[2/3] Are reliability and security additional options or the foundation for modern IT systems? (Category Architecture)

Continue. story about my speech at PHDays, I will share the remaining part of the theses and materials. In the last post, I ended with examples from Western bigtech companies, and then I wanted to talk a little bit about how it works at T, and also give tips on how to make reliability and security a fundamental part of development, rather than an option:)

Well, we start with the fact that we have a developer ecosystem inside the company, which is represented by the PaaS platform Spirit, which consists of a large number of components. But let's start with principlesThis is what kids do when they build a platform.

• Repeatability and transparency of the code lifecycle within delivery processes. The code goes through the same stages: writing, building, different forms of testing, updating documentation, rolling out to the environment, quality control after rollout, support and decommissioning. It is important that any developer understands what is going on and what stages of the process they need to go through.
• Code base management and quality assessment at all stages. The quality of the code base is one of the main characteristics of the technical product. The ability to keep it at a consistently high level is an indicator of the sustainability and maturity of development processes. Transition to Inner Source in the company. Reusing the code and the achievements of colleagues is a big plus for the company. This helps reduce development costs and increase the speed of business feature delivery. The platform should help share code quickly and painlessly.
• Results orientation. When a developer has all the necessary tools to manage the product lifecycle, it saves a lot of time. It becomes easier to create new features and fix old ones, run tests and more. We want developers to be able to spend on creating business features. 80Percentage of working time without being distracted by routine and infrastructure complexity. Ultimately, users benefit from this. Platform components are presented at schemeBut if you mention some of the most important things for safety and security, then

• Sage Observability platformIt is used for centralized collection and analysis of telemetry of all services of the company. Sage ensures transparency of business applications and IT infrastructure and helps maintain service continuity.
• FineDog - Incident management platformIt helps T-Bank to quickly identify service failures, reduce the time to resolve them and prevent the recurrence of the same incidents.
• Nestor Copilot for code suggest and chat within the IDE, as well as other tools near the code and beyond.
• Safeliner It is an AI security assistant for development teams that can work both inside the CI/CD steps and be integrated into the IDE as a plugin. At the same time, it should be noted that the guys from Spirit are actively working on the topic developer experience and they talked about it in the report “Why DevEx is important in the development of IDP and how to measure it”. (I mean, told). This allows them to collect engineering experience metrics and determine what needs to be improved inside the platform.

But it’s great to have a mature platform and processes around reliability and security, and what if you don’t have one?

Change needs to happen. At the level of the company's strategy, make these issues a priority, determine clear goals. (And put them in OKR.)agree on the allocation of resources At the company culture level, make security & reliability a shared responsibility of teams. At the architectural and design level, consider these architectural characteristics and use best practices. At the process level, they must be integrated into pipelines. (devsecops and shift left)

All of this needs to be managed as a big change project using change mgmt approaches.

#SRE #SystemDesign #Software #Architecture #Metrics #SoftwareArchitecture #Engineering