nice - trust building is the long running process

hard to gain and easily damaged

I do think some our narrative is stil based on this

I've learned that associated too, though I know little about who Taylor was. <knowledge gap>

https://www.slideshare.net/npflaeging/special-edition-paper-organize-for-complexity-part-iii is the best concise intro to Taylorism I've seen

yet Taylorism is just a manifestation of that current Zeitgeist

I found the discussion of Taylorism (and the potted bio of FWT himself) in 'Team of Teams' really interesting - how such reductionist methods just don't apply in today's VUCA world.

I love that book (he's also a fellow Belgian) - I know many don't like it as it feels like one model is better then other. I just see it as different thinking evolutiuon

one claim might be they are fit for different environments

Everyone needs to stop being proprietary! ain't nobody got time for that! Well ok everything but the HumanDebt TM term 🙂

@jtf and different problem spaces - It's important to judge your company culture to understand how new ideas land

I think it is useful to consider the information flow ala Westrum in the different organization types.

the different models have different natural flows. the power centric red model matches and tends to give rise to pathological. the strongly hierarchical orange tends towards bureaucratic.

But I am fairly ignorant on the topic, have not spend a large amount of time to think about this in depth

It's not container in the k*s sense, is it?

Then I'm even more confused, maybe I'll need to dive into the book 😄 @patrick.debois256 do you have some enlightenment on this one maybe?

Container driven collaboration hints at a few things: • we believe in a tangible thing to be discussed • it is a clearly defined thing The danger of it , is that you focus on what you are delivering not how and with who It stems from a belief we can write down all specs and we're good

People usually stop at Container-driver and ignore the collabaration point

So it's using a tangible clearly known thing (like a container spec file) to then collaborate on that boundary?

Yes, it's important to get them all on the same team under one manager :rolling_on_the_floor_laughing:

if your outsourcer cares they will succeed

It's always about the people and work put in to develop the trust relationship and overcome the friction

what I meant was that people are watching build vs buy/outsource decisions a company makes, and they become skeptical if they dont feel the org has confidence in them to build it

I started a new job in April 2020 - still haven’t ever met 80%+ of my colleagues…

I think developing trust and other similar things while fully remote is an area needing experimentation and development.

Looking at the pre covid all remote companies, they still advocate coming together several times a year to 'rehumanise' too

So what is the objection ?

Both fast and slow feedback can be useful

It's definitely better then no feedback

Not necessarily an objection, but any best practices on how often to run DAST and any ways to speed it up

sorry - don't have specific advice on that

Can you decouple it from the deployment pipeline and run it asynchronously?

OK, no worries! Thanks for a great talk today - really enjoy how you weave all these great books together.

I think that is very specific to your own risk profile for what you're scanning in the end. Some things you can cope with not scanning every release, other systems are so critical you definitely take a hit in speed to be more sure :thinking_face:

yes - that is indeed what longer feedback does - much like unit test and integration test can have a different cycle

Thanks @nickeggleston and @philipp.boeschen650! Appreciate your thoughts - will go back and muddle over it

https://www.youtube.com/watch?v=po712VIZZ7M Actually touches on some of this a bit 🙂

@bernard.voos I don't want to hijack this thread but have you looked into IAST? Let me know if you want to talk

Think of it as AST for DevOps and continuous testing/deployments

Hi @robertso! Yes we are already using IAST and it’s super valuable, but I think we need a balance of IAST and DAST to layer our security.

Ok great to hear, if your looking at way to intelligently decide when to run what AST tools then you might be interested in Intelligent Orchestration. This is a new product we launched this year and is designed to solve the problem your referring to. When should I run DAST, IAST, SCA and what do I do with the results?

It works with our own tools but its an open platform so can work with any vendors tools which have APIs or other integration points

https://www.synopsys.com/software-integrity/polaris/intelligent-orchestration.html

I'm your fan

mutual admiration ftw!

Listening to the talk works great to understand how people's question progress. It's torture at the same time listening to myself - euhs - struggling with words etc.. 🙀

Nobody likes it, Patrick 🙂 but you sound great

I totally agree... Hearing myself is a huge distraction and the inner critic starts commenting...

I'm definitely not looking forward to hear myself in 5 minutes 😬

It's an opportunity to practice radical acceptance hehe

super hard though

I need a Star Wars emoji for an appropriate response

Personally, I like to hear stories from your experience that underscore each point - both the positive and negative... but something about the detailed real life story is captivating

fair point - stories can be indeed powerfull - they also tend to expand in time 🙂

Would love to hear more on your view of psychological safety and it's importance here

I'm still learning on that part @ffion - definitely intersting

@patrick.debois256 I would love to know about experiences where organisations have all combinations of the DevOps team patterns, and how we can recognise it and understand if there is a natural evolution & devsecops maturity path in transitioning from one state to another. Is there an optimal devsecops team pattern/model to aspire to?

separate training (the education part) suffers from the silos - you'd have to escape your siloed education program

One way a lot of security engineers learn is by hacking deliberately vulnerable apps. As a developer you can understand the underlying causes in code and it is fun to hack around.

There's a security company that does that and has various "ranges" or scenarios to attack, and I think they open it up for "free" occasionally. Now, if I could just remember the name...

there are many deliberately vuln environments and apps you can find on GitHub. Bunch of them have docker images so you can pull, run and start attacking. 🙂

@nickeggleston think you mean Secure Code Warriors? @dacahill7 Snyk also produces a lot of material around developer education. Check out this e-book for example that looks at Serverless Security: https://go.snyk.io/oreilly-serverless-security.html Happy to DM you some more if you want 🙂

A few interesting vulnerable apps here - https://github.com/appsecco

Me too! Do we need to dip back into control in order to maintain the balance?

If so, we will have no trouble doing this !

We are masters at control

I think Aristotle has it right - we need Structure and Clarity which is easy to conflate

Just Enough Debois Information - JEDI 🙂

My take is that you hit it with the word care - there might be different motivations to care of security part of being an employee is having obligations to keep things secure - but you should translate it into their daily life about what they care Like sales, we don't want to leak information to competitors , loose subscribers when people feel their privacy is violated

When building up that care, is there a way you avoid using "Security" as a blugeon? One example is in the Pheonix Project where the security director can halt any process by talking about how important security is. How are some ways you have effectively seen security implemented gently while still keeping the importance?

The problem is not that security says no - if we trust them we want them to say no - what we are hinting is that if we externalize the basic knowledge & judgement we can distribute the situation assessment allowing not to be blocked all the time. Much like Ops still has a place as the experts or the UX or the project manager - they all have deep expertise I agree that is when people get better they often feel less need to ask for advice. And that reflex of asking advice needs to be enforced by the rules of engagement - everyone that will have impact needs to be solicited in case of doubt (by exception) That is the aim of the trust building

We have multiple apps for students: 1 . Early learn app K3 in collab with Disney 2. K5-K12 app For parents we have a partner app. But no apps for schools/colleges. We however are working with Google classroom to give content to schools and colleges via Google classroom platform

We use MongoDb as our DB For analytics we use Redshift and BQ depending on different use cases. However, we have realized over time that certain transaction data had to be moved to Relational DB. So parts of it are now being moved to PostgresSQL

Thanks

We kept the design as is. Reduced the threshold for alarms for disk space, CPU for the Jenkins.

We tried to stay as close to what engineers expected from before the lockdown, since now all support and interactions were going to be remote.

Slack channel for build status updates acted more of a shared workspace for the DevOps team working from different parts of the country.

Having each status there allowed for further discussion if required.

We did not have to switch been apps to know if something went wrong. Also, because we had alerts come on a certain channel where multiple people were there, we never missed something that was critical. Threaded discussions meant we had the context

Interesting. We have tried both having alerts in the channel and outside the channel and both cases have resulted in them being ignored. Now, new managers are wanting to move alerts again and I'm trying to think about how best to help.

This is a great question for a BoF session. Even I would like to hear from the other experts on what they say.

so we are using github->jenkins->s3

Thanks

great, under which name

I'm right to the bar

would like to join you, are you planning to be there in 30 mins?

actually i have no idea, but I can be there

just wanted to listen to Mark Schwartz

Are you able to avoid V&V finding real bugs this way?

Intriguing! KPIs are dangerous generally, if used as targets. IMHO they're great for teams to use internally, but dangerous for any form of upward or outward reporting.

We use this in some work I do on service design, great to see it here!

I captured the screen with this one it, to show my management I am not the only one who talks about it

The brilliant John Willis talks about the cynefin framework in his podcast with Dr. Mik Kersten https://projecttoproduct.org/podcast/john-willis/

Interesting