This presentation show that Devops is not conflict with regulation for IT @ Bank in Indonesia

1. PAGE1
NaradaCode
CISA | Scrum Master | Devops Leader
Devops – Bad Cop or Robo Cop?
Christian Hermanus
v1.0
This document is confidential and is intended solely for the use and
information of the client whom it is addressed
Devops Implementation @ Bank in
Indonesia
https://www.linkedin.com/in/christianhermanus/

2. PAGE2
NaradaCode
ImplementationofRiskManagementintheUseofInformation
TechnologybyCommercialBanks
PBI No
9/15/PBI/2007
SEBI No
9/30/DPNP
POJK No 38
/POJK.03/2016
SE No 21
/SEOJK.03/2017

3. PAGE3
NaradaCode
RisksofApplicationDevelopment
SURAT EDARAN OTORITAS JASA KEUANGAN NOMOR 21 /SEOJK.03/2017
2.1. Pendahuluan
 Kesalahan (error)
 Kecurangan (fraud)
 Manipulasi data (data manipulation)
 Penyalahgunaan sistem (system misuse)
 Ketidaktepatan fungsi layanan yang dikembangkan (incorrect function)

4. PAGE4
NaradaCode
ApplicationDevelopmentProcess
Identify And Analyze
User Needs
Defining User Needs System Planning Programming
Testing Implementation
Post-
Implementation
Review
Maintenance
SURAT EDARAN OTORITAS JASA KEUANGAN NOMOR 21 /SEOJK.03/2017
2.3. Kebijakan, Standar, dan Prosedur Pengembangan dan Pengadaan

5. PAGE5
NaradaCode
ApplicationDevelopmentProcess
SURAT EDARAN OTORITAS JASA KEUANGAN NOMOR 21 /SEOJK.03/2017
2.3. Kebijakan, Standar, dan Prosedur Pengembangan dan Pengadaan
Identify And Analyze
User Needs
Defining User Needs System Planning Programming
Testing Implementation
Post-
Implementation
Review
Maintenance
BUSINESS ANALYST DESIGNER DEVELOPER
QA OPERATION

6. PAGE6
NaradaCode
ApplicationDevelopmentProcess
SURAT EDARAN OTORITAS JASA KEUANGAN NOMOR 21 /SEOJK.03/2017
2.3. Kebijakan, Standar, dan Prosedur Pengembangan dan Pengadaan
Identify And Analyze
User Needs
Defining User Needs System Planning Programming
Testing Implementation
Post-
Implementation
Review
Maintenance
BUSINESS ANALYST DESIGNER DEVELOPER
QA OPERATION

7. PAGE7
NaradaCode
WallofConfusion
Development Operation
Wall of
Confusion
“Wall of Confusion” between development and operations is caused by a combination of
conflicting motivations, processes, and tooling

8. PAGE8
NaradaCode
WallofConfusion
Development Operation
Wall of
Confusion
“Wall of Confusion” between development and operations is caused by a combination of
conflicting motivations, processes, and tooling
I want
Change!!
I want
Stability!!

9. PAGE9
NaradaCode

10. PAGE10
NaradaCode
WallofConfusion
Development Operation
Wall of
Confusion
“Wall of Confusion” between development and operations is caused by a combination of
conflicting motivations, processes, and tooling
I want
Change!!
I want
Stability!!
The main reasons the DevOps movement started was to address the communication
challenges between Dev and Ops teams, getting teams with very different perspectives to
work more effectively together.

11. PAGE11
NaradaCode

12. PAGE12
NaradaCode
DevOpsintheregulatoryandbestpracticesperspective
Good
Cop
Bad
Cop
Development Process according POJK
MRTI (WATERFALL)
DevOps

13. PAGE13
NaradaCode
DevOpsPractices
Build Unit Test
Deploy to
Stage
Acceptance
Test
Deploy to
Production
Auto Manual Approval Required
Continuous Deployment
Build Unit Test
Deploy to
Stage
Acceptance
Test
Build Unit Test
Deploy to
Stage
Acceptance
Test
Deploy to
Production
Acceptable
for Bank
Continuous Integration
Continuous Delivery

14. PAGE14
NaradaCode
DevOpsProcess
Plan & Design Develop Testing Deploy Detect Diagnose
Collaboration
Visibility &
Tracking
Requirement
Management
Versioning & SCM
Continuous
Integration
Static Analysis &
Code Checking
Acceptance Test
Automation
Non-Functional
Test Automation
Configuration
Management
Deployment &
Release
Management
Blameless
Post Mortem
Continuous
Monitoring
Alarm & Ticket
Automation
Continuous
Improvement

15. PAGE15
NaradaCode
ApplicationDevelopmentProcess
SURAT EDARAN OTORITAS JASA KEUANGAN NOMOR 21 /SEOJK.03/2017
2.3. Kebijakan, Standar, dan Prosedur Pengembangan dan Pengadaan
Identify And Analyze
User Needs
Defining User Needs System Planning Programming
Testing Implementation
Post-
Implementation
Review
Maintenance
BUSINESS ANALYST DESIGNER DEVELOPER
QA OPERATION
Collaboration
Visibility & Tracking
Requirement
Management
Versioning &
SCM
Continuous
Integration
Static Analysis & Code
Checking
Blameless
Post Mortem
Continuous
Improvement
Continuous
Monitoring
Alarm &
Ticket
Automation
Acceptance Test
Automation
Non-Functional
Test Automation
Configuration
Management
Deployment &
Release
Management

16. PAGE16
NaradaCode
Howaboutsecurity?

17. PAGE17
NaradaCode
DevSecOps,anotherDevOpsPractices
DevSecOps strives to automate core security tasks by embedding security controls and
processes into the DevOps workflow.
DevSecOps
originally focused
primarily on
automating code
security and
testing, but now
it also
encompasses
more operations-
centric controls.

18. PAGE18
NaradaCode
DevOpsintheregulatoryandbestpracticesperspective
Good
Cop
Bad
Cop
Development Process according POJK
MRTI (WATERFALL)
DevOps
Good
Cop
Robo
Cop

19. PAGE19
NaradaCode
DevOps may introduce new risk but mitigate
other risk, from a technical and business
perspective.
The question is not :
“ What is the risk of implementing DevOps?”
but
“ What is the risk of not implementing DevOps?”

20. PAGE20
NaradaCode
DevOps Consulting Company in Indonesia