Putting Together a DevOps Pipeline Leveraging Technology, Process, and People 1 May 2019 Mr. Patrick Bush

National Security Challenges Gray or hybrid warfare Time to respond Data, Information, and Intelligence Complacence Build capabilities faster that can quickly adapt to changing missions across the spectrum of conflict

National Security Imperative We will use the latest commercial capabilities, shared services, and best practices to modernize our federal information technology. We will improve our ability to provide uninterrupted and secure communications and services under all conditions.  National Security Strategy December 2017

How we build software is more important than what it does Crucial and growing part of mission success Increasing use of commercial products (COTS, FOSS, and GOTS) Production processes that support new mission features Organizational transparency and synchronization How we build software is more important than what it does

Software Development Considerations Innovation Development Test Migration Operations Security Environment Software Supply Chain Source Code Configuration Control Risk Assessment Platform is the foundation of innovation

Platform Service Value Chain Software Services Platform (S2P) Development Pipeline RHEL AMI Dev. Desktop MS Windows BitBucket Fisheye/Crucible Jenkins SonarQube Nexus Repo Manager Nexus IQ Server Fortify Develop Commit & Review Build Unit Testing Quality Analysis Vulnerability Analysis Publish JIRA Confluence PIWIK Chef API Management Deployment Pipeline Continuous Monitoring Publish Performance Testing Functional Testing Provision Selenium Cucumber Nexus Repo Manager Nexus IQ Server Graphic is UNCLASSIFED

Software Supply Chain Management Collect the body of evidence through automation Establish criteria for acceptable risk Download from a trusted source by a responsible component Maintain an approved software repository Know vulnerabilities and accept risk Update vulnerability scores Track deployments throughout the enterprise Help manage and predict license agreements Supports rapid development, contains risk

Treat the Software Services Platform as a System Keys to Adoption Established a software services platform Support adoption as a value proposition Speed Quality Cost avoidance Partner across the organization Security accreditation Software supply chain management System engineering and requirements Operations Contracts Treat the Software Services Platform as a System

Essential enabling capability Platform as a System Modular and adaptive Support lifecycle Deliver new capabilities faster Transform existing capabilities Responsive to needs and opportunities Guide adoption of new supporting processes Focus the enterprise Ignite creativity Essential enabling capability

Leverage Technology, Process, and People Summary View the platform as a system Enterprise security boundary Multiple uses Adopt processes consistent with automation capabilities Security accreditation Development pipelines Operational deployment Requirements management Rapid innovation Allow the user developer teams to create Data analytics System orchestration Leverage Technology, Process, and People