The document discusses how to secure software delivery pipelines using a TACO (Traceability, Access, Compliance, Operations) model. It describes mapping controls to different stages of a pipeline to ensure issues are addressed, traceability exists, access is validated, and operations are monitored. Implementing automated controls in a pipeline can help govern risk while allowing rapid software delivery. The presentation provides examples of how organizations like Capital One have implemented pipeline controls and governance. It emphasizes that safety is about behaviors, not just tools, and addresses how to get teams onboard with these ideas.

1. © 2020, Xodiac Inc. All rights reserved.© 2018, Xodiac Inc. All rights reserved.cab Author – Title
Securing your pipes with a TACO
Peter Maddison
© 2019, Xodiac Inc. All rights reserved.cb vxla – Factory and Pipeline

2. © 2020, Xodiac Inc. All rights reserved.
Talk map
Intro
Setting the
stage
Addressing
concerns
and causes
TACO
time!
How to
make a
TACO
Wrap
Up
and
Q&A
Automating
Governance

3. © 2020, Xodiac Inc. All rights reserved.
Who am I?
Peter Maddison
Coach, consultant, founder…
peter.maddison@xodiac.ca
@pgmaddison
https://www.linkedin.com/in/peter-maddison/

4. © 2020, Xodiac Inc. All rights reserved.
“ ”
I cannot teach anybody anything.
I can only make them think
- Socrates

5. © 2020, Xodiac Inc. All rights reserved.
Talk map
Intro
Setting the
stage
Addressing
concerns
and causes
TACO
time!
How to
make a
TACO
Wrap
Up
and
Q&A
Automating
Governance

6. © 2020, Xodiac Inc. All rights reserved.
What problem are we solving?

7. © 2020, Xodiac Inc. All rights reserved.
Where to begin?
Photo by Jukan Tateisi on Unsplash

8. © 2020, Xodiac Inc. All rights reserved.
Introducing change
cbnd Kevin Spear – http://kevinspear.com/growth/resolving-avoid
“This year, I resolve to stay away from
unnecessary risks.”

9. © 2020, Xodiac Inc. All rights reserved.
“
”
People, processes and tools working
together to enable rapid and continuous
delivery of value to customers.
- A bunch of people

10. © 2020, Xodiac Inc. All rights reserved.
Time to deliverTime to ideation
Pipeline overview
Customers
Channels (forums,
focus groups,
social media)
Product
Owner
Team
members
Delivery Team
A
B
C
SCM
App
Test
Infra
A 1.
2.
3. Automated
Pipeline
Build
Test
Deploy
Feedback (monitoring, logging,
test results)
auto triggered
manually triggered
1.

11. © 2020, Xodiac Inc. All rights reserved.
?
© 2019, Xodiac Inc. All rights reserved.

12. © 2020, Xodiac Inc. All rights reserved.
Bunch of pictures

13. © 2020, Xodiac Inc. All rights reserved.cab Author – TitlePhoto by Michael Longmire on Unsplash
Hitting a wall

14. © 2020, Xodiac Inc. All rights reserved.
Talk map
Intro
Setting the
stage
Addressing
concerns
and causes
TACO
time!
How to
make a
TACO
Wrap
Up
and
Q&A
Automating
Governance

15. © 2020, Xodiac Inc. All rights reserved.
Conversation

16. © 2020, Xodiac Inc. All rights reserved.cab Author – Title
GRC
Governance: Cost
effectively govern
the organizations
risk landscape
Compliance:
Documenting
and reporting
on how we
address risk
Risk:
Identifying and
mitigating
risks

17. © 2020, Xodiac Inc. All rights reserved.cab Author – Title
IRM (Satisfying the industry need for acronyms)

18. © 2020, Xodiac Inc. All rights reserved.
Lost in translation
Developers
Security
Compliance
Testing
Operations Architecture

19. © 2020, Xodiac Inc. All rights reserved.
Is there a risk?
Photo by NordWood Themes on Unsplash

20. © 2020, Xodiac Inc. All rights reserved.
Talk map
Intro
Setting the
stage
Addressing
concerns
and causes
TACO
time!
How to
make a
TACO
Wrap
Up
and
Q&A
Automating
Governance

21. © 2020, Xodiac Inc. All rights reserved.
Collaboration
Photo by John Schnobrich on Unsplash

22. © 2020, Xodiac Inc. All rights reserved.
Modeling
Traceability
Access
Compliance
Operations
Identify what happens in
the pipe
Secure the delivery
process
Validate the payload in the
pipe
Record execution and
monitor
© 2019, Xodiac Inc. All rights reserved.
• Source code managed
• Creator tracked
• Build once, deploy many
• Pipelines only
2
• Peer review
• Scan the code
• Scan the artifact
• Manage the data
3
• Validate the target
• Validate quality
• Check it works
• Watch it live
4
1 • Chain of custody
• Test results for all
• Deployed version is tracked
• Change is recorded
Ensure
issues are
addressed
Strengthen
team
behaviour
Ensure
traceability
exists
Validate
access

23. © 2020, Xodiac Inc. All rights reserved.
TACO!

24. © 2020, Xodiac Inc. All rights reserved.
Example
Then link this to the tasks to create and the impediments to success

25. © 2020, Xodiac Inc. All rights reserved.
Visualize
how much
TACO
0
5
10
15
20
25
30
Access
Compliance
Operations
Traceability

26. © 2020, Xodiac Inc. All rights reserved.
Talk map
Intro
Setting the
stage
Addressing
concerns
and causes
TACO
time!
How to
make a
TACO
Wrap
Up
and
Q&A
Automating
Governance

27. © 2020, Xodiac Inc. All rights reserved.
How can you apply TACO
and make it work for you?

28. © 2020, Xodiac Inc. All rights reserved.
CapitalOne example
• Source code version control
• Optimum branching strategy
• Static analysis
• >80% code coverage
• Vulnerability scan
• Open source scan
• Artifact version control
• Auto provisioning
• Immutable servers
• Integration testing
• Performance testing
• Build deploy testing automated for every commit
• Automated rollback
• Automated change order
• Zero downtime release
• Feature toggle

29. © 2020, Xodiac Inc. All rights reserved.

30. © 2020, Xodiac Inc. All rights reserved.
Mapping the controls
Build Validate Test Deploy
If controls fail, break the build and radiate back to team for resolution

31. © 2020, Xodiac Inc. All rights reserved.
Pipeline
Source Code
Repository
Build
Dependency
Management
Package
Artifact
Repository
Non-
production
deploy
Production
deploy

32. © 2020, Xodiac Inc. All rights reserved.
Mapping the controls
Build Validate Test Deploy
If controls fail, break the build and radiate back to team for resolution
Source Code
Repository
Build
Dependency
Management
Package
Artifact
Repository
Non-
production
deploy
Production
deploy

33. © 2020, Xodiac Inc. All rights reserved.
Initial controls design

34. © 2020, Xodiac Inc. All rights reserved.
Mapping the controls

35. © 2020, Xodiac Inc. All rights reserved.
Talk map
Intro
Setting the
stage
Addressing
concerns
and causes
TACO
time!
How to
make a
TACO
Wrap
Up
and
Q&A
Automating
Governance

36. © 2020, Xodiac Inc. All rights reserved.
Automating Governance
• Not about keeping audit off your
back
• Start small, get one team working and
grow from there
• Engage leaders, focus on conversation,
not tooling

37. © 2020, Xodiac Inc. All rights reserved.
Running the pipe
Define
work
here
SCM
Service
state
Artifacts
CI build
1
2
Build
Results
CI run 2
Quality
tests
3
4
Organisational
tests
5
6 7
8
Cycle time
X X

38. © 2020, Xodiac Inc. All rights reserved.
Auditing the pipe
Work
item
Work
item log
CI build
Build
Results
Unit test
results
QA test
results
URL to stages
of pipeline as
they execute
Code
review
System
design
record
Logs
Tools
Work item
number

39. © 2020, Xodiac Inc. All rights reserved.
Paved road
Photo by Jon Flobrant on Unsplash

40. © 2020, Xodiac Inc. All rights reserved.
Beyond roadmaps

41. © 2020, Xodiac Inc. All rights reserved.
Talk map
Intro
Setting the
stage
Addressing
concerns
and causes
TACO
time!
How to
make a
TACO
Wrap
Up
and
Q&A
Automating
Governance

42. © 2020, Xodiac Inc. All rights reserved.
What have we learned?

43. © 2020, Xodiac Inc. All rights reserved.
“ ”
We cannot solve our problems with the
same thinking we used when we created
them
- Albert Einstein

44. © 2020, Xodiac Inc. All rights reserved.
References
CapitalOne Focusing on the DevOps Pipeline:
https://medium.com/capital-one-tech/focusing-on-the-devops-pipeline-topo-pal-833d15edf0bd
Automated Governance – John Willis
https://www.youtube.com/watch?v=_j9eB0flTtY
Risk & Control is Dead, Long Live Risk & Control — Jon Smart
https://www.youtube.com/watch?v=XRMf9QjUwlI
https://itrevolution.com/forum-paper-downloads/https://www.amazon.ca/Field-Guide-Understanding-Human-Error-dp-
1472439058/dp/1472439058/ref=dp_ob_title_bk

45. © 2020, Xodiac Inc. All rights reserved.
So let’s review
• Safety is about behaviour, not tools.
• Ways to help automate software delivery compliance
• A way to create common understanding of a “good pipeline”

46. © 2020, Xodiac Inc. All rights reserved.© 2018, Xodiac Inc. All rights reserved.cab Author – Title
Thank you!
peter.maddison@xodiac.ca
@pgmaddison
https://www.linkedin.com/in/peter-maddison/
© 2019, Xodiac Inc. All rights reserved.cb vxla – Factory and Pipeline
Feedback survey:
https://bit.ly/2KWP1pA