1
Running Head: SECURITY CHAOS ENGINEERING
SECURITY CHAOS ENGINEERING
CARLA GINART
LIBERTY UNIVERSITY
CSCI612_B01_202420
JANUARY 17, 2024
SECURITY CHAOS ENGINEERING 2
Introduction
These days, safeguarding information, and communication technology (ICT) assets from
possible dangers is crucial, particularly with the introduction of Industry 4.0 and the ensuing
upheaval. To this end, cybersecurity seeks to safeguard technology and data across various
domains, including social, business, personal, and family. A variety of initiatives have been
undertaken to help in these ways, such as safeguarding individuals against online sexual
offenders, defending IoT devices against attacks on data or services, enhancing the resilience of
the infrastructure in smart cities, implementing cybersecurity in distributed organizations, and
assisting Law Enforcement Agencies (LEAs) in the identification of malware and the prevention
of cybercrimes. Furthermore, cybersecurity has been seen as an area of study that extends
beyond identity verification, access control, and activity tracking. It has developed into a field
that concentrates on the robustness and consistency of systems.
In addition, Site Reliability Engineering (SRE) is a collection of procedures that seeks to
enhance the design parameters of a system as well as the operational environment to provide the
system with necessary characteristics like efficiency, scalability, and reliability. Around 2003,
Google introduced the SRE idea, which was quickly embraced by other businesses with stringent
software needs for dependability and scalability. Because SRE offers a set of concepts around
automatization, quantification of business-required dependability, minimization of availability
risks, and observability, it may be considered one approach to realize a DevOps strategy. SRE
may be implemented, for example, by defining dependability goals like SLO (Service Level
Objective) or SLI (Service Level Indicator), creating a capacity plan, and defining and carrying
out a change management procedure.
SECURITY CHAOS ENGINEERING 3
Chaos Engineering (CE) is a relatively new technique in the context of SRE that is being
used to examine the resilience of distributed systems. The purpose of CE is to verify the
capabilities and weaknesses of a system under uncontrolled circumstances. Several tests may be
developed and used to verify in a quantifiable manner the changes that a system's steady state
may experience by utilizing the CE approach. Moreover, an additional CE principle highlights
the need to include real-world occurrences (hardware or software malfunctions) in the trials,
particularly those that possess the capacity to produce significant effects or may transpire
periodically. Additionally, CE emphasizes the need to automate trials wherever feasible as it
makes it possible to analyze the results more effectively. Last but not least, CE places a high
priority on testing in production to ensure experiment authenticity and take into account actual
traffic patterns, even if the effects of these experiments should be carefully measured and
limited.
To observe the variables that characterize the target system's steady state, a "chaotic"
experiment across a controlled environment must be planned by the CE approach. Furthermore, a
scientific methodology that permits the formulation and verification of a series of hypotheses
must govern such a CE experiment. Recently, CE experiments have become more popular as a
means of implementing SRE since they enable the testing of a system's resilience against chaotic
occurrences, allowing for the early identification and correction of the system's shortcomings.
However, it is important to verify a system's resilience from more than just an availability
standpoint. In actuality, it ought to include other facets of the system's safe and proper operation.
As a result, it becomes necessary to assess the system's resilience holistically, and this is what is
usually required when assessing distributed systems that handle sensitive data, such as secure
Internet of Things services or personal data management programs.
SECURITY CHAOS ENGINEERING 4
To carry out a security-based assessment of a system, a new idea surfaced in 2017 to use
CE principles in experiments that assess a system's confidentiality and integrity under chaotic
occurrences in conjunction with availability. In other words, Security Chaos Engineering, or
SCE, enters the cybersecurity ecosystem and works to protect the systems from these kinds of
attacks. Chaotic events can arise in a cybersecurity context when a threat agent attempts to: (i)
take down a system, for example by using a Distributed Denial of Service (DDoS) attack; (ii)
read legitimate data hosted by a system, for example by elevating privileges to enable access to
restricted information; or (iii) modify users or system files in a way that changes how the system
functions, for example, by using remote execution of malicious code. (Chavarro, 2023)
Research Objectives
To examine what Security Chaos Engineering is.
To assess the relationship between security engineering and security chaos engineering.
To determine the impact of constantly evolving technology on security chaos engineering
and maintaining cyber-security.
To determine how the Bible supports/ doesn't security chaos engineering.
Research Questions
What is security chaos engineering and how does it tie in with security engineering?
How does security chaos engineering work with cyber-security?
How do technology and the IoT come into play when talking about security chaos
engineering and cyber-security?
How much does the Bible support/ doesn't security chaos engineering and cyber-security?
Security Chaos Engineering and Security Engineering
SECURITY CHAOS ENGINEERING 5
"Chaos Engineering is the discipline of experimenting on a system to build confidence in
the system's capability to withstand turbulent conditions in production." - The Principles of
Chaos Engineering. Chavarro wrote an article talking about security chaos engineering and how
software security ties in with it. Software security should now be viewed as a requirement rather
than a desirable feature because software is the driving force behind the technical solutions that
provide numerous services to our society. Software protection is a never-ending task that
involves both strengthening security measures and identifying the causes of mishaps, many of
which are brought on by poorly executed or presumptively sound rules. It is necessary to try
innovative alternatives because conventional techniques might not be effective in identifying
those security presumptions. This makes Security Chaos Engineering (SCE) an inventive
methodology that allows for the identification of failed components and, in the end, the
protection of assets under cyber risk scenarios. It is based on the formulation of a steady state, a
hypothesis, experiments, and measurements. When Netflix shifted its operations to the AWS
cloud in 2011, the idea of CE first surfaced. The developers at Netflix were concerned that
during the transfer, an internal instance would fail and negatively affect the business as a whole.
Because of this, ChaosMonkey was developed to inject faults that arbitrarily terminate internal
instances to verify Netflix's stability. Netflix introduced additional modes that identify
anomalous events or report various fault kinds a year after ChaosMonkey was first released.
Together, those modes—each of which was regarded as a novel simian—formed the Simian
Army. (Chavarro, 2023)
"Security engineering is about building systems to remain dependable in the face of
malice, error, or mischance. As a discipline, it focuses on the tools, processes, and methods
needed to design, implement, and test complete systems, and to adapt existing systems as their
SECURITY CHAOS ENGINEERING 6
environment evolves" (University of Cambridge, n.d.) Security engineering is the process of
incorporating security controls into an information system so that the controls become an integral
part of the system's operational capabilities. Alijawarneh wrote an article discussing how security
vulnerabilities and defects are the results of poorly constructed software that can lead to easy
exploitation by cybercriminals. Even the most advanced security tools and methods cannot
identify the security dangers that a large number of Cloud software systems are currently facing.
The monitoring, control, and maintenance of the software development process are necessary
due to the current problem. One of the nonfunctional needs that significantly influences the
architectural design of cloud software as a service (SaaS) is security. The two software
engineering ideas, conventional and current, are also frequently held in conflict, which makes it
difficult for the software development team to address security during the implementation and
maintenance phases of the SDLC. (Alijawarneh, 2017) This article helps to show why security
engineering and cyber-security are necessities for all companies now. "In the end, understanding
cybersecurity is about understanding risk, where it comes from, and how to effectively reduce it
for a reasonable cost and small impacts to mission. "(Basta, 2023) Using security chaos
engineering helps determine what risks there are. I chose to do an article review on this article
because security chaos engineering seemed like a very interesting topic to learn about, and it was
also something I had not heard about before. I have learned about security engineering and
cyber-security of course but I wasn't sure how Security Chaos Engineering tied into all of this.
"And he has filled him with the Spirit of God, with skill, with intelligence, with knowledge, and
with all craftsmanship, to devise artistic designs, to work in gold and silver and bronze… He has
filled them with skill to do every sort of work done by an engraver or by a designer or by an
embroiderer in blue and purple and scarlet yarns and fine twined linen, or by a weaver—by any
SECURITY CHAOS ENGINEERING 7
sort of workman or skilled designer." -Exodus 35:31-32. God created us in his image and this
bible verse illustrates how he filled us with intelligence and knowledge. So it would stand to
reason that since he gave us all of those things, that is why things like security chaos engineering
were developed.
Security Chaos Engineering and Cyber-Security
"We note up-front that cybersecurity stands in stark contrast with the random failures
involved in reliability because cybersecurity involves the more challenging problem of
intelligently guided intentionally induced system failure—what we call cyberattacks. Said
another way, trustworthiness is achieved in an environment of active threats, not passive failures.
(Basta, 2023) Ensuring that a system can continue to operate dependably in the event of an
intentional or unintentional attack is the aim of security engineering. Using the methods and
procedures researched in this discipline, entire systems can be built, put into practice, tested, and
updated to account for changing circumstances. Successful security engineering involves many
different fields of study, including cryptography, computer security, tamper-resistant hardware,
formal methodologies, economics, applied psychology, organizational knowledge, and the law.
While business process analysis, software engineering, testing, and assessment are important
aspects of system engineering, they are insufficient on their own since they concentrate on
unintentional rather than intentional damage. Although fast, systems built on specialized
hardware have limited filtering capabilities; sadly, most current classification systems fall short
in both categories. Although software filters provide strong semantics for matching, their line
speed is typically inadequate. This explains why quicker but more complex specialist hardware
should be combined with a slower but more adaptable software firewall. Firewalls with packet
filtering offer low complexity, cheap cost, high speed, low resource consumption, predictability,
and determinism as advantages in network security solutions. Its shortcomings include but are
SECURITY CHAOS ENGINEERING 8
not limited to, its incapacity to withstand contemporary attacks, its susceptibility to spoofing, its
inability to make judgments based on authentication or application, and its rule lists getting too
big to handle. (Madhloom, 2023) I chose to look at the article written by Madhloom because it
helped me to understand what the goal of security engineering is, which helped me to also
understand why security chaos engineering came into play. It also showed me that a lot of
components come into play other than just security chaos engineering to help with cyber
security. This article mentioned firewalls, but there are so many other components that go into
securing your network. Whitemore wrote an article that lists the essentials for cybersecurity as
data security, software security, component security, connection security, system security,
human security, organizational security, and societal security. Mapping this broad set of
"essentials" to an undergraduate curriculum presents a challenge. The body of knowledge that
security engineers rely on includes catalogs and lists of security controls, attack patterns,
weaknesses, and vulnerabilities; families of functional and assurance requirements; technical
manuals; technology manuals; public records of previous security incidents; and international,
national, and industry standards. Data communications, computer system architecture, software
architecture, software systems, system testing planning and execution, fault analysis, reliability,
data science, electromagnetics, signal processing, cryptology (cryptography and cryptanalysis),
and many other topics are covered in the technical guides and technology manuals. The content
is updated in real-time with newly identified vulnerabilities, threats, and mitigation strategies.
This material is becoming more and more available online and as downloadable downloads. An
engineering effort like security analysis entails formulating a problem statement, obtaining
information, observing, testing, and fine-tuning theories before coming to a decision. Security
analysis techniques are customized for a particular system, circumstance, or issue. System
SECURITY CHAOS ENGINEERING 9
modeling, critical thinking, constraint analysis, problem determination, problem source
identification, root cause analysis, and other skills may be needed for security analysis. A
Computer Science Curricular Guideline for Security was released in 2017 by the Joint Task
Force (JTC) for Cybersecurity Education, which was established by the International Federation
for Information Processing, the Association for Computing Machinery, the IEEE Computer
Society, and the Association for Information Systems.18 "...a computing-based discipline
involving technology, people, information, and processes to enable assured operations," is how
the paper defines cybersecurity. It entails building, running, evaluating, and testing secure
computer systems. Aspects of law, policy, human issues, ethics, and risk management in the
context of enemies are all covered in this multidisciplinary course of study. (Whitemore,2023)
"Chaos Engineering is the discipline of experimenting on a system to build confidence in the
system's capability to withstand turbulent conditions in production." - The Principles of Chaos
Engineering. I chose to look at this article to support my review of the article written by
Chavarro because it allowed me to dig deeper and examine security analysis principles and
techniques that are used in both academic and professional security engineering settings. It
helped me understand more about what exactly cybersecurity and security engineering is. This
article also helped me to understand why using security chaos engineering to test a system is an
emerging need. We need to do more than just do reactive patching, we need to be proactive and
learn about what can hurt a system. Breaking a system can help make sure the system is resilient
and that it can withstand failure. You can't avoid failure but being proactive and constantly
improving and testing your system helps make it less likely your system will fail, or if it does
fail, it allows you to get back up and running quickly. "for though the righteous fall seven times,
they rise again, but the wicked stumble when calamity strikes."-Proverbs 24:16. The Bible helps
SECURITY CHAOS ENGINEERING 10
support his because God knows that we are going to fail. It is a normal thing that happens.
However, we are made to keep getting up when we fail and learn from those failures. This is
what using security chaos engineering is about. "Intelligence-agency rules are very much
tougher. Most of the operational security effort goes into training staff on what not to do,
instilling a culture of discretion that shades well over into anonymity. And since foreign
intelligence agencies make many fewer approaches to spooks than private eyes make to medical
record clerks, a spymaster can't rely on a robust detection culture to spring up of its own accord.
He has to have his red team constantly testing his staff to ensure that they take the paranoia
business seriously." (University of Cambridge, n.d.) If intelligence agencies do red team testing,
it should be an example of why being proactive and testing your system to keep it secure is so
important. A lot of companies are aware of this and have started to do this to help keep their
systems safe. This is also part of the reason security chaos engineering is something that has
been developed.
Security Chaos Engineering and IoT
Technological systems, such as Internet of Things (IoT) applications, smart automobiles,
and industrial control systems, have grown in importance over the past few years, and as a result,
attackers have turned their attention to these systems. This presents a significant barrier when it
comes to upgrading and maintaining cyber-security because technology is always advancing, so
trying to find ways to protect a network but constantly be updated as well. To withstand cyber
security threats, customers and designers must cooperate. In the last ten years, software
architecture has become one of the most extensively studied subjects in the world of software
engineering. Researchers are particularly interested in the topic of cloud security, although many
problems, such as those related to distributed design and architecture, are not yet fully resolved
SECURITY CHAOS ENGINEERING 11
The IoT uses the cloud. There is a requirement that all services when dealing with technology
and the IoT have a security type at various levels. The user must correctly, consistently, and
securely authenticate its service for it to function. One of the main factors influencing
architectural choice is security necessity. Architectural choices (ADs) can either improve or
worsen such nonfunctional requirements. Its restrictions (such as logical components or
technologies) are regarded as the inclusion or exclusion of specific components of the
architecture. It is regarded as a challenging undertaking to determine the impact of AD or the
affected architectural components by a security constraint. Alijawarneh did a study to shed light
on a poorly designed Cloud service architecture, the study proposed a methodology that
addressed the system requirements at the beginning of the SDLC. 2017's. (Alijawarneh,2020).
The advancement of IoT is one of the main reasons security chaos engineering has become a
thing. IoT is constantly evolving and changing, and this means that failures in a system will be
constantly evolving and changing, using security chaos engineering can help keep your system
secure and make sure if you fail you bounce back from it. Following the teachings of the Bible
can help with running a company successfully and can help make sure that following compliance
laws and implementing security policies are being done. In terms of ethics, perhaps the most
important duty that Jesus encourages people to fulfill is the duty known as the "Golden Rule":
"Therefore all things whatsoever ye that men should do to you, do ye even so to them: for this is
the law and the prophets" (Matthew 7:12). A company should not treat its employees or its
consumers in a way that they would not want to be treated. If they cannot be trusted with a
person's personal information, they should not be in business at all.
The Bible and Security Chaos Engineering
SECURITY CHAOS ENGINEERING 12
Scripture regularly forewarns us of our dishonesty (see, for example, 1 John 1:8). As business
professionals, we frequently define success in monetary terms. However, Shearer cautions us,
"It's unlikely that God would question you about your workforce size or revenue stream when
you stand before him one day. But he will probably question something more along the lines of,
"By the standard of my Word, how mature was the company I entrusted to you?" among many
other things. Mature businesses emulate mature Christian behavior. Our comprehension of the
biblical practices that support us on our path to maturity is improved by Shearer's work.
(Langford, 2023) As Langford pointed out, God isn't going to ask a business owner question that
don't relate to his teachings. He will ask questions that follow his teachings. Are you doing the
right thing not only for you but for your employees and customers? Part of that means keeping
your company secure and all the information within the company secure. Using security chaos
engineering helps ensure that you are following God's teachings and doing what you need to do
to keep everything running and secure. It also makes a company trustworthy which is a huge
thing when it comes to security engineering and cyber security.
Conclusion
In conclusion, some of the things that should be taken from this paper would be: What is
security chaos engineering and how does it work with cyber-security and security engineering?
How do technology and the IoT come into play when talking about security engineering and
cyber-security? How much does the Bible support/ doesn't security chaos engineering and
cyber-security? Security engineering is the process of incorporating security controls into an
information system so that the controls become an integral part of the system's operational
capabilities. Security Chaos Engineering is the discipline of experimenting on a system to build
confidence in the system's capability to withstand turbulent conditions in production."
SECURITY CHAOS ENGINEERING 13
Technological systems, such as Internet of Things (IoT) applications, smart automobiles, and
industrial control systems, have grown in importance over the past few years, and as a result,
attackers have turned their attention to these systems. One way to combat this threat is by using
security engineering. "And he has filled him with the Spirit of God, with skill, with intelligence,
with knowledge, and with all craftsmanship, to devise artistic designs, to work in gold and silver
and bronze… He has filled them with skill to do every sort of work done by an engraver or by a
designer or by an embroiderer in blue and purple and scarlet yarns and fine twined linen, or by a
weaver—by any sort of workman or skilled designer." -Exodus 35:31-32. God created us in his
image and this bible verse illustrates how he filled us with intelligence and knowledge. So it
would stand to reason that since he gave us all of those things, that is why things like security
chaos engineering were developed. It also shows that He does support security chaos
engineering.
SECURITY CHAOS ENGINEERING 14
References
Aljawarneh, S. A., Alawneh, A., & Jaradat, R. (2017). Cloud security engineering: Early stages
of SDLC.Future Generation Computer Systems,74, 385-
392.Ihttps://doi.org/10.1016/j.future.2016.10.005
Basta, Alfred 2023.ISecurity Engineering. McGraw Hill
https://bookshelf.vitalsource.com/books/9781307917031
J. Whitmore. (2023). Information-Driven Security Analysis: Tools and Techniques for the Study
and Practice of Security Engineering.Computer,56(6), 107-
120.Ihttps://doi.org/10.1109/MC.2023.3263575
Jamal, K. M., Noori, Z. H., Ebis, S. K., Hassen, O. A., & Darwish, S. M. (2023). An Information
Security Engineering Framework for Modeling Packet Filtering Firewall Using
Neutrosophic Petri Nets.Computers,12(10), 202.
https://doi.org/10.3390/computers12100202
Langford, C. (2020). The Christ-Centered Company: 37 Biblical Business Habits to Build a
Thriving Company That Honors God and Blesses the World By D. Shearer. The Journal
of Biblical Integration in Business, 23 (1), 99-101.
https://cbfa-jbib.org/index.php/jbib/article/view/662/656
Palacios Chavarro, Sara, Pantaleone Nespoli, Daniel Díaz-López, and Yury Niño Roa. 2023. "On
the Way to Automatic Exploitation of Vulnerabilities and Validation of Systems Security
through Security Chaos Engineering"IBig Data and Cognitive ComputingI7, no. 1: 1.
https://doi.org/10.3390/bdcc7010001
University of Cambridge. (n.d.). Usability and psychology - university of Cambridge. Usability
and psychology. https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c02.pdf
SECURITY CHAOS ENGINEERING 15
University of Cambridge. (n.d.). What is security engineering? - university of Cambridge. What
is Security Engineering? https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c01.pdf
