DevSecOps in Practice

The Cost of Failure is Education

If incidents occur, they should be treated as learning opportunities. Adopt the blameless approach of postmortems from the SRE world.

Incidents and outages are inevitable in large-scale, complex, distributed systems. Postmortems are essential for learning and improving services. Blameless postmortems focus on understanding the root causes of incidents without assigning blame to individuals. They should be conducted in a safe environment where team members feel comfortable sharing their experiences and insights. The goal is to create a report that identifies the root causes and fills the backlog with actionable items to prevent similar incidents in the future.

This is an example of a blameless postmortem template:

Date: YYYY-MM-DD

Title: [Incident Title]

Status: [Resolved/In Progress]

Summary: [Brief summary of the incident]

Impact: [Impact on users, services, etc.]

Root Cause:
    - [Root cause 1]
    - [Root cause 2]
    - [Root cause 3]

Triggers:
    - [Trigger 1]
    - [Trigger 2]
    - [Trigger 3]

Resolution:
    - [Resolution 1]
    - [Resolution 2]
    - [Resolution 3]

Detection:
    - [Detection method 1]
    - [Detection method 2]
    - [