contractor-control model. But it doesn’t. Requirements: Requirements are a way of controlling the development team by constraining their creativity. Instead of requirements, we want to charge the team—the rather than just a coding tactic. If you missed last month, you can find this on the Agile4Defense GitHub page at: https://git.io/JeaOu Enterprise Architecture Enterprise Architecture, the domain of the changes to the whole ball of EA.  It has a robust, automated regression test suite, so that new development does not cause expensive break-fix activity.  It has good monitoring tools in place.  It is

and when we realize that the costs and risks of custom development have been radically reduced, the economics often now favor custom development. Governance and Oversight: Governance has traditionally creating value. If you missed last month, you can find the handout for Part 2 on the Agile4Defense GitHub page at: https://git.io/JeaO2 Risk The presence of uncertainty is the simple reason why Agile Cross-functional and team-based: It used to be natural for ops specialists to do ops, developers to do development, and testers to do testing. Now, crossover skills are increasingly important. On a delivery team

is an organizational software engineering culture and practice that aims at unifying software development (Dev), security (Sec) and operations (Ops). The main characteristic of DevSecOps is to automate approach  Remove bottlenecks (including human ones) and manual actions.  Automate as much of the development and deployment activities as possible.  Adopt common tools from planning and requirements through frequent updates over larger, more sporadic releases.  Apply the cross-functional skill sets of Development, Cybersecurity, and Operations throughout the software lifecycle, embracing a continuous monitoring

CHAT ROOMS AND CHAT BOTS TO AUTOMATE AND CAPTURE ORGANIZATIONAL KNOWLEDGE i. ChatOps pioneered at GitHub – put automation tools (Hubot) into the middle of their chatrooms 1. Everyone saw everything that NFRs. Codify these into the tests and pipeline f. BUILD REUSABLE OPERATIONS USER STORIES INTO DEVELOPMENT i. Goal – make recurring work as repeatable and deterministic as possible; standardize and automate operations b. Compliance checking is the opposite of security engineering c. INTEGRATE SECURITY INTO DEVELOPMENT ITERATION DEMONSTRATIONS i. Bring Infosec left; incorporate them into demos and help them understand

GIT is a version control system that is used for software development and other version control tasks. As a distributed revision control system it is aimed at speed, data integrity, and support for for distributed, non-linear workflows https://try.github.io/levels/1/challenges/1 https://www.atlassian.com/university From: www.atlassian.com Mapping out Agile with the Atlassian Tool Suite

technologies and operations, including the challenges associated with information assurance. Agile development practices can help the DoD to transform IT acquisition by delivering capabilities faster and responding in an increasingly complex environment. Agile has emerged as the leading industry software development methodology, and has seen growing adoption across the DoD and other federal agencies. Agile practices tailoring program structures and acquisition processes to the program characteristics. Agile development can achieve these objectives through:  Focusing on small, frequent capability releases 

production instances v. Keep developers’ environments most current e. MODIFY OUR DEFINITION OF DEVELOPMENT “DONE” TO INCLUDE RUNNNING IN PRODUCTION-LIKE ENVIRONMENTS i. In general, the longer the interval frequently as possible i. WRITE OUR AUTOMATED TESTS BEFORE WE WRITE THE CODE (“TEST DRIVEN DEVELOPMENT”) i. TDD – Kent Beck as part of Extreme Programming 1. Ensure the tests fail – “Write a test ii. Implemented Trunk-based development & CI iii. After CI: 40% effort on new features, 40% decrease in development costs, 140% increase in programs under development, 78% reduction in cost per program

INFRASTRUCTURE i. Remove the silos of information – Developers don’t just log what’s interesting to development. Operations don’t just monitor what’s up or down. ii. Modern Monitoring architecture 1. Data iii. More exotic - Fast Fourier Transforms or Kolmogorov-Smirnov 4. Ch. 16 – Enable Feedback So Development and Operation Can Safely Deploy Code a. USE TELEMETRY TO MAKE DEPLOYMENTS SAFER i. Actively monitor Prevent upstream work from locally optimizing at the expense of the entire value stream – Everyone (development, managers, architects, ops, etc.) in the value stream shares responsibility for handling operational

when we have an annual schedule for software releases, where an entire year’s worth of code that Development has worked on is released to production deployment. Like in manufacturing, this large batch release 1. In the book Implementing Lean Software Development: From Concept to Cash, Mary and Tom Poppendieck describe waste and hardship in the software development stream as anything that causes delay for result. The following categories of waste and hardship come from Implementing Lean Software Development unless otherwise noted: a. Partially done work: b. Extra processes: c. Extra features: d.

feasible.  History – How I Got Here?  Contentious relationship existed between development and operations.  Left development because I was frustrated that it took so much time to get my products into production team wasn’t the same as the game time team.  Segregated technical and business functions  Development  Operations (Operational Waterfall)  Infrastructure Ops  Product Ops  Product Management related to product configuration and deployment  Built a strong relationship with development (built empathy)  Development began to see operational issues, and usability problems  The relationship is