Major Challenges of Systems-of-Systems with Cloud and DevOps – A Financial Experience Report

The term Systems-of-Systems (SoS) refers to a complex system that comprises other systems (the constituent systems), which have operational and managerial independence, geographical distribution, emergent behavior, and evolutionary development processes. DevSecOps (or SecDevOps) offers an approach to guide the implementation of IT Processes, which in turn may support the integration of a cloud environment to a systems-of-systems environment, incorporating information security practices, as well as fostering collaboration between both development and operation teams. It also aims to promote automation of IT processes so that the development of applications and / or services is fast and secure. However, there is a lack of detail in the process definitions to guide the implementation and use of DevSecOps in a Systems-of-Systems environment, especially when it is intended to merge cloud computing into pre-existing conventional infrastructures. In this context, this paper aims at describe the main actions, concerns and lessons learned, during planning and implementation phases, about IT Processes and IT Governance Model to transform an IT traditional environment into Systems-of-Systems environment, considering DevSecOps standards in a large Brazilian financial institution. It will show how IT Processes and IT Governance Model should be changed for incorporating a Cloud environment to a SoS. For doing so, we proposed the use of DevOps techniques as a means to reduce development time without to affect the quality and information security.