Kelly Shortridge - Episode 87

So you are the author of Security Chaos Engineering, Sustaining Resilience in Software and Systems.

And I spent the weekend reading the book and trying to understand where the intersection of chaos engineering and security engineering is.

Because I remember when Chaos Monkey was a thing, and I just got to imagine all the Netflix people running around pulling cables and the monkey was just messing up their stuff.

And now I'm trying to understand the intersection of security engineering with chaos engineering.

I wonder if you could help me understand that.

Yes, I think it's better characterized by the umbrella of resilience engineering, if anything.

I've actually had the rare and delectable pleasure of unplugging cables from Fast Lease Pops.

Of course, network continued working perfectly.

It is a thrill, though, I will admit.

Part of the title with the book is with a little behind the scenes tea is chaos engineering, especially at the time, was a big buzzword.

The book is certainly more than just chaos engineering.

That is one tool in kind of the resilience engineering toolkit.

When we think about resilience, it's ultimately about how do you recover from failure of any kind and prepare for what's next? That what's next could be a threat, but equally it could be a business opportunity.

It could be massive traffic growth for good reasons, or it's a DDoS.

So security really is a subset of the both surprises, stressors, opportunities, and threats in a very broad sense that we need to think about.

This might be a dumb question.

It could be a spicy question, but why call it security chaos engineering? Is it because those are fun words? Because resilience engineering wouldn't fly off the shelves? Because it seems very clear that resilience is really what we want, but it's just not a sexy term.

I mean, I think this is a classic tension always when you're trying to publish a book or, frankly, a movie.

You have to have some sort of catchy name.

No,

that's a great point.

Chaos would be an awesome movie name, but Resilience is like, it's more of an A24 movie.

Exactly.

A24 Vibe.

It's also, you know, talked about at Davos and it's in the National Association of Corporate Directors book around organizational resilience.