resilient systems with higher degrees of assurance 3. Ch. 20 – Convert Local Discoveries into Global Improvements a. USE CHAT ROOMS AND CHAT BOTS TO AUTOMATE AND CAPTURE ORGANIZATIONAL KNOWLEDGE i. ChatOps Goal is focused improvement on daily work, not experimentation and innovation iii. Demo back improvements at the completion of the blitz iv. Empower those closest to the work to continually identify cultural norm is for everyone to find and fix as part of their daily work 1. Facebook HipHop PHP compiler – resulted from hack day project. Small team refined it over 2 year period and allowed Facebook

of Constraints “Eliyahu M. Goldratt, who created the Theory of Constraints, showed us how any improvements made anywhere besides the bottleneck are an illusion . Astonishing, but true useless, because it will always remain starved, waiting for work from the bottleneck. And any improvements made before the bottleneck merely results in more inventory piling up at the bottleneck.” Resource

ideas don’t work and reinforcing those that do3. local learnings are rapidly turned into global improvements, so that new techniques and practices can be used by the entire organization iii. ENABLING THE IMPROVEMENT OF DAILY WORK 1. Mike Rother observed in Toyota Kata that in the absence of improvements, processes don’t stay the same—due to chaos and entropy, processes actually degrade over time

and management tested continuously. Steve Barr steve.barr@csgi.com @srbarr1 Overall Quality improvements, “it” goes in better, and with less issues.  Maintenance window changed from once a week to

approval ii. Peer review help improve overall quality, provide cross-training, learning, and skill improvements. iii. Keep batch sizes of reviews small iv. 4 simple Peer Review Guidelines 1. Everyone must

less able to refactor due to potential rework and merge problems 1. Cross-cutting dependency improvements often provide high-payoffs d. ADOPT TRUNK-BASED DEVELOPMENT PRACTICES i. CI and Trunk-based

monitoring, signature-based continuous scanning using Common Vulnerabilities and Exposures (CVEs), runtime behavior analysis, and container policy enforcement.The security stack in the security sidecar container hardening from DCAR containers are preserved and complies with the NIST 800-190 requirements [12]. 3. Runtime Defense, this can perform both signature-based and behavior-based detection. This can also be used Log Storage and Retrieval Service 2. Service Mesh 3. Program-specific artifact repository 4. Runtime Behavior Analysis Artificial Intelligence (AI) service 5. DCAR for the hardened containers 6