Practical Magic: The Resilience Potion & Security Chaos Engineering • Kelly Shortridge • GOTO 2023
Interesting. speech Kelly Shortridge, Senior Principal at Fastly, about Security Chaos Engineering eponymous. The author himself describes the 5 sustainability (resilience) systems:
- Define the system’s critical functions Knowing what belongs to the critical functionality, it is easy to understand what is not included in it, and this allows you to act more consciously both during development and during incidents. For example, it is clear where to use boring but predictable technologies:) New and fashionable technologies should be used where it acts as a market differentiator for business problems. Here we are talking about the importance of standardization: languages, libraries and tools, memory safety. Next, the author moves on to the importance of understanding their dependencies, as well as working with data, where it is necessary to limit access to sensitive information.
2. Define the system’s safe boundaries A lot of getting security “right” is just solid engineering. Security is a facet of quality, which allows us to argue the implementation of good engineering practices not only from the point of view of optimizing the pace of development or improving quality, but also from the point of view of risks. (How to build arguments security professionals). In the same section, the author says that it is necessary to anticipate the scaling of the system and think about how it will feel under changed conditions. We need to anticipate the need for our ops/SRE teams to respond to incidents. Then again, it's about standardization, but this time with patterns and tools. The author suggests not to create middleware themselves, but to provide teams with a list of proven libraries and service providers that they should use. Plus, teams again need to know about their dependencies and understand what mistakes there may be. If you think about vulnerabilities, then they should be classified by how easy an attack is to automate and scale, and how far the attack is from the attacker’s goals. With this in mind, the elimination of vulnerabilities can be prioritized.
3. Observe system interactions across spacetime To build secure and sustainable systems, we need observability, both in terms of system topology and in terms of changes over time. The mental models we build to understand the system, and the testing of both systems and our mental models. The author drowns for integration tests and scolds unit tests, but it seems the consequences of professional deformation. This is about chaos engineering. (For example, there is one. book)And then how does that translate into security chaos engineering? The author tells about the standard cycle: setting a hypothesis, conducting experiments, analyzing the results and setting goals for improvement.
4. Feedback loops and a learning culture Here, the author talks about the importance of feedback and learning to improve the situation. And here comes the distributing tracing that we just need:) About the topic with distributed trading you can read a separate bookDistributed Tracing in Practice"
5. Flexibility and willingness to change In general, without the desire to change and change the system, you cannot build a sustainable system. This is about adapting and refactoring, changing the code of our systems and making changes easy. Next, the author talks about static code typing as an aid in refactoring:) Next, the author moves to modularity and there are references to coupling and the fact that modules form local boundaries. Isolation is a key property that supports system resilience. Next, the author talks about the use of sandbox to execute dangerous code. Finally, the author explains how to change the system using the Strangler Fig pattern. told Not bad, Martin Fowler. 20 years ago.
#Chaos #Engineering #SystemEngineering #SystemDesign #SoftwareArchitecture #Software