CI Tools and Best Practices in the Cloud

Continuous Integration

Subscribe to Continuous Integration: eMailAlertsEmail Alerts newslettersWeekly Newsletters
Get Continuous Integration: homepageHomepage mobileMobile rssRSS facebookFacebook twitterTwitter linkedinLinkedIn


Continuous Integration Authors: Mehdi Daoudi, Liz McMillan, Don MacVittie, XebiaLabs Blog, Elizabeth White

Related Topics: Agile Digital Transformation, Continuous Integration, DevOps Journal

Article

Islands Are Wasteful in #DevSecOps | @DevOpsSummit @CAinc #DevOps #DX

DevSecOps is about breaking down silos and waste along the software development lifecycle

DevSecOps - a trend around transformation in process, people and technology - is about breaking down silos and waste along the software development lifecycle and using agile methodologies, automation and insights to help get apps to market faster. This leads to higher quality apps, greater trust in organizations, less organizational friction, and ultimately a five-star customer experience.

These apps are the new competitive currency in this digital economy and they're powered by data. Without data or data-based interactions, these apps would be of little value to the user and would be just static one-dimensional bulletin boards. Imagine a banking app, for example, that does not give you data about your account or let you take some action. How much value is this bringing to the user?

IT's dirty little secret
Most companies, with the exception of recently born-in-the-cloud "unicorns," know that critical data resides in many different systems-of-record that have persevered through infrastructure refresh cycles or have been added via mergers and acquisitions. A dirty IT secret is that systems-of-record rarely go away as new ones are added, so coexistence is the unspoken reality. The apps you are speeding to market are - or should be - capable of interacting with many legacy code bases.

This legacy code base reality has implications for your organization, processes and tools as you apply DevOps principles. Here are three imperatives for every IT leader managing multiple code bases to build the right foundation for their Modern Software Factory.

  1. Break down your infrastructure-based operational silos. Every organization has specialized individuals who have specific knowledge of certain code bases and infrastructure types. Do your best to break down those reporting silos and infrastructure-based management fiefdoms. For example, have your Windows, Linux, Unix, AS-400, mainframe and even cloud system admins report to the same managers. Don't isolate your "legacy" Dev or Ops teams on an island as the data that resides on those "legacy" platforms is vital to your current and future apps. This practice will speed decision-making and reduce organizational friction, while also helping to overcome retention and talent shortage issues.
  2. Make your DevOps processes and tools inclusive of all your code bases and infrastructure types. Having a separate set of AppDev or DevSecOps tools and processes for each type of infrastructure or code base is antithetical to the business outcomes you want to achieve. This also reinforces silos - in this case, hardware and operating system silos - rather than breaking them down. You can't afford different ALM, release automation, service virtualization, test data management, app security testing, privileged access management, automation, APM or infrastructure management toolchains. Not only is software license duplication expensive but so are the supporting costs to host, maintain, learn, manage and upgrade those tools. That is wasteful and inhibits your ability to fund innovation. Steer clear of vendors pushing point tools that reinforce islands of infrastructure and the lock-in that results. Always ask if that DevOps-enabling software works across your infrastructure.
  3. Use modern app architectures like APIs and Microservices. With APIs, developers can leverage data and build integrations between disparate systems faster and with fewer errors. With this approach, your APIs need to be adequately catalogued, which is more often than not an area developers glance over, to be used by teams across code base and infrastructure types. Microservices also allow for parallel development by enabling small autonomous teams to develop, deploy and scale their respective services independently. Monolithic architectures and hard-coded data paths should be a relic of the past.

There's a lot to learn about DevSecOps as it's a dynamic and evolving practice with many nuances. Flexible app architectures, heterogeneous tool chains and inclusive organizational structures can eliminate islands, unnecessary costs and friction as you advance on your DevSecOps journey.

More Stories By Cameron Van Orman

Cameron Van Orman is vice president for solution and product marketing and enterprise management at CA Technologies. He leads a team of 20 people who together devise strategy for the business unit and develop all aspects of product marketing. Cameron and his team also lead the way for early product adoption in enterprise management.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.