DevSecOps Software Factory

Software now defines the bulk of mission critical capabilities and in many cases, it delivers the decisive advantage for our customers — from our integrated sensors and weapons systems that give pilots an advantage over potential threat to the ground systems that keep satellites flying.

By utilizing DevSecOps methodology, our team capitalizes on common code whenever possible to rapidly deliver mission capabilities at a lower cost with the same level of quality and mission success our customers have come to expect — meeting U.S. Department of Defense criteria for a software factory including key security requirements.  

Enabled by cloud-based apps and automation, Lockheed Martin’s Software Factory delivers cybersecure mission capabilities that help our customers solve today and tomorrow’s toughest challenges. For over 20 years, we’ve been along the journey from agile to DevSecOps and now GitOps, working alongside our clients, turning real-time input into new valuable software capabilities quickly, and reducing downtime and costs.

Delivering software at the speed of relevance is just the start. With our DevSecOps approach, we bring your software capabilities to a new realm of cybersecurity from software build out to testing right through ground operations. This means more secure, faster software done right the first time.

• Embedded security
• Pull based system that meets customer needs
•  Increased quality

In this environment of faster, leaner and more secure — now more than ever — it’s imperative for today’s software applications to be built on up-front, not backed-in or retro-fitted security. Our Software Factory employs a principled and collaborative approach to building security into threat modeling, risk assessment and automation of security tasks.

GitOps allows us to take frequent delivery with DevSecOps to the next level. Git began as a tool for software developers, but GitOps brings more value to software development. Our customers demand not only frequent updates, but also reliable systems with integrated Continuous Delivery pipelines that can seamlessly roll out changes and roll back failures. Our ability to meet these needs requires building self-healing into our systems. Achieving this kind of reliability and self-healing starts with reliable deployment. With DevSecOps practices such as Infrastructure as Code (IaC), we bring automation to deployment, providing both speed and repeatability. IaC also means that deployment automation can be tracked, reviewed, tested, and version controlled, just like the rest of the system software.

Now, with GitOps, we create the complete deployment loop, ensuring that our production system always reflects exactly the right version of the software. We verify that everything needed to build, test, and deploy an application is version controlled in a Git repository—including the version information of the application itself! In this way, GitOps makes configuration management a core part of DevSecOps, increasing the traceability and reliability of software components even in the most complex systems. This means the system is continually working on its own to achieve the desired state as recorded in the Git repository, automatically healing failures and rolling out new features.

Software Dojos: Iterative Learning
Our growth-oriented mindset and commitment to continuous learning are key developmental pillars of the Lockheed Martin Software Factory. We have a continuous learning environment in our Software Dojos — or training facilities. With a globally diverse workforce, we strive to provide ways for our employees to upskill and master DecSecOps practices to commit to the most effective software delivery.

After developing initial skills, adoption and adherence of these best practices can grow over time. With common training grounds, our employees continue to leverage the best code across multiple domains.

Air Space Integration - Multi-Domain Operations / Joint All-Domain Operations 
Multi-Domain Operations (MDO) is about connecting systems and building resilient networks that quickly connect critical data across multiple domains to predict, disrupt and paralyze our adversaries. Our software architects and developers are building supporting architectures with distributed data management and advancing the technologies that will define this next generation battlespace — all while using agile methodology to rapidly iterate.

By using DevSecOps, we can develop a common reference architecture that will eventually support a suite of common mission services, connectivity and interfaces using existing government open, standards-based architecture compliant with OMS and UCI.

Air
At Skunk Works®, software developers are partnering with customers to ensure existing aircraft can remain dominant in the future battlespace. Through a series of technology demonstrations, incremental increases in software capability are rapidly fielded to enable a connected network across air, ground, sea, space and cyber domains. Most recently, the team successfully connected an F-35, U-2 and a multi-domain ground station in a ground-breaking test demonstrating MDO and the secure distribution of sensitive information across multiple platforms.

Rapidly fielded software can save lives. Leveraging a rapid development, test and contracting approach, a joint government and industry team successfully fielded the Automatic Ground Collision Avoidance System onto Air Force F-35As seven years earlier than previously planned. The life-saving system was previously fielded and proven on F-16 aircraft.

Space
At our Space division, our Mission Solutions group has developed a full suite of software products called the Cognitive Mission System Products. These are Lockheed Martin’s next-generation, cyber-hardened and adaptable satellite ground solution that supports the DoD and Intelligence Community Space Enterprise, including:

• Horizon (Command & Control)
• Compass (Mission Planning)
• TAISR (Tasking/Exploitation)
•  BEAST (BMC2)
• Nayru (Sensor Data Processing)

The architecture is based on a “micro-services” design approach — focusing on the deployment of only the necessary components for the mission. Our DevSecOps practices enhance speed and responsiveness while also increasing the quality of the final deliverable. This architecture also enables customers to deploy single components without carrying along large amounts of unneeded software, substantially reducing sustainment costs.