Multi-Factor risk assessment for DevOps changes

Version 1
    Share This:

    DevOps and IT Change Governance teams need change requests to be approved quickly so that the required updates can be deployed faster to support the business. However, the business should also be protected from bad changes by enforcing risk evaluation. To evaluate the risk level of a change created from a DevOps Development tool,  BMC Helix Multi-Cloud Service Management provides the Risk Calculation service that calculates the risk level of a change request when it is brokered from Atlassian JIRA Software. The calculated risk level data is automatically added to the BMC Helix ITSM Change record.

     

    Risk Management configurations

    As an Administrator, you can view and update the risk management configurations. These configurations define the risk value and weightage for Jira development groups and services that are used to calculate the risk level of a change request.

     

    Note:  Out of the box, Jira does not have specific fields for development groups or services. You can use existing fields in Jira or add custom fields for the values of development groups or services associated with the User Story or Bug.

    The following configurations are available:

     

    Configuration name

     

    Purpose

    Development Groups

    Defines the risk value associated with a Jira development group.

    If the development group used to create a Jira issue does not exist in the BMC Helix Multi-Cloud Service Management configuration, it is automatically when a Jira issue is created.

    By default, the risk level for the group is set to 50. You can update this value as per your organization's requirement.

    Risk Mapping

    Defines the mapping of the risk values to High, Low, and Medium.

    Out of the box, the following values are defined:

    • Low: 0 - 10
    • Medium: 11 - 60
    • High: 61 - 100
    Risk Rules

    Defines the weightage to be used when calculating the risk level.

    Note: To activate the Risk Calculation service, at least one Risk Rule must be defined.

     

    Activating the Risk Calculation service

    To activate risk calculation, you must complete the following tasks:

    • Update the Create Change flow to map the Jira fields to be used for risk calculation to the Vendor Group and Service fields in Multi-Cloud.
    • Define at least one risk rule.

    To update the Create Change flow

    1. Log in to BMC Helix Multi-Cloud Service Management, and navigate to My Flows.
    2. Open the Create Change flow.
    3. Click the Details tab.
    4. Expand the Field Mapping. Map the following Multi-Cloud fields to the Jira field used to define the risk calculation factors.
      1. Vendor Group to the Jira field that is used for defining the development group.
      2. Service to the Jira field used for defining the service.
    5. Save the flow.

    To define a risk rule

      1. Log in to BMC Helix Multi-Cloud Service Management and click Settings.
      2. Navigate to Risk Management > 4. Risk Rules > Map Risk Rules.
      3. To add a new risk rule, click +Risk Rule.
      4. Add the following values:

        Field Name

        Description
        Source MetricsSelect the value based on the source for which you are defining the metrics: - Risk Metric - Development Group—Rule for a development group metric - Risk Metric - Technology Service—Rule for a service metric
        WeightThe weight % to use when using this metric to calculate the risk level.
        Technology ProviderSelect JIRA.
        StatusSelect Enable to make the rule active.
        DescriptionEnter a short description for the rule.
      5. Click Save.

    How the risk values are calculated

    1. When an issue is created in Jira, the user selects a service and development group.

    2. In the corresponding BMC Helix Multi-Cloud Service Management record that is created, the Risk Calculation service calculates the risk level based on the Development Group and Service metrics defined in BMC Helix Multi-Cloud Service Management.  These metrics include the risk value and the weight for the Development Group and Service.

      • Weightages are defined in the risk rules.
      • Risk value of the development group is defined in the Development Groups configuration, and that of a service is defined in from the Risk Metrics - Service record of the Risk Management service.
      • For example, the risk values defined for a specific development group and Service are 5 and 50 respectively, and the risk rule defines the weightage of the development group as 70% and service as 30%, risk level is calculated as follows:((5 * 70) + (50 * 30)) / (70+30) = 18.5Since the valid risk level for a Change record has a value ranging from 0-4 (Level 1 - Level 5), the risk value is normalized to match the range of the enum value:18.5 / 100 * 4 = 0.74 = 1 (round off) = Risk Level 1
    3. The risk level is added in the change record created in BMC Remedy with Smart IT from the BMC Helix Multi-Cloud Service Management record. When the change request is approved and moves to Planning in Progress, the Jira issue is updated with the approval status providing the DevOps team the current status of a change request.
      • NOTE:  You can configure auto approval rules in BMC Helix ITSM so that low risk changes are automatically approved and high risk changes are evaluated before being approved.

    4. The Risk Calculation services track the status of the change requests. When the change is completed, based on the success or failure of the change, the risk level of the development team is increased or decreased by 20. However, the range of the risk level is maintained between 0 - 100. This ensures that risk levels are realistic and based on the capability of a development team to deliver a change.

      • For example, the risk level defined for the development team working on the change request is set to 40. If the change they are implementing is closed successfully, the risk level of the development team is automatically reduced to (40-20)=20.If the change they are implementing is closed as a failure, the risk level of the development team is automatically increased to (40+20)=60.Note, if the risk value is 90, it is incremented to 100 for a successful change. Similarly, if the risk value is 10, it is decreased to 0 for an unsuccessful change.