A Seat at the Table – IT Leadership in the Age of Agility – Part 2 By Mark Schwartz “To the talented and hard-working government employees, so resilient in the face of impediments, criticism, and abuse the enterprise’s needs precisely. Risk is low, because the team is constantly adjusting.  Option 2: Compare that to the risk of buying a vendor’s product, where the investment is one large lump sum—and doesn’t have financial incentives to supportyou. Text “1” to @obvious if you like the first option, or “2” to @/dev/null if you prefer the second. Governance and Oversight Governance has traditionally been

Prctices 1 Shawn Stumme Continuous Delivery 4 Josh Wade Cyber Security through Agile 2 Nick Tuck Maximizing Retrospectives 2 Ray Page Open Agile Topics 0 Jason Beranek Application Transparency 0 Ed Snodgrass Code - Book Overview 2 Kyle Baardson SAFe: Scaled Agile Framework 3 Brandon McAllister Automation 2 Eric Collins The Servant: Agile Book Club 1 Ron Horner Kanban for the People! 2 Steve Miller Crucial Page Release Planning 2 Darin Plum Agile Coaching 5 Nick Wenner Clean Coder (book review) 2 Josh Sagucio Collaborative Work Environments 3 Scott Grimes Agile Certifications 2 Agile Transformation

The DevOps Handbook – Part 1 & 2 1. Preface xi a. Myth—DevOps is Only for Startups: b. Myth—DevOps Replaces Agile c. Myth—DevOps is incompatible with ITIL d. Myth—DevOps is Incompatible with Information is Just “Infrastructure as Code” or Automation: g. Myth—DevOps is Only for Open Source Software: 2. Foreword xix 3. Imagine a World Where Dev and Ops Become DevOps: a. THE CORE, CHRONIC CONFLICT i which must be pursued simultaneously: 1. Respond to the rapidly changing competitive landscape 2. Provide stable, reliable, and secure service to the customer b. THE BUSINESS VALUE OF DEVOPS i. Code

improvement, and learning ii. Create mechanism to rapidly spread learning throughout the organization 2. Ch. 19 – Enable and Inject Learning into Daily Work a. Complex systems are impossible to predict for beyond it b. ESTABLISH A JUST, LEARNING CULTURE i. Unjust responses to incidents 1. Impede safety 2. Promote fear over mindfulness 3. Create bureaucracy rather than carefulness 4. Cultivate secrecy of troubles; instead, human error is a consequence of the design of the tools that we gave them.” 2. Accidents are due to the inevitable design problems in complex systems that we build; they are system

architecting for low-risk releases b. Integrating objectives of QA & Operations to improve outcomes 2. Ch. 9 – Create the Foundations of Our Deployment Pipeline a. Enterprise Data Warehouse program by document the environment specifications 1. Create a common build mechanism to create it on demand 2. Codified in automated environment build process iii. Environments will be stable, reliable, consistent Everything, everything, everything is checked into version control 1. Application code & dependencies 2. Environment scripts & creation tools 3. DB scripts and reference data 4. Containers 5. Automated

quick detection & recovery iv. Ensure features operate as intended and achieve organizational goals 2. Ch. 14 – Create Telemetry to Enable Seeing and Solving Problems a. Fact – Things will go wrong in best-performing organization were better at diagnosing & fixing service incidents. 1. “Culture of Causality” 2. Used disciplined approach to solving problems using telemetry to understand contributing factors and environments layer a. Events, logs, & metrics b. Common service to centralize, rotate, and delete 2. Event router responsible for storing our events and metrics a. Enables visualization, trending, alerting

Struts2 Struts2-005 Struts2-008 Struts2-009 Struts2-013 Struts2-016(实际上,很多都⽼系统都漏补了这个洞,成功率较⾼) Struts2-019 Struts2-020 Struts2-devmode Struts2-032 Struts2-033 Struts2-037 Struts2-045 Struts2-046 Struts2-046 Struts2-048 Struts2-052 Struts2-053 Struts2-057 weblogic CVE-2019-2725 CVE-2019-2729 CVE-2018-3191 CVE-2018-2628 CVE-2018-2893 CVE-2018-2894 CVE 2017 3506 CVE-2017-3506 CVE-2017-10271 Glassfish 任意⽂件读取 [ 低版本 ] 控制台弱⼝令,部署webshell IBM Websphere Java 反序列化 控制台弱⼝令,部署webshell Axis2 任意⽂件读取 ⽬录遍历 Apache ActiveMQ 未授权访问,5.12 之前的版本 fileserver存在 PUT任意写 CVE-2015-5254 Apache Solr

........................... 1 2 Agile Development Fundamentals ................................................................................................... 2 II. Implementing an Agile Approach and process owners can reach the full potential of Agile development. Agile Acquisition Guide2 This document is structured to provide an overview of Agile development and recommendations for DoD guide also includes dozens of hyperlinks to external sources for further research and information. 2 Agile Development Fundamentals Agile development emerged in 2001, when 17 leading software developers

告警的聚合分两层：1）将Alert的状态变化进⾏聚合、 2）多个相近的 Alerts 进⾏聚合。 2. 告警的通知，以 incident 为最⼩单位进⾏发送，降低通知的数量（80%下降）。 INTERNAL OR RESTRICTED, ALL RIGHTS RESERVED © 北京快猫星云科技有限公司 告警排班 1. 提前规划值班表，可以让 on-call ⼯作更有计划性，减少疏忽和失误。 2. 通过值班表，可以有效的減少告警对⾮值班 监控⼯具太多，维护和使⽤都很麻烦 2. 缺少业务维度的监控 3. 缺乏统⼀的稳定性视图，缺乏故障定位的驾驶舱 效果： 1. 通过Flashcat平台，整合了Prometheus、ClickHouse、⽇志、云监控等多个 数据源，其中包括近10个 Prometheus 集群， ⼗余个⽇志主题，实现统⼀的报 警管理、数据可视化，降低了监控⼯具的维护成本，仅需投⼊⼀个⼈⼒。 2. 建⽴了⼀整套稳定性的量 1. 故障发现慢，主要依赖⽤户保障 2. 缺乏基于业务视⻆的全链路监控，故障定位耗时较⻓ 3. 缺乏对重要故障场景的应急预案的梳理和演练 效果： 1. 通过落地Flashcat平台，公司A级产品线北极星指标监控实现了全覆盖，P3级 及以上故障北极星监控发现率为100%，MTTI控制在5分钟以内。真正做到了先 于⽤户发现问题，让故障处理变被动为主动。 。 2. 故障定位能⼒建设也已取得重要进展，我们和业务⼀起梳理了公司A级产品线

yourself into a state a Flow. Basic requirements ① A kitchen timer ② A short to-do list [2] ③ A little discipline [2] • Turn off Phone(s) • Turn off IMs or DND • No non-task related browsing • No bathroom No meetings • No eating • No preening How does it work? 1. Choose a task you’d like to get done 2. Set the Pomodoro for 25 minutes 3. Work on the task until the Pomodoro rings 4. When the Pomodoro activity requires you by monitoring how many Pomodoros you need in order to accomplish a specific task 2. Learn to protect your Pomodoro from the internal and external interruption 3. Make accurate estimations