Within a traditional separate Development and Operations organisations, procedures and processes are put in place to ensure that relationships between software vendors and suppliers are maintained. These relationships exist so that when for example a vulnerability is discovered operations teams are able to identify the business impact and mitigate appropriately.
If that organisation was built around ITIL service management principals then they would likely be doing one or all of the following:
With the assumption that the Operations role doesn't exist as a separate entity within a DevOps enabled organisation, how is an organisation collectively or severally meant to maintain supplier/vendor relationships so that when a vulnerability is publicised the teams can respond by reaching out to the vendor to understand remediation and mitigation actions.
Conceivably we could:
- Ask all of the Scrum teams to own their vendor relationships and act accordingly, this seems scalable but at the cost of a high overhead across an organization.
- Maintain a central function responsible for these relationships, this central function may not have the full context the the Cross-functional teams have.
- Use a 3rd Party automated service to scan infrastructure and applications to maintain a dynamic inventory which can be assessed for known vulnerabilities, this however doesn't actually maintain a relationship with vendors and is only as good as it's database of known vulnerabilities.
What strategies do you use?