DevSecOps Adventures: A Game-Changing Approach with Chocolate, LEGO, and Coaching Games

Table of Contents
About the Author
About the Technical Reviewer
Acknowledgments
Chapter 1: Introduction
	Who This Book Is For
		Audience
		Facilitators
		Organizations
	Facilitating Culture Change with Games
	How I Got Started with Designing Coaching Games
	How About You Now?
Chapter 2: About This Book
	What’s New in the Second Edition?
	How to Use This Book
	What’s Included in the Appendices
		Role Cards
		Mod Cards: Special Instructions That Modify the Game
		Team Handouts
		In-room Posters
			Visible Posters
			Hidden Posters
		Debriefing and Ideas Crowdsourcing Resources
		Coaching Games for Psychological Safety
	Electronic Version of the Appendices
Chapter 3: Brief History of DevOps and DevSecOps
	DevOps
		Functional Silos and a Low-Trust Culture
		The Movement of People Who Cared
		No Longer “for Unicorns Only”
		Refocusing on Culture
			2013
			2014
			2018
			2019
		Psychological Safety
	DevSecOps
	Summary
Chapter 4: What You Will Teach with LEGO and Chocolate Simulation
	Ideas from “The Phoenix Project”
	The First Way of DevOps
		Bottlenecks
		Technical Practices Supporting The First Way
			Continuous Delivery
			Containerization and Microservices
			Infrastructure as Code
	The Second Way of DevOps
	“Shift Left” and “Shift Right” of DevSecOps
	Scrum and Agile
	Summary
Chapter 5: LEGO and Chocolate: Rules of the Game
	Summary and Aim of the Game
	Player Roles and Avatars
		Scrum Team
			Patricia Product
			Danny Developer
			Tim Tester
			Samuel Scrum
		IT Operations Team
			Adam Admin
			Robert Release
		Security Team: Sara Security
		Business Team (Benjamin Business)
		Surprise Character: Harry Hacker
	Basic Game Flow and Modifications
		Sprint 1: Feel the Pain
		Sprint 2: First Steps to DevSecOps
		Sprint 3: Continuous Delivery of Value
	Summary
Chapter 6: Game Components
	Role Cards
	Mod Card
	Supplies for One Scrum Team
	Supplies for Operations Team
	Supplies for Sara Security
	Supplies for Business Team
	Supplies for Harry Hacker
	Supplies for the Facilitator
	Complete List of Component Links
	Summary
Chapter 7: Setting the Space
	Setting Up the Room Posters
		Visible Posters
			LEGO Animal Exchange Board
			Delivery Board
			Learning/Debriefing Poster
		Hidden Posters
			Cross-training “FEEL” Poster
			Innovation Center: “Known Good Configuration”
	Room Configuration Options
		Optimal Configuration (4 Tables x 21 People)
		Small Group Setup (3 Tables x 9–14 People)
		Medium Group Setup (4 Tables x 15–25 People)
		Medium Group Setup (5 Tables x 18–28 People)
		Large Group Setup (6 Tables x 28–42 People)
		Large Group Setup (7 Tables x 38–56 People)
		Extra Large Group Setup (11 Tables x 57–84 People)
		Scaling Beyond Extra Large (22 Tables x 124+ People)
	Summary
Chapter 8: Know Your Timebox
	Visible Interval Timer
	Session Plan for an Experiential DevSecOps Training (3 hours)
	Session Plan for a Standalone LEGO and Chocolate Simulation (90 minutes)
	Room Setup and Teardown Timebox
Chapter 9: Be the Gamemaster
	Facilitation Script for DevSecOps Training with LEGO and Chocolate Game (3 hours)
		Turn and Talk (5 min)
		Introduce Yourself (3 minutes)
		Introduce the First Topic: Misalignment of Goals (10 minutes)
		Introduce the Flow of Sprint 1 (6 minutes)
		Sprint 1: Feel the Pain (18 min)
		First Debriefing (12 minutes)
		Introduce the Next Topic: First Way of DevOps (7 minutes)
		Introduce Process Modifications of the Second Sprint (2 minutes)
		Sprint 2: First Steps to DevSecOps (18 minutes)
		Spring 2 Debriefing (15 minutes)
		Optional Break (10 minutes)
		Introduce the Final Topic (8 minutes)
		Introduce Process Modifications for the Final Sprint (4 minutes)
		Sprint 3: Continuous Value Delivery (18 minutes)
		Introduce the Final Debriefing Activity (3 minutes)
		Final Debriefing: User Experience Fishbowl (27 minutes)
	Facilitation Script for a Standalone Version of the LEGO and Chocolate Game (90 minutes)
		Introduce the Game (8 minutes)
		Sprint 1: Feel the Pain (15 minutes)
		First Debriefing (10 minutes)
		Introduce Process Improvements and Modifications for the Second Round (2 minutes)
		Sprint 2: First Steps to DevSecOps (15 minutes)
		Spring 2 Debriefing (10 minutes)
		Introduce Process Improvements and Modifications for the Final Round (2 minutes)
		Sprint 3: Continuous Value Delivery (15 minutes)
		Final Debriefing (13 minutes)
	Summary
Chapter 10: Fear in the Workplace Coaching Game
	When DevSecOps and Organizational Culture Collide
	Symptoms and Impact of Fear in  Organizations
	Fear-Inducing Organizational Changes
		DevSecOps Transformations
		Mergers and Acquisitions
	Reorgs and Layoffs, Is There a Better Way?
	Team-level Fears
	Facilitating the Fear in the Workplace Game
		Option One: A Competitive Game
		Option Two: A Collaborative Game
		Option Three: A Short Activity for an Extra-large Group
	Teaching the Third Way of DevOps with the Fear in the Workplace Game
	Summary
Chapter 11: Safety in the Workplace Coaching Game
	How to Use This Game
	Safety Enhancers Collection
		SCARF® model
		Status
			Model Asking Clarifying Questions
			Ask For & Provide Candid Feedback
			Model Vulnerability: Ask for Help
			Manage by “Not Knowing”
			Speak Candidly about Ambiguous Threats
			Share Concerns Cross-Hierarchy
			Amplify Signal (“Helpful Cassandras”)
		Certainty
			Practice Heavy Transparency
			Bring Up Uncertainty, Interdependence, Impact
			Host Failure Parties (Fail–Learn–Move on)
			Frame Silence as an Unethical Choice
			Uncouple “Fear” from “Failure”
			Change Terminology, Reframe Error
			Reframe the Role of the Boss
			Adopt an Experimental (vs. Operational) Mindset
		Autonomy
			Success through Course Correction: “Early, Often, Ugly”
			Practice Inclusive Leadership
			Experiment with Dynamic Reteaming
			Abandon “Trust-Destroying” Practices
			Discover & Amplify Voices through Open Space
			Design Structures for Input
		Relatedness
			Practice Speaking about Feelings
				If your current mood was a weather pattern, how would you describe it?
				What version of you is showing up here today?
				Check-in with “I feel . . . (Mad |Sad |Glad |Afraid). I am In.”
			Take Team Outside (Share Experiences Together)
			Create & Share Your User Manual
			Increase Communication Frequency in the Team
			Run Frequent Retrospectives
			Introduce & Use Core Protocols
		Fairness
			Embrace Sustainable Pace
			Co-Create Team Norms
			Negotiate Boundaries with Delegation Poker
			Measure Team’s Health & Safety
			Go After the “Things that Suck”
			Anti-Gossip Rule: “Fire Slimy Weasels”
			Respond Productively (Curiosity over Blame)
			Emphasize the Goal
	Summary
Chapter 12: ​​Master Your Debriefing
	Why Is Debriefing Important?
	Debriefing Models
	Debriefing Tips for DevSecOps Games
		Debriefing Sprint 1
		Debriefing Sprint 2
		Debriefing Sprint 3
		Debriefing Sprint 4
		Summary
Chapter 13: Key Takeaways
	Visualizing Bottlenecks and Silos
	Benefits of Cross-training
	Concerns about the Cross-training
	“Shift-left” on Security
	DevSecOps’ Impact on Business
	Fearless Culture
	Summary
Chapter 14: Frequently Asked Questions
	LEGO and Chocolate Simulation
	Fear in the Workplace and Safety in  the Workplace Games
	Facilitation with Remote Teams
	Summary
Chapter 15: Play History and Modifications: It’s All about the Feedback!
	2013: Minimum Playable Version
	2014–2015: First Public Workshops (v 1.0)
		Global Scrum Gathering New Orleans, May 2014
		Global Scrum Gathering Berlin, September 2014
		Toronto Agile and Software, November 2014
		Play4Agile in Rückersbach, February 2015
	2016–2018: More Public Workshops (v2.0)
		Agile Days 2015, March 2015
		XP2015, May 2015
		Agile2015, August 2015
		Global Scrum Gathering Prague, November 2015
		Rakuten Technology Conference, November 2015
		US, Brazil, and Portugal Conferences in 2016
		Content Delivery Redesign with TBR in 2017
	2018: The Fear in the Workplace Is Born!
		Fear-Focused Retrospective at HBC Digital
		AgileCamp2018 Conference, New York, September 2018
		Agile + DevOps East Conference, Orlando, Florida, November 2018
	Train-the-Trainer Workshops
	2019–2020: More Workshops, Design Iterations, and Global Pandemic
		AgileCamp2019, New York, October 2019
		OOP2020, Munich, Germany, February 2020
		Agile India 2020 and the Failed Attempt at Online Conversion
		2021: Fear in the Workplace and Safety in the Workplace, Online Edition
	2022: DevOps Coaching Games Are Back!
Chapter 16: Kickstarting Transformations with Games: Field Stories
	Karl Métivier, Canada
		1. Ensure Buy-in and Continuity
		2. Watch Out for Habitual Behaviors
		3. Draw Attention to Business Needs
		4. Ask: “How Can We improve?”
		5. First Master the Games, Then Modify Them
	Dr. Peter Fassbinder, Germany
		Virtual Adaptation with a Focus on Flow
			Major Simplifications
			Tools and Setup
		Key Observations
			This Simulation Works Well as an Eye-opener
			“Shift-left” on Security Benefits the Team
			The “One-Piece Flow” Requires a Mindset Shift
			New Processes and a Competency Build-up Are Necessary for Avoiding Chaos
	Wayne Hetherington, Canada
	Norma Hernandez Garcia, José Luis Ortiz González, and Jorge Gándara, Grupo Salinas, Mexico
		Virtual Adaptation
		Dealing with Skeptics
		Trainer’s Attitude Plays an Important Role
	It\'s a Wrap!
Appendix: Design Assets, Posters, and More...
	Part 1: Design Assets and In-room Posters for Running the LEGO and Chocolate Game
		Role Cards
			Scrum Team (Danny Developer, Tim Tester, Patricia Product, and Samuel Scrum)
			Operations Team (Adam Admin, Robert Release)
			Security Team (Sara Security)
			Business Team (Benjamin Business)
			Hacker (Harry Hacker)
		Mod Cards
			Adam Admin, Sara Security: Sprint 1
			Sara Security, Benjamin Business: Sprint 2
			Patricia Product: Sprint 3
		Workshop Handouts
			Packing Checklist (21-person group)
			In-room Posters
				LEGO Animal Exchange poster with PBI cards
				Delivery Board Poster for 4 Scrum Teams and 3 Sprints
				Key Takeaways Poster
				Cross-training (FEEL) Poster
				Known Good Environment Configuration Poster
	Part 2: The Liberating Structures Referenced in This Book
		1-2-4-All
			Sequence of Steps:
			If You Need to Run It Virtually:
		What? So What? Now What?
			Sequence of Steps:
			If you need to run it virtually:
		User Experience Fishbowl
			Sequence of Steps:
			If you need to run it virtually:
		25 – 10 Crowdsourcing
			Sequence of Steps:
			If you need to run it virtually:
		TRIZ
			Sequence of Steps:
			If you need to run it virtually:
		Tiny Monsters (a.k.a. Tiny Demons)
			Sequence of Steps:
			If you need to run it virtually:
Index