DevOps Main Area and Core Capabilities Adopting DevOps in the Last Decade: A Systematic Literature Review

DevOps is a collaboration between software development and operation that utilizes frameworks like continuous integration, microservices, continuous delivery, and continuous deployment for an agile software development process. DevOps has principles like automation, iteration, and continuous release and development. This research aims to know DevOps development in the last decade and know how potentially adopt the DevOps development process. This study uses the Systematic Literature Review (SLR) method to locate, evaluate, and summarize pertinent works that were published in the public domain between 2012-2022. The result of this review will be used by researchers and practitioners as a piece of knowledge about the DevOps core capabilities and main areas of DevOps from adopting DevOps in the last decade

Management Challenges for DevOps Adoption within UK SMEs

The DevOps phenomenon is gathering pace as more UK organisations seek to leverage the benefits it can potentially bring to software engineering functions. However substantial organisational change is inherent to adopting DevOps, especially where there are prior and established methods. As part of a wider piece of doctoral research investigating the management challenges of DevOps adoption, we present early findings of a six month qualitative diary study following the adoption of DevOps within a UK based SME with over 200 employees. We find that within our case study organisation, the DevOps approach is being adopted for the development of a new system used both internally and by customers. DevOps, conceptually, appears to be generally well regarded, but in reality is proving difficult to fully adopt. This difficulty is down to a combination of necessity in maintaining a legacy system, lack of senior management buy-in, managerial structure and resistance. Additionally, we are finding evidence of job crafting, especially with the software developers. Taken together, we put forward the argument that DevOps is an interdisciplinary topic which would greatly benefit from further management and potentially psychology oriented research attention

Large scale agile software development compliant to IEC 62443-4-1: artefact design and tool support

There has been a considerable increase in the use of agile methodologies over the last years. However, applying these methodologies can be challenging, particularly for industrial control systems that must obey to rigorous operational requirements through regulations and standards, and in particular cybersecurity requirements. The current work proposes a concept for a structured and systematic integration of security activities into a DevOps pipeline, with the ambition of pursuing the capability of both secure agile development and security compliant agile software engineering. The basis for this concept is the integration of the IEC 62443-4-1 (4-1) standard, which describes secure product development in industrial control systems, with a Continuous Integration/Continuous Delivery pipeline specification. To achieve this, the security requirements, as described in the 4-1 standard, were mapped into a simple DevOps pipeline specification. As a result, all of the 4-1 activities were analysed and classified according to the possibility of being automated through tool support. Interviews with expert practitioners, from the fields of security compliance and agile software engineering, were conducted to evaluate the present work. Results have shown evidence about the possibility of providing tool support for the IEC 62443-4-1 standard and to specify a DevOps pipeline compliant to the 4-1 standard.Nos últimos anos houve um aumento considerável no uso de metodologias ágeis. No entanto, a aplicação destas metodologias pode ser um desafio, em especial para sistemas de controle industrial que têm a obrigação de obedecer a requisitos operacionais rigorosos através de regulamentos e normas, e em particular no âmbito da cibersegurança. Este trabalho propõe um conceito para uma integração estruturada e sistemática de actividades de segurança num pipeline de DevOps, com o intuito de alcançar ambas as capacidades de desenvolvimento ágil seguro e engenharia de software ágil em conformidade com segurança. A base para este conceito é a integração da norma IEC 62443-4-1 (4-1), que descreve o desenvolvimento seguro de produtos em ambientes de controle industrial, com um especificação de Continuous Integration/Continuous Delivery. Para alcançar isto, foi feito um mapeamento de requisitos de segurança, de acordo com a descrição na norma 4-1, numa especificação simples de DevOps. Como resultado, todas as actividades da norma 4-1 foram analisadas e classificadas de acordo com a possibilidade de serem automatizadas através de suporte de ferramentas. Para avaliar o trabalho, foram realizadas entrevistas com profissionais especializados nas áreas de conformidade em segurança de TI’s e engenharia de software ágil. Os resultados mostram evidências sobre a possibilidade de fornecer suporte de ferramentas para a automatização da norma IEC 62443-4-1 e para a especificação um pipeline de DevOps conforme com a norma 4-1

Report from GI-Dagstuhl Seminar 16394: Software Performance Engineering in the DevOps World

This report documents the program and the outcomes of GI-Dagstuhl Seminar 16394 "Software Performance Engineering in the DevOps World". The seminar addressed the problem of performance-aware DevOps. Both, DevOps and performance engineering have been growing trends over the past one to two years, in no small part due to the rise in importance of identifying performance anomalies in the operations (Ops) of cloud and big data systems and feeding these back to the development (Dev). However, so far, the research community has treated software engineering, performance engineering, and cloud computing mostly as individual research areas. We aimed to identify cross-community collaboration, and to set the path for long-lasting collaborations towards performance-aware DevOps. The main goal of the seminar was to bring together young researchers (PhD students in a later stage of their PhD, as well as PostDocs or Junior Professors) in the areas of (i) software engineering, (ii) performance engineering, and (iii) cloud computing and big data to present their current research projects, to exchange experience and expertise, to discuss research challenges, and to develop ideas for future collaborations

Service Level Agreement-based GDPR Compliance and Security assurance in (multi)Cloud-based systems

Compliance with the new European General Data Protection Regulation (Regulation (EU) 2016/679) and security assurance are currently two major challenges of Cloud-based systems. GDPR compliance implies both privacy and security mechanisms definition, enforcement and control, including evidence collection. This paper presents a novel DevOps framework aimed at supporting Cloud consumers in designing, deploying and operating (multi)Cloud systems that include the necessary privacy and security controls for ensuring transparency to end-users, third parties in service provision (if any) and law enforcement authorities. The framework relies on the risk-driven specification at design time of privacy and security level objectives in the system Service Level Agreement (SLA) and in their continuous monitoring and enforcement at runtime.The research leading to these results has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 644429 and No 780351, MUSA project and ENACT project, respectively. We would also like to acknowledge all the members of the MUSA Consortium and ENACT Consortium for their valuable help