GitLab PubSec & Regulated Industries, 13 Oct 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: DevSecOps Remotely: The New Model

Description

We find ourselves in the middle of a new paradigm, forced to either work from home or be at home and not work at all. How does that affect our delivery to the mission? Can we maintain our technological advantage or deliver what we promised to our citizens in light of this new way of working?
In this Lightning Talk, we will briefly explore this new paradigm from the context of DevSecOps, that is how do we make fundamental structural changes to how we work to continue to deliver critical application enhancements and updates while working away (silo’d), from our normal office. We will discuss some tips and tricks other government agency programs have embraced to begin this new journey. In addition, we will look at software technology that enables this journey across all the stages of DevSecOps and allows silo’d teams to work seamlessly as if they were co-located.

Times have changed, the new normal is very different from the old way of supporting the mission. Are you ready to embrace this change?

A

My name is mark chris, and I work for gitlab's national security group and our topic today is dev secops or developing software remotely the new normal. Now, what is the new normal? Well, obviously, we find ourselves in a real uh critical situation today, uh with this pandemic that we're all facing um and and really what we have discovered uh working through. This uh very unfortunate situation is that it has forced us to consider structural change to how we do mission development today now working across silos to develop uh software applications.

A

This is nothing new, uh as a matter of fact, uh you may already in your mission. You may already have your teams working across silos to develop some code in one group and then pass that code to another group for for putting some finishing touches on it or maybe some changes.

A

So that's nothing new, but what is new is that this pandemic has taught us that we may not be able to work from the office or the agency. In fact, we may be forced to work from home, so the definition of silo is changing to include telework now for those of us in the federal government. This this is a new normal because we're we're not used to having telework we're used to having people work either at the agency or in an agency approved contractor facility.

A

So uh what happens when we get through this current situation? And things start to reopen? Does that mean we go back to the old way of doing things? Or what does this new normal look like well for, in a lot of cases, we're going to have to continue to observe social distancing? So what does that mean? Does that mean we get to open the office and bring everyone back? Does it mean we only get to bring part of our workforce back?

A

So, even though we start to go back to more open in terms of our states and cities and country, we're still going to be looking at this new normal, and so we need to look at how we can change our workflow and our methodology begin a journey that takes us to the point where we can do mission work from home.

A

This new, normal, doesn't just affect federal agencies, so as a federal leader, uh certainly you're you're uh challenged with looking at this new normal, but state and local agencies are also facing the same challenges. uh They've got the same. Requirements of work must be done either at the agency or a contractor, approved facility, etc. So they're looking at the same journey, but it also affects commercial customers too.

A

We've heard from commercial customers in some of the regulated industries that have the same security requirements that we do in this federal state and local and they're being challenged to start this journey as well, and some of those regulated industries include health care, financial services, oil and gas, just to name a few. So no matter where you are on this journey or where you sit within these different industries and agencies, this is a journey that we have to take a look at, and how can we make this change together?

A

So the what we'd like to share with you today are just some really get the discussion going with some high level tips and tricks that we've learned from others that we've worked with that have started this journey or maybe have progressed a ways down the path of this journey.

A

So the first tip I'd like to share with you that we've learned is the these other uh agencies and customers have told us that the important thing is to take small steps when you're looking at a cultural change like this at a workflow change at a methodology change the biggest thing is that it can be very daunting, so break it down into very small chunks or what we call minimal viable change. So it's important to take small steps.

A

The challenge, though- and this is where those uh customers that have really started down this path have shared with us. The challenge is to take that first step. That was the hardest thing on the journey.

A

Once they took that first small step, they began to accelerate and take more small steps and more small steps, and the key was iterating, collaborating on those small changes and looking at those small changes as victories every day and that allowed them to continue down that path, as opposed to looking at the whole thing uh uh collectively and saying: oh, my gosh, how are we going to make this kind of a huge structural change? They started to do it a small step at a time so another tip. They said in terms of those small steps.

A

They said. One of the first small steps they took was to get their whole team together to do an assessment of their current workflow, their current application development to figure out what parts of their application could in fact be developed outside of the agency outside of a contractor facility.

A

So in terms of this, what they did, they said what really helped them in this small step was to collaborate with their industry partners with their contractors. So, as a government leader bringing your whole team together, uh both your employees and your contractor partners is so important and collaborate on this work assessment now another best practice we learned was: uh they told us that they used as their bar of looking at their application to break it down to see what could be developed on the low side or in outside the agency.

A

They looked at the open source software uh industry. The reason they chose that was open source software components are used by their teams every day to build the government applications.

A

They might use an open source library, maybe an open source script um and what they would do is they looked at the definition of open source software and realized that the components they were already using inside their their agency or or as some put it on the high side, were being developed by teleworkers located all over the place, so they were already sort of working in that kind of methodology.

A

So, looking at that as their barometer, they were able to do a real assessment of how much of their application could in fact be developed outside the agency. In some cases, it ranged anywhere from 80 percent was almost kind of the low all the way up to 100 and the other best practice they uh or tip, rather that they gave us out of this effort. Was their assessment led them to understand that what was really sensitive was the data, the data that the application produced or the data that the application ran against.

A

That was what was sensitive, so they kept the data inside the agency or inside the contractor facility, but they allowed their development teams to work outside the agency.

A

Now the other thing that they discovered in this journey, another small step, was to meet with the professionals on their contracting team, and this was necessary step because a lot of their contracts they shared with us, had a clause written into it. That said, all work must be done in a government approved or gov or in a government facility rather or government, approved contractor facility.

A

Now they wanted to make that change to start this journey, so they included a new clause which said or government approved home office facility. Now I know you're, probably thinking what is a government approved home office facility. Well, that really depends on your security posture, your security, professional, that's part of your team and how you want to define that.

A

But here's a couple of examples that were shared with us, some of the customers and programs shared with us that they had requirements that ran kind of the full gamut, um some with more some with less again using that barometer of open source software that is developed by teleworkers today from from all many different locations.

A

So what they did was they said: okay, there's really two ways to look at this: there is security of the home office, so some of the programs had uh requirements in there, such as all, work must be done on a contractor, supplied laptop and that laptop has to have um contractor approved security, software vpn software, etc, and then that laptop must be able to be locked away in a cabinet. At the end of the day in the home office we saw requirements like the laptop screen must be turned away from any windows, etc.

A

While work is being done in the home office. Even some requirements that said there has to be a physical lock and a door on the home office itself, so that, at the end of the day, that office can be locked, but then the the best practice that they they found through this effort was wait a minute. If we look at open source software today that we use in building our applications that software is developed. Who knows where? So? How do we make sure that software is secure?

A

Well, we make sure the code is secure, so we can't control the edge device. We can't control people's home offices in that instance. So let's look at securing the code scanning the code, making sure that the code doesn't have vulnerabilities in it, making sure that the code is secure. So the best practice that flowed out of this effort was secure. The code because that's something the code arrives at the agency, that's something that can be controlled by the agency.

A

How secure is the code being developed in the home office? So that was one big insight that was shared with us. Another was collaboration.

A

The key that came out of this piece was uh these uh programs, government programs and agency programs that have started down this journey really worked together with their industry partners uh to uh create this. This road map, if you will for this journey and to really start to get work uh being done uh via telework now. um What came out of this, though? What they shared with us was um as government leaders.

A

uh They realized that the benefit to the government was obvious, but they discovered that there were a lot of benefits to the contractor as well. So there was incentive to work together as a team because of the the benefits uh that that flowed down to both. So on the government side, it was very obvious mission. Work is getting done so, instead of being forced as an employee, a government employee to sit at home and not be able to work because I'm outside the office, I was able to then begin to develop software as an example.

A

I could develop software, so the mission could continue. So that's a key benefit to the government and because I wasn't spending time as an example commuting to an office. I could actually spend more time developing code, so work got done faster.

A

It actually got done faster, which was another key insight and it got done at a lower cost, a lower cost, because I wasn't spending time sitting in a car stuck in traffic. I was spending time writing code.

A

What was really interesting, though, was it benefited industry. The benefits to industry were flexibility and agility in in the meeting of the mission requirements.

A

So as an example, the contractor was able to be much more flexible in their workspace, so they could allow their developers to work from their home offices, which then freed up office space that is at a premium, but also allowed them to pick and choose developers on their team, no matter where they were geographically located.

A

So um whatever city in the u.s that developer was sitting in, that contractor could tap that developer on the shoulder and get them working on a program so that uh developing an application so that the mission could move forward, while maybe they were waiting to hire resources locally within that particular agency's region.

A

So it gave tremendous flexibility which then led to talent, acquisition and retention, so the contractor was able to actually go hire the best developers, no matter what city in the us they lived in, and this allowed them the freedom to uh really offer jobs to people who didn't want to move out of their hometown, or maybe they didn't want to move out of a particular urban area because they really loved how that city met their particular lifestyle.

A

So they could tap people on the shoulder, no matter where they were, and this then also allowed speed to mission um and then overall, uh combining all of this together. It allowed the contractor to meet the mission requirements, increase the speed to delivery and uh allow them agility and meeting that that mission now technology alone doesn't solve the problem, but the right technology can be an enabler. As you begin your journey uh one quick example: uh the company I work for get lab.

A

We are the first complete end-to-end devsecops solution, so one solution to stand up and get to ato uh and because it's deployed anywhere there are developer teams today, using it to work from home telework.

A

To then take their project with all the artifacts, with all the context and pass it to another team, maybe at a contractor facility or even at a government agency, so that that enables this journey. One quick example I'll give. You is uh an agency that we worked with uh wanted to bring on a team of summer interns. Now this is an agency that has very stringent security requirements, so there was no way that they could literally get these summer. Interns uh brought into the physical agency.

A

So they looked at this idea of telework and what they did is they allowed the interns to continue to work from their home offices.

A

uh They had them use contractor approved laptops, but what they did is uh using uh git lab. They uh brought everyone together on the same sheet of music, the same page. If you will the summer interns collaborated and did a research project, but then um they would on a regular basis.

A

They would pass that whole project with all of its artifacts up to the secure agency and the branch chief who sat there in the program office, and he could uh look at the work being done by his interns and he could take the benefits of that uh work and uh bring it into his secure mission, and so it allowed for this seamless collaboration from the low side, if you will to the high side and it allowed for an extremely successful summer, intern program.

A

Now the the beauty of that was, the branch chief also used that as an opportunity to introduce these talented young people from different universities across the region to the agency as potential future employees.

A

So, in summary, uh we are uh being forced into this cultural change, uh and this is a new normal. We we can't go back, we're not not going to be able to go back, but we shouldn't go back. We need to move forward.

A

We need to look at how we begin this journey, how we move down this path, and we need to think about doing it in small steps again as a government leader, the first small step bring your whole team together, uh your employees, your contractors, your your advisors, bring everyone together and uh start that first step, which is an assessment of your workflow of your current application and find out uh from the team what can be done today uh as a teleworker? What work could be started today to keep that mission?

A

Your mission moving forward, I want to thank you for the time I want to thank you for allowing me to share this with you, and I wish you uh all the best. As you begin your journey.