Putting the “Sec” in DevSecOps… Quantified

Putting the “Sec” in DevSecOps… Quantified

The March 2021 tech talk was presented by Larry Maccherone

Abstract:

A guiding principle of Comcast Cybersecurity is that we are no longer gatekeepers, but rather coaches and toolsmiths. Another, is that we favor building security in over bolting it on. Together, what this means is that the ownership of the problem of the security of the products shifts primarily to the teams that are developing those products. Further, the role of the cybersecurity group at Comcast shifts to supporting those engineering teams by developing and providing self-service tools that prevent problems or give automated feedback. We then provide coaching to help teams understand how best to use those tools and whatever other DevSecOps practices they need to adopt.

This talk dives deeper into what the above paragraph means and then presents original research quantifying the impact that various DevSecOps practices have on security risk outcomes so you can make an informed decision what to focus on first.

About the Presenter 

Larry Maccherone is an industry-recognized thought leader on Lean/Agile, Analytics, and DevSecOps. He currently leads the DevSecOps transformation at Comcast as a Distinguished Engineer. Previously, Larry led the Insights product line at Rally Software where he published the largest ever study correlating development team practices with performance. Before Rally, Larry worked at Carnegie Mellon with the Software Engineering Institute (SEI) and CyLab for seven years conducting research on cybersecurity and software engineering.

Contact Larry on his LinkedIn page: https://www.linkedin.com/in/LarryMaccherone

Schedules are so 20th Century! Leveraging the TSP℠ and Agile Disconnect

Schedules are so 20th Century! Leveraging the TSP℠ and Agile Disconnect

The October 2020 Tech Talk was presented by David R. Webb.

Abstract:

The Team Software Process℠ (TSP℠) and Scrum are similar in so many ways. They are both dedicated to delivering value to the customer, using historical data for planning, developing iteratively, building in quality, practicing continuous process improvement, and much more. Despite these similarities, the TSP concentrates intently on schedule performance, with tools, measures, and practices laser-focused on creating and meeting a defined schedule. On the other hand, Scrum considers schedule prediction to be a waste of valuable time that could be spent delivering value.

This presentation will explore why this fundamental disconnect exists, when to focus on schedule, and (just as importantly) when not to. The presentation will conclude with recommendations on employing Scrum techniques for TSP teams as well as TSP methods that can help out with Scrum projects.

About the Presenter

David R. Webb is a Senior Operations Program Analyst at Kihomac, Inc. He is currently working as an Agile coach to improve the engineering processes of the A-10 Operational Flight Program team in the 309th Software Engineering Squadron at Hill Air Force Base, Utah. Prior to this assignment, Dave worked as a government project management and process improvement specialist with 309 SWEG. He has over 33 years of technical, program management, and process improvement experience on Air Force software. Dave is a certified Scaled Agile Framework (SAFe) Product Owner, Scrum Master, and Agilist. Previously, he was authorized by the Software Engineering Institute as an instructor for the Personal Software Process, as well as a Team Software Process coach. He has worked as an Air Force manager, SEPG member, systems software engineer and test engineer. He is a frequent contributor to technical journals and symposiums, and he holds a bachelor’s degree in Electrical and Computer Engineering from Brigham Young University.

℠ Personal Software Process, PSP, Team Software Process, and TSP are service marks of Carnegie Mellon University. The Software Excellence Alliance is not affiliated with Carnegie Mellon University.

How to Manage $30M and 150 Projects in 90 Minutes

How to Manage $30M and 150 Projects in 90 Minutes

The August 2020 Tech Talk was presented by Brad Hodgins

Abstract:

This presentation describes a solution implemented by the Performance Resource Team (PRT) to help a customer manage $30M+ across 150+ projects and required project leads to attend only one 90-minute training session on what they had to do to manage their projects. The solution had to address the needs of the customer to have a simple status report (e.g., one picture) and have minimum impact on the project leads, since some of the projects had very small budgets (e.g., $10K).

To minimize the impact on the project leads, the solution relied on using tools that the project leads already knew (e.g., Microsoft Excel) and simplified the actions required for tracking and reporting their project status to the point that it required less than an hour a month. Only a few project management concepts were used in the solution so that the project lead training could be delivered in one 90-minute session. The solution was stood up halfway through a fiscal year and was used for the entire following fiscal year. Both years resulted in over 90% participation by the projects, and the customer was pleased with the simplicity of the single chart output showing all the projects’ status.

About the Presenter 

Brad Hodgins is a computer scientist and has been supporting Naval Air Systems Command (NAVAIR) for 36 years. He has over 20 years’ experience developing simulation and avionics software. He has spent the last 16 years as a project planning and tracking coach and instructor for the Performance Resource Team (PRT), actively coaching project teams in the development of high-quality products for on-time, on-budget delivery to the fleet.

Brad has expertise and a national reputation in process improvement. During his time with the PRT, Brad gave over two dozen presentations at symposiums and conferences, and authored/co-authored half a dozen published articles and papers, all sharing the great things NAVAIR has been doing. Brad was given a Navy patent in 2008 for the Learning Applying Mastering Perfecting (LAMP) model for team process implementation evaluation and improvement. He was awarded the Michelson Laboratory Award in 2010, and he became a NAVAIR Associate Fellow in 2013. Brad earned a Doctorate in Computer Science from Colorado Technical University in 2015. He retired from government service in 2019, but continues to support NAVAIR as an employee of Saalex Solutions Inc.

Brad is a Taurus and likes surfing (just kidding about the surfing).

A Framework for Software Development Excellence

A Framework for Software Development Excellence

Abstract:

We describe a broad and unifying framework of the most important traits, principles, and practice areas supporting the achievement of software development excellence. For software development excellence, we broadly emphasize both the definition of a product that effectively meets stakeholder needs (“building the right product”), and designing and constructing an effective and reliable solution for satisfying those needs (“building the product right”). One objective of the framework is to help unify different software communities, such as the Agile community and the Team Software Process community, who have independently developed approaches that have both much in common and also some important differences. Another objective is to provide guidance to help organizations identify gaps in their current practice and develop a roadmap for improvement. We stress the importance of commitment, participation, preparation, simplicity, iteration, continuous feedback, regular adjustment, objectivity, openness, communication, direct interaction, and continuous improvement. We outline the most important practice areas of product management, technical excellence, quality management, teamwork, project management, and process management.

About the Presenter 

Darryl L. Davis is the Principal and founder of Davis Systems, an improvement consulting firm that helps develop agile high-performance software teams. He is a former SEI Certified TSP Mentor Coach and a former SEI Authorized PSP-TSP Instructor. He served as an SEI Authorized Capability Maturity Model Integration Instructor and for 13 years as an SEI Authorized Lead Appraiser. He is a Project Management Institute Certified Project Management Professional, and a scrum.org certified Professional Scrum Master and Professional Scrum Product Owner. Prior to founding Davis Systems in 1993, he was a Senior Technical Manager at Intergraph Corporation. At Intergraph and at Chrysler Corporation, he developed software ranging from commercial desktop computer-aided engineering tools to custom real-time embedded systems. He holds a Master’s degree in computer science from the University of Alabama in Huntsville and a Bachelor of Computer Engineering degree from Auburn University. He is a Senior Member of the Institute of Electrical and Electronics Engineers and its Computer Society, a member of the Project Management Institute, and a Senior Member of the American Society for Quality.

Agile Software Development

Agile Software Development

Abstract:

The goal of this talk is to better understand Agile teams’ strengths and problems so that we can better identify practices that can aid them the most. Darryl will give a brief Agile and Scrum overview, present a comparison and contrast to TSP℠, talk about implemented Agile with ideas from TSP to address the weaknesses, and walk through a success story. Dave will add details about how he has implemented Agile with ideas from TSP. Scott will tell us about his experiences with some Agile project failures.

About the Presenters

Darryl L. Davis is the Principal and founder of Davis Systems, an improvement consulting firm that helps develop agile high-performance software teams. He is a former SEI Certified TSP Mentor Coach and a former SEI Authorized PSP-TSP Instructor. He served as an SEI Authorized Capability Maturity Model Integration Instructor and for 13 years as an SEI Authorized Lead Appraiser. He is a Project Management Institute Certified Project Management Professional, and a scrum.org certified Professional Scrum Master and Professional Scrum Product Owner. Prior to founding Davis Systems in 1993, he was a Senior Technical Manager at Intergraph Corporation. At Intergraph and at Chrysler Corporation, he developed software ranging from commercial desktop computer-aided engineering tools to custom real-time embedded systems. He holds a Master’s degree in computer science from the University of Alabama in Huntsville and a Bachelor of Computer Engineering degree from Auburn University. He is a Senior Member of the Institute of Electrical and Electronics Engineers and its Computer Society, a member of the Project Management Institute, and a Senior Member of the American Society for Quality.

David R. Webb is a Senior Operations Program Analyst at Kihomac, Inc. He is currently working as an Agile coach to improve the engineering processes of the A-10 Operational Flight Program team in the 309th Software Engineering Squadron at Hill Air Force Base, Utah. Prior to this assignment, Dave worked as a government project management and process improvement specialist with 309 SWEG. He has over 33 years of technical, program management, and process improvement experience on Air Force software. Dave is a certified Scaled Agile Framework (SAFe) Product Owner, Scrum Master, and Agilist. Previously, he was authorized by the Software Engineering Institute as an instructor for the Personal Software Process, as well as a Team Software Process coach. He has worked as an Air Force manager, SEPG member, systems software engineer and test engineer. He is a frequent contributor to technical journals and symposiums, and he holds a bachelor’s degree in Electrical and Computer Engineering from Brigham Young University.

Scott Pavetti is a member of the faculty at Carnegie Mellon’s Master of Software Engineering professional program. Prior to joining the faculty, he was a tech lead at the Software Engineering Institute in the Security Automation directorate within CERT where he led a small, multi-disciplinary team that operates two compute laboratories, develops software solutions for government customers, and consults on software engineering best practices.

He’s worn a number of job titles, such as research programmer, senior software engineer, tech lead, and software quality engineer. Within those roles, Scott has accumulated broad set of product development experiences ranging from mobile and desktop development, small IT deployments, embedded, to IoT systems. As a software quality engineer, he developed quality plans, software development plans, conducted requirements workshops, and even architected a few products. He also has two patents related to indoor navigation and their associated methods.

Not all of Scott’s experiences are technical, he spent two years as a Community of Practice Leader in Software where he worked with 50 engineers in the US and Germany to develop better practices and share knowledge. He’s also trained engineers in software architecture, design, requirements, and testing practice. He understands that being a software engineer takes more than technical ability, that it takes leadership as well.

He got his undergraduate degree in Computer Engineering from the University of Pittsburgh and a master’s degree in Software Engineering (MSIT-SE) from Carnegie Mellon University.

He likes bicycling on roads and trails in rural Pennsylvania and landscape photography.

℠ Personal Software Process, PSP, Team Software Process, and TSP are service marks of Carnegie Mellon University. The Software Excellence Alliance is not affiliated with Carnegie Mellon University.