https://twitter.com/RealGeneKim 😉

ask in #ask-the-speaker-keynote

btw, most comments are in #ask-the-speaker-keynote

thanks, hadn’t seen that channel

Hi Chris! 👋

Hi Liz - good to see you here. I stepped away for a while for some work stuff I couldn't dodge :man-frowning:

TIL: https://kesselrun.af.mil

No, but I'd love to read more (link).

I'm also deeply fascinated by the thinking behind this: https://software.af.mil/

I work for a bank and I think I have governance tough....

@dvallera - would you be open for a chat?

hey guys @jtf that is my organization and @matthew.cobby Platform One came after KR but they are leading the way in other efforts. We are trying to build out DevSecOps in an acquisition community that is old and still implements waterfall process

That's a hard yard in such an environment

absolutely

@dvallera @matthew.cobby @jtf Happy to pick up the discussion by e mail, zoom, separate channel in the conference, etc. Cheers.

I guess this is similar to the aviation industry - if 'the fear of being wrong / need to be right' is more powerful than 'speaking up / OK to being wrong' then pilots make bad decisions and planes crash. There was a strong incentive for the Navy proactively tackle these new problems ahead of time - 'if we don't try to solve these problems now - lots of people will die' . Glad the Navy culture was in a good place to make these problem solving learning exercises happen!

Holy cow. Trent Hone works with @jeff.gallimore!

@genek101 yep. he’s on my core team. i learn lots from him.

@genek101 @jeff.gallimore one day I was trying to learn more about Gary Klein's Shadowbox Training method. Turns out a person who co-authored MDCP1 Warfighting - the USMC doctrine document works with him (John F. Schmitt) https://www.shadowboxtraining.com/the-shadowbox-team

Hope you don't mind I screenshotted this - a lot of times I have people say they struggle to sell Value Stream Mapping internally and look for recommendations

Thanks. Here’s a very short note we wrote for students on how to map a process. We’ve done this in pharma NPD in IT etc. HUGE help in creating shared visualization of what we think is happening to which we can append our discoveries about what is actually happening + what we think should be changed.

Ooh - thanks for sharing - I have a version of Karen Martin/Mike Orzen's approaches that I use - always the tech delivery stream though - it's always really interesting to see other disciplines mapped. Sometimes I get a team to map 'getting a coffee' as warm up exercise

Do you need a tool, there will of course be tools to help you achieve your goals. You will always need to put a process in place so the tribes understand the guardrails they are working in.

people-process-technology! never fails

Thanks @andy!

Hi Trevor, We have a full lifecycle check on code, so from a runtime immutability enforcement we have a lot pipelines covered and some that are in progress, so not fully covered yet but will be soon.

They are several in that space. Mural, Klaxoon, ...

Yes, we were using Mural.

I recommend Mural - we spent some time focussing on this with a timer function so we equally didn't dwell on what to put on the board, that timer created that urgency to think and think out of the box a bit quicker 🙂

Thanks Nisha. Great preso today. Cheers.

As someone that has never been involved in a Dojo this was really fun and engaging - as you say just having the camera on added to that experience 🙂

I was thinking related to the talk, but I suppose I could try fielding others… 🙂

what was going on behind you? Looked like a couple of sock puppets from here! 🙂 - and thanks for the food for thought.

I think it was my daughter laying on the couch in the background… or so I thought!

Thank you @saloni.seth 🙂, really appreciate

Happening now! @steve773 will be doing a follow-up Q&A to his morning keynote at 330pm BST (in 90 min). Join here: https://us02web.zoom.us/j/8908483265

👆

@matthew.cobby - Martin is also in the https://github.zoom.us/j/93929282358?pwd=Z3pkSHJPTHAvZSs1M2VvTVhPUlZOQT09 if you want to ask those questions 🙂 (password: GitHub)

Answered in #ask-the-speaker-track-3 - basically we encourage them to use their personal ID’s but we associate the GitHub ID with the Microsoft org so that we can check they have 2fa etc enabled when contributing to the Microsoft org

You can also configure SAML so that they are authenticated against AAD when they contribute to the Microsoft org

@matthew.cobby we use that quite heavily. If you want you can have users add in their corporate email to the GitHub profile .. and you can ask them to set that as their secondary email; and then you can verify that. There are some neat approaches to managing Identity as part of Github

I think the organisers are going to put them in a dropbox and a github repo for everyone. #summit-help is probably the place to ask 🙂

awesome thank you again I really enjoyed the presentation which had valuable information for all team members!

Thank you!

Great presentation @mail832 - a lot of key takeaways and lessons for sure. Thank you 🙏

+1 really enjoyed it

Me too in Cardiff.

lager season is in flight 😉

It can unfortunately start at any level of the organization and takes continual vigilance to keep it at bay and out of the culture. Psychological safety is a key component here and there are many aspects to this. It needs to be openly discussed and defended by everyone. Leaders need to model behavior by accepting feedback. Post-incident reviews need to be blameless

Yes!!! I've been on (far too many) war rooms where senior managers have sworn at techies, and have wanted them fired after incident resolution!

A Culture of Terror... ☠️👹

We had a saying at one of my old companies: “the fish rots from the head”.

Very easy actually. It's honestly so easy to see this framework is better. For someone like a SME, it gives them more time to actually do troubleshooting without being constantly peppered questions and allows them to pursue multiple things. Reducing chaos and MTTR will sell most people 🙂

Unfortunately that hasn't been my experience. Having technical folks answer questions from an IC usually results in some version of, 'I am troubleshooting my service, leave me alone'.

The first IC on the bridge is the IC until they give up control. They are the boss and have final authority to make any change in IC decisions. That can happen for a couple of reasons 1) The issue moved more towards a domain they don't know, 2) The issue got too big and they need to transition to a SME. If a senior leader is misbehaving on a call, you use "Would you like to take over as IC?" - that's the queue they've overstepped. If everyone is trained in this, it works pretty well

I guess the key aspect is that the senior leaders also require the training 🙂 That makes sense

@philipp.boeschen650 that's a really good observation and question: I was in similar situations and we got to a point (at Expedia) where we started educating our leaders about the critical importance of safety and trust 🙂. It didn't happen overnight, but they progressively got it and tried hard not to walk the floor and engage in telling people what to do, how fast etc. 🙂. Educating is key because they may know realize the negative impact of their behaviors.

Ah travel industry ! 🙂 I work at TUI currently. That's well put - guess it's a long road ahead of coaching our leaders as well as ourselves, thanks for that input!

Well you're right: we worked w transformation coaches and leadership consultants 🙂 . Influencing execs often takes external coaches/consultants, seen that many times

Yeah bottom up tends to be hard since it takes someone very secure in themselves to deal with that properly I guess since it's questioning some fundamentals :thinking_face:

@erica.morrison great talk. “do you want to take over as IC ?” is a very common queue. Also featured in tv shows: :https://youtu.be/Qypoco4BL_c?t=228

They actually don't conflict at all. ACL recommend Blackrock 3 to us. One of their findings was that we needed to run our outage bridges better and I couldn't agree more that this was such a pivotal finding they provided to us. They compliment each other really well and go hand in hand

100% agree

I’m honored to follow you as a speaker, BTW!

@jwillis @allspaw would like to dialog with you on this in his current Q&A session...

😃

Are technology leaders other people? Or are they everyone here? Leaders at all levels? :-)

@jonathansmart1 I believe we refer (at least I am) Execs. And what we'd welcome ifs that they make space for all the other Leaders who are able to think, lead and fix.

It also causes more work instead of fixing the problem... because you have to teach them why and what etc..

That's why: 1. We don't wait for incidents to happen to coach Leaders/ exces

2. Incidents mgt needs to be fully integrated into the transformation stagery and roadmap, and generally it isn't 🙂

3. we have dedicated folks coaching/ educating exces/ leaders

4. Educating them on safety must be holistic not siloed like we usually do, team safety vs incident, vs performance reviews etc. it needs to be integrated and holistic. And foccussed on safety and growth mindset as an organizational capability

kidding of course ... great stuff

There are various ways to count accesses on web pages! 🙂 depends on where/how the documents are stored and made available.

Ah-ha ... it would work too. Thanks.

Google Docs have Tools->Activity Dashboard where you can see all viewers, for example. Confluence has Page View Statistics.

Yep, @jiri.klouda’s suggestions are good ones

it can happen in an async fashion and doesn’t have to be long. the most important part of separating them is to focus the group review meeting on a richer understanding of the event first. We never find that people forget what action items might be worth exploring later. But we do find people generating them too quickly before understanding the incident in a deeper way, resulting in tickets that get “won’t fix” later because frankly: it was a bad idea, based on a faulty understanding.

thanks!

I think people find time for what matters -- if there is value, they show up.

Meeting ID invalid - must’ve run out of time

The definition of safety in this context is compliance (Governance, Risk and Compliance), i.e. InfoSec, Data Privacy, Fraud, Compliance, etc. The control environment, both regulatory controls and company controls (psychological safety is covered via 'Happier' in Better Value Sooner Safer Happier). It's agile not fragile. Covered in "Risk and Control is Dead, Long Live Risk and Control" talk from DOES 19 Las Vegas. To answer your question, what we've done in the past is two key measures: (1) Left to Right measure. i.e. via the tooling we can see that you have a change with a number of mandatory risk stories. We can see if any changes were promoted without those mandatory risk stories having been automatically or manually attested as done and tested (e.g. MFA should've been implemented, but the controls have been bypassed maliciously or via breakglass) (2) Right to Left. A check of binary changes in prod. to ensure that it can be correlated back to the firm's control environment (i.e. the mandatory risk stories). If not, someone's bypassing all the controls. These two indicators would show up as red flags, and were part of the formal control environment, as reviewed and agreed by regulators. They were reviewed at exec level, aggregated by top level value streams.

Awesome. Thank you.

If I may offer a different view: https://devopsenterprise.slack.com/archives/C015DQFEGMT/p1592927981483800?thread_ts=1592927596.471000

(just an acknowledgement that to equate safety with compliance can be problematic)

Safety = zero bad things gone wrong. Inspiration for this point of view is Alcoa which established zero injuries as the goal and responding to every indication of risk as trigger. Here’s a link to an appreciation I wrote on Paul O’Neill’s passing which talks to that. https://conta.cc/2x7fD3q

Like equating quality with testing

A modern perspective is also that safety is the presence of activities and capabilities that enable people to anticipate, respond, monitor, and learn in situations that make for vulnerable outcomes - in this case it’s not the absence of adverse events, which tends to stretch interpretations of ‘zero’ and ‘bad’ and ‘thing’ and ‘wrong’

Advocates for taking this view (sometimes referred to as a “Safety II” perspective or a “safety differently” perspective) would say that defining safety in the way @steve773 mentioned (and what’s historically been the definition) has some issues: how it’s measured and how it’s studied…Erik Hollnagel being a proponent of taking this new view: “The measurement problem is simply that an increase in safety is represented by a decrease in what is measured. Thus, a lower number of reported accidents (or other unwanted outcomes) is seen as representing a higher level of safety. The purpose of safety management is continuously to reduce or eliminate adverse outcomes and thereby achieve the enviable state of ‘freedom from harm’. But it is only possible to know how well an SMS works if there is something to measure. Therefore, the better the job an SMS does the less information there is about how to make improvements. This corresponds to the well-known regulator paradox, where the absence of feedback ultimately leads to a loss of control (Weinberg and Weinberg, 1979). The essence of the paradox is that the task of a regulator is to eliminate variation but this variation is the ultimate source of information about how well the regulator works. Therefore, the better the job a regulator does the less information it gets about how to improve. Thus, if an investment in safety does not lead to measurable results, such as a reduction in the number of accidents, then there is no way of knowing whether the investment had the desired effect. Furthermore, if the number of accidents is low to begin with, it is unreasonable to expect that the effect of improvements made can ever be measured.”

Sidney Dekker’s talk on this at DOES 18 was good. ‘It’s the presence of positives rather than the absence of negatives’ Airlines with the highest reported incidents have the lowest mortality rate

I love this conversation, such great knowledge.