Operating many small locations.
WHAT THE CHALLENGE IS
Many locations, few or no staff, variable connectivity.
WHAT MUST BE AUTOMATED
Provisioning Configuration Updates Monitoring Recovery
WHY RECOVERY SPECIFICALLY
Sending someone to a remote location is slow and expensive.
WHAT TO BUILD IN
Remote power control, where possible A recovery mode that survives a failed update Automatic rollback on failure to start
WHY
An update that bricks a remote device is the most expensive failure available.
WHAT UPDATE STRATEGY TO USE
Staged: a few locations first, then progressively.
WHAT TO NEVER DO
Update every location simultaneously.
WHAT TO DESIGN FOR
Devices that have been offline for a long period, updating through several versions.
WHAT PHYSICAL SECURITY TO ASSUME
Limited.
WHAT THAT MEANS
Encrypt storage Assume the device may be taken Limit what credentials it holds Scope any compromise to that location
WHAT TO MONITOR
Health, connectivity, storage and version, per location.
WHAT TO RECORD
Every device, where it is, and who is responsible for the site.
