1625627142
Security Chaos Engineering - Winning at Security “Whack-a-Mole”
This presentation was recorded at GOTOpia Chaos Engineering Day 2021. #GOTOcon #GOTOpia
http://gotopia.eu
Aaron Rinehart - Co-Founder & CTO at Verica
ABSTRACT
AARON RINEHART; Winning at Security “Whack-a-Mole” with Security Chaos Engineering
Hope isn’t a strategy. Likewise, perfection isn’t a plan. The systems we are responsible for are failing as a normal function of how they operate, whether we like it or not, whether we see it or not. Security chaos engineering is about increasing confidence that our security mechanisms are effective at performing under the conditions for which we designed them. Through continuous security experimentation, we become better prepared as an organization and reduce the likelihood of being caught off guard by unforeseen disruptions. These practices better prepare us (as professionals), our teams, and the organizations we represent to be effective and resilient when faced with security unknowns.
In this session Aaron Rinehart, co-author of the O’Reilly Report on Security Chaos Engineering, will share how you can get started in applying the Security based Chaos Engineering to create highly secure, performant, and resilient distributed systems.
KELLY SHORTRIDGE; From Catastrophe to Chaos in Production
We all know that production systems must be protected so we can realize value from the software we develop. What is less understood is the right way to keep production systems safe, because trying to prevent any and all badness is more of a prayer than a strategy. In this talk, we’ll explore how security failure can manifest in prod systems and how Security Chaos Engineering presents a saner path. We’ll cover why it’s important to harness failure as a tool and a teacher, along with examples of security chaos experiments you can conduct on production systems.
TIMECODES
- 00:00 Intro
- 01:13 The security “Whack-a-Mole” problem
- 10:35 Security chaos engineering (SCE)
- 11:25 Use cases
- 13:17 Experiment framework
- 13:59 Example SCE experiment
- 17:40 Outro
Read the full abstract here:
https://gotopia.us/chaos-day-2021/sessions/1733/winning-at-security-whack-a-mole-with-security-chaos-engineering-security-and-chaos-engineering-a-novel-approach-to-crafting-secure-and-resilient-distributed-systems
RECOMMENDED BOOKS
Aaron Rinehart • Security Chaos Engineering • https://www.verica.io/sce-book
Nora Jones & Casey Rosenthal • Chaos Engineering • https://www.verica.io/book
Nora Jones & Casey Rosenthal • Chaos Engineering • https://amzn.to/3hUmuAH
Mikolaj Pawlikowski • Chaos Engineering • https://amzn.to/2SQ5Olf
Russ Miles • Learning Chaos Engineering • https://amzn.to/3hCiUe8
Murphy, Beyer, Jones & Petoff • Site Reliability Engineering • https://amzn.to/2Vg6Mbr
https://twitter.com/GOTOcon
https://www.linkedin.com/company/goto-
https://www.facebook.com/GOTOConferences
#ChaosEngineering #SecurityChaosEngineering #SCE #CyberSecurity #SRE #SoftwareReliabilityEngineering #Programming #GameDay #ChaoSlingr
Looking for a unique learning experience?
Attend the next GOTO conference near you! Get your ticket at https://gotopia.tech
SUBSCRIBE TO OUR CHANNEL - new videos posted almost daily.
https://www.youtube.com/user/GotoConferences/?sub_confirmation=1
#chaos-engineering #security #developer
What is GEEK
Buddha Community
1625627142
Security Chaos Engineering - Winning at Security “Whack-a-Mole”
This presentation was recorded at GOTOpia Chaos Engineering Day 2021. #GOTOcon #GOTOpia
http://gotopia.eu
Aaron Rinehart - Co-Founder & CTO at Verica
ABSTRACT
AARON RINEHART; Winning at Security “Whack-a-Mole” with Security Chaos Engineering
Hope isn’t a strategy. Likewise, perfection isn’t a plan. The systems we are responsible for are failing as a normal function of how they operate, whether we like it or not, whether we see it or not. Security chaos engineering is about increasing confidence that our security mechanisms are effective at performing under the conditions for which we designed them. Through continuous security experimentation, we become better prepared as an organization and reduce the likelihood of being caught off guard by unforeseen disruptions. These practices better prepare us (as professionals), our teams, and the organizations we represent to be effective and resilient when faced with security unknowns.
In this session Aaron Rinehart, co-author of the O’Reilly Report on Security Chaos Engineering, will share how you can get started in applying the Security based Chaos Engineering to create highly secure, performant, and resilient distributed systems.
KELLY SHORTRIDGE; From Catastrophe to Chaos in Production
We all know that production systems must be protected so we can realize value from the software we develop. What is less understood is the right way to keep production systems safe, because trying to prevent any and all badness is more of a prayer than a strategy. In this talk, we’ll explore how security failure can manifest in prod systems and how Security Chaos Engineering presents a saner path. We’ll cover why it’s important to harness failure as a tool and a teacher, along with examples of security chaos experiments you can conduct on production systems.
TIMECODES
- 00:00 Intro
- 01:13 The security “Whack-a-Mole” problem
- 10:35 Security chaos engineering (SCE)
- 11:25 Use cases
- 13:17 Experiment framework
- 13:59 Example SCE experiment
- 17:40 Outro
Read the full abstract here:
https://gotopia.us/chaos-day-2021/sessions/1733/winning-at-security-whack-a-mole-with-security-chaos-engineering-security-and-chaos-engineering-a-novel-approach-to-crafting-secure-and-resilient-distributed-systems
RECOMMENDED BOOKS
Aaron Rinehart • Security Chaos Engineering • https://www.verica.io/sce-book
Nora Jones & Casey Rosenthal • Chaos Engineering • https://www.verica.io/book
Nora Jones & Casey Rosenthal • Chaos Engineering • https://amzn.to/3hUmuAH
Mikolaj Pawlikowski • Chaos Engineering • https://amzn.to/2SQ5Olf
Russ Miles • Learning Chaos Engineering • https://amzn.to/3hCiUe8
Murphy, Beyer, Jones & Petoff • Site Reliability Engineering • https://amzn.to/2Vg6Mbr
https://twitter.com/GOTOcon
https://www.linkedin.com/company/goto-
https://www.facebook.com/GOTOConferences
#ChaosEngineering #SecurityChaosEngineering #SCE #CyberSecurity #SRE #SoftwareReliabilityEngineering #Programming #GameDay #ChaoSlingr
Looking for a unique learning experience?
Attend the next GOTO conference near you! Get your ticket at https://gotopia.tech
SUBSCRIBE TO OUR CHANNEL - new videos posted almost daily.
https://www.youtube.com/user/GotoConferences/?sub_confirmation=1
#chaos-engineering #security #developer
1596789120
Best Custom Web & Mobile App Development Company
Everything around us has become smart, like smart infrastructures, smart cities, autonomous vehicles, to name a few. The innovation of smart devices makes it possible to achieve these heights in science and technology. But, data is vulnerable, there is a risk of attack by cybercriminals. To get started, let’s know about IoT devices.
What are IoT devices?
The Internet Of Things(IoT) is a system that interrelates computer devices like sensors, software, and actuators, digital machines, etc. They are linked together with particular objects that work through the internet and transfer data over devices without humans interference.
Famous examples are Amazon Alexa, Apple SIRI, Interconnected baby monitors, video doorbells, and smart thermostats.
How could your IoT devices be vulnerable?
When technologies grow and evolve, risks are also on the high stakes. Ransomware attacks are on the continuous increase; securing data has become the top priority.
When you think your smart home won’t fudge a thing against cybercriminals, you should also know that they are vulnerable. When cybercriminals access our smart voice speakers like Amazon Alexa or Apple Siri, it becomes easy for them to steal your data.
Cybersecurity report 2020 says popular hacking forums expose 770 million email addresses and 21 million unique passwords, 620 million accounts have been compromised from 16 hacked websites.
The attacks are likely to increase every year. To help you secure your data of IoT devices, here are some best tips you can implement.
Tips to secure your IoT devices
1. Change Default Router Name
Your router has the default name of make and model. When we stick with the manufacturer name, attackers can quickly identify our make and model. So give the router name different from your addresses, without giving away personal information.
2. Know your connected network and connected devices
If your devices are connected to the internet, these connections are vulnerable to cyber attacks when your devices don’t have the proper security. Almost every web interface is equipped with multiple devices, so it’s hard to track the device. But, it’s crucial to stay aware of them.
3. Change default usernames and passwords
When we use the default usernames and passwords, it is attackable. Because the cybercriminals possibly know the default passwords come with IoT devices. So use strong passwords to access our IoT devices.
4. Manage strong, Unique passwords for your IoT devices and accounts
Use strong or unique passwords that are easily assumed, such as ‘123456’ or ‘password1234’ to protect your accounts. Give strong and complex passwords formed by combinations of alphabets, numeric, and not easily bypassed symbols.
Also, change passwords for multiple accounts and change them regularly to avoid attacks. We can also set several attempts to wrong passwords to set locking the account to safeguard from the hackers.
5. Do not use Public WI-FI Networks
Are you try to keep an eye on your IoT devices through your mobile devices in different locations. I recommend you not to use the public WI-FI network to access them. Because they are easily accessible through for everyone, you are still in a hurry to access, use VPN that gives them protection against cyber-attacks, giving them privacy and security features, for example, using Express VPN.
6. Establish firewalls to discover the vulnerabilities
There are software and firewalls like intrusion detection system/intrusion prevention system in the market. This will be useful to screen and analyze the wire traffic of a network. You can identify the security weakness by the firewall scanners within the network structure. Use these firewalls to get rid of unwanted security issues and vulnerabilities.
7. Reconfigure your device settings
Every smart device comes with the insecure default settings, and sometimes we are not able to change these default settings configurations. These conditions need to be assessed and need to reconfigure the default settings.
8. Authenticate the IoT applications
Nowadays, every smart app offers authentication to secure the accounts. There are many types of authentication methods like single-factor authentication, two-step authentication, and multi-factor authentication. Use any one of these to send a one time password (OTP) to verify the user who logs in the smart device to keep our accounts from falling into the wrong hands.
9. Update the device software up to date
Every smart device manufacturer releases updates to fix bugs in their software. These security patches help us to improve our protection of the device. Also, update the software on the smartphone, which we are used to monitoring the IoT devices to avoid vulnerabilities.
10. Track the smartphones and keep them safe
When we connect the smart home to the smartphone and control them via smartphone, you need to keep them safe. If you miss the phone almost, every personal information is at risk to the cybercriminals. But sometimes it happens by accident, makes sure that you can clear all the data remotely.
However, securing smart devices is essential in the world of data. There are still cybercriminals bypassing the securities. So make sure to do the safety measures to avoid our accounts falling out into the wrong hands. I hope these steps will help you all to secure your IoT devices.
If you have any, feel free to share them in the comments! I’d love to know them.
Are you looking for more? Subscribe to weekly newsletters that can help your stay updated IoT application developments.
#iot #enterprise iot security #how iot can be used to enhance security #how to improve iot security #how to protect iot devices from hackers #how to secure iot devices #iot security #iot security devices #iot security offerings #iot security technologies iot security plus #iot vulnerable devices #risk based iot security program
1597315320
The Principles of Chaos Engineering
Resilience is something those who use Kubernetes to run apps and microservices in containers aim for. When a system is resilient, it can handle losing a portion of its microservices and components without the entire system becoming inaccessible.
Resilience is achieved by integrating loosely coupled microservices. When a system is resilient, microservices can be updated or taken down without having to bring the entire system down. Scaling becomes easier too, since you don’t have to scale the whole cloud environment at once.
That said, resilience is not without its challenges. Building microservices that are independent yet work well together is not easy.
What Is Chaos Engineering?
Chaos Engineering has been around for almost a decade now but it is still a relevent and useful concept to incorporate into improving your whole systems architecture. In essence, Chaos Engineering is the process of triggering and injecting faults into a system deliberately. Instead of waiting for errors to occur, engineers can take deliberate steps to cause (or simulate) errors in a controlled environment.
Chaos Engineering allows for better, more advanced resilience testing. Developers can now experiment in cloud-native distributed systems. Experiments involve testing both the physical infrastructure and the cloud ecosystem.
Chaos Engineering is not a new approach. In fact, companies like Netflix have been using resilience testing through Chaos Monkey, an in-house Chaos Engineering framework designed to improve the strength of cloud infrastructure for years now.
When dealing with a large-scale distributed system, Chaos Engineering provides an empirical way of building confidence by anticipating faults instead of reacting to them. The chaotic condition is triggered intentionally for this purpose.
There are a lot of analogies depicting how Chaos Engineering works, but the traffic light analogy represents the concept best. Conventional testing is similar to testing traffic lights individually to make sure that they work.
Chaos Engineering, on the other hand, means closing out a busy array of intersections to see how traffic reacts to the chaos of losing traffic lights. Since the test is run deliberately, more insights can be collected from the process.
#devops #chaos engineering #chaos monkey #chaos #chaos testing
1606927174
10 Cyber Security Tools to Watch Out for in 2021 - DZone Security
With an immense number of companies and entities climbing onto the digital bandwagon, cybersecurity considerations have come up as limelight. Besides, new technologies such as Big Data, IoT, and Artificial Intelligence/Machine Learning are gradually more making inroads into our everyday lives, the threats related to cybercrime are mounting as well. Additionally, the usage of mobile and web apps in transacting financial information has put the complete digital stuff exposed to cybersecurity breaches. The inherent risks and vulnerabilities found in such apps can be exploited by attackers or cybercriminals to draw off crucial information data counting money. Internationally, cyber-security breaches have caused a yearly loss of USD 20.38 million in 2019 (Source: Statista). Plus, cybercrime has led to a 0.80 percent loss of the entire world’s Gross domestic product, which sums up to approx. USD 2.1 trillion in the year 2019 alone (Source: Cybriant.com).
In this article, take a look at ten cyber security tools to watch out for in 2021, including NMap, Wireshark, Metasploit, and more!
#security #cyber security #security testing #security testing tools #cyber security tools
1624290590
Security Chaos Engineering: Pushing Security from Theory to Practice
This presentation was recorded at GOTOpia Chaos Engineering Day 2021. #GOTOcon #GOTOpia
http://gotopia.eu
Jamie Dicken - Cybersecurity People Leader
ORIGINAL TALK TITLE
Security Chaos Engineering: Pushing Security from Theory to Practice
ABSTRACT
KRIS BEEVERS: Converging applications & audiences - the return to “dumb pipes”
Through the lens of DNS - the first touchpoint between audiences and applications - we’ll examine how application networking has grown in complexity to address reliability and security risks and solve for increasingly dynamic and distributed footprints.
The future will take a turn - collapsing application networking complexity into the audience footprint to distribute the risk surface, crush blast radius, and drive a return to dumb pipes.
JAMIE DICKEN: Security Chaos Engineering: Pushing security from theory to practice
Our security programs are full of assumptions. We believe that engineers implement all security requirements without error before deploying systems to production. We take for granted that the security solutions we purchase and implement actually protect our applications, infrastructure, and data. The ultimate effectiveness of a security program, however, cannot rely on assumptions. Mistakes, accidents, and misconfigurations weaken the best-designed security solutions, architectural patterns, and technical designs, leaving our companies vulnerable to breaches.
The application of Chaos Engineering to the security domain proves to be the logical solution to this problem. By testing and validating our own systems, we can tease out false assumptions, proactively identify opportunities for security hardening or remediation, and fix them before an adversary exploits them.
In this session, we will discuss the principles of Security Chaos Engineering and share the real-life story of establishing the practice at Cardinal Health – a Fortune 20 healthcare company. We will also show you how you can do the same – regardless of your organization’s size, scale, industry, or cybersecurity maturity. Join us and learn how Chaos Engineering can help increase confidence in your security posture.
TIMECODES
- 00:00 Intro
- 01:29 Agenda
- 02:03 Reality check
- 07:25 Security chaos engineering basics
- 13:08 Real-world implementation
- 17:30 How to get started
- 10:15 Impact of security chaos engineering
- 20:41 Outro
Read the full abstract here:
https://gotopia.us/chaos-day-2021/sessions/1711/converging-applications-and-audiences-the-return-to-dumb-pipes-security-chaos-engineering-pushing-security-from-theory-to-practice
#security #chaos-engineering #developer