[1/3] Are reliability and security additional options or the foundation for modern IT systems? (Category Architecture)

Today I am. speaker at the Positive Hack Days conference in Luzhniki with the above topic. And here I will write theses and give links to an additional source. n

1) Why we should discuss these topics now The average cost of failures is growing and now costs about $300k/hour - more in the report "Hourly Cost of Downtime - ITIC" 2024" (here story) The average cost of data breaches is rising and costs about $5M/breach, according to IBM Cost of a Data Breach Report. 2024" (Here's my story. 2 parts: 1 and 2) Average complexity of systems is increasing (Clouds, Microservices and Rapid Change) This makes reliability and security more difficult to maintain. 2) Why this should be discussed at the system and process level (emergent) The whitepaper “Developer Productivity for Humans: Software Quality” by Google (I already am. told about). The bottom line is that to get a quality product, you need to build the process correctly. (conditionally, if you want a good sausage at the meat processing plant, then be kind to build processes taking into account ISO 9000). This is also true for development, and here we chase emergent properties. (Good architecture, reliability, security), that is, those properties of the system as a whole that are not present in any of its individual components, but arise as a result of interactions and relationships between these components. I recommend reading more about Emergence in Wikiand also in the king of physicist David Deutsch.The Fabric of Reality: The Science of Parallel Universes" (The Structure of Reality.)which I mean wrote earlier 3) Approaches to reliability and security Reliability has been popularized by Google through SRE culture – there are three key books: SRE Book, SRE Workbook, Building Secure & Reliable Systems. told Security moved toward DevSecOps and Security by Design, where the former was well documented in the long-standing book Agile Application Security. (I already am. told about)The second is well revealed in the whitepaper "Security by Design at Google", which I too handler. The essence of the whole story is that security shifts to the left and is integrated into development processes. 4) Approaches to architecture and solution design

• ATAM (architecture tradeoff analysis method) Good Approach to Solution Design from Software Engineering Institute (SEI)It is often used in design to reduce risks. In this approach, we have target functional scenarios, accompanying architectural characteristics that often influence each other, and we need to make decisions about trade-offs between them. In fact, there is a good story about this approach in the book "Software Architecture for Busy Developers." told. In addition, the risk matrix approach is often used to take into account risks. And to take into account security risks in design, it would be good to use threat modeling. As a result, we at ATAM have not only functional scenarios that we need to implement in the system, but also Threat modeling threat scenarios that need to be prevented. 5) Case studies from industry leaders Google – I’ve talked about it a lot in the context of SRE and Secure by Design, but I’ll just add their motto: “Hope is not a strategy”, and also remember that to check that everything is taken into account at the design stage, they have a process they talked about in the whitepaper “Improving Design Reviews at Google”. (here survey) Netflix bets on chaos (Chaos Monkey and beyond)To provide resilience to their systems. Read more about the book Chaos Engineering. wrote Amazon’s slogan is “At Amazon, security is job zero.” Section on Security Culture via AWS

Continue in the following post, as in one all did not fit:)

#SRE #SystemDesign #Software #Architecture #Metrics #SoftwareArchitecture #Engineering