Going cloud native in a highly regulated context presents challenges of its own. In this talk, Jez Humble will share with you the platform created by the cloud.gov team at 18F, and the benefits it brought to federal agencies seeking to use the cloud. More details: https://confengine.com/agile-india-2019/proposal/8525/cloud-native-in-the-us-federal-government Conference link: https://2019.agileindia.org

1. cloud native in the us federal government
@jezhumble #agileindia2019

2. what cloud.gov is
continuous delivery refresher
why we built cloud.gov
implementation
principles for building a paas
agenda

3. @jezhumble
what is continuous delivery?
The ability to get changes—features, configuration changes, bug
fixes, experiments—into production or into the hands of users
safely and quickly in a sustainable way.
https://continuousdelivery.com/

4. @jezhumble
increase software quality and stability
make releases painless, low risk events
reduce time to market
increase customer and employee satisfaction
reduce cost of ongoing software development
why continuous delivery?

5. Let’s ship it!

6. Or not.

7. Shipping software isn’t
rocket science

8. Is the launch checklist working?

9. The U.S. Government's
Digital Launch Checklist

10. Records Management
Records Schedule
Privacy Act
Paperwork Reduction Act
Section 508 and Accessibility Standards
Federal Acquisition Regulation
Anti-deficiency Act
Economy Act
E-Government Act
Computer Matching Act
National Cyber Protection System
Guidance for Agency Use of Third-Party Websites and Applications
Social Media and Web-Based Interactive Technologies
Office of Management Budget Circular A-130 Appendix 3
Federal Information Security and Management Act
Federal Information Processing Standard (FIPS) 199
Federal Information Processing Standard (FIPS) 200
Federal Information Processing Standard (FIPS) 140-2
Special Publication 800-37
Special Publication 800-53 Revision 4
Special Publication 800-60 Volume 1
Special Publication 800-60 Volume 2

11. Special Publication 800-18
Special Publication 800-137
Special Publication 800-171
Special Publication 800-133
Special Publication 800-95
EINSTEIN Compliance
FedRAMP
OMB Guidance on third party websites and applications
OMB Memo M-14-04
OMB Memo M-15-01
Trusted Internet Connection 2.o Reference Architecture
Pages in total:
4006

12. My friend, you can clearly see the
intention of FIPS 140-2 Annex A was to
deprecate SHA-1 on the lunar new
year...

13. http://dx.doi.org/10.6028/NIST.SP.800-53r4

14. http://dx.doi.org/10.6028/NIST.SP.800-53r4

15. http://dx.doi.org/10.6028/NIST.SP.800-53r4

16. http://dx.doi.org/10.6028/NIST.SP.800-53r4

18. How long is this going to take?

19. 6 - 14 months to ship

21. Speed is the new security.

23. Ops
Dev

24. IaaS
Ops
Dev
PaaS

28. compliance
https://18f.gsa.gov/2017/02/02/cloud-gov-is-now-fedramp-authorized/

29. push-button deployments
teams can deploy into a production-like environment from day 1
architectural paradigm designed for distributed systems
templates for all your compliance documentation
most of the controls taken care of at the platform level
what this gets you

30. everything must be self-service
principles for building a paas

31. what is a cloud?
NIST SP 800-145, “The NIST Definition of Cloud Computing”

32. what is a cloud?
http://bit.ly/2018-devops-report | https://devops-research.com/research.html

33. everything must be self-service
design your platform for multi-tenancy
principles for building a paas

34. multi-tenancy

35. IaaS “one account to rule them all” trade-offs
• Hard to deal with multi-tenancy & provide a real cloud
• Significantly higher ongoing maintenance costs
• Hard to manage sprawl
• One-size-fits-all platform solution

36. IaaS multiple accounts trade-offs
• Can give teams direct control over each account
• Potentially need to instantiate shared services in each account
• Still some issues with multi-tenancy

37. PaaS trade-offs
• You only need to ATO once
• RBAC built-in - deals with multi-tenancy
• Good practices baked in
• Lower maintenance & operational costs
• One-size-fits-all solution

38. use native cloud primitives
everything must be self-service
design your platform for multi-tenancy
principles for building a paas

39. use native cloud primitives
everything must be self-service
design your platform for multi-tenancy
everything must be reproducible from version control
principles for building a paas

41. use native cloud primitives
everything must be self-service
design your platform for multi-tenancy
take care of compliance at the platform layer
everything must be reproducible from version control
principles for building a paas

42. building security in
http://bit.ly/2018-devops-report | https://devops-research.com/research.html

45. more on cloud native in the federal government
https://devops-research.com/research.html

46. thank you!
© 2016-8 DevOps Research and Assessment LLC and Jez Humble and Associates LLC
Please take the 2019 State of DevOps Survey and help
us understand how to build high performing teams!
bit.ly/2019-sodr-survey