Security Chaos Engineering: Fix Things and Make Friends

Explore security chaos engineering in this conference talk from Conf42 Chaos Engineering 2024. Dive into the challenges of modern security practices, including the difficulty of integrating defensive tools and the limitations of using security incidents as detection metrics. Learn how security chaos engineering can help manage existing chaos rather than create new problems, and why embracing failure is essential. Discover the process of building and implementing experiments, measuring defense reliability, and extending security chaos engineering beyond just engineering teams. Gain insights on how this approach can improve decision-making, foster collaboration, and lead to more effective security practices. Walk away with practical strategies for getting started, asking better questions, and making security initiatives more palatable to others in your organization.

intro
preamble
doom loops are scary and impede the decision making process
is security getting better, or better at shifting responsibility?
with all the hot fresh defensive tools available, making it all work together is still difficult
security incidents are poor methods to measure detection because the bas thing already happened
hope is not a valid strategy
sce isn't creating chaos, it helps manage the chaos around us
failure is normal, expected, and should be embraced
identifying what you care about is crucial to sucess
the anatomy of an experiment
building your experiments
experiments in practice
proving outcomes
getting started is the hardest part
measuring the reliability of defenses
experiments in practice
security chaos engineering shouldn't be limited to engineering
we need you all
makign other programs better helps you make friends
security chaos engineering helps you ask better questions
making things palatable for others will make your life easier
you can do it!