3 ms·
At my company (80,000+ people, bank), we have an app security department that handles everything. We give them a URL to our test environment for a dynamic scan
by jbob2000 8y ago
At my company (80,000+ people, bank), we have an app security department that handles everything. We give them a URL to our test environment for a dynamic scan and we give them the contents of our release branch for a static scan.
We are not allowed to release until the security scans are done and reviewed with the app security team. We release about once a quarter because of this. We do not practice continuous delivery and doing agile is difficult. There's no gatekeeper, story grooming, product owners, nada. You do what app security says when they say to do it, we work on their schedule.
As a tangent, working for a large company has shown me that agile doesn't really work at this scale. There's too many third parties that you have no control over. And the business is always trying to respond to the market, so projects are changing all the time and people are always shifting roles. I just come in, put my commits on the branch, and pray that the machine has my back.
- motohagiography 8y agoWrt agile not scaling because of 3rd parties you don't control, would you attribute that more to unwillingness or inability of third parties like security to collaborate?
- jbob2000 8y agoI don't want to call it an unwillingness or inability, because they are good people who do good work. I really just think that at our scale, we move with the world, and the world isn't agile nor does it care about agile, it just is. So really, we aren't agile because the world isn't agile. For example, we were preparing to run some world cup soccer promotions based on the teams that won. We literally had to wait until a soccer match finished in order to deliver our changes. How do you practice agile with that kind of restriction?