What processes enable software vendor/supplier management in a DevOps way of working?

Question

Within a traditional separate Development and Operations organisations, procedures and processes are put in place to ensure that relationships between software vendors and suppliers are maintained. These relationships exist so that when for example a vulnerability is discovered operations teams are able to identify the business impact and mitigate appropriately.

If that organisation was built around ITIL service management principals then they would likely be doing one or all of the following:

• Supplier Management
• Vendor Management
• Risk Management

With the assumption that the Operations role doesn't exist as a separate entity within a DevOps enabled organisation, how is an organisation collectively or severally meant to maintain supplier/vendor relationships so that when a vulnerability is publicised the teams can respond by reaching out to the vendor to understand remediation and mitigation actions.

Conceivably we could:

• Ask all of the Scrum teams to own their vendor relationships and act accordingly, this seems scalable but at the cost of a high overhead across an organization.
• Maintain a central function responsible for these relationships, this central function may not have the full context the the Cross-functional teams have.
• Use a 3rd Party automated service to scan infrastructure and applications to maintain a dynamic inventory which can be assessed for known vulnerabilities, this however doesn't actually maintain a relationship with vendors and is only as good as it's database of known vulnerabilities.

What strategies do you use?

Answer 1

Since you reference the handling of vulnerabilities specifically in your question, I'll speak to this regarding how we handle this within our organization and group of companies.

We have an Information Security department who are responsible to monitoring and detecting vulnerabilities. You could think of this team as being responsible to technical information security management. When vulnerabilities are detected using regular scan with tools such as Nessus or published US-CERT by the information security community, this team passes these vulnerabilities to each Information Security Officer within the group.

The Information Security Officer, who is responsible and accountable for risk management, is tasked at a high level with:

• Establishing Information Security Policy, Standards, Procedures and Guidelines
• Promoting Information Security Awareness
• Completing Information Security Assessments and Audits

Having received the information regarding vulnerabilities, the Information Security Officer evaluates the vulnerability, determines the criticality of the vulnerability and it's impact on the business applications and environment. This information is then given to the appropriate Development Manager.

Development Managers are responsible and accountable for supplier and vendor management. Business Applications are allocated by business domain to various Development Managers. The Development Managers work with either a vendor and/or their own Scrum team to resolve the vulnerabilities withing their domain. Should specialist advice be required, this is provided by the Information Security Officer.

Regarding your possible options.

• Scrum teams might well lack the organizational clout to negotiate and compel vendors to address vulnerabilities quickly. It's also unlikely that the scrum teams themselves would have been in a position to ensure that all the correct legal clauses have been put into the vendor and supplier contracts to ensure that there is an obligation to handle vulnerabilities within a given SLA.
• Maintaining a central function ought to work to a degree, however as you point out they would lack the full context. Three tiers of management, covering three different aspects will address this short coming.
• A 3rd Party automated service will be able to alert you to vulnerabilities, but it will not necessarily be able to correlate those results to a specific business application, and as a consequence a given vendor or supplier. You will still need individual people to manage this aspect.