3 ms·

Where do FedRAMP/FISMA require manual deployments?

by count 6y ago

a1369209993 6y ago
Because someone, somewhere, sometime years/decades ago, auto-deployed buggy/incomplete code to production, and it destroyed something important, and the 'solution' they came up with was "all deployments must be conducted manually by team lead^W^Wan approved engineer^W^W^Wsome random shmuck".
- count 6y ago
  'Where', not 'why'. I know 'why' people might think that, and make assumptions. The actual controls are pretty level headed though.
nl 6y ago
Totally made up answer ahead, but based on lived experience in a different country. It probably happened like this: In 1995 people started planning for this Y2K bug. Some developer said "Nah it's not an issue I'll just change this field" so they changed it like they change everything else, and then 6 months later people got paid the wrong amount because a date calculation was wrong. So they went looking for someone to blame. They fire the developer of course, but they want someone responsible, who signed off on the release. There was no one, so and with the biggest software fixing exercise in their history coming up they figured they should make sure this problem didn't happen again. So they introduced sign-off procedures, where someone above a certain level had to sign off on things. And that is how manual deployments are "banned". They probably aren't exactly, but some poor person will have to put their job on the line to sign off on automating them.
- count 6y ago
  'sign off' procedures, and 'automated deployments' are not different ends of the spectrum. Nobody who gives a shit about their product/service is deploying from a developer directly into production without any kind of, you know, code review, pipeline testing, etc. It's 'automated' in that you git push. The pipeline handles code reviews, sign-offs, etc., and then automatically deploys the approved code change. This isn't banned at all. Just randomly pushing shit to production is banned (separation of concerns, amongst other controls). You can still have everything be fully automated, just not fully autonomous. Someone reviewing a change and then clicking 'LGTM' is still an automated, continuously integrated and deployed system.

Where do FedRAMP/FISMA require manual deployments?

by count 6y ago

Where do FedRAMP/FISMA require manual deployments?

a1369209993 6y ago

Because someone, somewhere, sometime years/decades ago, auto-deployed buggy/incomplete code to production, and it destroyed something important, and the 'solution' they came up with was "all deployments must be conducted manually by team lead^W^Wan approved engineer^W^W^Wsome random shmuck".

count 6y ago
'Where', not 'why'. I know 'why' people might think that, and make assumptions. The actual controls are pretty level headed though.

nl 6y ago

Totally made up answer ahead, but based on lived experience in a different country. It probably happened like this: In 1995 people started planning for this Y2K bug. Some developer said "Nah it's not an issue I'll just change this field" so they changed it like they change everything else, and then 6 months later people got paid the wrong amount because a date calculation was wrong. So they went looking for someone to blame. They fire the developer of course, but they want someone responsible, who signed off on the release. There was no one, so and with the biggest software fixing exercise in their history coming up they figured they should make sure this problem didn't happen again. So they introduced sign-off procedures, where someone above a certain level had to sign off on things. And that is how manual deployments are "banned". They probably aren't exactly, but some poor person will have to put their job on the line to sign off on automating them.

count 6y ago
'sign off' procedures, and 'automated deployments' are not different ends of the spectrum. Nobody who gives a shit about their product/service is deploying from a developer directly into production without any kind of, you know, code review, pipeline testing, etc. It's 'automated' in that you git push. The pipeline handles code reviews, sign-offs, etc., and then automatically deploys the approved code change. This isn't banned at all. Just randomly pushing shit to production is banned (separation of concerns, amongst other controls). You can still have everything be fully automated, just not fully autonomous. Someone reviewing a change and then clicking 'LGTM' is still an automated, continuously integrated and deployed system.