Veterans Affairs driving new software capabilities by making DevSecOps part of its culture

Date: On Demand
Duration: 1 hour
Cost: 
No Fee

When the Veterans Affairs Department committed to move to an agile development methodology in 2018, only 22% of its projects were delivering new capabilities in less than 90 days.

VA was caught in that in-between world of agile and waterfall approaches.

The challenges of moving to a fully agile development methodology was more about changing the viewpoint of their customers and less about the technology or application development process themselves.

Dan McCune, the acting associate deputy assistant secretary of the Enterprise Program Management Office at the VA’s Office of Information and Technology, said too often mission areas would only “get one drink at the water fountain” and try to ask for as many features and functions as possible.

McCune said the goal to deliver capabilities more quickly was to get its mission areas to think agiley.

“We want to we want to package things up smaller and the customer has to be able to take these big things and break them up into bite sized chunks and so we had some evolving to do both in IT and our customer to get to where we are today,” McCune said on Ask the CIO, which was sponsored by GitLab. “Today, over 80% of our products are releasing within 90 days, and most are releasing every two weeks. We want to get feedback from our customer early. We use the term fail quickly where we don’t want to fail, but it’s better if we discover something that’s wrong earlier than later. Certainly getting that quick feedback from our customer helps us to make quick course corrections and quick pivots as well.”

McCune said several high profile successes have helped create that much-needed culture change.

He said the MISSION Act, which President Donald Trump signed into law in 2018, and Blue Water Navy Act of 2019, were two examples of where agile and DevSecOps capabilities helped implement the laws quickly and effectively.

“With a short timeline with the MISSION Act in particular, we had six months to deliver what would normally have taken us multiple years. Our ability to deliver fast and our ability to prove success at delivering short iterations has encouraged our customers,” McCune said. “It’s been about building of a narrative and a building trust. I think as that trust grows, our customers start to see us more as a partner. They understand and trust that we’re bringing best of breed and industry best practices.”

Collapsing the developmental siloes

The implementation successes helped VA make the move to a full DevSecOps and agile development methodologies.

McCune said along the way VA improved its software development lifecycle (SDLC) practices, the training of technology and mission employees around agile and Dev/Ops and, of course, technology that underpins the processes.

“We were very fragmented in pillars or silos of excellence, and particularly between development and operations, we throw it over the wall and there’s that. We weren’t distilling information as it passes from one team to another so we were losing context, losing the architectural principles that were used to create that software,” he said. “We’ve really brought those two teams together and created a DevSecOps team. We have a phrase called ‘you build it, you own it,’ as a way to epitomize our shift from development and operations to DevSecOps.”

The biggest differences VA’s software development effort has seen is around its velocity of capabilities delivery. McCune said time to go from need to capability delivery has increased by 400% over the last couple of years.

The other major factor in VA’s success has been the move to cloud and a low code, no code platform.

“I think we find in in VA that traditionally we spend with legacy coding models about 80% of our resources on non-value add activities that really don’t deliver business value,” McCune said. “With low code, no code platforms, we’re able to flip the script. We spent about 20% of our resources on those non-value added activities and 80% that were focused on delivering business value. It’s a great accelerator. We’re able to accelerate 6x of the delivery of new software solutions that used to take us almost 18 months, now we do it in 90 days.”

Software factory coming soon

To keep the momentum going, VA is launching an Agile Center of Excellence and a software factory.

The Agile CoE (ACoE) is further along than the software factory, but McCune said both will further the move to agile and DevSecOps.

“The ACoE is managing our transition to product line management DevSecOps. They’re key and instrumental in building our dashboards. I’ve got one dashboard now that I can look at either at the product level, or even at the portfolio level, and get a real good indication of our complete DevSecOps health,” he said. “The next level, our software factory, is a little newer. We’re just getting started with that. It’s really, I think, a next generation of what we’re doing with development. In my last job, I led a development shop and we had hundreds of 1000s, maybe even millions, of lines of code written in a bunch of different languages. It’s it really kept me awake at night, thinking about the need to refresh that code, the amount of technical debt we were accruing every single day that code sat there. That really was the genesis for our move to low code, no code, and we started to develop platforms, and software factories are really the next generation of that.”

He said the software factory includes people skilled and familiar with the tools, the processes that are all optimized on a single technology platform to deliver software applications.

New training application to connect employees

The other piece to this effort is continuous training. McCune said VA soon will launch a new initiative called guilds, communities of staff members who share a common interest. Guilds encourage cross-functional creative problem solving in a setting without chains of command.

“One of the traditional problems with content that comes from the front office or from leadership is leadership can put their own spin on it. They have their own goals that they want to achieve with that training. Our people have their own organic needs for information and for learning. The other thing I find is, no matter how skilled we are at delivering training material, our people need to understand it within context, how have you solved problems with the same problems that I have in the same parameters that I have?” McCune said. “Guilds is this idea that it’s really more organic and driven by the workforce themselves. What they’ll have is topics. DevSecOps is a great one or product line management or automated testing are all topics that they can show interest in, and then they can meet and talk about those issues. They talk about their lessons learned. They talk about some of the things that they’ve learned, some of their successes and maybe some of their roadblocks. They can learn from each other. It’s not facilitated by leadership. It’s not organized by leadership, it’s really driven from the workforce themselves.”

He added guilds isn’t just for technology or DevSecOps, but for any topic VA employees are interested in.

McCune said all of these efforts are pointed to ensuring veterans have the best services possible so that also means moving more than 500 applications off of old coding languages including COBOL and Ruby on Rails.

“We’re really in the age of software. All you have to do is look at your iPhone or your Android phone and the number of applications you have installed, to know that the demand for automation and the demand for software is growing, and certainly that’s just as true in VA,” he said. “On average, our software inventory is growing 16% a year. We’re adding new software all the time. Certainly during COVID, we saw a kind of a tsunami of new software solutions come. We’ve got a very heterogeneous development environment, and those languages aren’t going away, but it will be modernized over time. Really our low code, no code solution is focused on those newer things that are coming in. It creates new opportunities for our staff as well. If they felt pigeon holed and writing COBOL on a mainframe, right now they’ve got opportunities to do something that’s a little bit more modern and forward leaning.”

Learning objectives:

  • People, process and technologies at VA
  • The Development of VA’s software factory and Agile Center of Excellence
  • The role of automation in VA’s it modernization strategy
  • The industry perspective

Complimentary Registration
Please register using the form on this page or call (202) 895-5023.

This program is sponsored by   

By providing your contact information to us, you agree: (i) to receive promotional and/or news alerts via email from Federal News Network and our third party partners, (ii) that we may share your information with our third party partners who provide products and services that may be of interest to you and (iii) that you are not located within the European Economic Area.

Comments

Featured speakers

  • Dan McCune

    Acting Associate Deputy Assistant Secretary of the Enterprise Program Management Office, Office of Information and Technology, Department of Veterans Affairs

  • Bob Stevens

    Area Vice President, Public Sector, Gitlab

  • Jason Miller

    Executive Editor, Federal News Network