Mike Worthington from Sonatype gave a presentation on aligning teams and establishing a software supply chain for success. He discussed how most software projects have hundreds of components with frequent updates but many have known vulnerabilities and lack governance. Applying principles like component selection, quality control, and monitoring assemblies can help. Worthington also covered getting started, building bridges between teams, setting expectations, and defining meaningful success metrics like time to value and quality measures.

1. Dallas, TX
April 5, 2016
Mentor’s View: Aligning your team and your
powers for success
Mike Worthington, Customer Success Engineer, Sonatype

2. Agenda
2 4/11/2016
• Software Supply Chain & Rugged DevOps
• Getting Started on Your Journey
• Interactive Demo – Setting Policy
• Policy Results in Jenkins & Eclipse
• Meaningful Success Metrics

3. The Software Supply Chain
3 4/11/2016
• Hundreds of thousands
of projects
• 3-4 updates annually
• 30 billion download
requests last year
• 1 in 16 have known
vulnerabilities
• 43% have no
component governance
• 75% of those who do
don’t enforce it
• 106 components per
application
• 24 known
vulnerabilities
• 73% have no inventory

4. If manufacturers built cars the way we build software…
4 4/11/2016
Any part
can be used
even if it’s
outdated or
known to be
unsafe.
Since parts
aren’t tracked,
it’s
challenging to
issue a recall.
There is
no quality
control
or consistency
from car to car.
There is
no inventory
of parts used,
or where.
Choose
any supplier for
any part,
regardless of
quality.

5. 5 4/11/2016
Apply Software Supply Chain Principles For Rugged DevOps

6. Supplier &
component selection
(3rd party or Proprietary)
Component quality
& governance
Monitoring components & assemblies
(patches, updates, vulns, age)
Guidelines & policies Bill of Materials
Warehouse
& Staging
Image: Gartner Research, March 2016: Avoid Failure by Developing a Toolchain that Enables DevOps
Nexus Automates Software Supply Chain Practices
Across The Devops Toolchain

7. Getting started on your journey
7 4/11/2016
Rugged DevOps, Software Supply Chain, Now What?
• The Hero’s Journey
• Align Your Heroes
• Building Bridges
• Setting Expectations

8. Building a trusted software supply chain
8 4/11/2016

9. Different stakeholders, different priorities
9 4/11/2016
Where’s
that
release?
Done! On
to the next
sprint.
Now,
where are
we in that
process?

10. 10 4/11/2016
Building a better bridge between Dev, Ops & Sec
• Tooling needs to adopt the practice of
the practitioner
• A tool is not a process and a process
is not a tool; learn to leverage both

11. Two philosophies
Support & guide
• Objective information across
the lifecycle
• Each performs the task they
are good at
• Faster component selection
and issue resolution
• Bridges the developer
“compliance” gap
11 4/11/2016
Scan & scold
• Reactive information late
in the lifecycle
• Creates rework and slows
remediation
• Hinders technology innovation
• More expensive

12. 12 4/11/2016
Building a good component practice
Phase 3
Reducing risk &
enforcing compliance
Phase 2
Creating policy &
rating risk
Phase 1
Understanding your
environment

13. 13 4/11/2016
Communicate expectations
Determine lifecycle enforcement strategy:
Allows developers time to research & fix or to request waivers
Everything is documented on an internal WIKI
Development CI Build
Promotion to
staging or release

14. Fix the Red – Actionable?
14 4/11/2016

15. Fix the Red – Actionable?
15 4/11/2016

16. Interactive policy development
16 4/11/2016

17. 17 4/11/2016
What is policy?

18. 18 4/11/2016
Out-of-the-box policies with easy customization
Architecture
Component
License
Security

19. IQ Server Policy Definition
19 4/11/2016
DEMO

20. IQ Server policy definition
20 4/11/2016

21. Jenkins & IDE integration
21 4/11/2016
DEMO

22. Toolchain integration – IDE & CI Server
22 4/11/2016

23. 23 4/11/2016
ZTTR (Zero Time to Remediation)
EMPOWER DEVELOPERS FROM THE START1

24. 24 4/11/2016
DESIGN A FRICTIONLESS APPROACH
2

25. 25 4/11/2016
CREATE A SOFTWARE BILL OF MATERIALS
3

26. Defining Meaningful Success Metrics
26 4/11/2016
http://www.aintitcool.com/node/44547

27. It’s Not What You Measure…
27 4/11/2016
http://ronjeffries.com/articles/016-03/you-want/

28. …It’s the Behavior that Results
28 4/11/2016
Manager: “Nathan, this isn’t fair. You’re just showing the
number of stories, not how big they are.”
Nathan: “That’s right.”
Manager: “But that’s not fair!”
Nathan: [silent]
Manager: “All I’d have to do would be to divide up my stories
into little bits and release those every month.”
Nathan: [silent, smiling]
Manager: “Oh.”
Soon, the manager was doing small stories, to the benefit of
everyone.
http://ronjeffries.com/articles/016-03/you-want/

29. Success Metrics
29 4/11/2016
• Short Term – Time to Value
• “By the end of the workshop, we configured ~80% of
our policies. Just six business days after training, we
have made the test environment available in our
organization”
• Long Term – Quality Metrics
• MTTR
• WIP
• New violations delivered to production

30. Q&A
30 4/11/2016

31. Wrap Up
31 4/11/2016
• Manage your Software Supply Chain
• Collaborate with counterparts –
BA/PM/Dev/QA/Ops/Sec.
• Discuss mutual interdependence and shared
objectives
• Automated Real-Time Feedback is a win-win
• http://bit.ly/app-check

32. We’re here, engaged &
READY
TO HELP
32
Nexus Newsletter Nexus Live – Google Hangouts Cool Things in 2 Minutes
Customer Success Team
Training On-Site or OnlineOnline Knowledge BaseNexus Community Pages
Books Online

33. Dallas, TX
April 5, 2016
Mike Worthington - http://bit.ly/mwsonatype
Customer Success Engineer, Sonatype