  • 28.
    28  DevOps metricsgaining in widespread popularity  Hybrid of development & IT operations measures  Includes code, deployment & e-business analytics Velasquez, N. F. (2014). State of devops report. Portland, OR: Puppet Labs, Inc.  DevOps—Deployment Metrics
  • 29.
    Activity Def CoQDevOps Economics Hours ROI Development Operations 100 0.001 100 Defects x 70% Efficiency x 0.001 Hours 0.070 72,900% Continuous Delivery 30 0.01 30 Defects x 70% Efficiency x 0.01 Hours 0.210 24,300% Continuous Integration 9 0.1 9 Defects x 70% Efficiency x 0.1 Hours 0.630 8,100% Software Inspections 3 1 2.7 Defects x 70% Efficiency x 1 Hours 1.890 2,700% "Traditional" Testing 0.81 10 0.81 Defects x 70% Efficiency x 10 Hours 5.670 900% Manual Debugging 0.243 100 0.243 Defects x 70% Efficiency x 100 Hours 17.010 300% Operations & Maintenance 0.073 1,000 0.0729 Defects x 70% Efficiency x 1,000 Hours 51.030 n/a 29  Agile testing is orders-of-magnitude more efficient  Based on millions of automated tests run in seconds  One-touch auto-delivery to billions of global end-users Rico, D. F. (2016). Devops cost of quality (CoQ): Phase-based defect removal model. Retrieved May 10, 2016, from http://davidfrico.com  DevOps—Cost of Quality  Under 4 Minutes 4,500 x Faster than Code Inspections
  • 30.
    30  Hewlett-Packard isa major user of CI, CD, & DevOps  400 engineers developed 10 million LOC in 4 years  Major gains in testing, deployment, & innovation Gruver, G., Young, M. & Fulghum, P. (2013). A practical approach to large-scale agile development. Upper Saddle River, NJ: Pearson Education.  TYPE METRIC MANUAL DEVOPS MAJOR GAINS CYCLE TIME IMPROVEMENTS Build Time 40 Hours 3 Hours 13 x No. Builds 1-2 per Day 10-15 per Day 8 x Feedback 1 per Day 100 per Day 100 x Regression Testing 240 Hours 24 Hours 10 x DEVELOPMENT COST EFFORT DISTRIBUTION Integration 10% 2% 5 x Planning 20% 5% 4 x Porting 25% 15% 2 x Support 25% 5% 5 x Testing 15% 5% 3 x Innovation 5% 40% 8 x DevOps—HP Case Study  
  • 31.
     Assembla wentfrom 2 to 45 releases every month  15K Google developers run 120 million tests per day  30K+ Amazon developers deliver 136K releases a day 31Singleton, A. (2014). Unblock: A guide to the new continuous agile. Needham, MA: Assembla, Inc. 62 x Faster U.S. DoD IT Project 3,645 x Faster U.S. DoD IT Project  DevOps—Dot Com Case Study  
  • 32.
    32Ashman, D. (2014).Blackboard: Keep your head in the clouds. Proceedings of the 2014 Enterprise DevOps Summit, San Francisco, California, USA.  Productivity STOPS due to excessive integration  Implements DevOps & Microservices around 2010  Waste elimination, productivity & innovation skyrocket DevOps—Blackboard Case Study  DEVOPS & MICROSERVICES IMPLEMENTED
  • 33.
    33Denayer, L. (2017).U.S. DHS citizenship and immigration services: USCIS agile development. Washington, DC. iSDLC Seminar.  1st gen replete with large portfolios & governance  2nd-3rd gen yield minor incremental improvements  4th-5th gen enables big order-of-magnitude impacts DevOps—U.S. DHS Case Study            Automated GovernanceManual Governance  
  • 34.
    34  Detailed DevOpseconomics starting to emerge  ROI ranges from $17M to $195M with minor costs  Benefits from cost savings, revenue, and availability Forsgren, N., Humble, J., & Kim, G. (2017). Forecasting the value of devops transformations: Measuring roi of devops. Portland, OR: DevOps Research. Rico, D. F. (2017). Devops return on investment (ROI) calculator. Retrieved August 29, 2017, from http://davidfrico.com/devops-roi.xls  DevOps—Return on Investment
  • 35.
    35  DevOps adoptiongrowing fast in-spite of slow start  35% using, 27% thinking about it, & 38% are in-dark  DevOps a global industry-wide extinction-level event 35 Brown, A. (2016). Devops and the need for speed, quality, and security: Do organizations really have to pick two out of three. Portland, OR: Puppet Labs.  DevOps—Adoption Statistics 
  • 36.
    36  Having aDevOps rollout strategy is a key to success  Phased, incremental, and situational implementation  Includes build, testing, & IT operations, & practices St-Cyr, J. (2015). Evolving devops: Advance alm and devops practices with cont. imp. Agile Dev, Better Software, & DevOps East Conference, Orlando, Florida, USA.  DevOps—Roadmap
  • 37.
    37  Industry leadingDevOps assessments are emerging  DORA Technology DevOps Assessment is popular  Includes speed, deployments, reliability & morale Kim, G., Forsgren, N., & Humble, J. (2017). The DORA technology performance assessment. Portland, OR: DevOps Research.  DevOps—Assessments
  • 38.
    38Kim, G., Debois,P., Willis, J., & Humble, J. The devops handbook: How to create world-class agility, reliability, and security in technology organizations. Portland, OR: IT Revolution Press.       Everything begins with lean & agile principles  Next step is smaller portfolio & simpler designs  Final step is modular interfaces & E2E automation DevOps—5 Keys to Success    
  • 39.
     DevOps DOESNOT mean deliver it now and fix it later  Lightweight, yet disciplined approach to development  Reduced cost, risk, & waste while improving quality 39 Rico, D. F. (2012). What’s really happening in agile methods: Its principles revisited? Retrieved June 6, 2012, from http://davidfrico.com/agile-principles.pdf Rico, D. F. (2012). The promises and pitfalls of agile methods. Retrieved February 6, 2013 from, http://davidfrico.com/agile-pros-cons.pdf Rico, D. F. (2012). How do lean & agile intersect? Retrieved February 6, 2013, from http://davidfrico.com/agile-concept-model-3.pdf What How Result Flexibility Use lightweight, yet disciplined processes and artifacts Low work-in-process Customer Involve customers early and often throughout development Early feedback Prioritize Identify highest-priority, value-adding business needs Focus resources Descope Descope complex programs by an order of magnitude Simplify problem Decompose Divide the remaining scope into smaller batches Manageable pieces Iterate Implement pieces one at a time over long periods of time Diffuse risk Leanness Architect and design the system one iteration at a time JIT waste-free design Swarm Implement each component in small cross-functional teams Knowledge transfer Collaborate Use frequent informal communications as often as possible Efficient data transfer Test Early Incrementally test each component as it is developed Early verification Test Often Perform system-level regression testing every few minutes Early validation Adapt Frequently identify optimal process and product solutions Improve performance                  DevOps—Summary
  • 40.
    40 DevOps ensures enterprisesuccess by delivering large volumes of valuable, reliable, & secure IT products & services to billions of users in fractions of a second ... DevOps—Bottom Line?
  • 41.
    Dave’s PROFESSIONAL CAPABILITIES 41 Software Quality Mgt. Technical Project Mgt. Software Development Methods Leadership& Org. Change Cost Estimates & Scheduling Acquisition & Contracting Portfolio & Program Mgt. Strategy & Roadmapping Lean, Kanban, & Six Sigma Modeling & Simulations Big Data, Cloud, NoSQL Workflow Automation Metrics, Models, & SPC BPR, IDEF0, & DoDAF DoD 5000, TRA, & SRA PSP, TSP, & Code Reviews CMMI & ISO 9001 Innovation Management Statistics, CFA, EFA, & SEM Evolutionary Design Systems Engineering Valuation — Cost-Benefit Analysis, B/CR, ROI, NPV, BEP, Real Options, etc. Lean-Agile — Scrum, SAFe, Continuous Integration & Delivery, DevOpsSec, etc. STRENGTHS – Communicating Complex Ideas • Brownbags & Webinars • Datasheets & Whitepapers • Reviews & Audits • Comparisons & Tradeoffs • Brainstorming & Ideation • Data Mining & Business Cases • Metrics & Models • Tiger Teams & Shortfuse Tasks • Strategy, Roadmaps, & Plans • Concept Frameworks & Multi-Attribute Models • Etc. ● Data mining. Metrics, benchmarks, & performance. ● Simplification. Refactoring, refinement, & streamlining. ● Assessments. Audits, reviews, appraisals, & risk analysis. ● Coaching. Diagnosing, debugging, & restarting stalled projects. ● Business cases. Cost, benefit, & return-on-investment (ROI) analysis. ● Communications. Executive summaries, white papers, & lightning talks. ● Strategy & tactics. Program, project, task, & activity scoping, charters, & plans. PMP, CSEP, FCP, FCT, ACP, CSM, SAFE, & DEVOPS 35+ YEARS IN IT INDUSTRY