Agile + DevOps East 2019 - Continuous Integration/ Continuous Delivery

Imagine this … As soon as any developed functionality is submitted into the code repository, it is automatically subjected to the appropriate battery of tests and then released straight into production. Setting up the pipeline capable of doing just that is becoming more and more common and something you need to know about. But most organizations hit the same stumbling block—just what IS the appropriate battery of tests? Automated build architectures don't always lend themselves well to the traditional stages of testing. In this hands-on tutorial, Melissa Benua introduces you to key...

DevOps is about creating alignment across the value stream for an application, service, or product. DevSecOps integrates security into this process, making the entire team responsible for delivering secure code that works and can be deployed and used securely. But how do you actually do that? What tools do you add to your DevOps pipeline to help make your software secure and provide your stakeholders with a high level of confidence that the software meets all security requirements & standards? In this tutorial Tom Stiehm will explore what security tools you can add to your DevOps...

Organizations today can no longer afford to deliver new features to their respective markets once a year or even once a quarter. In the attempt to catch up with the competition, they jump onto DevOps journey starting with the "How" and losing the sight of "Why" and "What". Join this gamified simulation tutorial to gain a solid understanding of foundational principles of the DevOps culture. Experience the benefits of DevOps transformation even before initiating one in your enterprise! This tutorial is ideally designed for organizations that are evaluating their approach to DevOps...

The ability of DevSecOps to produce secure code requires the merging of two very different cultures: AppSec and DevOps. While AppSec lives in a black-and-white world of secure or not secure that would cause “Hello World” to take six months to release, DevOps knows that the reality of software development is actually shades of gray, especially as demands are increasingly placed on development teams to produce more, faster. Brittany Greenfield will teach you how to apply the Japanese concept of wabi-sabi, which accepts imperfections in the things that we create, to DevSecOps, allowing you to...

User story maps capture the journey a customer takes with your product, including activities and tasks needed to make that journey a successful one. Typically they begin from the point where the customer has a problem and continues until the feature solving that problem is built. However, rarely do we see the story map include DevOps themes such as release and configuration management activities, or even feature activation. Join Catherine Louis as she guides you through the anatomy of a user story map, including DevOps aspects. You will create a story map from problem discovery to...

Lean practices teach us that small batch sizes optimize flow of value to market. Small batch sizes also help organizations focus on building quality into systems by enabling the power of continuous integration, encouraging faster feedback cycles, increasing our ability to debug, emphasizing a focus on simplicity, decreasing lead and cycle time, and discouraging "snowplowing" testing efforts. These practices are critical for building quality into our products. In the government sector, it also enables the alignment of traditional cost accounting methods, such as earned value...

DevSecOps uses application security practices that have existed for a while. The innovation of DevSecOps is incorporating security into the daily workflow of the team rather than leaving it to the end, shifting security left by automating aspects of security testing. DevSecOps leverages DevOps practices to make application security a first-class citizen in the practices of modern software development. But that requires a culture change: DevSecOps starts before the code is even written, using techniques like threat modeling and risk analysis to figure out who will attack you and how. Come...

Liberating structures offer a revolutionary solution to collaboration in groups by using a handful of simple rules to unleash and involve everyone, enabling groups of any size to work at the top of their intelligence. Discuss them with peers and experts in this fishbowl discussion, where the audience members sit in a circle of chairs in the middle of the room. Several brave souls will fill all but one of the chairs in the "fishbowl." When you want to join as a speaker, you enter the fishbowl and sit in the empty chair, and one of the other speakers will voluntarily leave so that one chair...

Software testing lags behind the pace of features development and digital innovation. Despite recent advancements, testing remains one of the biggest challenges in DevOps. Research shows that DevOps teams have an average of less than 60 percent test automation coverage—and that’s a problem. To scale DevOps and agile and realign the entire software release cycle, Eran Kinsbruner believes there needs to be a better solution. To increase test automation coverage, teams need to match software testing deliveries with the right testing tools, skill sets, and personas. Eran will explain...

The primary goal of DevOps is to provide velocity and quality through improved collaboration. However, without a tailored measurement framework to direct efforts to the problems that matter to the customer and the business, these goals are meaningless. DevOps teams must outline relevant KPIs to measure the impact of their efforts. While keeping the end goal of a DevOps transformation in mind, it’s important to have a canonical source for the relevant metrics that is visible and understandable to all stakeholders. Focusing on success metrics empowers organizations to determine if...

You've got DevOps questions, and we've got Andy Glover to answer them for you. He won't really be sitting by the fire, but he will be on hand to talk about all things DevOps. From his experiences building the Spinnaker continuous delivery platform to writing the open-source BDD framework easyb, Andy wants to talk about the things that worry you or thrill you about DevOps. Bring your questions and be ready for a lively, interactive discussion.

Join us for a game of Agile+DevOps Feud, where two teams of thought leaders compete to name the most popular responses to survey questions to win bragging rights and to share their experiences. Questions and voting will be in the TechWell Hub leading up to the conference, where community members will name their greatest concerns, best practices, etc. Our two teams of panelists, will do their best to guess the community’s viewpoint, and the winning team will get to explain how they deal with those concerns. Our panelists are competing...

DevOps and agile are designed to help you be adaptable and move quickly. But meeting your compliance obligations tends to slow you down and make processes rigid. However, by using key components of agile and DevOps and approaching compliance obligations from a different angle, you can meet your obligations while being adaptable. Guy Herbert will show examples of how his company structures their CI/CD processes to include compliance and how they have changed their compliance approach to be able to better meet the needs of the DevOps teams. Guy will also discuss the cultural implications of...

Are you moving faster than fast? Congrats! Chances are you already use feature flags to decouple code deployments from feature rollouts. Whether you use a roll-your-own feature-flagging solution (with a few quirks) or a feature-flags-as-a-service solution, hopefully you post feature flag rollout changes to something like Datadog so that when a flag rollout lines up with an obvious spike, you know whom to have a talk with. It's a solid start, but that’s just the basics. What do data-driven CD ninjas do? They build in observability to every feature release, so when they push a...

DevSecOps is so much more than forcing developers to use legacy scanning tools. In this talk, we will discuss a continuous, effective, and scalable DevSecOps pipeline using free cutting-edge tools. We'll discuss and show IAST (Interactive Application Security Testing) to accurately pinpoint vulnerabilities in both custom code and libraries in real time without scanning. We'll discuss and show RASP (Runtime Application Self-Protection) in production to gain visbility into application attaches and to prevent vulnerabilities from being exploited. And we'll discuss how to integrate the results...