Designing Security Chaos Gamedays

Presented in 8.8 Security Chile

Transcript

1. Designing Security Chaos GameDays to Prepare SRE Teams
2. YURY NIÑO ROA Site Reliability Engineer Chaos Engineering Advocate @yurynino https://www.yurynino.dev/
3. Topics to Cover
4. This talk is dedicated to the #SREs On-Call well caffeinated, who get woken up in the middle of the night when “things go bump”.
6. Some attacks!
8. What is common here? Lack of Reliability and Security! https://www.yurynino.dev/
9. Reliability & Security are Important Features 500 Something was wrong!
10. https://www.yurynino.dev/ Reliability is often referred to as quality over time. This idea of Reliability that was birthed in the early days of electronics and aviation, now extends into every sector of consumer and software. An Introduction to Reliability Engineering
11. If you know the enemy and know yourself, you need not fear the result of a hundred battles … The Art of War. Sun Tzu https://www.yurynino.dev/
12. Security Attacks Denial of Service Phishing Man in Middle Attacker overwhelms a system’s resources so that it cannot respond to service requests. DoS doesn’t provide direct benefits for attackers! Attacker hijacks a session between a trusted client and network server. Session hijacking, IP spoofing and replay! Attacker sends emails that appear to be from trusted sources to gain access. Social engineering and Technical trickery. https://blog.netwrix.com
13. Attacks Attacker executes a SQL query via an input data from the client to server. “SELECT * FROM users WHERE account = ‘’ or ‘1’ = ‘1’;” Attacker uses third-party web resources to run scripts in browsers or applications. Steal cookies, keystrokes and collect information. Attacker installs malicious software in the system without consentment of the owner. File infectors, trojans, worms, ransomware. https://blog.netwrix.com Security SQL Injection Malware Cross-Site Scripting
14. https://www.yurynino.dev/ SRE is what you get when you treat operations as if it's a software problem. Successful SRE teams are built on trust! Training reliable people is the beginning good investment! Site Reliability Engineering Book
15. 2003 DevOps is born Ben Treynor coined SRE 2014 First Conference about SRE: SRECon 2016-2018 SRE Books are released 2019 SRE massification SRE History
16. SRE Expertise
17. Cyberwar is everywhere! In the media, in the military, among politicians and in academia. https://www.yurynino.dev/
18. Build a Culture based on Security & Reliability Training Security Teams https://www.yurynino.dev/
19. Avoid Toil NaLSD Curiosity
20. https://www.yurynino.dev/ Organizations Training SREs Training SREs
21. https://www.yurynino.dev/ Chaos Engineering Book Roles
22. Red Team Exercises • They were originated with the US Armed Forces by Bryce Hoffman. • Adversarial approach that imitates the behaviors and techniques of attackers in the most realistic way possible. • Two common forms of Red Teaming seen in the enterprise are: • Ethical hacking • Penetration testing. • Blue Teams are the defensive counterparts to the Red teams in these exercises. • Recommendations: Think-Write-Share! https://whatis.techtarget.com Training
23. Purple Team Exercises • They were intended as an evolution of Red Team exercises by delivering a more cohesive experience between the offensive and defensive teams. • The “Purple” in Purple Teaming reflects the cohesion of Red and Blue Teaming. • The goal of these exercises is the collaboration of offensive and defensive tactics to improve the effectiveness of both groups in the event of an attempted compromise. • The intention is to increase transparency as well as provide a conduit for the security apparatus to learn about how effective their preparation is when subjected to a live fire exercise. https://whatis.techtarget.com Training
24. Strategies https://whatis.techtarget.com Comparison
25. What is Chaos Engineering? It is the discipline of experimenting failures in production in order to reveal their weakness and to build confidence in their resilience capability. https://principlesofchaos.org/
26. What is Security Chaos Engineering? It is the identification of security control failures through proactive experimentation to build confidence in the system’s ability to defend against malicious conditions in production. Chaos Engineering Book. 2020
27. 1986 Artificial Immune Systems 2008 Chaos Engineering was born 2018 2020 Chapter dedicated to Security CE 2019 Aaron Rinehart first articles Artificial Intelligence for data security https://www.yurynino.dev/ SCE History
28. GameDays Chaos Gamedays GameDays are interactive team-based learning exercises designed to give players a chance to put their skills to the test in a real-world, gamified, risk-free environment. A Chaos GameDay is a practice event, and although it can take a whole day, it usually requires only a few hours. The goal of a GameDay is to practice how you, your team, and your supporting systems deal with real-world turbulent conditions. How
29. https://www.yurynino.dev/ Designing Framework Before After During • Pick a hypothesis. • Pick a style. • Decide who. • Decide where. • Decide when. • Document. • Get approval! • Detect the situation. • Take a deep breath. • Communicate. • Visit dashboards. • Analyze data. • Propose solutions. • Apply and solve! • Write a postmortem. • What Happened • Impact • Duration • Resolution Time • Resolution • Timeline • Action Items https://www.yurynino.dev/
30. Human Factors in cybersecurity are perhaps the biggest challenge when building an effective threat prevention strategy. Vircom
31. • Introduce latency on security controls. • Drop a folder like a script would do in production. • Software secret clear text disclosure. • Permission collision in a shared IAM role policy. • Disable service event logging. • API gateway shutdown. • Unencrypted S3 Bucket. • Disable MFA. https://www.yurynino.dev/ Experiment
32. Hypothesis: After the owner of Root account in AWS left the company, we could use our cloud in a normal way. Result: Hypothesis disproved. In this experiment the access to AWS was connected to the Active Directory. When an employee left the company his account is dropped and we lost the access to AWS. Side Effect: Thinking in this scenario allows to consider another applications connected to Active Directory. https://www.yurynino.dev/ Experiment
33. My Recommended Books References
34. Humans operate differently when they expect things to fail! Aaron Rinehart
35. https://lnkd.in/eM77sJJ
36. Thanks for coming! @yurynino