Foundations of Our Deployment Pipeline a. Enterprise Data Warehouse program by Em Campbell-Pretty - $200M, All streams of work were significantly behind schedule. Surprising discovery: only 50% of the source of files. 50% of code is changed each month. 40K code commits/day, 120K automated test suites, 75M tests cases/day e. CONTINUOUSLY BUILD, TEST, AND INTEGRATE OUR CODE AND ENVIRONMENTS i. Create automated to run in parallel ii. Enable different test categories to run in parallel iii. Generally, limit manual testing if automated tests haven’t passed iv. For resource intensive suites, performance tests,

specifications, and standards. Systems Engineer Manages releases, overseeing system implementations, O&M, and transition, and integrates all the engineering sub disciplines and specialty groups into a team published an update to the JCIDS Manual on 19 Jan 12 that includes an IT Box model for Information Systems (IS). The policy applies to programs with software costs over $15M and with COTS or Government off-the-Shelf four sides of the IT Box identified in the IS-ICD include: Figure 12 IT Box (Source JCIDS Manual 19 Jan 12) As long as the program operates within these four sides of the IT Box, they need not

continually as part of daily work c. THE DANGERS OF CHANGE APPROVAL PROCESSES i. Knight Capital - $440M trading loss ii. Counterfactual Narratives 1. Accident due to change control failure – seems valid DOING MORE MANUAL TESTING AND CHANGE FREEZES i. When testing failures occur, adding more testing could backfire, especially if the testing is at the end of a project and/or manual 1. Manual testing is

ii. Continue to amplify signals to help avert the next catastrophe iii. Michael Roberto, Richard M.J. Bohmer, & Amy C. Edmondson (Harvard Business Review): organizations are typically structured as:1 blocking and storing source of events when attacks are detected to facilitate mitigation strategies m. PROTECT OUR DEPLOYMENT PIPELINE i. CD pipelines represent a new attack surface. If not properly secured CATEGORIZED AS NORMAL CHANGES i. If change approval board is required, aim for quick deployment even if manual steps are required ii. Use tooling to generate the artifacts needed for approval. Share evidence

company is making 36% more money? No Was your plant able to ship even one more product per day? I’m not sure… Did you lay anyone off or reduce operating expenses? No, there is a union… Did your inventories bottleneck, you have lost time that cannot be recovered.” Parallel: Automated Unit Testing before Manual Testing & QA Time and Batch sizes From the moment material comes into the plan to the minute

Extra features: d. Task switching: e. Waiting: f. Motion: g. Defects: h. Nonstandard or manual work:i. Heroics: d. The Second Way: The Principles of Feedback 27 i. KEEP PUSHING QUALITY CLOSER ineffective quality controls include: a. Requiring another team to complete tedious, error-prone, and manual tasks that could be easily automated and run as needed by the team who needs the work performed

Principles to implementing a successful DevSecOps approach  Remove bottlenecks (including human ones) and manual actions.  Automate as much of the development and deployment activities as possible.  Adopt common

no respect for “bad guys” vs Think about what others need Complaints $70k per, 2-3/month Cutting 100M from budget Finding a way to keep others from cutting their budgets vs. Finding a way to keep others

(standard C, IDIQ, BPA, GWAC, set-aside, etc.) can support Lean-Agile contracts All types (FFP, T&M, CPFF, CPAF, etc.) can support Lean-Agile contracts ...In exercising initiative, Government members

what you planned on doing, allegedly because you needed to do it.”Theory of Constraints “Eliyahu M. Goldratt, who created the Theory of Constraints, showed us how any improvements made anywhere