Risk-Driven Fault Injection for Fast & Furious
summary
Proposes Risk-Driven Fault Injection (RDFI) as a way to prioritize security chaos experiments by measurable business risk, implements a tool called CloudStrike that runs chained attack scenarios (create user "bob", attach malicious S3 policy, exfiltrate from a random bucket) and logs outcomes into a knowledge base/security data lake. Claims experiments expose misconfigurations and control gaps (CSPM, CloudTrail, IR) by measuring detection and recovery times and feeding automated monitor → analyze → plan iterations.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 3:45Security chaos engineering matters
- 9:04Cloud native security challenges
- 13:15Unifying security platforms
- 15:25Risk-driven fault injection
- 17:11Security chaos feedback loop
- 22:05Monitoring experiments
- 23:07Analyzing results
- 24:30Next experiments and fixes
- 26:16Automating insights
- 28:27Research and resources
- 30:15Q&A
related talks
14mDFIR - Don't Forget Your Roots!
42mSecurity Threat Modeling Live from Scratch Session
46mRugged Software Engineering
40mSecurity & Chaos Engineering: Resilient Distributed Systems
15mRAIL: Risk-Aware Human-in-the-Loop Framework with Adaptive Intrusion Response...
47mSecurity Pre-Cognition
28mFOSS and Security Risk Management
31mFollow the Trace: How Traditional AppSec Tools Have Failed Us