Security Chaos Engineering

The Case for Security Chaos Engineering

Definition of security chaos engineering: The identification of security control failures through proactive experimentation to build confidence in the system’s ability to defend against malicious conditions in production.¹

Information security is broken. Our users and our customers—who make up our world—are entrusting us with more and more of their lives, and we are failing to keep that trust. Year after year, the same sort of attacks are successful, and the impact of those attacks becomes greater. Meanwhile, the security industry keeps chasing after the shiny new tech and maybe incremental improvement in the process.

A fundamental shift in both philosophy and practice is necessary. Information security must embrace the reality that failure will happen. People will click on the wrong thing. Security implications of simple code changes won’t be clear. Mitigations will accidentally be disabled. Things will break.

By accepting this reality, information security can move from trying to build the perfect secure system to continually asking questions like “How will I know this control continues to be effective?”, “What will happen if this mitigation is disabled, and will I be able to see it?”, or “Is my team—including executives making critical decisions—ready to handle this sort of incident tomorrow?”

Hope isn’t a strategy. Likewise, perfection isn’t a plan. The systems we are responsible for are failing as a normal function of how they operate, ...