Transition plan - Nicole Schwartz - Composition Analysis Off-boarding
Overview
This issue will serve as a tracker for the transition from Senior PM with Secure - Composition Analysis to new company.
This information is intended for Sam White @sam.white as the acting PM but also written with the intent that the new permanent person can utilize this issue as well.
Transition Overview
- Effective Date: 2022-05-06
- Announcement Date: 2022-04-16
PM Composition Analysis Responsibilities
-
Current roleDuties:- Assignee: DRI group decisions (A or B etc)
- known upcoming choice - deciding to go OSS or roll our own for License Compliance
- Assignee: mr / bug triage reports read and make changes if needed
- Assignee: Sales requests
- Assignee: Support requests
- Assignee: Release planning
- Assignee: Monthly Release Kickoff call
- Assignee: Release post content blocks
- Assignee: Deprecations
- Assignee: Removals
- Assignee: Breaking Changes
- Assignee: Monthly Metrics reporting
- Assignee: DRI group decisions (A or B etc)
Meetings
click to expand
- Weekly 1:1 w/EM - FYI
@brytanniawill be@gonzoyumowhen he is out - Weekly 1:1 w/Manager
- every other week: Quality 1:1
@willmeek
Note I generally read the meeting agenda before and do NOT attend every week the meetings below
Mostly on the "Secure Stage Calendar"
- Monday: Weekly Secure::Composition Analysis Group Meeting
- Wednesday: Sec Section Weekly Meeting
- Wednesday: Sec Section Coffee Chat
- Thursday: Composition Analysis Show & Tell
- Thursday: Secure & Protect PM Team Meeting
- Thursday: Product-Marketing sync up
- Monthly: Composition Analysis group retrospective
- Quarterly: Iteration meeting hosted by
@brytannia - IDK: "Secure & Protect UX" weekly, every other week? monthly?
Opening Tasks
click to expand
-
Create transition issue -
Share issue with Manager -
Once announcement is final move to Product Project -
Add retrospective thread for updates to template
Timeline
Week 1
click to expand
-
Update direction page dependency scanning - mr -
Update direction page license compliance - mr -
Share issue in your impacted channels -
Update 2022 plan with Explanation of why priorities are what they are -
Clearly define dependency scanning to complete -
Update stages.yml - MR -
Monthly Kick Off - MR
Week 2
-
Schedule syncs with Transition Parties (if needed) -
Transition any customer calls scheduled to new PM -
Transition any documents, open problem/solution validation -
Transition open release post MRs -
Share planning issues -
Bulk update issues
Updates
click to expand
-
Update triage report assignment in this policy - mr -
Update Team Retrospective Assignments in this repo - MR -
Organization Retrospective could not find assuming /issue_templates/product-development-retro.md- MR -
Team member checkboxes -
no longer exists but updated .gitlab/issue_templates/Sec-Section-PI-Review.md- MR
-
-
Update any www-gitlab-com CODEOWNERS for direction pages - mr
Skip
click to expand
assuming will be done when IT offboards me
-
Update reporting structure in Bamboo -
Update team yml files to reflect changes in role, managers, and specialty if needed -
Update Team/Group/Stage Project permissions -
Consult EM and UX counterparts on group-specific pages or auto-generated issues that need to be updated. -
Consult EMs to add and remove from Google groups as needed
-
could not find my name anywhere
-
Update policy used for issues generated in the Product group. -
Product Issue Templates - SKIP - reviewed and nothing popped out as i would expect my name in it
Cleaning
-
clear 1password vault -
clear passwords in chrome -
clear bookmarks in chrome -
clear harddrive -
reassign MRs -
reassign issues -
clean gitlab projects -
reassign google docs -
clear /action slack pins -
clear/action TODOs -
exercise any shares available
Nicole Goals
-
15.1 (May-June) -
15.2 June-July -
15.3 July-August -
15.4 August-September -
15.5 September-October -
License Compliance maturity plans -
SBOM maturity plans -
Automatic Remediation maturity plans -
Dependency List maturity plans -
how i plan a release and sensing mechanisms i use to fill any space if any -
Current things in flight -
Upcoming decision points -
detail on each item in the generic next 2022 idea bucket -
Longer term plan for Dependency Scanning -
Longer term plan for License Compliance -
Any blockers to downstream decisions (e.g. A, B, C has to happen before we can do X, Y, Z) -
FAQ Any items that you know people will get questions about and an answer so someone can explain why the thing is the way it is -
Tier Plan / EE/CE plan -
try to clean backlog
Relevant Documents
Useful Links
Important Projects
- Exit Codes / Unification and Consistency - 1. everyone always makes a report on sucess or failure 2. all secure and protect 16.0 give same codes for sucess and failure, and always sucess is if it technilogically completed even if it finds things 3. Add a ???? (post job?) that determines if the findings are new or old, if for some reason cheap scans haven't happened yet this should be used to accomplish same where new findings on old things are found, NOT surfaced in MR, Surfaced in Security Center, but new new are surfaced in MR ALSO add a summary data like "0 new" or "3 new - 1 crit, 2 high" 4. have post-job data be the data that is shown in MR to reduce noise 5. enhance scan result policies to do the halt pipeline/fail pipeline nonsense based off this data OR if too hard let users enable a variable that then has the post scan job output failure codes specific to "new findings" if they want to break stuff that way (policy more ideal)
- Scan Result Policies enhance so that it can work with License Compliance (allow deny), then enhance so exceptions can be specific to a dependency, then so it can be specific to a dependency AND version (or range), then so it can also send an audit event on approval (who approved the override, which type), then add comment on override!
- Scan Result Policies enhance so that it can work with Dependency Scanning where exceptions can be specific to a dependency, then so it can be specific to a dependency AND version (or range), then so it can also send an audit event on approval (who approved the override, which type), then add comment on override!
- Scan Result Policies enhance so that it can prevent NAMED dependencies instead of just severities/CVSS/etc, then enhance so it can be NAMED dependency AND version (or range), then so it can also send an audit event on approval (who approved the override, which type), then add comment on override!
- https://gitlab.com/gitlab-com/alliances/alliances/-/issues/261+ `@jkander should be getting access to mailchimp and allowing that to be leveraged to work with our partners
- Design & Spike - associate Dependency and Conta... (gitlab-org/gitlab#348655 - closed)
- split build and analyze - Composition Analysis Container Infrastructure c... (gitlab-org&7860 - closed)
- Replace License Finder
- Dependency Scanning to Complete
- Error Budget
- Automatic remediation bot is blocked on token issue once unblocked need to bot auto-create merge request - status evaluation (gitlab-org/gitlab#343392 - closed) then address any findings then https://gitlab.com/gitlab-org/gitlab/-/issues/343393+
- search take this and apply to dependency list
- grouping
- Cheap Scans - Placeholder Dependency Scanning (gitlab-org/gitlab#349926 - closed)
- workspaces
- Provide additional Project Dependency context a... (gitlab-org&2626)
- TAM interaction guide
- 15.0 blog
- Request Database / Data Storage - Public Artifact Metadata/Risk - and Request Database / User Specific Dependencies - related handbook page
- Group License Management Blocked by workspaces and likely need Sam White to get dependency information into database first and need matt williams to figure out optimized search first and need dependency list to use database not artifacts.
- User feedback on Dependency List (gitlab-org/gitlab#218517 - closed)
- User feedback on License Compliance (gitlab-org/gitlab#218521 - closed)
Useful Queries
click to expand
- CA issues
- CA epics
- license compliance issues
- license compliance epics
- dependency scanning issues
- dependency scanning epics
- not owned all sec groups epics
- not owned all sec groups issues
- Secure - Composition Analysis planning issues
- deprecation MRs
- Monthly Release Kickoff call issues
- RP issues
- Release Post top issues
- Release Post primaries issues
- Release Post secondary issues
- Release Post deprecation issues
- removal issues
- Removal MRs
- Breaking Changes issues
- Breaking Changes MRs
- Monthly Metrics issues
Scisense / Periscope
click to expand
- metrics dictionary - SaaS diagram - lucid chart - SM diagram - lucid chart - dbt insecure - dbt secure - dbt flow - in:favorites - in:archived - https://app.periscopedata.com/app/gitlab:safe-dashboard/919377/TD:-Public-Company-Metrics-v1.0 - https://app.periscopedata.com/app/gitlab:safe-dashboard/919307/TD:-ARPU-and-ARR-(Live) - https://app.periscopedata.com/app/gitlab:safe-dashboard/919322/Pricing-Dashboard---Customer-Discounts - https://app.periscopedata.com/app/gitlab:safe-dashboard/919329/Schwartz-SCA-Namespace-trends - https://app.periscopedata.com/app/gitlab:safe-dashboard/919349/Secure-SCA---Namespaces---Software-Composition-Analysis---Schwartz - https://app.periscopedata.com/app/gitlab:safe-dashboard/919364/TD:-Customer-Segmentation - https://app.periscopedata.com/app/gitlab/749790/Secure-SCA---PI---Software-Composition-Analysis---Schwartz - https://app.periscopedata.com/app/gitlab:safe-dashboard/919369/TD:-Drillable-Net-Retention - https://app.periscopedata.com/app/gitlab:safe-dashboard/919366/TD:-Pricing-Dashboard---Customer-Overview - https://app.periscopedata.com/app/gitlab/764436/Secure-SCA---Performance-SaaS-Jobs---Software-Composition-Analysis---Schwartz - https://app.periscopedata.com/app/gitlab/635927/Programming-Languages-on-GitLab.com - https://app.periscopedata.com/app/gitlab/895813/Secure-Scan-metrics - https://app.periscopedata.com/app/gitlab/764225/Secure-SCA---Engineering-Issues---Software-Composition-Analysis---Schwartz - https://app.periscopedata.com/app/gitlab/1003214/Feature-Retention - https://app.periscopedata.com/app/gitlab/928597/Isaac's-VR-Data-Playground?widget=13308542&udv=0 - https://app.periscopedata.com/app/gitlab/topic/Secure-and-Protect-Section-Secure-&-Protect-Secure-Stage/abd1f99b8f2d4259945de8a58928cb7f - https://app.periscopedata.com/app/gitlab/topic/SCA-Software-Composition-Analysis---Schwartz/ab18060d38cb46ffadf1b7f2f971514e - https://app.periscopedata.com/app/gitlab/916395/WIP:-nagyv-sandbox - https://app.periscopedata.com/app/gitlab/785953/Pipeline-Authoring-Dashboard - https://app.periscopedata.com/app/gitlab/771580/Product-Adoption-Dashboard - https://app.periscopedata.com/app/gitlab/737412/Threat-Management-Metrics---Matt's-Playground - https://app.periscopedata.com/app/gitlab/718481/Static-Analysis-Metrics---@tmccaslin - https://app.periscopedata.com/app/gitlab/707777/Secure-&-Protect-GMAU-SMAU-Metrics - https://app.periscopedata.com/app/gitlab/703762/WIP:-Dynamic-Analysis-metrics - https://app.periscopedata.com/app/gitlab/694854/Container-Security-Metrics - https://app.periscopedata.com/app/gitlab/671986/Threat-Insights-Metrics - https://app.periscopedata.com/app/gitlab/556285/Threat-Insights-group-metrics - https://app.periscopedata.com/app/gitlab/641753/UX-Debt - https://app.periscopedata.com/app/gitlab/518035/Secure:Static-Analysis-performance-metrics - https://app.periscopedata.com/app/gitlab/410654/Secure-Metrics - https://app.periscopedata.com/app/gitlab/831132/Secure-Stage-Unique-Jobs-with-Artifacts - https://app.periscopedata.com/app/gitlab/863712/Vulnerability-Info-CWE-Coverage-(Internal) - https://app.periscopedata.com/app/gitlab/895813/Secure-Scan-metrics - https://app.periscopedata.com/app/gitlab/906240/Vulnerability-Tracking - https://app.periscopedata.com/app/gitlab/921266/VET-False-Positive-Reduction - https://app.periscopedata.com/app/gitlab/927624/Vulnerability-Info-False-Positives-Confirmed-Resolved-(Dismissed-Findings) - https://app.periscopedata.com/app/gitlab/snippet/development_department_metrics_for_secure/553b96c29a0642ea8902e4ceb0c2f278/editKibana / Grafana / elasticsearch
click to expand
Handbook Pages
click to expand
Unofficial
click to expand
Partners / Alliances / Third-Party
click to expand
Other
What I add to many backlog issues
### Note to wider-community, sales, support and customer successAs always we welcome contributions so feel free to ask questions the PM of Composition Analysis if you are unsure about what needs to be done here and want to contribute the fix yourself!
NOTE if you are a user who also would like to see this feature, please UPVOTE
If you are a team member commenting on behalf of a user (not ideal, as you can only upvote once!) Please remember to upvote and include as much information (what they are trying to solve for, their setup) as possible in addition to a salesforce or zendesk link.
Closing Tasks
-
Mark all tasks as complete -
Update template with retrospective thread items -
Close Issue