Download as PDF, PPTX
Uploaded byRundeck
The "Ops" Side of DevSecOps
The document discusses the challenges faced by operations teams in a DevSecOps framework, emphasizing issues like siloed information and queues that lead to inefficiencies. It proposes an 'Operations as a Service' model to enhance collaboration, decentralize control, and improve security and compliance through automation and self-service. Key steps include establishing a secure ops hub, developing a software development lifecycle for operational procedures, and linking with enterprise management systems for better visibility and audit trails.
More Related Content
Similar to The "Ops" Side of DevSecOps
![Runbook Automation: Old News or a Key to Unlock Performance? [DOES2020]](https://cdn.slidesharecdn.com/ss_thumbnails/does-damonedwards-v2-201015073337-thumbnail.jpg?width=640&height=640&fit=bounds)
![Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]](https://cdn.slidesharecdn.com/ss_thumbnails/codedagentsdeck-251215155422-5497c599-thumbnail.jpg?width=640&height=640&fit=bounds)
The "Ops" Side of DevSecOps
- 1. The “Ops” Sideof DevSecOps Damon Edwards @damonedwards DevSecOps@RSA AJP - 25 July 2017
- 2.
- 3.
- 4.
- 5.
- 6. Now here comesDevSecOps DevOps
- 7. Now here comesDevSecOps Dev Ops
- 8. Now here comesDevSecOps Dev OpsSec
- 9. Now here comesDevSecOps Dev OpsSec
- 10. Now here comesDevSecOps Dev OpsSec
- 11. Operations is gettingsqueezed OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!”
- 12. Operations is gettingsqueezed OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!”
- 13. What Keeps OpsUnder This Pressure? Silos Queues Centralization Backlog Information I need X PrioritiesTools Backlog I do X Requests for X Silo A Information Priorities Silo B Tools ?? Silo A Silo B Ticket Queue
- 14.
- 15. Backlog Information I needX PrioritiesTools Silos
- 16. Backlog Information I needX PrioritiesTools Silos Backlog I do X Requests for X Silo A Information Priorities Silo B Tools
- 17. Silos cause disconnectsand mismatches Backlog Information I need X PrioritiesTools Backlog I do X Requests for X Silo A Information Priorities Silo B Tools Context Context Process Process Tooling Tooling Capacity Capacity
- 18. Function A Function B FunctionC Org becomes siloed pools of functional specialists Requests fulfilled by semi- manual or manual effort Primary management focus is on protecting team capacity
- 19. How do wecover for our silos disconnects and mismatches? Silo A Silo B
- 20. How do wecover for our silos disconnects and mismatches? Silo A Silo B Ticket Queue
- 21. ?? Silo A SiloB We all know how well that works Ticket Queue
- 22. Request queues arean expensive way to manage work Ticket Queue Queues Create… Longer Cycle Time Increased Risk More Variability More Overhead Lower Quality Less Motivation Adapted from Donald G. Reinertsen, The Principles of Product Development Flow: Second Generation Lean Product Development
- 23. Tickets queues become“snowflake makers” ?? Silo A Silo B Ticket Queue
- 24. Tickets queues become“snowflake makers” ?? Silo A Silo B Ticket Queue Snowflakes (each unique, technically acceptable but unreproducible and brittle)
- 25. Tickets queues become“snowflake makers” ?? Silo A Silo B Ticket Queue Snowflakes (each unique, technically acceptable but unreproducible and brittle) Unintended variability = Security risks!
- 26. Where are decisionsmade? Who can take action? escalate 1° 2° 3° 4° escalate escalateor
- 27. Where are decisionsmade? Who can take action? escalate 1° 2° 3° 4° escalate escalateor Most common decision methods: 1. Similar history 2. Folklore 3. Mostly guessing
- 28. All work iscontextual John Allspaw
- 29. All work iscontextual rm -rf $PATHNAME John Allspaw
- 30. All work iscontextual rm -rf $PATHNAME Is this dangerous? John Allspaw
- 31. All work iscontextual rm -rf $PATHNAME John Allspaw
- 32. All work iscontextual rm -rf $PATHNAME John Allspaw
- 33. All work iscontextual rm -rf $PATHNAME Is this dangerous? John Allspaw
- 34. All work iscontextual rm -rf $PATHNAME John Allspaw
- 35. All work iscontextual rm -rf $PATHNAME Answer is always “it depends” John Allspaw
- 36. escalate 1° 2° 3°4° escalate escalateor Context Where are decisions made? Who can take action?
- 37. “Shift Left” theability to take action Push the ability to take action this direction escalate 1° 2° 3° 4° escalate escalateor
- 38. How can youhelp operations? (and help yourself) OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!” Silos Queues Centralization Backlog Information I need X PrioritiesTools Backlog I do X Requests for X Silo A Information Priorities Silo B Tools ?? Silo A Silo B Ticket Queue
- 39. How can youhelp operations? (and help yourself) OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!” Silos Queues Centralization Backlog Information I need X PrioritiesTools Backlog I do X Requests for X Silo A Information Priorities Silo B Tools ?? Silo A Silo B Ticket Queue
- 40. How can youhelp operations? (and help yourself) OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!” Silos Queues Centralization Backlog Information I need X PrioritiesTools Backlog I do X Requests for X Silo A Information Priorities Silo B Tools ?? Silo A Silo B Ticket Queue Self-Service
- 41. How can youhelp operations? (and help yourself) OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!” Silos Queues Centralization Backlog Information I need X PrioritiesTools Backlog I do X Requests for X Silo A Information Priorities Silo B Tools ?? Silo A Silo B Ticket Queue Self-Service
- 42. How do wedecentralize control, but stay under control?
- 43. Automated Procedures havethree essential elements Definition of the automated procedure Execution of the automated procedure Governance of the automated procedure Define Execute Govern
- 44. Automated Procedures havethree essential elements Definition of the automated procedure Execution of the automated procedure Governance of the automated procedure Define Execute Govern (security, oversight, compliance, etc.)
- 45. Traditional Ops Silo Define Execute Govern “Consumersof Ops” (Dev, QA, Release, NOC, Security, etc.) Ops
- 46. Rigid Self-Service Define Execute Govern “Consumers ofOps” (Dev, QA, Release, NOC, Security, etc.) Ops
- 47. Define Execute Govern Execute “Consumers of Ops” (Dev,QA, Release, NOC, Security, etc.) Ops Rigid Self-Service (ends up being limited)
- 48. High-Velocity Handoffs Define Govern Execute “Consumers ofOps” (Dev, QA, Release, NOC, Security, etc.) Ops
- 49. Self-Service Operations Define Govern Execute “Consumers ofOps” (Dev, QA, Release, NOC, Security, etc.) Ops
- 50. Self-Service Operations Define Govern Execute Govern “Consumers ofOps” (Dev, QA, Release, NOC, Security, etc.) Ops
- 51. “Operations as aService” design pattern is the key enabler fdfd Operations as a Service E Define/Approve actions Define security policy Oversight Define actions Execute actions Execute actions Ops“Consumers of Ops” (Dev, QA, Release, NOC, etc.) D G
- 52. “Operations as aService” design pattern is the key enabler Split definition, execution, and governance and move to where most effective use of labor fdfd Operations as a Service E Define/Approve actions Define security policy Oversight Define actions Execute actions Execute actions Ops“Consumers of Ops” (Dev, QA, Release, NOC, etc.) D G
- 53. Building out yourOperations as a Service capability
- 54. Step 1: Establisha Secure Ops Hub Operations as a Service Engineers get visibility and controlled self-service Secrets Ops Procedures “Status” “Firewall Change” "Restart" deny allow Identity Audit Logs Infrastructure view Service health System metrics Ops Support use for remediation procedures Inventory and Health Execute + Observability/Monitoring Security and Ops manages access, configuration, and compliance
- 55. Step 2: Establisha SDLC for Ops Procedures Operations as a Service Engineers get visibility and controlled self-service Secrets Ops Procedures “Status” “Firewall Change” "Restart" deny allow Identity Audit Logs Infrastructure view Service health System metrics Ops Support use for remediation procedures Inventory and Health Execute Source Repo if (($state==wait)) then kill -9 $PID fi Change Product Engineers produce automated procedures and health checks. RISKY Automated Procedures and Health Checks FIX Code review + Observability/Monitoring Security and Ops manages access, configuration, and compliance Package Repo CI
- 56. Step 3: Connectwith Enterprise Management Systems Service Desk CustomersOps Support get visibility and audit trail updated by support tools Service Ticket Execute Software Supply Chain Ops integrate with artifact flow Operations as a Service Engineers get visibility and controlled self-service Secrets Ops Procedures “Status” “Firewall Change” "Restart" deny allow Identity Audit Logs Infrastructure view Service health System metrics Ops Support use for remediation procedures Inventory and Health + Monitoring Tools Security and Ops manages access, configuration, and compliance Source Repo if (($state==wait)) then kill -9 $PID fi Change Product Engineers produce automated procedures and health checks. RISKY Automated Procedures and Health Checks FIX Code review Package Repo CI
- 57. Step 4: Reapthe security and compliance benefits Service Desk CustomersOps Support get visibility and audit trail updated by support tools Service Ticket Execute Software Supply Chain Ops integrate with artifact flow Who reviewed it? Who ran it? When? Where? Approval trail? Who created the procedure? Who created the policy? Operations as a Service Engineers get visibility and controlled self-service Secrets Ops Procedures “Status” “Firewall Change” "Restart" deny allow Identity Audit Logs Infrastructure view Service health System metrics Ops Support use for remediation procedures Inventory and Health + Monitoring Tools Security and Ops manages access, configuration, and compliance Source Repo if (($state==wait)) then kill -9 $PID fi Change Product Engineers produce automated procedures and health checks. RISKY Automated Procedures and Health Checks FIX Code review Package Repo CI
- 58. Recap Understand the pressureon Ops Leverage the Operations as a Service design pattern “Shift-Left” control and decision making. Queues Create… Longer Cycle Time Increased Risk More Variability More Overhead Lower Quality Less Motivation Adapted from Donald G. Reinertsen, The Principles of Product Development Flow: Second Generation Lean Product Development Understand the cost of silos and queues Self-service to remove silos and queues OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!” Team A (Dev) Team B (Ops) Ticket System ?? Service Desk CustomersOps Support get visibility and audit trail updated by support tools Service Ticket Execute Software Supply Chain Ops integrate with artifact flow Who reviewed it? Who ran it? When? Where? Approval trail? Who created the procedure? Who created the policy? Operations as a Service Engineers get visibility and controlled self-service Secrets Ops Procedures “Status” “Firewall Change” "Restart" deny allow Identity Audit Logs Infrastructure view Service health System metrics Ops Support use for remediation procedures Inventory and Health + Monitoring Tools Security and Ops manages access, configuration, and compliance Source Repo if (($state==wait)) then kill -9 $PID fi Change Product Engineers produce automated procedures and health checks. RISKY Automated Procedures and Health Checks FIX Code review Package Repo CI Reap the security and compliance benefits
- 59. Recap Understand the pressureon Ops Leverage the Operations as a Service design pattern “Shift-Left” control and decision making. Queues Create… Longer Cycle Time Increased Risk More Variability More Overhead Lower Quality Less Motivation Adapted from Donald G. Reinertsen, The Principles of Product Development Flow: Second Generation Lean Product Development Understand the cost of silos and queues Self-service to remove silos and queues OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!” Team A (Dev) Team B (Ops) Ticket System ?? Service Desk CustomersOps Support get visibility and audit trail updated by support tools Service Ticket Execute Software Supply Chain Ops integrate with artifact flow Who reviewed it? Who ran it? When? Where? Approval trail? Who created the procedure? Who created the policy? Operations as a Service Engineers get visibility and controlled self-service Secrets Ops Procedures “Status” “Firewall Change” "Restart" deny allow Identity Audit Logs Infrastructure view Service health System metrics Ops Support use for remediation procedures Inventory and Health + Monitoring Tools Security and Ops manages access, configuration, and compliance Source Repo if (($state==wait)) then kill -9 $PID fi Change Product Engineers produce automated procedures and health checks. RISKY Automated Procedures and Health Checks FIX Code review Package Repo CI Reap the security and compliance benefits https://www.rundeck.com/oaas
- 60.
- 61.