Security Chaos Engineering

Preface

In Life’s wave, in action’s storm,

I float, up and down,

I blow, to and fro!

Birth and the tomb,

An eternal flow,

A woven changing,

A glow of Being.

Over Time’s quivering loom intent,

Working the Godhead’s living garment.

Faust

If you’ve worked with computers in a professional setting at any point since the dawn of the millennia, you’ve probably heard that security is important. By now, you’ve also probably realized cybersecurity is broken. Humans are entrusting us, as people working with software, with more and more of their lives and we are failing to keep that trust. Year after year, the same sorts of attacks ravage the coasts and heartlands of our ever-growing digital territories.

Meanwhile, the security industry accumulates power and money, indulging in newer, shinier technology and oft deepening their sanctimonious effrontery. Success outcomes remain amorphous; and in the background slinks an existential dread that security can’t “keep up” with software. Fingers point and other fingers point back. Our security programs coagulate into performative rituals—a modern humoralism based in folk wisdom and tradition rather than empiricism. Software engineering teams simmer in resentment, yearning for answers on how to keep their systems safe without requiring ritual sacrifices. We know we can do better, but we struggle to chart a course when immersed in the murky obliqueness that is cybersecurity today.

A fundamental shift in both philosophy and practice is nigh. Cybersecurity ...