Accelerating innovation with software supply chain management

Editor's Notes

• #2: Research provided by Derek Weeks, VP of Marketing, Sonatype and author of “2015 State of the Software Supply Chain Report”
• #3: We are going to compare building cars with building software – what we are going to realize is the car industry is leaps ahead of the software industry in managing their supply chain – the question is what can we learn from them? We will explore the question, does closely managing our supply chain have benefit in the software industry? I think the answer will be obvious!
• #4: A defective part as simple as a “nut or bolt” can create havoc in a finished product such as a car – it’s clear that each part matters!
• #5: Having a keen eye on the explosive utilization of OSS components, I was VERY interested to see the intersection of the traditional Supply Chain Management principles and how they were used in the software world. I knew there were problems, but after reading “2015 State of the Software Supply Chain” and “The Phoenix Project,” I was astonished to see that many, if not all, of the core Supply Chain Management principles have yet to be or are just starting to be applied to the software industry. The definition of supply chain management is “the collaboration, planning, execution, control, and monitoring of supply chain activities with the objective of creating value.” Probably the most important part of that definition is the collaboration between supply chain activities to create value. Devops and Continuous Delivery have great promise, but velocity without value is not going to cut it – or put another way, even if you are efficiently digging yourself into a hole, you still need to STOP DIGGING!
• #9: These are the principles that Toyota applies. Our customers strive to automate their software supply chain by using better and fewer suppliers, higher quality and secure parts—and confidently track the parts their using and their dependencies. Add wrap it up slide to position or products as solutions
• #11: The suppliers and the manufacturers need to share information. And right now that communication channel is not only broken, it simply doesn’t exist. Components are updated an average of 4X a year to fix issues, but how do the manufacturers even learn about it? …….. Supply chain management at Toyota was transformational. They went from being a textile company to the world’s leading automobile manufacturer, largely because of these improvements and these principles. And even today, the effect of their philosophy is pretty remarkable to me. For example, Toyota-wide, they have 226 suppliers. General Motors has 5,500. And so imagine the efficiencies of only having to deal with 226 suppliers as opposed to 5,000. And what’s further to that, is that GM produces 54% of the content of their vehicles and Toyota produces 27%. So, GM has 1/20th the suppliers, and yet they produce half of the content of their vehicles. And so it’s no surprise that a Volt costs $40,000 and a Prius $20,000. And the Prius sells 20,000 units a month and GM sells 1,700.
• #17: By not using a repo, it’s like going to the grocery store every time you need a glass of milk or a teaspoon of sugar.
• #27: The analogy is sobering, yet fairly close to the truth than one might imagine. Modern software development has evolved into a “software supply chain” where developers re-use open source components from vast public repositories. Unlike traditional supply chains, developer lack the automation and visibility needed to choose better and fewer suppliers, use the highest qualify parts and track what is used where.
• #28: So how do we change that!
• #29: First of all… when you can clearly see the threat levels of components in your IDE, you can easily shift to a safer one. The area here in the lower right works like a slider… you simply slide to the right to identify a safer, accepted version of a component. So you see, you not only see a potential problem early one, but you also see the solution. Better yet… ========= Click onto pane and zoom in and zoom out Guide your eyes to the RIGHT…. This is a normal Developer IDE called Eclipse… Sonatype made a PLUGIN within it to show a developer the component BEFORE before they choose or commit to ELECTIVE/AVOIDABLE Risk/AttackSurface/Complexity/LegalIssues … The RED chain (e.g.) is every version of Strut2-core…. And if you move RIGHT far enough…. It will lack KNOW CRITICAL vulnerabilities. The Green bar charts are the download popularity… which doesn’t speak at all to SECURITY… but may give people more comfort that it is stable and being used. License rsik is based on self-defined policy – we track if the use of this license can cause your whole website to now be FREE common opensource – like GPL… which might be very bad for you… and a DIFFERENT type of risk…
• #32: Toyota’s process innovations brought them enormous gains in productivity, predictability and long term competitive advantage. That is our mission for the world of software development.
• #33: You may know Gene Kim, the author of the Phoenix project - he certainly understands the value of managing your software supply chain!