Defining Steady States and Developing Hypotheses
summary
Argues that security chaos engineering uses existing baselines like CIS benchmarks and threat models like MITRE ATT&CK to turn controls into testable steady states, then runs experiments (take down a caching proxy to validate 1 million requests per second, flip auth from SAML to OAuth while disabling a log server for 20 minutes, kill containers, disconnect networks) and measures with monitoring (Prometheus/Grafana) to find missed configs, validate incident detection, and close gaps left by scans, pentests and IR drills.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:04Security chaos engineering
- 6:03Conducting a chaos experiment
- 8:09Resiliency testing in infrastructure
- 12:50Security controls effectiveness
- 16:21Aligning chaos with security
- 17:25Security benchmarks and frameworks
- 22:00Adversarial tactics testing
- 25:49Benefits of security chaos
- 29:21When to introduce testing
- 31:25Conclusion and key takeaways
related talks
40mNavigating the Unknowable: Resilience through Security Chaos Engineering
25mSecurity Chaos Engr.: Fix Things and Make Friends
47mSecurity Pre-Cognition
31mNavigating the Unknowable: Resilience through Security Chaos Engineering
52mContinuous Security
43mCyber Chaos Engineering
40mSecurity & Chaos Engineering: Resilient Distributed Systems
28mUnknown Unknowns + Chaos = Security Chaos Engineering