![…It’s the Behavior that Results
28 4/11/2016
Manager: “Nathan, this isn’t fair. You’re just showing the
number of stories, not how big they are.”
Nathan: “That’s right.”
Manager: “But that’s not fair!”
Nathan: [silent]
Manager: “All I’d have to do would be to divide up my stories
into little bits and release those every month.”
Nathan: [silent, smiling]
Manager: “Oh.”
Soon, the manager was doing small stories, to the benefit of
everyone.
http://ronjeffries.com/articles/016-03/you-want/](https://image.slidesharecdn.com/mentorsview-aligningyourteam-mikev4-160411202954/85/Aligning-Your-Team-and-Your-Powers-for-Success-28-320.jpg)
Aligning Your Team and Your Powers for Success
- 1. Dallas, TX April 5, 2016 Mentor’s View: Aligning your team and your powers for success Mike Worthington, Customer Success Engineer, Sonatype
- 2. Agenda 2 4/11/2016 • Software Supply Chain & Rugged DevOps • Getting Started on Your Journey • Interactive Demo – Setting Policy • Policy Results in Jenkins & Eclipse • Meaningful Success Metrics
- 3. The Software Supply Chain 3 4/11/2016 • Hundreds of thousands of projects • 3-4 updates annually • 30 billion download requests last year • 1 in 16 have known vulnerabilities • 43% have no component governance • 75% of those who do don’t enforce it • 106 components per application • 24 known vulnerabilities • 73% have no inventory
- 4. If manufacturers built cars the way we build software… 4 4/11/2016 Any part can be used even if it’s outdated or known to be unsafe. Since parts aren’t tracked, it’s challenging to issue a recall. There is no quality control or consistency from car to car. There is no inventory of parts used, or where. Choose any supplier for any part, regardless of quality.
- 5. 5 4/11/2016 Apply Software Supply Chain Principles For Rugged DevOps
- 6. Supplier & component selection (3rd party or Proprietary) Component quality & governance Monitoring components & assemblies (patches, updates, vulns, age) Guidelines & policies Bill of Materials Warehouse & Staging Image: Gartner Research, March 2016: Avoid Failure by Developing a Toolchain that Enables DevOps Nexus Automates Software Supply Chain Practices Across The Devops Toolchain
- 7. Getting started on your journey 7 4/11/2016 Rugged DevOps, Software Supply Chain, Now What? • The Hero’s Journey • Align Your Heroes • Building Bridges • Setting Expectations
- 8. Building a trusted software supply chain 8 4/11/2016
- 9. Different stakeholders, different priorities 9 4/11/2016 Where’s that release? Done! On to the next sprint. Now, where are we in that process?
- 10. 10 4/11/2016 Building a better bridge between Dev, Ops & Sec • Tooling needs to adopt the practice of the practitioner • A tool is not a process and a process is not a tool; learn to leverage both
- 11. Two philosophies Support & guide • Objective information across the lifecycle • Each performs the task they are good at • Faster component selection and issue resolution • Bridges the developer “compliance” gap 11 4/11/2016 Scan & scold • Reactive information late in the lifecycle • Creates rework and slows remediation • Hinders technology innovation • More expensive
- 12. 12 4/11/2016 Building a good component practice Phase 3 Reducing risk & enforcing compliance Phase 2 Creating policy & rating risk Phase 1 Understanding your environment
- 13. 13 4/11/2016 Communicate expectations Determine lifecycle enforcement strategy: Allows developers time to research & fix or to request waivers Everything is documented on an internal WIKI Development CI Build Promotion to staging or release
- 14. Fix the Red – Actionable? 14 4/11/2016
- 15. Fix the Red – Actionable? 15 4/11/2016
- 16. Interactive policy development 16 4/11/2016
- 17. 17 4/11/2016 What is policy?
- 18. 18 4/11/2016 Out-of-the-box policies with easy customization Architecture Component License Security
- 19. IQ Server Policy Definition 19 4/11/2016 DEMO
- 20. IQ Server policy definition 20 4/11/2016
- 21. Jenkins & IDE integration 21 4/11/2016 DEMO
- 22. Toolchain integration – IDE & CI Server 22 4/11/2016
- 23. 23 4/11/2016 ZTTR (Zero Time to Remediation) EMPOWER DEVELOPERS FROM THE START1
- 24. 24 4/11/2016 DESIGN A FRICTIONLESS APPROACH 2
- 25. 25 4/11/2016 CREATE A SOFTWARE BILL OF MATERIALS 3
- 26. Defining Meaningful Success Metrics 26 4/11/2016 http://www.aintitcool.com/node/44547
- 27. It’s Not What You Measure… 27 4/11/2016 http://ronjeffries.com/articles/016-03/you-want/
- 28. …It’s the Behavior that Results 28 4/11/2016 Manager: “Nathan, this isn’t fair. You’re just showing the number of stories, not how big they are.” Nathan: “That’s right.” Manager: “But that’s not fair!” Nathan: [silent] Manager: “All I’d have to do would be to divide up my stories into little bits and release those every month.” Nathan: [silent, smiling] Manager: “Oh.” Soon, the manager was doing small stories, to the benefit of everyone. http://ronjeffries.com/articles/016-03/you-want/
- 29. Success Metrics 29 4/11/2016 • Short Term – Time to Value • “By the end of the workshop, we configured ~80% of our policies. Just six business days after training, we have made the test environment available in our organization” • Long Term – Quality Metrics • MTTR • WIP • New violations delivered to production
- 30. Q&A 30 4/11/2016
- 31. Wrap Up 31 4/11/2016 • Manage your Software Supply Chain • Collaborate with counterparts – BA/PM/Dev/QA/Ops/Sec. • Discuss mutual interdependence and shared objectives • Automated Real-Time Feedback is a win-win • http://bit.ly/app-check
- 32. We’re here, engaged & READY TO HELP 32 Nexus Newsletter Nexus Live – Google Hangouts Cool Things in 2 Minutes Customer Success Team Training On-Site or OnlineOnline Knowledge BaseNexus Community Pages Books Online
- 33. Dallas, TX April 5, 2016 Mike Worthington - http://bit.ly/mwsonatype Customer Success Engineer, Sonatype