~/talk

The Scientific Method: Security Chaos Experimentation & Attacker Math

on YouTube 40m
Talkat RSAC 2021 · 2021-05-17..05-20· [security]

speaker

name:Kelly Shortridge
website:https://kellyshortridge.com/

resources

video:https://youtu.be/oJ3iSyhWb5U
slides:none on file

summary

Security chaos engineering applies the scientific method to attacker math by building decision trees that map attacker choices and defender mitigations. Example: a cloud host with an exposed Docker socket discovered via Shodan leads to a scheduled crypto‑miner container; mitigations include removing public Docker sockets, adding auth, WAFs, repo key scanning and rotation, Kubernetes podSecurityPolicies, immutable hosts and host‑security monitoring. Experiments proposed: provoke misconfigured Docker socket and verify detection/log/kill; trigger auto‑scaled miners and confirm billing alerts and resource‑usage monitoring. Results feed revisions and make incidents routine.

AI-written summary · about

chapters (28)

  1. 0:00Start
  2. 1:04So, how can we science our way to better security outcomes?
  3. 1:52Ask a question of reality
  4. 2:12Develop a hypothesis
  5. 2:31Conduct an experiment
  6. 2:50Compare observations with your predictions
  7. 3:09Report findings, then iterate
  8. 3:54Security Chaos Engineering (SCE) uses the scientific method for infosec
  9. 4:24Intentionally introducing failure helps you discover the system reality
  10. 4:46We must make assumptions about reality to inform our experiments
  11. 5:14Decision trees help humans improve assumptions via belief prompting
  12. 6:40Understanding the attacker math for a specific asset = a hypothesis
  13. 7:40II. Decision Tree Case Study
  14. 19:26The last attack path is the hardest & highest-cost (so mitigate it last)
  15. 20:34Naturally, a maple syrup heist paired with blackmail is their next move.
  16. 22:23Now let's zoom out to see today's decision tree.
  17. 24:00Remember our goal: learn incident impact and design graceful responses
  18. 24:27using the power of science!
  19. 24:40Experimentation derives new insights & info that was previously unknown.
  20. 26:30Next is step 4 of the Sci_Method: compare observations to predictions.
  21. 26:47Work through your decision tree branches & validate your assumptions.
  22. 27:00Conduct a post-mortem to discuss what did or didn't work as intended.
  23. 27:26Where were your hypotheses correct? What did you overlook or miss?
  24. 27:57Update your (versioned) decision tree with your newfound empirical evidence
  25. 28:48Repeated practice can make incidents feel boring vs. scary & stressful
  26. 29:59Conclusion
  27. 30:16Decision trees help us formulate hypotheses about our security reality
  28. 30:58Next week: Identify the 3 most relevant attack goals to your org Next 3 months: Create a decision tree for each of those 3 attack goals

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.