Risks in Systems Design: Chaos Engineering in Apps & Cloud Security
summary
An industry analysis of 524 incidents finds 48% internal incidents and high‑profile cases like SolarWinds show attacker plus supply‑chain risk; practical steps include starting manual, targeting OWASP Top 10 items, and running game day every two weeks against Kubernetes clusters. A concrete hypothesis—rotate leaked GitHub credentials and alert AppSec without breaking builds—fails in practice due to missing monitoring and runbooks. Teams use Capture The Flag repos, a dedicated cluster for experiments, and aim to automate successful experiments into CI/CD.
AI-written summary · about
chapters (6)
- 0:00Intro
- 0:40Why does bringing security into the mix matter?
- 11:26Getting started with security chaos engineering
- 18:39Game day exercises
- 25:42Realizing a strong DevSecOps culture
- 29:27Outro
related talks
40mNavigating the Unknowable: Resilience through Security Chaos Engineering
27mExecuting Chaos Engineering in Production at a Critical Financial Institution
46mApplication security from start to finish
43mCyber Chaos Engineering
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
57mBuilding a Modern Security Engineering Organization
44mSecurity Lessons for Early Adopters
54mControlled Chaos: The Inevitable Marriage of DevOps & Security