Aaron Rinehart -- Chaos Engineering and #AppSec

How do you know a security control will work when the system around it fails? Aaron Rinehart introduces chaos engineering as a way to test assumptions about complex systems before an unexpected incident exposes them. He explains its relationship to good engineering, Netflix’s Chaos Monkey, and site reliability engineering, then brings the discussion into application security. Chris and Robert explore ChaoSlingr, the difference between testing a failure condition and introducing a vulnerability, and how experiments can reveal gaps in detection or response. Aaron also discusses a SOC-less model that connects security signals with the people best placed to act. Books and foundational resources round out an introduction to learning from controlled experiments and building confidence in how systems actually behave.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Aaron Rinehart:
→ Aaron Rinehart on LinkedIn

Mentioned in this episode:
→ Principles of Chaos Engineering
→ Chaos Monkey
→ ChaoSlingr
→ Release It! Second Edition
→ Google SRE books

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Chaos engineering and AppSec with Aaron Rinehart
03:31 Security as a reflection of good engineering
06:52 What chaos engineering means
09:57 How Chaos Monkey works
12:30 Principles and the wider movement
14:13 The relationship with site reliability engineering
15:56 Examples of complex-system failures
20:28 Applying chaos engineering to security
21:13 Introducing ChaoSlingr
24:50 Testing failure conditions rather than adding flaws
25:58 Resources for learning more
29:17 Release It and resilience lessons
31:33 The SOC-less model at Netflix
35:04 Aaron’s writing and further reading