Systems
Building a business with continuous delivery and Serverless
Hey – I’m back! I’ve been heads-down learning what Cloud teams need to deliver to AWS securely and make IAM usable, and building that into a business delivered via SaaS & infrastructure code libraries: k9 Security. I’d like to share my experience in how continuous delivery and serverless supported that endeavor. I hope this experience
Converting energy into something that matters
DevOps practitioners can help deliver value to customers quickly and collaborate across teams, even or especially, in times of crisis
Help with big changes
I hope that you and your family are safe and healthy. COVID-19 is forcing many organizations to change long-standing policies and processes very quickly under great uncertainty. I’d like to help you navigate through those changes, especially if you support healthcare services. First, there are resources in the Knowledge Base that you may find helpful
Modeling Risk in Cloud Deployments
Information Security risks are those risks “that arise from the loss of confidentiality, integrity, or availability of information or information systems and reflect the potential adverse impacts to organizational operations, organizational assets, individuals, other organizations, and the Nation (NIST 800-30).” Risk assessments should help people understand a given Cloud deployment’s information security risks and help
Modeling Security in Cloud Deployments
Cloud deployments often use tagging to describe the context of a compute or resource such as a who owns or what application a virtual machine or object storage bucket belongs to. However, the common resource tagging models in use don’t describe the context required for people or tools to assess security or manage risk easily.
Assessing and Managing Information Security Risks
Reading Time: 6 minutes The current crop of Best Practice tagging schemes and recommendations don’t describe the context required for people or tools to assess security or manage risk easily. But I never explained why risk management is important nor how to assess risk. Let’s start with an introduction to the process of managing risk
Key practices for achieving large professional goals
My hope is that this post will help you reach your own goals in 2020. I attained several long-term professional goals in 2019 and I’d like to share the key practices for how I did that to help you along your way. We’ll return to Cloud, Security, and DevOps topics in the New Year. I
Review: The Unicorn Project
You can learn a lot from The Unicorn Project about the day-to-day leadership, management, and ‘manage-up’ skills to transform yourself, a team, or an organization using The Five Ideals.
Changing organizations successfully
Organization and process changes are full of challenges. First, the existing structure and process is (probably) a ‘stable state’ that people are comfortable with and whose very position in ‘the machine’ reinforces. Even if no one likes the existing state. Second, there are forces within the organization that will actively oppose the change because people
Improving software delivery processes at the organization level
Today I will share my high-level process and questions for reflecting and improving an organization’s delivery process and outcomes. First, review the Aspects of Software Delivery Performance (DORA) that generate improved business outcomes: Deployment frequency Lead time for changes Time to restore service Change failure rate Second, imagine what the ideal delivery process looks like
Choose Container Orchestrators Strategically
Deciding which of container orchestrator is right for your organization or team now and in the future is an exercise in strategy. This post will help you develop a strategy aligned to your specific customer needs, technological and organizational assets, desired business state, and other information required to build a good strategy.
How to review a design
Today, I will share how I like to review a design produced by my design process: I call this a ‘semi-formal’ design review, because it leverages key aspects of a ‘formal design review’ such as: the design is built from a structured template tailored to our problem space and is written to be read and
The design process
This post describes QualiMente’s design process. This design process incorporates feedback from authors, a design review, and (optionally) prototypes. Once design feedback is collected, the delivery team and product manager have much more knowledge about whether to continue, how to approach the solution, and how to break up and sequence the work. Additionally, you can communicate to collaborating teams with the confidence that you’e probably identified half or more of the design’s defects.
The genesis of a design
Designing a solution is one of engineering’s primary creative activities. We use our knowledge of principles, techniques, and primitives from science, engineering, and industry to create a solution to a problem. This post describes my initial steps for designing.
Form follows function
Teams must select the right steel — the patterns, compute platforms, algorithms, languages, and frameworks that form the core of our systems in order for them to function well, or at all.
Zzzt! Closing the loop
Reading time: 90 seconds In QualiMente’s Secure Cloud team retrospective on Friday, we identified a couple of improvement actions: For context, we are several weeks into building a new service called k9 that helps people and access analysis tools understand “who has access to what” in AWS. As product owner and team lead, I prioritized
The work iteration retrospective aka ‘Sprint retro’
Retrospectives are a tool that can provide a primary data gathering mechanism for a team’s health and delivery process and are performed at the completion of an iteration of work.
Feedback loops are a beautiful thing
Delivery process improvement ideas rise from the frustration felt by teams executing the process. If you want to improve a team’s delivery processes, I recommend putting your team in control of improving itself and support the team with practices and resources to help them do that.
The Silver Bullets Are Not Evenly Distributed
Reading time: 3.5 minutes Are there any ‘silver bullets’ in software development? Fred Brooks led the IBM’s System/360 development effort and recounted that delivery story and strategies in The Mythical Man-Month (brilliant) said: “There is no single development, in either technology or management technique, which by itself promises even one order-of-magnitude improvement within a decade
Concept: Configuration
Configuration is data interpreted by a program to change its behavior so that it supports a particular use case. This post describes the challenges and techniques for creating a configuration interface that is safe and usable.
Learning to Debug
Finding the needles in a large haystack is sometimes the hardest part of solving a problem. Debugging is also a skill you can learn and develop.
Why I Design
(Reading Time: 2.5 minutes) I design to avoid waste. Waste in building something: nobody wants can use effectively can afford That is, design is a process that helps maximize the value of systems we create. The design process is also critical to understanding whether we should build them at all. Some systems will have low
Scaling Architectural Processes with Guilds
Reading Time: 2 minutes Comcast published a detailed description of how they use Architecture ‘Guilds’ to scale investigation, review, and decision making: https://www.infoq.com/articles/architecture-guild-800-friends Scaling decision making is a hard problem because you want to: gather input from interested and knowledgeable creators and users focus on the most important parts of the problem and solution, avoiding
Why did we do that?
We make every decision with imperfect information. ADRs give you a way to quickly record what you knew at the time and why you did what you did.
The Future of Information Security is Simpler (I Hope)
We can improve the world’s software by transforming ‘complicated’ and ‘complex’ into something simper, even boring. This transformation isn’t easy but there is a way to commoditize security and other specialty practices that make your system safer and more reliable.
Joe Armstrong and Fault Tolerant, Concurrent Systems
Joe Armstrong pioneered the engineering of fault tolerant, concurrent systems. Throughout his career he asked and answered: How can we program systems which behave in a reasonable manner in the presence of software errors? He surmised that: Large systems will probably always be delivered containing a number of errors in the software, nevertheless such systems
Concepts: Zones and Regions
The major cloud providers provide a Region+Zone model to help you architect, deploy, and operate applications built upon isolated fault domains with well-defined behaviors. Learn the characteristics of your Cloud provider’s model and architect a deployment that will meet your availability goals prior to deploying your application.
Concept: Failure Domain
A failure domain is a set of resources that provide a service to users and operates independently of other failure domains that provide that same logical service. And they are incredibly important.
Cooking Something Good with DevOps
This is the final piece of a three-part series introducing the Principles and Value of DevOps. I am excited and relieved that after 15 years of trying to discover, learn, apply, and teach these practices, that we have matured so that it’s clear: what principles we should apply how to guide the application of those
The Value of DevOps to Your Organization
DevOps provides value to organizations by enabling them to change quickly and safely.
Principles of DevOps
DevOps will help you optimize the delivery of services that are built on technology _and improve the services_ themselves.
Mapping a Safer, Faster IAM Development and Review Process
I used Wardley mapping this morning to explore ideas I have for improving the development and review of AWS Identity and Access Management (IAM) policy changes. I’d like to share the internals of that mapping process with you to give you an illustrated example. The purpose of this process improvement effort is to help people
Learning to evolve strategy with Wardley mapping
I think Wardley Mapping is a fascinating and effective way to describe a system and develop a strategy to evolve it. Wardley Mapping has a growing community of practice with many ways to learn and participate. Here are the ones I know about (and I’d love to hear about more): Online Simon Wardley’s tweets about
Identifying Undifferentiated, Heavy Lifting
In The Promise of Clouds and Optionality, I said: Cloud providers are competing to offer high quality services that meet their customers’ needs at decreasing cost and increasing scale. They want you to offload whatever you consider undifferentiated heavy lifting to them. But what the heck is ‘undifferentiated, heavy lifting’ and where do I find
Recap: Going Fast, Safely
I’d like to recap why I’ve been discussing the nature of systems, isolation, and enterprise-level controls. It’s because I want you to: Go Fast, Safely I hope you recognize that the systems we build and work within are much more than the sum of a set of Obvious parts. The parts interact and we need
How many AWS accounts do I need?
Today, I’d like to answer a common question people ask about AWS accounts: How many AWS accounts do we need? What’s an AWS Account? First let’s start with some background about what an AWS Account is and the features it provides. An AWS Account is a logical container that owns resources in the AWS Cloud.
Why Docker makes sense through the lens of Cynefin
Docker promises to help you Build, Ship, and Run applications. In this post I will describe why Docker was such a breakthrough for those building and running applications through the lens of Cynefin. The previous post introduces using Cynefin to understand systems and make good decisions. Situational Awareness: Building, Shipping, and Running Applications What kind
Making Sense of Systems and Good Decisions
Cynefin is a framework created by Dave Snowden to help people understand systems and assist decision-making. Cynefin identifies five domains from which people can analyze a system or situation: Obvious, Complicated, Complex, Chaotic and Disorder. Dave Snowden – CC BY-SA 3.0 Managing a system from the context of a domain is important because the framework
What is in a System?
Let’s take a step towards understanding and building “Systems.” My favorite Systems Engineering textbook defines a System as: a set of components which are related by some form of interaction, and which act together to achieve some objective or purpose. Components are simply the individual parts, or elements, that collectively make up a system. Relationships