Q&A with Eveline Oerhlich on Building an Effective DevOps Culture

The DevOps Institute recently released their latest report entitled "Upskilling 2021: Enterprise DevOps Skills Report". The report found that automation and security remain vital to business success. A focus on building the human skills of DevOps was also identified as companies with the best learning cultures were most likely to succeed.

The report found that the global Covid-19 pandemic has caused companies to move 20 to 25 times faster than they were previously. This has caused an increase in demand for individuals filling SRE and DevOps roles. Security continued to rank high among the sought after skills as security continues to shift left:

There is a similar ‘shift left’ movement underway around such things as identity as code, privacy as code, and policy as code that broadens the scope of the DevOps universe.

The report also highlighted the importance of a strong, healthy culture to enable an effective DevOps transformation:

Culture refers to the organization’s informal patterns that signal to people which behaviors are appropriate and which behaviors define you as difficult. Our survey respondents attribute the lack of DevOps progress in tackling challenges with the organizations’ culture.

These challenges include an inability to secure and develop the right talent, an aversion to risk-taking and idea generation, and a fixation on past failures. The report highlighted the human skills to focus on to prepare existing staff for a successful DevOps transformation.

The DevOps human skill journey as identified by the DevOps Institute (credit: DevOps Institute)

InfoQ sat down with Eveline Oerhlich, Chief Research Office for the DevOps Institute, to discuss the report's findings in more detail.

InfoQ: In the report it is called out that "a successful DevOps journey has the DNA of a learning organization". What are some of the ways this learning culture manifests within successful organizations?

Eveline Oerhlich: According to Peter Senge (Fifth Discipline, 1990) learning organizations are … organizations where people continually expand their capacity to create the results they truly desire, where new and expansive patterns of thinking are nurtured, where collective aspiration is set free, and where people are continually learning to see the whole together.

This is manifested in 4 different ways:

1. Continually expanding their capacity to create results: By bringing together Dev and Ops (and a variety of other SMEs to form a multidisciplinary team) each team member adds their own expertise and experience to achieve results. Additionally, the first way of DevOps is enabling fast flow from left to right (dev to operations to deliver value to customers quickly) by increasing flow and making work visible, allowing the reduction of bottlenecks and the avoidance of bouncing things among team members back and forth. We want to ensure we see where work is flowing (Kanban helps with this) and part of the feedback loops help to continually expand capacity to create the results.
2. New and expansive patterns of thinking are nurtured: We see the adoption of a safety culture, where people are encouraged to learn from mistakes and leaders do not punish, which allows for experimentation and trial and error. Topics such as chaos engineering (creating chaos within the production environment to understand and fix what goes wrong) is one extreme example of this.
3. Collective aspiration is set free: same as the above plus bringing creativity and multi-disciplinary approaches together.
4. See the whole together: The second way of DevOps is including the feedback and feedforward loops where knowledge and information is moved from right (Ops) to left (Dev) or the other way around. This prevents problems from progressing downstream. In manufacturing this methodology was the Andon Cord where workers could pull a cord to stop the work to fix the issues. Additionally, we see organizations shift towards product thinking in combination with design thinking. Product thinking considers the entire value stream from initiation to value delivered via the feature or product whereas project thinking is less ongoing and value focused.

InfoQ: The report notes that companies are moving 20-25 times faster than before the pandemic. Do you see this continuing? How will organizations evolve to handle this?

Oerhlich: During a crisis such as the pandemic, a variety of bottlenecks are removed without resistance because they have to be. Velocity is key for innovation but also must be paired with quality and security. I do believe that we have learned the following from this pandemic:

• a) Business and IT need to converge: In the digital future and in the next way of working, technology plays a critical role and it is no longer just the IT team who has the responsibility for technology and the associated processes. The entire organization must be involved. There are too many use cases we are all familiar with which have gone wrong if both organizational bodies do not work together.
• b) Value is seen in the eye of the patient or customer. No matter what we as developers or operations or security or IT architects think, the patient or customer decides if what we are offering has value. This again requires shifting toward product thinking. Both product thinking and Value Stream Management skills are essential to ensure value is delivered.
• c) Skills matter but capabilities and habits matter more. Some skills such as technology, process frameworks, and understanding can be taught but human skills are difficult to teach. It requires the changing of habits and leaders who can influence their teams while inspiring and rewarding them. Last year we saw automation skills to be the number one must-have skill domain with human skills as the number two must-have skill domain. That is due to the pandemic as it is something we can control. Next year, my guess is that human skills will again be the number one must-have skill domain.

InfoQ: The report mentions a transition from baking security safeguards in, to a focus on identity, privacy, and policy as code. How are organizations approaching this? What challenges do you foresee with this shift?

Oerhlich: Organizations are including security and the security practitioners at the initial design stage of whatever products are being prioritized. This does two things:

1. Security is baked in from the beginning
2. Security is starting to become part of everything and at some point in the future it will no longer be the role of a team but a topic at every step of the way.

The challenge I see is that the model of security built in everywhere will take time and security experts must push the agenda across all topics while also inserting themselves into the value streams. Another challenge is that security is seen as a nuisance in some DevOps organizations and can slow things down. This is starting to change significantly and we see from our research and the Upskilling 2021: Enterprise DevOps Skills Report that DevSecOps and SecOps are being embraced as a skill.

InfoQ: What approaches have you seen work for organizations that are having challenges with their DevOps adoptions due to organizational structure or culture?

Oerhlich:

• Pilots which are established: As the results of DevOps are difficult to pinpoint in large and complex teams and organizations, one way to overcome some of the challenges within culture is to establish a pilot project which gets to focus on this modern way of working. Individuals who have the ability and skills to collaborate and have the ambition to change are put together. The capabilities are measured before and during with results being shared to inspire others.
• Key topology models are introduced: There are working topology models (organizational models) and some which don’t work. In the topologies of DevOps, there is great guidance on which models to go for and which to avoid.
• Coaches and advisors. The DevOps movement is supported through global and local advisors and practitioners who all are extremely knowledgeable about what works and what does not work. Many organizations have brought in such coaches and advisors to teach others and transfer their knowledge.  
• Center of Excellences, Institutes and Foundations: Vendors and System Integrators (e.g. HCL) have established centers of excellence where knowledge can be shared. This includes the DevOps Institute from a center of excellence or vendors like GitLab. Also, there are foundations such as Cloud Native Computing Foundation (CNCF) who are supporting enterprises in their technology and modern operating models now and into the future.

InfoQ: Do you have any predictions for next year's report? What changes do you see within how organizations are implementing DevOps practices?

Oerhlich: I am predicting that the adoption of DevOps across both projects and the enterprise will rise globally. I do think there will be tremendous shifts into the sub categories of DevOps such as ModelOps, DataOps, SRE, Value Stream Management, Chaos Engineering, and Holacracy, with growth in all of them. Currently, we are seeing  more combinations of terms such as BizDevOps and RelOps, just to name a few. We will see which other ones will show up. We are working on our next survey in July which should illustrate these new combinations. We already know that DevOps is seen as valuable within the business community from research done by IDC and HCL. I do think DevOps-plus will become the norm, perhaps not yet in 2022 but soon after. The bottom line is that DevOps journeys are not accidental, and they cannot just be focused on automation. All skill and capability domains such as human, functional, technical, process, and frameworks and automation must be continuously improved. Capability assessments (e.g. such as ADOC) are one way of doing that. These assessments need to be done not just once but frequently so that the team knows what is next.

About the Author

Eveline Oehrlich is an industry analyst, author, speaker and business advisor focused on digital transformation. Eveline is the Chief Research Director at DevOps Institute where she leads the research and analysis for the Upskilling: Enterprise DevOps Skills Report and other research projects. Previously, she worked at Forrester Research as research director and principal analyst helping large and small IT organizations with challenges. Prior to Forrester Research, she worked for New Relic and Hewlett-Packard Software.