2018-05-09_CRAFTConf_FirstStepsMovingToTheCloud

@a_bangser@CraftConf / #CraftConf
First steps moving to the cloud;
CI, security, and persuasion
Abby Bangser
@a_bangser
CRAFT Conference 2018

Gather ‘round
● Cross functional
● Experienced team, though some
newbies to cloud migrations
● Relatively stable across multiple
organisations
http://www.shaw.af.mil/News/Article-Display/Article/664467/resilient-airmen-brave-rapids/
2

Disclaimer...
Due to the requirements of non-disclosure
agreements the names and place have been
changed but the stories remain true.
3

A rainy early winter day
in London...
4

A classic trap
https://madstroelshansen.com/wp-content/uploads/2017/04/improve.png
5

Time to change directions
6
https://c1.staticflickr.com/4/3519/3462607995_150a6b2624_b.jpg
https://c1.staticflickr.com/3/2779/4476353959_8bb508198d.jpg

https://upload.wikimedia.org/wikipedia/commons/f/f6/Whiteboard_with_markers.jp
g
Setting up the plan at our initial meeting
7
Jim
(pm)Sarah
(arch)
Me (qa)
Kitty
(exec)
Aden
(mgr)
January = Inception
➔ Jim to send roles needed for high level planning
➔ Aden to confirm attendance
Open Question: When can we start? Target Jan 10
Inception Goal =identify plan to support cloud migration

...time passes...
8

@a_bangser@CraftConf / #CraftConf 9

Short
term
Mid term Long term
Whole team kick off with a complete plan from Aden
10
Jim
(pm)
Me (qa)
Aden
(mgr)
https://cdn.pixabay.com/photo/2016/03/24/16/24/projector-1277071_960_720.jpg
Sarah
(arch)
Kitty
(exec)
● Automate end to end
regression
● Deploy into other cloud
solutions
● Complete production
and test envs
● Automate
AWS
● Start building
production and
test env
● Define backlog
● Move to
AWS (Exactly
as today)

Short
term
Mid term Long term
Red flags in the short term plan
11
Jim
(pm)
Me (qa)
Aden
(mgr)
Sarah
(arch)
Kitty
(exec)
regression
solutions
and test envs
● Automate
AWS
● Start building
production and
test env
● Define backlog
● Move to
AWS (Exactly
as today)

Short
term
Mid term Long term
Red flags in the mid term plan
12
Jim
(pm)
Me (qa)
Aden
(mgr)
Sarah
(arch)
Kitty
(exec)
regression
solutions
and test envs
● Automate
AWS
● Start building
production and
test env
● Define backlog
● Move to
AWS (Exactly
as today)

Short
term
Mid term Long term
Red flags in the long term plan
13
Jim
(pm)
Me (qa)
Aden
(mgr)
Sarah
(arch)
Kitty
(exec)
regression
● Deploy into other
cloud solutions
and test envs
● Automate
AWS
● Start building
production and
test env
● Define backlog
● Move to
AWS (Exactly
as today)

Identify key lines of
communication early
(and keep up with them)
14
Note to self #1

The inception worked, but not without challenges
● Quick start to get delivery work started
● Getting the right people in the room
● Taking advantage when the right people are in the room
● Early integration with security
● Clear business case for first delivery
● Team buy in on what to build and why
● Expectation setting for wider organisation and stakeholders
15

2 weeks of meetings was torcher for much of the team
16
https://c1.staticflickr.com/6/5085/5341778744_ecf85a4d7c_b.jpg

So everyone wanted to get out and play...fast!
17
https://c1.staticflickr.com/6/5085/5341778744_ecf85a4d7c_b.jpg
https://www.maxpixel.net/Malinois-Belgian-Shepherd-Dog-Doggy-Ball-661174

“So much time and so
little to do.
Wait a minute. Strike
that. Reverse it.”
18
-- Willy Wonka

Less mental energy on the tech, focus on the process
19
● Honesty with the business case
● Focus on building contextual
consistency
● Trial, challenge, and endorse
practices together

Early delivery wins are
important
20
Note to self #2

Dan North, “Ops and Operability” PIPELINE Conf 2017, slide 13 (https://speakerdeck.com/tastapod/ops-and-operability)

Mob programming
22

Early delivery wins are
important, but cannot be
in lieu of building team
foundation
23
Note to self #2.5

First contact with security
24
Jim
(pm)
Sarah
(arch)
Me (qa)
Aden
(mgr)
Jonas
(security)
https://imageog.flaticon.com/icons/png/512/1/1329.png

The wall of paperwork was created
25
Jim
(pm)
Sarah
(arch)
Me (qa)
Jonas
(security)
https://c1.staticflickr.co
m/9/8515/8480910015_
d2211b1a49_b.jpg
Aden
(mgr)

Initial plan to engage with security
● Start with early communication
● Make security a core deliverable
● Walk the delivery journey together
● Stay away from big end of delivery sign off
26

Start with a plan...
and a plan on how to
evolve the initial plan
27
Note to self #3

Cheesy (but helpful!) analogy ahead
28

The 7 stages
of grief:
1. Shock & Denial
2. Pain & Guilt
3. Anger & Bargaining
4. "Depression", Reflection, Loneliness
5. The Upward Turn
6. Reconstruction & Working Through
7. Acceptance & Hope
29

The 7 stages
of grief:
1. Shock & Denial
2. Pain & Guilt
3. Anger & Bargaining
4. "Depression", Reflection, Loneliness
5. The Upward Turn
6. Reconstruction & Working Through
7. Acceptance & Hope
30

Bargaining started from the wrong place
31
Jim
(pm)
Sarah
(arch)
Me (qa)
Aden
(mgr)
m/9/8515/8480910015_
d2211b1a49_b.jpg
● Out of scope for our infra
● Excessive for our context
● Minimise evidencing
● Ways of working vs
active measures
● etc...

Still “show stopping”
estimates
32

There was no shared journey
33
Jim
(pm)
Sarah
(arch)
Me (qa)
Aden
(mgr)
Jonas
(security)
m/9/8515/8480910015_
d2211b1a49_b.jpg
Us
Them

THE UPWARD
TURN
34
Jonas
(security)
Jim
(pm)
Sarah
(arch) Me (qa)
Aden
(mgr)
https://upload.wikimedia.org/wikipedia/commons/f/f6/Whiteboard_with_markers.jpg
How can we support the business objective
of scaling capacity in a responsible way?

Reconstruction
and working
through
35
Jonas
(security)
Jim
(pm)
Sarah
(arch) Me (qa)
Aden
(mgr)
https://upload.wikimedia.org/wikipedia/commons/f/f6/Whiteboard_with_markers.jpg
How can we support the business objective
of scaling capacity in a responsible way?
➔ Threat modeling
➔ Change as a first principle
➔ Secure development practices
➔ Building evidence in to solutions

What we heard
36
“There needs to be a regular and
independent evaluation of all infrastructure”

What we heard > why they cared
37
“Smart hackers will first turn off any alerting, so
we want a separate account to check for issues”

What we heard > why they cared > shared understanding
38
“Sure, you can know what we are looking
for in these checks”

Work with the security team to create reliable and reusable tests to be run
within our pipeline AND independently on a regular basis.
“Sure, you can know what we are looking
for in these checks”
How we proceeded

“We need security sign off for all critical
changes”
How we proceeded

changes”
“Some changes like IAM policies can create a
significant enough risk we need safeguards in place”
How we proceeded

changes”
“No we don’t need to know when you
scale the system from 3 to 5 servers”
How we proceeded

changes”
“No we don’t need to know when you
scale the system from 3 to 5 servers”
Start the dialog of what are big risk changes and isolating them into their
own CI pipeline for manual review and sign off.
How we proceeded

Working examples does
wonders for building
trust across roles
(And make them available to be explored in private!)
44
Note to self #4

Acceptance & Hope
45
https://lh3.ggpht.com/nyfYkqhAVWU0SUaoxPNjLX6zrEEZcdc5tif5KD6sPbPPyJlbbUVT_zCzYJEa88BaI3JKELXfL71WwToRzfib4LF5Sw=s0

So I hear you had a very similar problem
statement not more than 2 months later.
How did you begin that one given this
experience?

Iterative development isn’t easy...
● Minimum security, resiliency, backup, and configuration is huge
● Pressure to replace certain services is usually high
● Significant temptation to lean towards less valuable/risky areas early
47
...but it is worth it
● Leverage managed services where you can (even if temporarily)
● Minimise new tech to minimise security surface area (within reason)
● Push for high value first customer to drive hidden requirements early

Watch for the circular dependency
Continuous Integration server
Source Control Management server
Test environment

Continuous Integration is our secret sauce
49
● Lower risk for resilience
● “Clean edge” given contracts between SCM and deployments
● Typically painful area that can build trust and value quickly
● DevOps by example with dog food builds
● Opportunities to extend into more complex environments

Let’s keep the
conversation going
50
Thank you for attending, any questions?

2018-05-09_CRAFTConf_FirstStepsMovingToTheCloud

More Related Content

What's hot

Similar to 2018-05-09_CRAFTConf_FirstStepsMovingToTheCloud

More from Abigail Bangser

Recently uploaded

2018-05-09_CRAFTConf_FirstStepsMovingToTheCloud