Navigating the Unknowable: Resilience through Security Chaos Engineering
summary
Chaos Engineering applied to security—Security Chaos Engineering—is framed as proactive experiments that inject small failures to reveal control drift and gaps. Examples include Cardinal Health’s continuous verification pipeline that queries configs, dashboards results and files risks, and UnitedHealth’s open source PortSlingr which injects port changes. Results show a firewall detection gap (about 60% caught), config management often self-heals, and SOC alerts lack metadata, so start with low‑risk experiments (open a public bucket, query agents) and iterate.
AI-written summary · about
chapters (16)
- 0:00Intro
- 1:36In the Beginning.
- 2:26Complexity creates a Security Problem
- 3:39The Design-Oriented Mindset is Old-School
- 9:15There's a difference between...
- 11:53Why Security Chaos Engineering?
- 13:01Security Chaos Engineering Use Cases
- 13:35Security Chaos Engineering Is Different
- 15:38Cardinal Health: Applied Security
- 18:03Cardinal Health: Goals for Identifying Security Gaps
- 20:12Cardinal Health: Continuous Verification and Validation
- 22:26Cardinal Health: The Results
- 23:30United Health Group: ChaoSlingr
- 26:51Test your security before someone else does!
- 29:43Security Chaos Experiments
- 32:35Implementing Security Chaos Engineering at your Company
related talks
31mNavigating the Unknowable: Resilience through Security Chaos Engineering
40mSecurity & Chaos Engineering: Resilient Distributed Systems
28mUnknown Unknowns + Chaos = Security Chaos Engineering
43mCyber Chaos Engineering
23mStandard Classification: Security Chaos Engineering - Turning the Tide in ...
28mBuilding Safety, Security and Resilience through Chaos
33mChaos Engineering, how to increase resilience by injecting chaos
27mChaos Engineering: The Path to Reliability