f-secure cloud software icgse2013

Protecting the irreplaceable | f-secure.com

Janne JärvinenDirector, External R&D Collaboration & Focus Area Director – Cloud Software program

When Cloud is not enough –Experiences from CloudSoftware Program

Protecting the irreplaceable | www.f-secure.com

Who am I ?

• Janne Järvinen has over 20 years of experience in software engineering and software process improvement.

• Work experience from various positions in software industry from programmer to VP Engineering in small and large software companies.

• PhD in Information processing science from VTT/University of Oulu (2000). Involved in SPICE (ISO15504), ESPRIT(BOOTSTRAP, PROFES) and ITEA (MOOSE, MERLIN, FLEXI, EASI-CLOUDS).


• F-Secure Company Intro

• F-Secure History in Agile

• Cloud Software Program

• Lean Software Enterprise

• The Next Big Thing

ICGSE 2013 – Janne Järvinen

Agenda


August 28, 20134

August 28, 20135

F-Secure Locations

28 August 20136

F-Secure - Russian Development CenterKey learnings

• Minimize handovers – Concentrating all thedevelopment of one product family to onelocation brings clear benefits

• Focus on the essential – You can outsource everything except professionalism and passion

• Standardize and centralize everything in your processes – Using the sametechnologies and tools in developmentprocesses minimizes the cost of hassle and re-inventing the wheel

• Use your charm to beat the big boys whenrecruiting – When competing as an unknownlittle player in the recruiting market, find a way to use your small size as an advantage

© F-Secure PublicAugust 28, 20137

F-Secure Locations

28 August 20138

F-Secure - KL Development Center Key learnings

• Going pretty pure scrum-organization:

• Sprints + 5% workshops, getting to understand the minimum viable scope works. These are still kept.

• Scrum masters do not work: too many fellows start to expect spoonfeeding on everything. No more scrum masters, teams responsible for their own work

• Lean improvements:

• Mental thinking to do improvements that cater for wider scope than your own (processes, tools)

• Works well, although too easy to just “fix fast”, needs constant monitoring, results need to be highly visible

• Getting organized

• Giving teams more “area of Freedom” works, 1 (senior) manager able to manage ~25 fellows









Agenda


DiscontinuationGeneral AvailabilityProduct Realization

R1S1 V3 V1V2

ReleaseDevelopment

D1S2

Business and Feasibility

Study

System

Test

Beta

Validation

RC

ValidationReleasingDevelopment Iterations

Screening Validation

D2

Product life-cycle and product realization cycle

DA Dn ...

Product &

Project

Elaboration

Product &

Project

Initiation

Product Life Cycle Management

From Waterfall to Agile at F-Secure

FPRP – F-Secure Product Realization Process

F-LEX

Lean Software Enterprise at F-Secure









Agenda


The new Finnish Growth by Collaboration

ICT leadership

Cloud Software

Next Media

From Data to Intelligence

Future Internet / IoT

Service program

Device and Interoperability

Data intensive digital services& ICT Enabling the transformationof other industry verticals

DIGILE* programs Goal Business focus and growth

* DIGILE = Finnish Strategic Center for Science, Technology and Innovation

SRA - Possibilities for Collaboration

16

SRA*

Academyproject

Research Applied research Product development

Eureka project Project with China

CompanyprojectCompany

projectCompany

projectCompany

projectCompany

project

Academyproject

Project with USA

Business concept

Business concept

Business concept

Tekes funded program60%/40% rule

*SRA = Strategic Research Agenda

Horizon 2020 project

Horizon 2020 PPP-project

Building the Competitive World-class Software Enterprise in the Cloud

Cloud Business

Lean & Agile Software Enterprise Cloud Technologies

User Experience

Security Sustainability

Succeeding globally in the cloud will require:- Right Business- Right Technologies- Right Organization- Right Timing

Cloud Software Program Consortia

Nokia

Reaktor

Ericsson

Movial

Vaadin

RM5

JAMK University

Program CoordinatorDr. Tua HuomoVTT

AcademicCoordinatorDr. Veikko SeppänenAhtisaari Institute

Focus Area DirectorDr. Janne JärvinenF-Secure

19

Main Achievements so far

Program management • Quarterly incremental

planning and results review & dissemination

• Active participation to Q-reviews (12 reviews so far, 100+ participants per meeting)

Program dissemination•200 publications•2 new international

conferences started - ICSOB, LESS

•Cloud Software Journal started – Communications of Cloud Software

• Major Lean/Agile transformation programs ongoing (e.g. F-Secure, Tieto, Ericsson, EB, EXFO, Nokia)

• Several new cloud service concepts and tools developed e.g.

o Freenest – Platform for agile cloud development

o F-Secure – Content cloud platform and service

o Vaadin – Collaborative SW development

o Owela – Conumers say on cloud services

• New ecosystems being formed, e.g. Ixonos CityOnline, Tieto ApplicationPlatform, F-Secure 3rd party ecosystem

7.3 MEUR savings in H1/2012

Up to 6x faster

delivery

Steeri: Company revenuetripled

already!

20

Main Achievements so far

• Major Lean/Agile transformation programs ongoing (e.g. F-Secure, Tieto, Ericsson, EB, EXFO, Nokia)

• Several new cloud service concepts and tools developed e.g.

o Freenest – Platform for agile cloud development

o F-Secure – Content cloud platform and service

o Vaadin – Collaborative SW development

o Owela – Conumers say on cloud services

• New ecosystems being formed, e.g. CSC Kajaani Datacenter, Ixonos CityOnline, Tieto Application Platform, F-Secure 3rd party ecosystem

Program management • Quarterly incremental

planning and results review & dissemination

• Active participation to Q-reviews (12 reviews so far, 100+ participants per meeting)

Program dissemination•200 publications•2 new international

conferences started - ICSOB, LESS

•Cloud Software Journal started – Communications of Cloud Software

Power of Iterative Planning and Sharing

Jan Feb Mar April May June July August Sep Oct Nov Dec

Q1 Q2 Q3 Q4

March 2013Vuokatti

June 2013Oulu

September 2013Turku

13 Dec 2013Helsinki

Concepts, Demos, etc.

ImpactDeliverablesTechnology, Methods, etc.

Patents, IPRPublications

Working Together –Learning Together

TrueCollaboration

True Sharing

BetterBusiness

BetterCompetitiveness

Energy and environment

(CLEEN)

Built environment (RYM)

What About Exploitation?

• Assets for systemic transformations in Finnish industries and public services• Renewal and accelerated new growth in ICT industry• Digitalization of every industry• Productivity in public services via digitalization

FORGE

Metal products and mechanical

engineering(FIMECC)

Forest industry(FIBIC)

Health and well-being

(SALWE)

Information and communication industry andservices (DIGILE)

Public services

Cloud Software

Next Media

From Data to Intelligence

Future Internet / IoT

Service program

= Category specific service design node

Flo

w o

f re

sult

s








Agenda


Lean Transformation – how to get started?

Lead Time (speed)

Amount of Days

Value Throughput (amount)

Flow of Value

Net Promoter Score(quality)

Width of smile

Work In Progress (sunken investment)

The unfinished things

We need to know.

The six Things we teach

Concepts

• Flow

• Value

• Waste

Tools

• A3

• VSM

• RCA

© F-Secure Public2012-02-2027


Understanding R&D work – Sample Data

0 %

10 %

20 %

30 %

40 %

50 %

60 %

70 %

80 %

90 %

100 %

TP45 TP46 TP47 TP48 TP49 TP50 TP51 TP52 TP53 TP54 TP55 TP56 TP57 TP58 TP59 TP60 TP61 TP62 TP63 TP64 TP65 TP66 TP67

Average of Other

Average of Waste

Average of Maintenance

Average of Improvements

Average of Bugs from Beta

Average of Features

August 28, 201329

Example: Value Stream Mapping leading to better Flow

Value Stream Mapping

We collected facts from all stakeholders and learned the big picture about what we actually do as a company when we decide to make software.

One project was used as a case study to reveal the issues we have. Discussion verified the findings also in broader context


August 28, 201331

ABC3.0

Req.work

ABC3.0 Client

PSI1&2 dev

UX

ConceptingPo Council

3.0 approved

Rescoping 3.0

to 2.3Po Council

2.3 approved

Client, WebUI,

Backend dev

PSG RTM

DecisionPS/Support

Req. added

ABC eu demo

prod upgrade &

fixes

2 Client service

releases, migration

script dev, packaging

rework, customization

Package

validation

Production for

Operator X

Sample Value Stream (case: new UX for ABC3.0)

Activity 6m 2,5m 5m 3w 2dWait 2,3m 2w 1wCumulative 16m

6,5m 1m 2,5m 1,5m 2d

27,5m

2,5 1d 5d 6m

Total 2,5 years Total 3 years

ABC2.3 Kick-

off

ABC3.0

Proj. started

Production for

operator

Fixes, customization,

migration, deployment

X times

1. May 2009 11. March 2010 10. Sep 2010

17. Jul 2011

PPSG

Delay RTM 1m

Client, WebUI,

Backend dev

Client, WebUI,

Backend dev

31. Jan 2011March 2011

9. May 2011 30. Jun 2011

1. Jul 2011

Cost of Delay 460++ kEur

Cost of Delay ?!

19. Oct 2011


Product Development Portfolio

Businessgoal

Businessgoal

Businessgoal

Businessgoal

Businessgoal

Businessgoal

Businessgoal

Businessgoal

Businessgoal

Decision queue Development queue Delivery queue

Roadmap capacity Development capacity Delivery capacity

Through-put


A Sample Flow

Reduction of items in queue

Total cumulative number of deliveries: 15

Relatively even number ofItems under development = steady flow and capacity

Development lead timereducing from ~3 monthsto 1-2 months

August 28, 201334

Example: Business Iteration Planning (BIP) to manage big projects

BIP in brief – the context

• Basic, Scrum-based Agile methodology does not cover scaling

• Dean Leffingwell‘s “Agile Release Train” covers multiple layers of abstraction in all key dimensions of the project:

content, timeline and organization.


Product BacklogProduct Owner 2

Team B

I1 I2 I3 I4

Beta1

BIP

BIP

I5 I6 I7 I8

Beta2

BIP

I9 I10 I11 I12

Release

Epic Feature Story

Reporting Aggregate Reports

As an user I want to see a list of my average spending for each of my budget-lines so that I can get a fast control of my average expenses

Reporting Aggregate Reports

As a end-user I can get a summary report my total spending on a selected set of accounts

Reporting List Report As a end-user I can get a summary report my total spending on a selected set of accounts

Reporting List Report As a end-user I can get a summary report my total spending on a selected set of accounts

Logging ...

Feat

ure

Sto

ryEp

ic Team A

Business Iteration

Product Owner 1

BIP = Business Iteration Planning

Example Project for BIP

• Major new product, significant changes in

• Business model

• Architecture

• Method for Longer-Term Planning, including new backlog tooling

• About 10 teams

• Mostly in Helsinki, some in Kuala Lumpur, later also one in Poland

• Mostly feature teams

• Fairly mature in basic Scrum and Agile engineering practices

• Some experience in multi-team projects but not on this scale


PMPM

AM

AM

Longer-Term Planning in brief – the event


Day 2

Status check

Planningteam breakout sessions

Final plan review

Risk review

Confidence vote

Retrospective

Day 1

Introduction

Project setup

Business Vision

Architecture Vision

User experience and UI

Engineering practices

Planning process intro

Planning team breakout sessions

Draft Plan review

Summary of the BIP method

• New method for handling layers of abstraction in all key dimensions

• Business Iteration for steering in mid-term time scale

• Levels of abstraction in the “Value item” hierarchy: epics, features, stories

• Planning for the Business Iteration with the features and stories in a multi-team setting

• Essential to pay attention to quality and the engineering practices like Continuous Integration and Test Automation

• Never sacrifice quality, never

• Every bug found invokes adding a new test case to the Test Automation suite

• No extra hardening outside of sprints, every sprint results in a customer beta


August 28, 201340

Example: Global Testing Network to get work done together

It took weeks to get TA running…

Back in 2008:

2010: it was days

Now it’s minutes!

Development TEAMS do test automation

Teams develop and ARE RESPONSIBLE for their code,

including test automation code.

Teams receive and SEE THE VALUE of their test automation.

Teams BECOME MORE ENGAGEDin developing their test automation.

© F-SecureAugust 28, 201343

Into the cloud

• Fast self service cloud for everything needed in SW delivery:

• All development

• All testing

• All test automation

• All beta / customer integration

• And all finally production


TestAutomation

ManualTesting

Internet facingtesting

Deliveries

Build Servers

DeveloperVM’s

GTN XTNDEV

XTN EuclyptusBeta

Safe testing cloudF-Secure R&D cloud

© F-SecureAugust 28, 201345

Effects

• Low barrier of entry

• Bye bye to handovers!

• API-happy, pro-automation

• Cost savings

• Time-to-market


• F-Secure Intro




• The Next Big Thin


Agenda

• The Next Big Thing -> Need for Speed – N4S

N4S - PARADIGM CHANGE

• 28.8.2013

N4S - BREAKTROUGH TARGETS

1) Paradigm Change – Delivering Value in Real-Time

2) Deep Customer Insight - Better Business Hit-rate

3) Mercury Business – Find the New Money

48

Route towards Continuous Deployment is just a start…

Integration level in the Company

Cyc

le t

ime

IID

Iterative and Incremental Development1960->

AgileContinuous DeploymentIn company level, software developed to a high standard and easily packaged and deployed to test environments, resulting in the ability to rapidly, reliably and repeatedly push out enhancements and bug fixes to customers at low risk and with minimal manual overhead 2011->

Fast

Vast

Individuals and interactions over processes and tools.Working software over comprehensive documentation.Customer collaboration over contract negotiation.Responding to change over following a plan.2001->

CI

CD

Continuous IntegrationIn RD, merging all developer workspaces with a shared mainline several times a day. It was first named and proposed as part of extreme programming (XP).1999->

N4S Paradigm Change – Real-time Economy

IID

Agile

Vast

Defining and implementing active and continuous strategy and business models in pursuit of new emergent opportunities. Active portfolio and corporate business strategy management, continuous creation of strategic options, fast decision making.Redefinition of competences and capabilities – how to move to business areas not currently company’s core business.

Mercury Business

Real-time

Real-time Value

Delivery

Provide the technical infrastructure and capabilities to allow organizations to deliver new features and new minimum viable products and services significantly faster

Deep Customer

Insight

Significantly improved business hit-rate by linking deep customer insight to the development.Systematic use of real-time feedback, market trends and behavior, analytics & visualization technologies.Develop a tool-based infrastructure for continuous experimentation and live customer feedback

CI

CD

Fast

Cyc

le t

ime

Integration level in the Company

Way of Working changes towards”Super Cells”

51

f-secure cloud software icgse2013

Technology

fsecure fsecure publicaugust

fsecure locations

janne jrvinen fsecure

cloud software journal

fellows fsecure publicaugust

software industry

software engineering

software process improvement