Making better building security, with a modern DevOps toolchain as a managed service

The challenge

Before 2018, there was no central DevOps tooling for development and IT teams. Therefore, the teams decided to build a common DevOps environment.

In it, it was important to maintain flexibility for the teams, so it should not be mandatory to use the common DevOps toolstack. Each team should be able to extend the stack with their own tools. For the organization to adopt it, the focus was on ease of use and close integration. The toolstack had to be the path of least resistance.

But DevOps is about so much more than tools. It was also crucial to spread a DevOps culture and best practices within the company.

The team set out to find a solution - and there are quite a few methods and solutions out there due to the complexity and width of DevOps. Some important factors that played in were:

• Finding the least common denominator for each team
• Dealing with a plethora of suppliers was not an option - they needed a supplier that could cover all (or most of) their DevOps tools
• Due to the fast adoption rate of their development teams, they had to perform a lot of migrations to the DevOps toolstack. These migration projects were challenging due to suboptimal data structures in their legacy environments.

At the time, the teams spent an unreasonable amount of time hosting their own set of tools on company infrastructure. Often these tools were poorly managed, which led to a lot of technical debt and security issues. And as if that wasn’t enough, most teams did not share any knowledge or best practices with other teams.

These are some immediate ways these challenges manifested themselves:

• Teams were mostly using open-source versions with a limited feature set
• Tools had no connection to the central user directory
• Operating systems and tools were not updated regularly enough
• There was no integration with other tools

The solution 

dormakaba selected the Eficode ROOT managed DevOps platform because:

• Eficode is a full-service provider within many different DevOps tools (40+ of the main ones)
• The team had a strong feeling that Eficode had a very similar culture and understanding as them, of both Agile and ITSM
• Technical excellence was important for them, as well as putting people interaction above following red tape processes

Within Eficode ROOT, Eficode now helps dormakaba host new tools in the DevOps toolstack (Artifactory, CodeSonar, SonarQube, and Xray). But after implementation, dormakaba has concluded that they are not using Eficode ROOT to its fullest extent, and are at the time of this writing, considering expanding usage further.

“We are happy to work with the competent colleagues from Eficode, learning together with them, and always being able to get flexible support from them”. - Christoph Papke, DevOps Evangelist and Damian Jesionek, DevOps Engineer, dormakaba

The result

With their DevOps toolstack managed by the Eficode ROOT team, dormakaba continues to see a wide range of continuous results.

Goals are met

The ultimate goal that has been met is to have a toolstack that is a common foundation for their widely used tools, to support all phases of the software delivery lifecycle. To:

• Free up time for development and operations tasks
• Get the most out of each commercial product they use. Every feature - not only the ones in the open-source version
• Foster knowledge transfer between different teams
• Enjoy stable but flexible hosting of tooling, with support (and issue resolution) around hosting, performance, and scaling

dormakaba currently uses Eficode ROOT to deliver tools for static code analysis (SonarQube), artifact management (Artifactory), and software composition analysis (Xray).

Metrics look good

Although the improvements cannot be quantified exactly, performance has clearly improved in the following areas:

• Mean Time To Recover (MTTR)
• Mean Time Between Failure (MTBF)
• Feature lead time
• Deployments per day
• Number of security incidents

The business is in even better shape for the future

All these positives can be directly translated into overall benefits to the business and its ability to maintain a strong position in a competitive industry.

 Some of these benefits include:

• Development teams can now focus on optimizing their own processes
• Development teams can speed up software development and production deployments
• There are fewer open-source vulnerabilities and license compliance issues
• The team can now focus on DevOps culture, consulting, and sharing best practices

Working together, dormakaba has found Eficode to be always very flexible and fast in adapting to new needs and requirements. Even difficult topics were quickly discussed and implemented (e. g. involving CodeSonar or a PrivateLink connection).

Exciting opportunities to improve even further

dormakaba intends to evaluate and introduce even more DevOps tools to be hosted within Eficode ROOT in the future - tools from other DevOps lifecycle stages that can be added. Especially tools for monitoring and analytics, log aggregation, and automated testing.

They are also considering migrating their Atlassian tools - Bitbucket, Confluence, and Jira. And there is a vision of connecting their own Jira Service Desk to Eficode’s. This would further speed up the process of sharing customer issues with the Eficode support team.

dormakaba’s recommendations for you

Here are some simple recommendations from dormakaba, based on their own experiences:

1. Focus on technical excellence and try to solve problems in a sustainable way.
2. Eat your own dogfood: Use your own tools extensively to find out their weaknesses and ways to improve them.
3. Do not only look at the price and cost involved in a DevOps transformation. Rather focus on the productivity improvements for your teams.