Source – forbes.com

The venerable Cloud Expo conference may be a mere shadow of its former self, but it still has its moments. One high point: a powerful panel of technology experts debating the ins and outs of DevOps.

The most refreshing insight: while DevOps is an important trend, there is no magic here. It’s difficult work, and we’ve built it on hard-earned lessons of the past. “DevOps is something we’ve done under different monikers for many, many years,” explained Tracy Bannon, Specialist Leader atDeloitte Consulting. “It’s about being intentional and specific about what you want to achieve.”

There were also some sober comments on the level of maturity of DevOps today. “Many companies are in different phases in the DevOps journey,” according to Silvia Prickel, Managing Director of Enterprise Quality and Release Management at United Airlines UAL +2.37%

 

. “I’m not sure it’s fully mainstream yet.”

In fact, some of the comments were downright snarky. “Words are used interchangeably depending on who the CIO is,” said Nicole Forsgren, Founder and CEO of DevOps Research and Assessment LLC. “You do a search and replace, take ‘DevOps’ out, use ‘Digital Transformation’ instead.”

In spite of the snark, each of the panelists had seen examples of success with DevOps. “We started at United with one program at a time. Success breeds success,” Prickel explained. “It really starts with the people. Once you get there, that’s when everything accelerates and just blossoms.”

DevOps without Agile?

Aruna Ravichandran, Vice President of Global Marketing for CA Technologies. and moderator of the panel, asked the most provocative question of the morning. “Can you be successful with DevOps without Agile?”

By Agile, Ravichandran was referring to Agile software development methodologies like Scrum. Agile has been around for over 15 years now, and while most enterprises have adopted Agile to some extent, many of them have struggled to implement it fully.

Following an Agile approach, however, is quite a different kettle of fish from achieving business agility, as the panelists were quick to point out. “Do you mean Agile with a capital ‘A’ or being agile?” Forsgren asked, referring to the family of software development methodologies with a capital letter. “Do you have to have capital A? No.”

Bannon reiterated this viewpoint. “I don’t care if you’re waterfall, hybrid Agile, or Agile,” Bannon said. “Agile principles on top of all of this are a cornerstone. There are obviously different business imperatives that can impact it.”

In other words, there’s a difference from dogmatically following Agile – with a capital ‘A’ – and following the principles that make up Agile, like taking a customer-focused, iterative approach with self-organizing teams. Many of these principles are in fact useful for DevOps, once you strip away the Agile religion.

One of these useful overlaps between DevOps and Agile, for example, is how software teams handle testing. “This new concept of continuous testing, people are talking about it,” Ravichandran noted.

In fact, United Airlines managed to transform how it handled software testing as it moved to DevOps. “Having responsibility for quality in the United organization, we were very manually oriented,” Prickel explained. “When you implement a CI/CD organization you need to automate testing.”

CI/CD stands for ‘continuous integration and continuous delivery,’ central goals of DevOps. “Big ‘A’ Agile helps to enable that even further,” Prickel continued. “The more you involve testing in the development cycle, the better.”

Adding Security to DevOps

The panel also discussed the knotty issue of security. Traditionally, application development teams treat security as little more than an afterthought, where the dev team has to run their code by the security team for approval before going live.

Such an approach, however, slows the organization down and reinforces an adversarial relationship between dev and sec – effects antithetical to DevOps. “I submit it to the security people, get back a report that terrifies me,” Bannon said. “Bringing security to the table from the very beginning, put security tools in the hands of developers is a cornerstone.”

In fact, applying the ‘shift left’ principle from Agile – where the team brings a task earlier into the development lifecycle – should apply to security as well.

Breaking down the organizational divisions between the two groups is also essential. “They end up spotting things much earlier and in a much different way because it’s more interactive,” Forsgren explained.

In fact, treating security as a separate group or ‘center of excellence’ (COE) is one of the practices that DevOps seeks to change. “It’s a cultural change,” Ravichandran added. “Security tends to be a COE. It’s a mind shift.”

Instead, security should be more of a ‘center of enablement’ that supports the organization’s software development efforts by participating actively on the teams.

One result of this ‘DevSecOps’ approach: security is now part of Agile. “There’s no reason why you can’t create sprints around security or infrastructure,” Prickel added, “And embed those sprints within your stories.”

User stories are how Agile approaches represent requirements, and sprints are the iterations that characterize Agile. Even though ‘official’ Agile doesn’t include security stories or sprints, taking a non-dogmatic approach to Agile allows for such updates. “Building out security stories and bringing them to the table is very relevant,” Bannon said.

Achieving Success with DevOps

All of the panelists had DevOps success stories. “Timeframes for app dev used to be months or even years, so you wouldn’t see the fruits of your labor,” Prickel remembered. “We were always under the gun, under pressure, and it’s tiring.”

Today, however, United is seeing better results in terms of delivered software as well as the morale and productivity of the app dev organization. “People really truly trust each other, and each member of the team is a contributor and a stakeholder in the process,” Prickel added.

Forsgren also related success stories she’s seen. “We are leveraging, tech, process, practice, and culture to deliver value in the organization in fast ways,” Forsgren said. “Speed and stability end up being a key differentiator.”

Prickel emphasized two of the most important benefits United has seen from its move to DevOps. “Success is not waking up in the middle of the night because there’s been a P1 [priority 1] or P2 [priority 2] issue,” she said. “We’re pushing out so much new code the business is having a hard time keeping up with us.”

In other words, DevOps has turned the tables at United Airlines. Traditionally, lines of business demand new capabilities and the app dev team struggles to devote the resources necessary to meet business deadlines. In United’s case, app dev is moving so quickly that it’s driving innovation across the organization – thus driving the airline’s digital transformation efforts in the bargain.