Yazılım Geliştirm e Sü reçleri ve COB I T

Transkript

1 Yazılım Geliştirm e Sü reçleri ve COB I T Form alis B ilgi Tek n olojileri Tam er Gü lce tam er.gu lce@form alistech.com

2 GÜNDEM

3 Neden Yönetişim ve Uyumluluk

4 Dünyada, Finans Sektörünün BT Harcamaları

5 Harcama Dağılımları

6 Yaşanmış Deneyimler

7 Tehditler

8 Operasyonel Risk

9 Risklerin Ölçülmesi

10 Kurumlar, Standartlar Yönetmelikler Sarbanes-Oxley Act Basel II IAS COBIT OSHA HIPAA 21CFR11 Patriot Act (Electronic Signature records for Food and Drug) (anti money laundering) Gramm Leach-Bliley Act (Financial confidentiality of non public info) DoD / PRO SEC 17a-4 / NASD 3010/3110 ACORD (Certification of electronic records mgt SW products) (Brokers, records for all correspondence)

11 Yönetmelikler (Regulations), Standartlar Düzenlemeler yönlendirici metodolojiler değil, olması gerekeni tarif eder. Standartları bir rehber olarak kullanıyorlar. Düzenlemeler Standartlar ITIL Patriot Act HIPAA Basel II FDA SOX CFR 21 Part 11 DoDAF FEAF CMMi Six Sigma COBiT COSO Ortak noktalar ISO 900x Bütünlük Kesinlik Doğruluk Yetkinlik Görevlerin Ayrımı

12 Denetçi Kuruluşlar

13 Düzenleyici Mevzuat

14 Düzenleyici Mevzuat

15 Diğer Ülkelerdeki Yaklaşımlar

16 Diğer Ülke Yaklaşımları

17 Diğer Ülke Yaklaşımları

18 Standartlar, COBIT Standartların kapsamlarına göre sınıflandırılması Kaynak: COBIT Mapping Overview of International IT Guidance 2nd Edition,

19 BDDK nın Tercih Edilen Çerçeve: COBIT Diğer Standartlarda Kapsanan CobiT Alanları Kaynak: COBIT Mapping Overview of International IT Guidance 2nd Edition, Section=Downloads3&Template=/TaggedPage/TaggedPageDisplay. cfm&tplid=63&contentid=13742

20 COBIT ADIMLARI

21 COBIT ADIMLARI PO - PLANLAMA ve ORGANİZASYON Planlama ve Organizasyon alanı teknoloji kullanımını ve kurumun amaç ve hedeflerini gerçekleştirmeye yardımcı olmak için nasıl en iyi şekilde kullanılabileceğini kapsamaktadır. Bu alan en uygun sonucu elde etmek ve bilgi teknolojileri kullanımından en iyi şekilde faydalanmak için bilgi teknolojilerinin alması gereken organizasyonel ve altyapısal şekli ortaya çıkartmaktadır.

22 COBIT ADIMLARI AI - İktisap ve Uygulama İktisap ve Uygulama alanı BT gereksinimlerini belirleme, teknolojiyi satınalma ve kurumun mevcut iş süreçlerine uyarlama için kurumun stratejilerini adreslemektedir. Bu alan aynı zamanda bilgi teknolojileri sisteminin ve parçalarının hayatını sürdürebilmesi için kurumun kabulleneceği bir bakım planı geliştirilmesini içermektedir.

23 COBIT ADIMLARI DS - Teslim ve Destek Teslim ve Destek alanı bilgi teknolojilerinin teslim yönüne odaklanmaktadır. Bu alan bilgi teknolojileri sistemindeki uygulamaların hayata geçirilmesi ve sonuçları ile bu BT sistemlerinin etkin ve elverişli uyarlanmasını sağlayan destek süreçlerini de kapsamaktadır. Bu destek süreçleri güvenlik konuları ve eğitimini içermektedir.

24 COBIT ADIMLARI ME Gözlem ve Değerlendirme Gözlem ve Değerlendirme alanı kurumun ihtiyaçlarını, mevcut BT sisteminin hedefleri karşılayıp karşılamadığını ve yasal gereksinimlerle uyumluluk için gerekli kontrolü tayin etmek için kurumun stratejilerini irdelemektedir. Gözlem ve Değerlendirme aynı zamanda bilgi teknolojileri sisteminin iş hedeflerini karşılamadaki etkinliği ile iç ve dış denetçilerce yapılan kurumun kontrol süreçlerinin bağımsız değerlendirmesi konularını kapsamaktadır.

25 IBM Rational Yazılım Çözümleri

26 IBM Rational Yazılım Çözümleri Strateji Organizasyon Süreç Uygulama ve veriler Teknoloji Özellikler Yönetişimin Kasamı

27 Yönetişim ve Uyumluluk Denetim

28 Uyumluluk ve Yönetişimi Rekabet avantajına dönüştürme

29 Örnek Sorular

30 Uyumluluk: Gereksinim ve Fırsat Optimize Edilmiş DÖNÜŞTÜRME Uyumu rekabet avantajına dönüştür KONTROL İYİLEŞTİRME Optimize et UYUM Yaptırımlardan kurtul Güvenilir Değil Yaşamını Sürdür İŞ PERFORMANSI Gelişen, büyüyen Daha kolay yönetilebilen, daha şeffaf, risklere daha hazırlıklı, süreçlerinde daha kontrollü, daha hızla büyüyebilen, daha hızlı dönüşebilen organizasyonlar

31 Örnek Proje İş Akışı Tepe Yönetim BT Yönetimi Denetim bir bildirim ortaya çıkardı Risk değerlendirmeli teklif Mimar Çözüm tasarlandı Geliştirme Yöneticisi Yeni versiyon planlandı Takım Lideri Fonksiyon geliştirildi Yeni versiyon tamamlandı Denetim verileri denetlendi Onay Yeni versiyon test için yüklendi Proje maliyet analizi yapıldı ve onaylandı İş Denetçi Kalite Yöneticisi Onay Yeni versiyon onaylandı Onay Onay Geliştirme Operasyon

32 Uyumlu Süreçler Geliştirme: Say what you do?

33 Do What You Say New GUI button Bug 849 Enhanced audit trail 5. Check in changes 1. Select activity 2. Checkout & edit files 4. Test changes 3. Compile and link

34 Müşterimize ne veriyoruz?

35 Be able to prove it! Planlama için teklifler, değerlendirmeler Proje onayı faaliyetleri Denetleme raporları üretim aşamalarını doğruluyor

36 Software Delivery Capabilities That Create Value IBM Service Management Best Practices and Services Process Management Service Management Platform Software Delivery Service Delivery and Support Development Efficiency Operational Management Optimized Infrastructure Project & Portfolio Management Software Change Management Process Composition 36 Build Management Project & Portfolio Management (Rational Portfolio Manager) Manage a portfolio of projects Gain insight into project status and value Streamline capacity and resource management Software Change Management (Rational ClearCase, Rational ClearQuest) Automate collaborative development workflows Manage source code and other assets Track and manage defects and issues Build and Release Management (Rational BuildForge, Tivoli Provisioning Manager) Automate software builds Automate provisioning of multiple environments Help improve software release tracking Help reduce compliance management risk Gain end-to-end process visibility Process Composition (Rational Method Composer) Flexible process authoring and publishing Customize for your team and environment

37 Unified Metrics Provide Visibility into the Business Portfolio Manager Budget Status from Rational Portfolio Manager Defect Glide Path from ClearQuest Testing Status from TestManager Requirements Volatility from RequisitePro Code Churn from ClearCase

38 Closed-Loop Software Build and Release Management Provide an end-to-end view of deployed applications Track information about assets in production Enforce and document process compliance Automate configuration and provisioning Release Develop Build Deploy Implement & Iterate Build & Stage Provision & Validate Server(s) Production Environment IBM Rational ClearQuest Development Assets Build Assets IBM Rational Build Forge Deployment Assets IBM Tivoli Provisioning Manager IBM Rational ClearCase Closed-loop software delivery management

39 Development Efficiency Solutions that Create Value Streamline and Automate Practitioner Tasks to Reduce Delivery Cycles IBM Service Management Best Practices and Services Process Management Service Management Platform Software Delivery Service Delivery and Support Development Efficiency Operational Management Optimized Infrastructure Manage requirements Define, document and prioritize business requirements Document and model business processes Manage quality across the lifecycle Help reduce the total cost of quality Make quality a shared responsibility Deliver software with ease of maintenance in mind Manage architecture for agility Design and document resilient enterprise, application, and service architectures Transform architecture to code Automate component creation

40 Development Efficiency Capabilities That Create Value IBM Service Management Best Practices and Services Process Management Service Management Platform Software Delivery Service Delivery and Support Development Efficiency Operational Management Optimized Infrastructure Requirement s Management Architecture Management Quality Management Requirements Management (Rational RequisitePro, WebSphere Business Modeler) Document and prioritize business requirements Document and model "as-is" and "to-be" business processes Architecture Management (Rational Software Architect, WebSphere Business Modeler, Rational Application Developer, Rational System Developer) Document and model enterprise, application and service architectures Ease the transition between architecture and code Leverage code-driven and model-driven development techniques Quality Management (Rational Functional Tester, Rational Manual Tester, Rational Performance Tester, Tivoli Composite Application Manager) Validate application and system functionality Evaluate and execute performance tests Perform root-cause problem analysis

41 IBM Rational Ürünleri

42 Delivering full lifecycle traceability Business Development Testing These business Requirements Submitted in this Proposal Evaluated against these common Where these Requiring these Changes Operations This Test Cases Executable Produce these on this To this System Test Results Source Code In this Built using these Criteria Build Scripts Estimated at this ROI Obtaining this Approval Impacting this To this Application Delivered in this Which deployed these Build Artifacts Associated with these Deployment Artifacts Obtained this Approval IBM Tivoli Provisioning Manager Release Assigned to these IBM Rational RequisitePro IBM Rational ClearCase Resources IBM Rational ClearQuest IBM Rational IBM Rational BuildForge Portfolio Manager IBM Rational Manual Tester Environment Clear line-of-sight across requirements, change requests, source code, build artifacts, test artifacts Linkage across the development and deployment environment Simplified audit reporting

43 Continuously validate compliance requirements Tester performs automated and manual functional testing based on use cases derived from business compliance requirements IBM Rational Functional Tester IBM Rational Manual Tester

44 Enforce compliance with your development process Sample workflow Submit with control checkpoints E-SIG E-SIG E-SIG Initiate Verify Deploy Dev QA Reject Deployed Postponed Configure electronic signature and workflows to your exact needs For example: Require e-signature by Change Control Board when - Defect is closed - Design is approved - Component passes acceptance test Configurable electronic signature - You choose the actions or state transitions which require sign-off - Authenticates against LDAP directory; if name and password are not valid, no changes are made. IBM Rational ClearQuest

45 Create business rule to implement policy change RequisitePro Analyst Corporate policy is referenced as a source document Analyst proposes a new business rule to automate policy

46 Establish link between Business Rule and Approval Request RequisitePro and ClearQuest Analyst Analyst requests executive approval for the new business rule

47 Route approval request ClearQuest and RequisitePro CIO CIO views work items in ClearQuest Web interface

48 Approve business rule ClearQuest and RequisitePro CIO CIO views approval request, with access to originating policy CIO approves business rule and provides his esignature

49 Assess project impact Rational Portfolio Manager Project Lead Project proposal submitted for planning and assessment

50 Prioritize and approve Rational Portfolio Manager CIO Consistent criteria used to assess and prioritize proposals Auditable project approval authorizes effort (CIO)

51 Find new work items Rational Software Architect and ClearQuest Developer Developer finds new work items in ClearQuest perspective, with links to requirements

52 Analyze change Rational Software Architect and RequisitePro Developer View requirements traceability and associated visual models / use cases to understand problem in detail View requirement details in RequisitePro or Microsoft Word

53 Implement change Rational Software Architect Developer Transform the UML design model into an EJB and automatically generate EJB code

54 Define test case Test management on ClearQuest Tester Tester creates a new Test Case

55 Link test case to requirement Test management on ClearQuest Tester Tester associates test case with requirement in RequisitePro

56 Link test script to test case Test Management on ClearQuest Tester Tester can associate a test script from: -Rational Functional Tester -Rational Performance Tester -Rational Manual Tester -other sources

57 Execute tests Test Management on ClearQuest Tester Configured test cases can then be executed directly from ClearQuest The test log shows a PASS Verdict

58 Attest Tests Test Management on ClearQuest Tester esignature is required for Test Case attestation

59 Stage Deployment Deployment records track each deployment Deployment Manager Deployment tracked for an application Records move through the pre-determined environments Approvals provide auditable gates for deploying into an environment Versioned Deployment Units identify build artifacts to deploy

60 Stage Deployments Add Automation with Tivoli Provisioning Manager Deployment Manager URL to TPM Web UI TPM Deployment status is recorded for reference

61 Build Audit Report Create audit reports with SoDA Project Lead Generate detailed reports from SoDA templates in Word format Reports can generate full traceability, including original requirement artifact, associated use case & diagram, enhancement requests and approval record with esignature

62 Measure for status and for process improvement Rational Portfolio Manager CIO Dashboard and drill down Metrics and Trends Business and technical perspectives

63 IBM BuildForge: Can you reproduce what you built? Must Know Servers Environment JDK Chaining Checksum Bill of materials Source differences per build Defects fixed QA tests run Task timings IBM BuildForge

64 Sorular