the work to fix the issues. Additionally, we see organizations shift towards product thinking in combination with design thinking. Product thinking considers the entire value stream from initiation to value delivered via the feature or product whereas project thinking is less ongoing and value focused.
InfoQ: The report notes that companies are moving 20-25 times faster than before the pandemic. Do you see this continuing? How will organizations evolve to handle this?
Oerhlich: During a crisis such as the pandemic, a variety of bottlenecks are removed without resistance because they have to be. Velocity is key for innovation but also must be paired with quality and security. I do believe that we have learned the following from this pandemic:
a) Business and IT need to converge: In the digital future and in the next way of working, technology plays a critical role and it is no longer just the IT team who has the responsibility for technology and the associated processes. The entire organization must be involved. There are too many use cases we are all familiar with which have gone wrong if both organizational bodies do not work together.
b) Value is seen in the eye of the patient or customer. No matter what we as developers or operations or security or IT architects think, the patient or customer decides if what we are offering has value. This again requires shifting toward product thinking. Both product thinking and Value Stream Management skills are essential to ensure value is delivered.
c) Skills matter but capabilities and habits matter more. Some skills such as technology, process frameworks, and understanding can be taught but human skills are difficult to teach. It requires the changing of habits and leaders who can influence their teams while inspiring and rewarding them. Last year we saw automation skills to be the number one must-have skill domain with human skills as the number two must-have skill domain. That is due to the pandemic as it is something we can control. Next year, my guess is that human skills will again be the number one must-have skill domain.
InfoQ: The report mentions a transition from
baking security safeguards in, to a focus onidentity, privacy, and policy as code. How are organizations approaching this? What challenges do you foresee with this shift?
Oerhlich: Organizations are including security and the security practitioners at the initial design stage of whatever products are being prioritized. This does two things:
Security is baked in from the beginning.
Security is starting to become part of everything and at some point in the future it will no longer be the role of a team but a topic at every step of the way.
The challenge I see is that the model of security built in everywhere will take time and security experts must push the agenda across all topics while also inserting themselves into the value streams. Another challenge is that security is seen as a nuisance in some DevOps organizations and can slow things down. This is starting to change significantly and we see from our research and the Upskilling 2021: Enterprise DevOps Skills Report that DevSecOps and SecOps are being embraced as a skill.
InfoQ: What approaches have you seen work for organizations that are having challenges with their DevOps adoptions due to organizational structure or culture?
Oerhlich: Pilots which are established: As the results of DevOps are difficult to pinpoint in large and complex teams and organizations, one way to overcome some of the challenges within culture is to establish a pilot project which gets to focus on this modern way of working. Individuals who have the ability and skills to collaborate and have the ambition to change are put together. The capabilities are measured before and during with results being shared to inspire others.
Key topology models are introduced: There are working topology models (organizational models) and some which don’t work. In the topologies of DevOps, there is great guidance on which models to go for and which to avoid.
Coaches and advisors. The DevOps movement is supported through global and local advisors and practitioners who all are extremely knowledgeable about what works and what does not work. Many organizations have