October 2021 Summaries

Compliance automation platforms such as Vanta, Strike Graph, Drata, etc., offer varying levels of assistance in achieving compliance with frameworks like SOC 2, HIPAA, or ISO 27001. These platforms can help companies understand how their internal operations map to compliance criteria and automate certain processes, particularly around audits. However, they may not be able to provide precise custom Control Statements that scale for a company's growth. To ensure a successful compliance program, it is crucial to retain the help of an expert, do what you say you are doing, internally manage Control Statements and resources, use a reliable auditing partner, and spread out the workload among team members with specific roles. Ultimately, embracing and learning your compliance framework is essential for maintaining internal accountability and ensuring that a company understands its operating processes in the context of any given compliance framework.

Workflows are structured representations of business processes that can be captured and expressed in various ways, such as pen and paper or software components. They provide two core capabilities: defining workflows and executing them. Workflow technologies integrate with different frameworks, offer testing and debugging capabilities, and feature visibility and observability features. Workflows are essential for organizing tasks and achieving goals in a structured manner. Defining workflows involves iterative improvements based on domain-specific terminology, dealing with known and unknown failures, recovering from failure, and adapting to changes. Workflows can be defined using domain-specific languages (DSLs) or general-purpose programming languages. DSLs provide a higher level of abstraction for specific technology domains but may struggle with complex workflow definitions. They are typically exposed in three ways: flowcharts, forms, and markup. General-purpose programming language workflow models target technical users and can be leveraged to define workflows across various technology domains. Workflow technologies offer numerous benefits, such as domain specialization, visualization, integration with existing frameworks, and large ecosystem support. However, they may also have drawbacks, including the need for custom tooling and difficulty in understanding complex workflow definitions.

Gremlin is leading the fast-growing field of Chaos Engineering, a practice involving carefully planned experiments to understand how systems behave in the face of failure. Temporal provides a scalable solution for handling failures and its co-founders Maxim Fateev and Samar Abbas recently appeared on Gremlin's podcast "Break Things on Purpose" to discuss it. Temporal originated from Cadence, an internal framework at Uber that grew in popularity within the company and was eventually adopted by other organizations like HashiCorp, Box, Coinbase, and Checkr. The founders decided to strike out on their own with Temporal to drive its technology forward for a global audience. One of Uber's values was to provide rides as reliable as running water, which led to the development of Cadence to help engineers build resiliency and reliability into their applications. The goal was to allow application teams to focus more on building amazing features rather than dealing with failure conditions. Temporal helps achieve this by providing fault-tolerant code that is guaranteed to finish execution. Temporal's features include task queues, local state management, and support for long-running tasks. It is particularly well-suited for financial transactions due to its strong reliability guarantees. To ensure a good experience with Temporal, it is recommended to redesign applications end-to-end and consider the importance of durability in the application's state.