Puppet and DevOps in a Regulated Environment

@jtopper shares how we've brought startup-like agility to customers in more regulated industries such as pharmaceuticals and finance, without the need for Word documents or Sharepoint workflows.

Recorded at PuppetConf 2015 in Portland, Oregon, you can watch the video here: https://www.youtube.com/watch?v=yj9PbsNO2uE

2. Puppet and DevOps in a Regulated Environment Jon Topper Founder / Principal Consultant | The Scale Factory @jtopper / @scalefactory
3. In the next 40 minutes… • Regulated Environments? What? • OK, so why do they suck? • How do we fix that?
4. Not in the next 40 minutes… • Deep discussion of specific regulatory frameworks • Sharepoint • Actual Puppets
5. Regulatory compliance describes the goal that organisations aspire to achieve in their efforts to ensure that they are aware of and take steps to comply with relevant laws and regulations. Wikipedia Regulated Environments? What?
12. “Pamela found that survey respondents in & reported a disproportionately high percentage of low- performing IT”. https://puppetlabs.com/blog/extra-data-from-2015-devops-survey healthcare banking
13. IT Performance • Deployment Frequency • Deployment Lead Time • Mean Time to Recovery
14. Change “πάντα χωρεῖ καὶ οὐδὲν µένει” Everything changes and nothing stands still. Heraclitus of Ephesus
15. Regulated businesses are less good at change.
16. OK, so why do they perform less well?
17. Bureaucracy “Bureaucracy destroys initiative. There is little that bureaucrats hate more than innovation, especially innovation that produces better results than the old routines”. Frank Herbert
18. “It's just we're putting new coversheets on all the TPS reports before they go out now”.
19. Paperwork has no intrinsic value
21. How do we fix this?
23. Find a tame auditor
24. Read the regulations
26. (e) Use of secure, computer-generated, time- stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information. Such audit trail documentation shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying.
27. Understand the intent
28. Read the internal regulations
29. Challenge and Simplify
31. Electronic, not Social
32. https://www.flickr.com/photos/wetwebwork/2847766967/
33. Let’s talk tech
34. Puppet
35. Version Controlled Peer Reviewed
36. Reports Not forms
37. Strong Identity Management
38. Artefact Deployment
39. Log Aggregation Retention
40. Monitoring Alerting
41. Minimum Viable Documentation
42. In the last 40 minutes… • Regulated Environments generally perform badly • Because change control is often implemented with needless overheads • Good use of best-practise DevOps solutions can help
43. @jtopper www.scalefactory.com