The world of technology does not stand still, and every day it becomes more and more obvious that cyber security is an important part of IT. Having worked as both a regular system administrator and a DevOps engineer, I have repeatedly encountered situations where the balance between development speed and security was a difficult challenge. DevOps integrates development and operations, allowing companies to quickly and efficiently implement, use, and in some cases refine ready-made solutions and implementation of their own, but when cybersecurity joins these processes, the processes begin to conflict, slowing down the work of key departments of the company.

How the work of a DevOps engineer is changing

When I started to delve into the work of DevOps, rising from the level of a system administrator, I saw that the main emphasis was on automation, integration and implementation of solutions at different levels of the company’s work, but with time and experience I came to understand that this approach stops working, and the perception Cyber ​​security alone or not connecting it to processes at all is a big mistake. This eventually led to a new approach, DevSecOps. This means that now it is necessary to think about security at all stages, from the moment of design to the final transfer of solutions to customers.

Security at all stages of development

Previously, the practice of implementing security processes and algorithms at the final stage of development was very common. But now, with the development of the field, such an approach is no longer expedient. Today, it is more appropriate to integrate cybersecurity components at every stage of development. As someone who specializes in DevOps engineering, I can’t just brush it off and have to always keep all the points in the field of my attention. This is not just an inseparable part of my work – to stay in the flow of the field, it is a forced restructuring of thinking as a specialist.

Automation of checks and monitoring

Automation is the foundation of DevOps. Later, this approach also covered security issues. Automation tools are widely used by industry leaders for code vulnerability testing, infrastructure monitoring, and access control. From the outside, without delving into the specifics of the processes, it may seem that this is only a deliberate complication of work, and in a certain sense it is, but in practice these tools really effectively help to avoid serious problems in the early stages of development.

Continuous training and professional development

Every day, technologies are developing faster, and at the same time, the risks of new, sometimes the most unexpected, system vulnerabilities are increasing. And in order to effectively predict system risk areas, you need to constantly learn, read and develop as a specialist. At the same time, it sometimes feels like you are in constant pursuit of new knowledge, but this is the price you have to pay for security. This is an obvious point that lies on the surface, but young professionals sometimes simply do not understand it or do not want to understand it.

Using Infrastructure as Code (IaC) with security in mind

Infrastructure as Code (IaC) has made our work much easier by allowing us to automate infrastructure configuration and deployment. While working at Zomro, my team encountered a problem that showed us the need to integrate cybersecurity at all levels of development. This was a multi-cloud project where we used IaC to automate setup and automatically deploy and provision additional resources. But after a while, we found out that as a result of a small mistake, we left open access to the internal API. This incident forced us to seriously reconsider the security approaches in IaC.

Implementation of the concept of Zero Trust

In the middle of my career, the concept of Zero Trust, that is, the lack of trust in users and devices, even if they are inside the corporate network, was only theoretical for me, but its implementation became something that gave a powerful development to both my own skills and the skills of the entire team in terms of automating user checks and all company devices. Yes, the implementation of Zero Trust added work to us in terms of control and automation settings, but it gave a justified reduction in the risks of hacking. When it comes to cybersecurity, the key is to trust no one.

What is changing for the better, and what can get worse?

Advantages:

1. Increasing the reliability of applications and systems: Integrating cybersecurity makes products more secure, giving you peace of mind and confidence in your work.
2. Growing demand for DevOps with cybersecurity: As security becomes a key requirement, professionals who can combine these skills become even more valuable in the marketplace.
3. Improved efficiency: Automating checks and continuous monitoring helps avoid critical problems late in development.

Disadvantages:

1. The constant increase in the complexity of work: all these new demands make our work more complex and exhausting, new technologies and tools break work solutions and there is a return to old problems.
2. Constantly increased skill requirements: Now a DevOps engineer must be an expert not only in automation, but also in cybersecurity, which significantly increases the requirements for the profession.
3. Conflict between security and speed: Sometimes these two factors seem to move in opposite directions, creating a constant tension and need to prove the importance of security in systems.

Conclusion

The role of a DevOps engineer is constantly changing under the influence of new challenges in the field of cyber security. There is an established understanding that it is no longer possible to ignore security, there is a need to integrate cyber security into all aspects of work. These changes open up new opportunities for development, but also make this work more difficult and stressful. My personal experience has shown that even small mistakes can have serious consequences. This proves that as professionals we must be ready for conflicts and challenges, adapt to them and keep moving forward, making our work more secure and reliable.